@alvin0/ai-agent-sdk-provider-copilot 0.1.1

package/dist/index.js

@@ -0,0 +1,2680 @@
+import { AgentSdkError, MISSING_CREDENTIAL_CODE, MODEL_ERROR_CODES, ModelError, safeErrorRecord, waitForSettlement } from "@alvin0/ai-agent-sdk-core";
+import { AgentSdkError as AgentSdkError$1, CREDENTIAL_CAPABILITY_API_VERSION, defineCredentialStore, defineModelProviderPlugin } from "@alvin0/ai-agent-sdk-core/provider";
+import { createRuntimeHttpProvider, defineWireProtocol, observeCredentialOperation } from "@alvin0/ai-agent-sdk-provider-http";
+import { OPENAI_CHAT_COMPLETIONS_PROTOCOL_ID, openAiChatCompletionsProtocol } from "@alvin0/ai-agent-sdk-protocol-openai-chat-completions";
+import { OPENAI_RESPONSES_PROTOCOL_ID, openAiResponsesProtocol } from "@alvin0/ai-agent-sdk-protocol-responses";
+
+//#region src/common/error-codes.ts
+/**
+* The Copilot error codes, in the leaf layer so the shared HTTP modules can reach
+* them.
+*
+* The taxonomy BELONGS to `../errors.ts` — that module is the public door, and it
+* re-exports everything here. The definition lives one layer down for a structural
+* reason: `common/` is a leaf, and `common/http.ts` needs
+* `ENDPOINT_ORIGIN_INVALID` and `COPILOT_REDIRECT_REJECTED` to throw. Importing
+* them from a root module would make `common/` depend on the root while the root
+* already depends on `common/`, which is the source-ownership cycle the repo's
+* package-graph check forbids. Duplicating the two strings instead would be worse:
+* a code that exists in two places is a code that can disagree with itself.
+*
+* Read `../errors.ts` for the taxonomy's rationale, including the three situations
+* that deliberately get an EXISTING SDK code rather than a Copilot one.
+*
+* @module ai-agent-sdk/providers/copilot/error-codes
+*/
+/**
+* Stable codes for the failures that are specific to Copilot.
+*
+* Frozen, and flat strings rather than a TS enum, for the same reason the core
+* taxonomy is: a consumer routes on the value, and the value has to survive
+* serialization into a log line.
+*/
+const COPILOT_ERROR_CODES = Object.freeze({
+	/** The token-exchange surface rejected the credential: a PAT, or a non-allowlisted OAuth App. */
+	CREDENTIAL_REJECTED: "COPILOT_CREDENTIAL_REJECTED",
+	/** Token exchange failed for a reason that is not the credential. */
+	TOKEN_EXCHANGE_FAILED: "COPILOT_TOKEN_EXCHANGE_FAILED",
+	/** The token-exchange response carried no readable `expires_at`, or was not JSON. */
+	TOKEN_MALFORMED: "COPILOT_TOKEN_MALFORMED",
+	/** A `*.ghe.com` data-residency tenant has no token-exchange surface. */
+	TENANT_UNSUPPORTED: "COPILOT_TENANT_UNSUPPORTED",
+	/** The endpoint rejected the request for missing `Editor_Headers`. */
+	EDITOR_HEADERS_MISSING: "COPILOT_EDITOR_HEADERS_MISSING",
+	/** The target URL is not on the same origin as the configured issuer/base URL. */
+	ENDPOINT_ORIGIN_INVALID: "COPILOT_ENDPOINT_ORIGIN_INVALID",
+	/** The response was a redirect; this SDK does not follow it. */
+	REDIRECT_REJECTED: "COPILOT_REDIRECT_REJECTED",
+	/** Device flow: the user denied the request. */
+	DEVICE_LOGIN_DENIED: "COPILOT_DEVICE_LOGIN_DENIED",
+	/** Device flow: the code expired server-side. */
+	DEVICE_LOGIN_EXPIRED: "COPILOT_DEVICE_LOGIN_EXPIRED",
+	/** Device flow: the absolute 15-minute bound passed without approval. */
+	DEVICE_LOGIN_TIMEOUT: "COPILOT_DEVICE_LOGIN_TIMEOUT",
+	/** Device flow: failed for any other reason. */
+	DEVICE_LOGIN_FAILED: "COPILOT_DEVICE_LOGIN_FAILED",
+	/** A credential commit found a revision other than the expected one. */
+	CREDENTIAL_REVISION_CONFLICT: "COPILOT_CREDENTIAL_REVISION_CONFLICT",
+	/** The `/models` response was the wrong shape at the structural level. */
+	CATALOG_MALFORMED: "COPILOT_CATALOG_MALFORMED",
+	/** `endpointOverrides` pinned a model to an endpoint that does not exist. */
+	ENDPOINT_OVERRIDE_INVALID: "COPILOT_ENDPOINT_OVERRIDE_INVALID"
+});
+
+//#endregion
+//#region src/errors.ts
+/**
+* The Copilot error taxonomy: the codes this provider owns, the two error
+* classes that carry a machine-readable classification beside them, and the one
+* door through which every credential-path error is built.
+*
+* ## What is deliberately NOT here
+*
+* Three situations get an EXISTING code rather than a Copilot one, because a
+* second code for the same situation forces every consumer to write a second
+* branch for it:
+*
+* - **No credential at all** — `MISSING_CREDENTIAL_CODE` from `packages/core`,
+*   with a message naming the login command (Requirement 13.4).
+* - **Abort** — the SDK's existing abort code, {@link MODEL_ERROR_CODES.ABORTED}
+*   (Requirement 4.6). `CopilotDeviceLoginError` with `reason: 'aborted'` maps to
+*   it rather than minting a Copilot abort code.
+* - **HTTP failures of the generation/embedding endpoints** — `MODEL_ERROR_CODES`
+*   plus `HTTP_PROVIDER_ERROR_CODES`. In particular there is no
+*   `COPILOT_RATE_LIMIT`: a 429 from Copilot is `RATE_LIMIT`, the same as from
+*   every other provider (Requirements 13.5, 15.5).
+*
+* @module ai-agent-sdk/providers/copilot/errors
+*/
+/**
+* Mirrors `safeProviderFailure` from `provider-http`: a {@link ModelError} keeps
+* its stable code and status and LOSES its message, because a provider message
+* is the one field that can have echoed a request header back at us.
+* @param failure - the serializable twin carried by a {@link ModelError}.
+* @returns a frozen record with no provider-authored text in it.
+*/
+function safeModelFailure(failure) {
+	return Object.freeze({
+		type: "ModelError",
+		message: "provider attempt failed; inspect the stable code and request ID",
+		code: failure.code,
+		...failure.status === void 0 ? {} : { status: failure.status }
+	});
+}
+/**
+* Build the inputs for an error on the Copilot credential path.
+*
+* This is the ONLY door: {@link CopilotTokenExchangeError} and
+* {@link CopilotDeviceLoginError} take a {@link CopilotCredentialFailure} rather
+* than a raw `cause`, so there is no code path that can attach an unfiltered
+* value to a credential-path error. `message` is SDK-authored text; a
+* `GitHub_User_Token` or a `Copilot_Api_Token` is never interpolated into it, and
+* response bodies reach `cause` only after the bounded read has replaced every
+* occurrence of the tokens held in memory with `[REDACTED]` (Requirement 13.7).
+* @param message - SDK-authored, actionable text. No token values.
+* @param cause - the caught value, if any; filtered before it is retained.
+* @returns the sanitized pair an error class accepts.
+*/
+function credentialFailure(message, cause) {
+	return Object.freeze({
+		message,
+		cause: cause === void 0 ? void 0 : cause instanceof ModelError ? safeModelFailure(cause.failure) : safeErrorRecord(cause)
+	});
+}
+/**
+* A `Copilot_Token_Exchange` that did not produce a token.
+*
+* `kind` exists because `code` alone does not answer the only question a caller
+* has to answer next: `TOKEN_EXCHANGE_FAILED` covers both a 5xx worth waiting out
+* and a 4xx that will fail identically forever.
+*/
+var CopilotTokenExchangeError = class extends AgentSdkError {
+	/** Retry classification for this failure. */
+	kind;
+	/**
+	* @param failure - message and filtered cause from {@link credentialFailure}.
+	* @param code - the Copilot code for this row of the classification table.
+	* @param kind - whether a retry could ever succeed.
+	*/
+	constructor(failure, code, kind) {
+		super(failure.message, code, failure.cause === void 0 ? void 0 : { cause: failure.cause });
+		this.kind = kind;
+	}
+};
+/**
+* Codes for the four device-flow outcomes this provider owns.
+*
+* `denied` and `expired` are separate on purpose: "you just declined this" and
+* "the code ran out" lead to different next steps. `aborted` is absent because it
+* maps to the SDK's existing abort code instead.
+*/
+const DEVICE_LOGIN_CODES = Object.freeze({
+	denied: COPILOT_ERROR_CODES.DEVICE_LOGIN_DENIED,
+	expired: COPILOT_ERROR_CODES.DEVICE_LOGIN_EXPIRED,
+	timeout: COPILOT_ERROR_CODES.DEVICE_LOGIN_TIMEOUT,
+	failed: COPILOT_ERROR_CODES.DEVICE_LOGIN_FAILED
+});
+/**
+* A device login that ended without a `GitHub_User_Token`.
+*
+* The `code` is derived from `reason` rather than passed in, so the two can never
+* disagree — a caller reading `code` and a caller reading `reason` always see the
+* same outcome.
+*/
+var CopilotDeviceLoginError = class extends AgentSdkError {
+	/** The distinguishable reason the flow ended. */
+	reason;
+	/**
+	* @param failure - message and filtered cause from {@link credentialFailure}.
+	* @param reason - the outcome; decides the `code`, with `aborted` mapping to
+	*   {@link MODEL_ERROR_CODES.ABORTED} rather than a Copilot-specific code.
+	*/
+	constructor(failure, reason) {
+		super(failure.message, reason === "aborted" ? MODEL_ERROR_CODES.ABORTED : DEVICE_LOGIN_CODES[reason], failure.cause === void 0 ? void 0 : { cause: failure.cause });
+		this.reason = reason;
+	}
+};
+
+//#endregion
+//#region src/auth.ts
+/**
+* The Universal half of `Copilot_Auth`: the in-memory store doubles, the
+* credential snapshot an operation carries, the one function that turns "no
+* credential" into an actionable error, and the pure predicate that decides
+* whether a token exchange is due.
+*
+* Storage is injected. Paths, the filesystem, and the environment belong to the
+* Node auth package, never this Universal one (Requirement 6.1).
+*
+* ## Two tiers, one of which lives here
+*
+* The long-lived `GitHub_User_Token` is what a store persists; the short-lived
+* `Copilot_Api_Token` obtained from it never reaches a store and lives only in
+* the process cache (Requirements 3.1, 3.3). Exchanging does not consume the
+* long-lived token, so the persisted value is left exactly as it was
+* (Requirement 3.4) — this module has no write path at all for that reason.
+*
+* @module ai-agent-sdk/providers/copilot/auth
+*/
+/**
+* The command that produces a credential, named in every message that tells a
+* caller how to fix a credential problem.
+*
+* Exported so the token-exchange path names the SAME command: a 401 and a 403
+* there both end in "sign in again", and two copies of that string are two
+* strings that can drift apart.
+*/
+const COPILOT_LOGIN_COMMAND = "npm run provider:copilot:login-device";
+/**
+* An in-memory {@link CopilotAuthStore} — the read/write variant (Requirement 6.4).
+*
+* The read/write variant exists for symmetry with Codex; normal runtime
+* composition uses {@link memoryCopilotCredentialStore}, the compare-and-swap
+* variant.
+* @param initial - the file the store starts with, or nothing for an empty store.
+* @returns a store backed by a single mutable slot.
+*/
+function memoryCopilotAuthStore(initial) {
+	let current = initial;
+	return {
+		location: "<memory>",
+		read: () => Promise.resolve(current),
+		write: (file) => {
+			current = file;
+			return Promise.resolve();
+		}
+	};
+}
+/**
+* An in-memory compare-and-swap store, for deterministic runtime and tests
+* (Requirements 6.2, 6.4).
+*
+* Values are `structuredClone`d in BOTH directions, which is the point of this
+* double: a caller that mutates the object it wrote, or the object it read, must
+* not be able to change what the store holds. Without the clone a test could pass
+* for the wrong reason — the store and the caller sharing one object rather than
+* the store having committed anything.
+*
+* A commit whose `expectedRevision` disagrees with the current revision raises
+* {@link COPILOT_ERROR_CODES.CREDENTIAL_REVISION_CONFLICT} (Requirement 6.3), the
+* Copilot-owned code, so exactly one of two concurrent commits wins and the loser
+* can tell why it lost.
+* @param initial - the file the store starts with, or nothing for an empty store.
+* @returns a compare-and-swap store over a single mutable slot.
+*/
+function memoryCopilotCredentialStore(initial) {
+	let current = initial === void 0 ? void 0 : structuredClone(initial);
+	let revision = 0;
+	return defineCredentialStore({
+		id: "copilot-memory-credentials",
+		label: "<memory>",
+		async read({ signal }) {
+			signal.throwIfAborted();
+			return current === void 0 ? void 0 : {
+				value: structuredClone(current),
+				revision: String(revision)
+			};
+		},
+		async commit(input, { signal }) {
+			signal.throwIfAborted();
+			const expected = current === void 0 ? null : String(revision);
+			if (input.expectedRevision !== expected) throw new AgentSdkError("Copilot credential revision changed before commit", COPILOT_ERROR_CODES.CREDENTIAL_REVISION_CONFLICT);
+			current = structuredClone(input.value);
+			revision++;
+			return { revision: String(revision) };
+		}
+	});
+}
+/**
+* Require a usable `GitHub_User_Token`, with a message that says how to get one.
+*
+* Three shapes of "there is no credential" — an empty store, a file with no
+* `github` field, and a `github.token` that is the empty string — collapse into
+* the SAME code, because to the person reading the error they are one problem
+* with one fix. That code is the SDK's own {@link MISSING_CREDENTIAL_CODE} rather
+* than a Copilot-specific one, so a consumer does not have to write a second
+* branch for a situation it already handles, and the message carries the command
+* to run `Copilot_Login_Cli` (Requirement 13.4).
+*
+* The token value is never interpolated into the message; only the store's label
+* is (Requirement 13.7).
+* @param file - the credential file, or `undefined` when the store was empty.
+* @param label - the store location named in the diagnostic.
+* @returns the long-lived GitHub token.
+*/
+function requireGitHubToken(file, label) {
+	const github = file?.github;
+	if (github === void 0 || github === null || typeof github.token !== "string" || github.token.length === 0) throw new AgentSdkError(`no GitHub Copilot credentials at ${label}; run \`${COPILOT_LOGIN_COMMAND}\` to sign in`, MISSING_CREDENTIAL_CODE);
+	return github;
+}
+/** Exchange this long before the `Copilot_Api_Token` actually expires. */
+const COPILOT_TOKEN_EXCHANGE_MARGIN_MS = 3e5;
+/**
+* Whether a token exchange has to happen before the next request.
+*
+* A pure function of three values that reads no global clock, so a property test
+* can place `now` at every boundary without a fake timer (Requirements 5.2, 5.3).
+* `undefined` — no token yet — is always `true`.
+*
+* `expires_at` is the authority and `refresh_in` is advisory: the hint may only
+* SHORTEN the refresh moment, never lengthen it. The endpoint is allowed to ask
+* for an earlier exchange; it is not allowed to ask this SDK to hold a token past
+* the expiry it announced itself.
+*
+* There is deliberately no fallback branch. `shouldRefresh` in
+* `provider-codex/src/auth.ts` decodes a JWT for `exp` and falls back to a
+* `last_refresh` age when it cannot; a `Copilot_Api_Token` is not a JWT this SDK
+* has any business reading, and the expiry is stated outright in the exchange
+* response body. With no second source, a fallback would have to invent a
+* lifetime, and an invented lifetime violates the no-inference principle.
+*
+* Because the decision is made BEFORE dispatch, a 401 from the Copilot base URL
+* always means the credential is genuinely dead rather than "the token expired
+* mid-flight" — which is what lets auth failures stay non-retryable
+* (Requirement 5.8).
+* @param api - the cached token, or `undefined` when there is none.
+* @param now - current time in epoch milliseconds.
+* @param marginMs - exchange this long before expiry.
+* @returns true when an exchange is due.
+*/
+function shouldExchange(api, now, marginMs = COPILOT_TOKEN_EXCHANGE_MARGIN_MS) {
+	if (api === void 0) return true;
+	const advisory = api.refreshInSeconds === void 0 ? Number.POSITIVE_INFINITY : api.expiresAtMs - api.refreshInSeconds * 1e3;
+	return Math.min(api.expiresAtMs - marginMs, advisory) <= now;
+}
+
+//#endregion
+//#region src/common/identity.ts
+/**
+* The two Copilot endpoint constants and the editor-header override type, in the
+* leaf layer so every module that has to speak to the Copilot surface can reach
+* them.
+*
+* They BELONG to `../adapter.ts` — that module is the public door, documents the
+* client-identity tradeoff, and re-exports everything here. The values live one
+* layer down for the same structural reason `COPILOT_ERROR_CODES` does:
+* `../catalog.ts` needs {@link COPILOT_BASE_URL} and `../exchange.ts` needs the
+* two editor headers, while `../adapter.ts` builds the catalog reader and the
+* token cache. Declaring the constants in `../adapter.ts` would make that edge
+* run both ways, which the repo's circular-dependency check forbids. Copying the
+* strings instead would be worse: a client identity that exists in two places is
+* a client identity that can disagree with itself.
+*
+* Read `../adapter.ts` for what these values mean, why they are overridable
+* options rather than hidden constants, and what is still outstanding on each.
+*
+* @module ai-agent-sdk/providers/copilot/identity
+*/
+/** The Copilot API base. Documented on the re-export in `../adapter.ts`. */
+const COPILOT_BASE_URL = "https://api.githubcopilot.com";
+/** Default `Editor-Version`. Documented on the re-export in `../adapter.ts`. */
+const COPILOT_EDITOR_VERSION = "vscode/1.99.0";
+/** Default `Editor-Plugin-Version`. Documented on the re-export in `../adapter.ts`. */
+const COPILOT_EDITOR_PLUGIN_VERSION = "copilot-chat/0.26.0";
+/**
+* Resolve each editor header from the override first and the exported default
+* second.
+*
+* Per field rather than per object: an override of one header leaves the other at
+* its default instead of dropping it, because a dropped editor header is an HTTP
+* 400 (Requirement 2.4).
+* @param headers - the caller's overrides, when they set any.
+* @returns both header values, neither of them empty.
+*/
+function resolveCopilotEditorHeaders(headers) {
+	return Object.freeze({
+		editorVersion: headers?.editorVersion ?? "vscode/1.99.0",
+		editorPluginVersion: headers?.editorPluginVersion ?? "copilot-chat/0.26.0"
+	});
+}
+
+//#endregion
+//#region src/common/no-follow.ts
+/**
+* The redirect guard every Copilot HTTP call passes through.
+*
+* `redirect: 'manual'` on the request is only half of a no-follow policy: it
+* stops the runtime from following a hop, but it does not stop the CALLER from
+* treating the result as a normal response. This module is the other half — it
+* turns every shape a redirect can take into a structured error before a second
+* request can be dispatched.
+*
+* There are four shapes, and a check for only one of them is a hole:
+*
+* - **A 3xx status** — the ordinary case, visible because `redirect: 'manual'`
+*   surfaces the response instead of following it.
+* - **`type === 'opaqueredirect'`** — what a browser returns instead of the 3xx,
+*   with the status flattened to `0` and the headers stripped. A status-only
+*   check misses this entirely.
+* - **`redirected === true`** — a hop that was already followed, by a runtime or
+*   an intermediary that ignored `redirect: 'manual'`.
+* - **`response.url` differing from the requested URL** — the last resort, for a
+*   runtime that reports neither of the flags above but still moved the request.
+*
+* The body is RELEASED before the error is thrown. A rejected response whose body
+* is never cancelled holds a socket open for as long as the runtime keeps the
+* stream alive, so the guard cannot leave that to the caller's `finally`.
+*
+* @module ai-agent-sdk/providers/copilot/no-follow
+*/
+/**
+* Reject every redirect shape Web fetch exposes, before any second request.
+*
+* @param response - the response as returned by a `redirect: 'manual'` fetch.
+* @param requestedUrl - the absolute URL that was requested, for the
+*   `response.url` comparison.
+* @param operation - which Copilot call site is refusing the hop.
+* @param teardownTimeoutMs - bound on the body cancellation, so a stream that
+*   never settles cannot hold the rejection open forever.
+* @returns nothing when the response is not a redirect in any of its four shapes.
+* @throws AgentSdkError with `COPILOT_REDIRECT_REJECTED` when it is.
+*/
+async function rejectCopilotRedirect(response, requestedUrl, operation, teardownTimeoutMs) {
+	const redirectStatus = response.status >= 300 && response.status < 400;
+	const responseUrlChanged = response.url.length > 0 && response.url !== requestedUrl;
+	if (response.type !== "opaqueredirect" && response.redirected !== true && !redirectStatus && !responseUrlChanged) return;
+	if (response.body !== null) await waitForSettlement(response.body.cancel().catch(() => void 0), teardownTimeoutMs);
+	throw new AgentSdkError(`Copilot ${operation} rejected a redirect before following it`, COPILOT_ERROR_CODES.REDIRECT_REJECTED);
+}
+
+//#endregion
+//#region src/common/http.ts
+/**
+* The one HTTP door for every Copilot call: origin pinning, no-follow, bounded
+* reads, and a caller signal that wins immediately.
+*
+* This is the counterpart of `oauthFetch` in `provider-codex/src/oauth.ts`, kept
+* deliberately close to it — the same guarantees, in the same order, so a reader
+* who knows one knows the other. What differs is scope: Codex has one auth
+* issuer, Copilot has THREE origins, and each is its own option.
+*
+* ## Three origins, three independent pins
+*
+* `oauthIssuer` (`https://github.com`), `githubApiBaseUrl`
+* (`https://api.github.com`) and `baseUrl` (`https://api.githubcopilot.com`) are
+* three separate options, pinned separately by three separate calls to {@link
+* issuerOf}. No module may dispatch a request to an origin other than its own
+* pinned one — the device flow cannot reach the Copilot surface, the Copilot
+* surface cannot reach the token exchange. That is why {@link copilotFetch}
+* demands a {@link CopilotOrigin} rather than reading an origin off a shared
+* options bag: there is no options bag that holds all three, so there is no way
+* to pass the wrong one by forgetting which field applies.
+*
+* The pin is compared BEFORE the request is dispatched (Requirement 3.7). A
+* post-hoc check on the response would already have leaked the `Authorization`
+* header to whatever origin the URL named.
+*
+* ## What is bounded, and why each bound exists
+*
+* - **`redirect: 'manual'` plus {@link rejectCopilotRedirect}** — a followed hop
+*   re-sends the credential headers to the redirect target (Requirements 3.8, 7.8).
+* - **A per-request deadline** — a server that accepts the connection and then
+*   says nothing must not hang a CLI.
+* - **Bytes AND chunk count on every read** — bytes alone still lets a stream of
+*   one-byte chunks pin the event loop, so both are checked (Requirements 4.7, 13.6).
+* - **{@link raceAbort}** — `fetch` honours a signal, but a pending read does not
+*   necessarily reject the instant it aborts. Racing makes the caller's signal win
+*   immediately rather than eventually (Requirement 4.6).
+* - **{@link positiveSafeInteger} on every configured limit** — a `0`, a `NaN` or
+*   a float silently disables a bound, which is worse than rejecting the config.
+*
+* @module ai-agent-sdk/providers/copilot/http
+*/
+/** Deadline for one Copilot HTTP request when the caller configures none. */
+const COPILOT_DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+/** Maximum response bytes retained or parsed when the caller configures none. */
+const COPILOT_DEFAULT_MAX_RESPONSE_BYTES = 1048576;
+/** Maximum response chunks accepted when the caller configures none. */
+const COPILOT_DEFAULT_MAX_RESPONSE_CHUNKS = 1e4;
+/** Bound on releasing a body that is being discarded. Never a caller-visible wait. */
+const TEARDOWN_TIMEOUT_MS = 3e4;
+/**
+* Validate and pin one of the three configurable origins.
+*
+* Two rejections, each for a concrete reason:
+*
+* - **Userinfo** (`https://user:pass@host`) — credentials in a URL would be sent
+*   as an extra `Authorization` header the caller never wrote, and they end up in
+*   logs. There is no legitimate use for them on any of these three origins.
+* - **`http:` without `allowInsecureIssuer`** — see the option's note.
+*
+* @param field - which option is being pinned; appears in the error message.
+* @param configured - the caller's value, or `undefined` to take the default.
+* @param fallback - the exported default for this field.
+* @param options - read for `allowInsecureIssuer` only.
+* @returns the pin to hand to {@link copilotFetch}.
+* @throws AgentSdkError with `COPILOT_ENDPOINT_ORIGIN_INVALID` when the value is
+*   unparsable, carries userinfo, or is cleartext without the opt-in.
+*/
+function issuerOf(field, configured, fallback, options = {}) {
+	const raw = configured ?? fallback;
+	let url;
+	try {
+		url = new URL(raw);
+	} catch (error) {
+		throw originError(`Copilot ${field} is not an absolute URL`, error);
+	}
+	if (url.username.length > 0 || url.password.length > 0) throw originError(`Copilot ${field} must not contain credentials`);
+	if (url.protocol !== "https:" && !(options.allowInsecureIssuer === true && url.protocol === "http:")) throw originError(`Copilot ${field} must use https unless allowInsecureIssuer is enabled`);
+	return Object.freeze({
+		field,
+		href: url.href.replace(/\/+$/, ""),
+		origin: url.origin
+	});
+}
+/**
+* Build an absolute URL on a pinned origin.
+*
+* The path has to be absolute-and-rooted: a relative path resolved against a base
+* is exactly how a URL quietly ends up somewhere else, and a path that is itself
+* absolute (`//evil.tld/x` or `https://evil.tld/x`) would replace the origin
+* outright.
+* @param pinned - the pin from {@link issuerOf}.
+* @param path - a path beginning with a single `/`.
+* @returns the absolute URL string, guaranteed to be on `pinned.origin`.
+* @throws AgentSdkError with `COPILOT_ENDPOINT_ORIGIN_INVALID` when the path could
+*   move the request off the pin.
+*/
+function copilotUrl(pinned, path) {
+	if (!path.startsWith("/") || path.startsWith("//")) throw originError(`Copilot ${pinned.field} path must start with a single '/'`);
+	const url = new URL(`${pinned.href}${path}`);
+	if (url.origin !== pinned.origin) throw originError(`Copilot ${pinned.field} path must stay on the pinned origin`);
+	return url.href;
+}
+/**
+* Dispatch one Copilot request with the origin pin, no-follow and deadline applied.
+*
+* Order matters and is the contract: the pin is compared FIRST, so a URL on the
+* wrong origin never receives the headers; then the request goes out with
+* `redirect: 'manual'`; then the response passes the redirect guard before it is
+* handed back. The body is left unread — {@link readCopilotResponseText} is the
+* bounded reader for it.
+* @param request - the pin, the URL, the call site and the init.
+* @param options - signal, fetch implementation and limits.
+* @returns the response, already cleared by the redirect guard.
+* @throws AgentSdkError with `COPILOT_ENDPOINT_ORIGIN_INVALID` when the URL is off
+*   the pin, or `COPILOT_REDIRECT_REJECTED` when the response was a redirect.
+*/
+async function copilotFetch(request, options = {}) {
+	const url = requestUrl(request);
+	const timeoutMs = positiveSafeInteger(options.requestTimeoutMs ?? 3e4, "requestTimeoutMs");
+	const timeout = AbortSignal.timeout(timeoutMs);
+	const signal = options.signal === void 0 ? timeout : AbortSignal.any([options.signal, timeout]);
+	const fetchImpl = options.fetch ?? globalThis.fetch;
+	if (typeof fetchImpl !== "function") throw new TypeError("Copilot HTTP requires fetch");
+	const response = await raceAbort(Promise.resolve(fetchImpl(url, {
+		...request.init,
+		signal,
+		redirect: "manual"
+	})), signal);
+	await rejectCopilotRedirect(response, url, request.operation, TEARDOWN_TIMEOUT_MS);
+	return response;
+}
+/**
+* Read a response body as text, bounded on bytes and on chunk count.
+*
+* A declared `content-length` over the limit is refused before a single chunk is
+* read; the running totals then catch a body that lies about its length or sends
+* none. Either way the reader is cancelled rather than abandoned.
+* @param response - a response already cleared by {@link copilotFetch}.
+* @param options - limits and the signal to race the read against.
+* @returns the decoded text, or `''` when there was no body.
+* @throws RangeError when a configured bound is exceeded.
+*/
+async function readCopilotResponseText(response, options = {}) {
+	const maxBytes = positiveSafeInteger(options.maxResponseBytes ?? 1048576, "maxResponseBytes");
+	const maxChunks = positiveSafeInteger(options.maxResponseChunks ?? 1e4, "maxResponseChunks");
+	const declared = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > maxBytes) {
+		if (response.body !== null) await waitForSettlement(response.body.cancel().catch(() => void 0), TEARDOWN_TIMEOUT_MS);
+		throw new RangeError(`Copilot HTTP response exceeds the ${maxBytes}-byte limit`);
+	}
+	if (response.body === null) return "";
+	const timeout = AbortSignal.timeout(positiveSafeInteger(options.requestTimeoutMs ?? 3e4, "requestTimeoutMs"));
+	const signal = options.signal === void 0 ? timeout : AbortSignal.any([options.signal, timeout]);
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let bytes = 0;
+	let chunks = 0;
+	let result = "";
+	try {
+		while (true) {
+			const next = await raceAbort(reader.read(), signal);
+			if (next.done) return result + decoder.decode();
+			if (next.value === void 0) continue;
+			chunks++;
+			bytes += next.value.byteLength;
+			if (chunks > maxChunks || bytes > maxBytes) {
+				await waitForSettlement(reader.cancel().catch(() => void 0), TEARDOWN_TIMEOUT_MS);
+				throw new RangeError("Copilot HTTP response exceeds its configured resource limit");
+			}
+			result += decoder.decode(next.value, { stream: true });
+		}
+	} finally {
+		reader.releaseLock();
+	}
+}
+/**
+* Settle as soon as either the pending work or the signal does.
+*
+* An already-aborted signal rejects synchronously rather than after one turn, so
+* a caller who aborts before the call never dispatches the request at all.
+* @param pending - the work to race.
+* @param signal - the signal that gets to win.
+* @returns the pending value, when it arrives first.
+*/
+function raceAbort(pending, signal) {
+	if (signal.aborted) return Promise.reject(abortReason(signal));
+	return new Promise((resolve, reject) => {
+		const abort = () => {
+			cleanup();
+			reject(abortReason(signal));
+		};
+		const cleanup = () => signal.removeEventListener("abort", abort);
+		signal.addEventListener("abort", abort, { once: true });
+		pending.then((value) => {
+			cleanup();
+			resolve(value);
+		}, (error) => {
+			cleanup();
+			reject(error);
+		});
+	});
+}
+/**
+* Accept a configured limit only when it can actually bound anything.
+*
+* `0`, a negative, a float and `NaN` all disable a bound silently, so each one is
+* rejected instead of normalized.
+* @param value - the configured number.
+* @param field - the option name, for the message.
+* @returns the value, unchanged.
+* @throws RangeError when the value cannot serve as a bound.
+*/
+function positiveSafeInteger(value, field) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new RangeError(`Copilot HTTP ${field} must be a positive safe integer`);
+	return value;
+}
+/**
+* Resolve the request URL and compare it against the pin, before anything is sent.
+*
+* Userinfo is rejected here as well as in {@link issuerOf}: `URL.origin` ignores
+* it, so a URL on the right origin can still carry credentials the caller never
+* intended to send.
+*/
+function requestUrl(request) {
+	let url;
+	try {
+		url = new URL(request.url);
+	} catch (error) {
+		throw originError(`Copilot ${request.operation} target is not an absolute URL`, error);
+	}
+	if (url.username.length > 0 || url.password.length > 0) throw originError(`Copilot ${request.operation} target must not contain credentials`);
+	if (url.origin !== request.pinned.origin) throw originError(`Copilot ${request.operation} target origin '${url.origin}' is not the pinned ${request.pinned.field} origin '${request.pinned.origin}'`);
+	return url.href;
+}
+function originError(message, cause) {
+	return new AgentSdkError(message, COPILOT_ERROR_CODES.ENDPOINT_ORIGIN_INVALID, cause === void 0 ? void 0 : { cause });
+}
+function abortReason(signal) {
+	return signal.reason ?? new AgentSdkError("Copilot HTTP request aborted", MODEL_ERROR_CODES.ABORTED);
+}
+
+//#endregion
+//#region src/catalog.ts
+/**
+* `Copilot_Catalog`: read `GET /models`, then PARTITION what came back.
+*
+* Discovery is the right default for this surface (Requirement 8.1): which models
+* an account may call depends on its plan, on its organisation's policy, and on
+* the editor identity the request presents, so no hardcoded list is correct for
+* two accounts at once. Passing `models` explicitly skips discovery entirely
+* (Requirement 8.5) — that decision belongs to the adapter, which simply does not
+* call this module in that case.
+*
+* ## Two levels of wrongness, two different answers
+*
+* The defensive read runs in a fixed order, and the order IS the contract:
+*
+* ```text
+* 1. redirect (every shape)                       ⇒ COPILOT_REDIRECT_REJECTED
+* 2. declared content-length over the limit       ⇒ RangeError, body cancelled
+* 3. accumulated bytes/chunks over the limit      ⇒ RangeError, reader cancelled
+* 4. body is not JSON, root is not an object,
+*    or `data` is not an array                    ⇒ COPILOT_CATALOG_MALFORMED
+* 5. entry count over maxCatalogModels            ⇒ COPILOT_CATALOG_MALFORMED
+* 6. entry: id is not a non-empty string          ⇒ omitted 'model-id-missing'
+* 7. entry: capabilities.type unrecognized        ⇒ omitted 'capability-type-unrecognized'
+* ```
+*
+* Steps 4 and 5 are STRUCTURAL, and a structural mismatch is an error rather than
+* a starting point for a guess (Requirement 8.8): a model list inferred from a
+* body this SDK could not read is a list nobody can be held to. Steps 6 and 7 are
+* at ENTRY level, and there the entry is dropped while the rest of the catalog
+* survives — one unfamiliar entry must not kill every model that still works.
+*
+* Dropping rather than listing-with-a-flag is the same judgement in the other
+* direction (Requirements 9.4, 9.5): listing a model this SDK cannot dispatch is
+* worse than not listing it, because it shows up in a selector and then fails at
+* call time, far from the cause.
+*
+* ## Metadata is translated, never invented
+*
+* Every field of {@link ProviderCatalogModel} is filled only from a field the
+* endpoint actually supplied (Requirement 8.4). The trap is
+* `inputModalities`: with no vision signal at all the field is ABSENT, NOT
+* `['text']`. An explicit list without `image` is a NEGATIVE claim the registry
+* acts on — it projects images to text — so inventing `['text']` would silently
+* strip images from every request to a model that may well accept them. Absent
+* means unknown, and unknown is what the endpoint said.
+*
+* `declaredEndpoint` follows the same rule and stays `undefined` when the catalog
+* discloses nothing. `undefined` is NOT "not supported"; the router treats the two
+* states differently (Requirement 8.6).
+*
+* ## The catalog is advisory
+*
+* `omitted` does not fail anything. A dispatched request to an omitted id still
+* goes out — it just takes the router's default branch — and a real error from the
+* endpoint remains the final word whenever metadata and behaviour disagree
+* (Requirement 8.6).
+*
+* @module ai-agent-sdk/providers/copilot/catalog
+*/
+/** Path of the catalog surface, relative to the pinned Copilot base URL. */
+const COPILOT_CATALOG_PATH = "/models";
+/** Maximum raw catalog bytes when the caller configures none. */
+const COPILOT_DEFAULT_MAX_CATALOG_BYTES = 4194304;
+/** Maximum catalog entries accepted when the caller configures none. */
+const COPILOT_DEFAULT_MAX_CATALOG_MODELS = 2048;
+/** Maximum catalog response chunks accepted when the caller configures none. */
+const COPILOT_DEFAULT_MAX_CATALOG_CHUNKS = 1e4;
+/** Catalog request deadline when the caller configures none. */
+const COPILOT_DEFAULT_CATALOG_TIMEOUT_MS = 3e4;
+/**
+* Resolve the per-read bounds, rejecting a value that cannot bound anything.
+*
+* Validation happens here rather than at the read, so a `0` or a `NaN` in the
+* configuration is a construction-time error instead of a silently disabled limit
+* discovered under load (Requirement 8.2).
+* @param options - the caller's catalog options.
+* @returns the four resolved bounds plus the insecure-HTTP opt-in.
+* @throws RangeError when a configured bound is not a positive safe integer.
+*/
+function resolveCopilotCatalogLimits(options = {}) {
+	return Object.freeze({
+		maxBytes: positiveSafeInteger(options.maxCatalogBytes ?? 4194304, "maxCatalogBytes"),
+		maxModels: positiveSafeInteger(options.maxCatalogModels ?? 2048, "maxCatalogModels"),
+		maxChunks: positiveSafeInteger(options.maxCatalogChunks ?? 1e4, "maxCatalogChunks"),
+		timeoutMs: positiveSafeInteger(options.catalogTimeoutMs ?? 3e4, "catalogTimeoutMs"),
+		...options.allowInsecureHttp === void 0 ? {} : { allowInsecureHttp: options.allowInsecureHttp }
+	});
+}
+/**
+* Forward the three cache-policy options, and only the ones that were set.
+*
+* A conditional spread rather than defaults: `provider-http` owns catalog caching,
+* and a default written here would override the runtime's own without anyone
+* asking for it (Requirement 8.7).
+* @param options - the caller's catalog options.
+* @returns an object carrying only the cache options the caller supplied.
+*/
+function copilotCatalogCacheOptions(options = {}) {
+	return {
+		...options.catalogTtlMs === void 0 ? {} : { catalogTtlMs: options.catalogTtlMs },
+		...options.catalogStaleTtlMs === void 0 ? {} : { catalogStaleTtlMs: options.catalogStaleTtlMs },
+		...options.catalogFailureBackoffMs === void 0 ? {} : { catalogFailureBackoffMs: options.catalogFailureBackoffMs }
+	};
+}
+/**
+* Read `GET {baseUrl}/models` and partition it.
+*
+* The base URL is re-pinned here from `context.baseUrl` rather than trusted as a
+* string: the catalog is the first Copilot call an adapter makes, and a pin
+* compared before dispatch is the only check that runs before the resolved
+* `Authorization` header leaves the process.
+* @param context - the discovery context `provider-http` supplies: base URL,
+*   already-resolved headers, and the operation's signal.
+* @param limits - bounds from {@link resolveCopilotCatalogLimits}.
+* @param fetchImpl - HTTP implementation, injected for tests and non-browser runtimes.
+* @returns the partitioned snapshot; an empty one when the endpoint answered a
+*   non-2xx status, because a catalog that could not be fetched is advisory too.
+* @throws AgentSdkError with `COPILOT_REDIRECT_REJECTED` on any redirect shape, or
+*   `COPILOT_CATALOG_MALFORMED` when the response is the wrong shape structurally.
+* @throws RangeError when the response exceeds a configured bound.
+*/
+async function discoverCopilotModels(context, limits, fetchImpl) {
+	const pinned = issuerOf("baseUrl", context.baseUrl.href, COPILOT_BASE_URL, { ...limits.allowInsecureHttp === void 0 ? {} : { allowInsecureIssuer: limits.allowInsecureHttp } });
+	const url = copilotUrl(pinned, COPILOT_CATALOG_PATH);
+	const http = {
+		signal: context.signal,
+		fetch: fetchImpl,
+		requestTimeoutMs: limits.timeoutMs,
+		maxResponseBytes: limits.maxBytes,
+		maxResponseChunks: limits.maxChunks,
+		...limits.allowInsecureHttp === void 0 ? {} : { allowInsecureIssuer: limits.allowInsecureHttp }
+	};
+	const response = await copilotFetch({
+		pinned,
+		url,
+		operation: "model catalog",
+		init: {
+			method: "GET",
+			headers: context.headers
+		}
+	}, http);
+	if (!response.ok) {
+		if (response.body !== null) await response.body.cancel().catch(() => void 0);
+		return EMPTY_SNAPSHOT;
+	}
+	return partitionCopilotCatalog(parseCatalogBody(await readCopilotResponseText(response, http)), limits.maxModels);
+}
+/**
+* Partition an already-read catalog body.
+*
+* Exported separately from the fetch so the partition is testable — and readable —
+* as what it is: a pure function from a parsed body to three lists.
+* @param body - the parsed root object of the catalog response.
+* @param maxModels - entry-count ceiling; exceeding it is structural, not per-entry.
+* @returns the partitioned snapshot.
+* @throws AgentSdkError with `COPILOT_CATALOG_MALFORMED` when `data` is not an
+*   array or holds more than `maxModels` entries.
+*/
+function partitionCopilotCatalog(body, maxModels) {
+	const data = body.data;
+	if (!Array.isArray(data)) throw malformed$1("Copilot model catalog `data` must be an array");
+	if (data.length > maxModels) throw malformed$1(`Copilot model catalog exceeds the ${maxModels}-model limit`);
+	const generation = [];
+	const embedding = [];
+	const omitted = [];
+	for (const candidate of data) {
+		const entry = isRecord(candidate) ? candidate : {};
+		const id = typeof entry.id === "string" ? entry.id : "";
+		if (id.length === 0) {
+			omitted.push({
+				id,
+				reason: "model-id-missing"
+			});
+			continue;
+		}
+		const type = entry.capabilities?.type;
+		if (type === "chat") {
+			generation.push(generationModel(id, entry));
+			continue;
+		}
+		if (type === "embeddings") {
+			embedding.push(embeddingModel(id, entry));
+			continue;
+		}
+		omitted.push({
+			id,
+			reason: "capability-type-unrecognized"
+		});
+	}
+	return Object.freeze({
+		generation: Object.freeze(generation),
+		embedding: Object.freeze(embedding),
+		omitted: Object.freeze(omitted)
+	});
+}
+/** The snapshot returned when there is nothing to report, frozen and shared. */
+const EMPTY_SNAPSHOT = Object.freeze({
+	generation: Object.freeze([]),
+	embedding: Object.freeze([]),
+	omitted: Object.freeze([])
+});
+/** Modalities claimed when — and only when — a vision signal was actually present. */
+const TEXT_AND_IMAGE = Object.freeze(["text", "image"]);
+/**
+* Translate one `type: 'chat'` entry, filling only what the endpoint supplied.
+*
+* `name` is not defaulted to `id`: a display label the endpoint did not send is a
+* label this layer would be inventing, and the layer that renders a selector
+* already falls back to the id.
+*/
+function generationModel(id, entry) {
+	const limits = entry.capabilities?.limits;
+	const supports = entry.capabilities?.supports;
+	const vision = entry.vision === true || supports?.vision === true;
+	const contextWindow = positiveInteger(limits?.max_context_window_tokens);
+	const maxTokens = positiveInteger(limits?.max_output_tokens);
+	return Object.freeze({
+		model: Object.freeze({
+			id,
+			...typeof entry.name === "string" && entry.name.length > 0 ? { name: entry.name } : {},
+			...contextWindow === void 0 ? {} : { contextWindow },
+			...maxTokens === void 0 ? {} : { maxTokens },
+			...vision ? { inputModalities: TEXT_AND_IMAGE } : {}
+		}),
+		declaredEndpoint: declaredEndpointOf$1(supports)
+	});
+}
+/** Translate one `type: 'embeddings'` entry, under the same fill-only-what-was-said rule. */
+function embeddingModel(id, entry) {
+	const capabilities = entry.capabilities;
+	const limits = capabilities?.limits;
+	const maxInputTokens = positiveInteger(limits?.max_context_window_tokens);
+	const maxInputs = positiveInteger(limits?.max_inputs);
+	const dimensions = capabilities?.supports?.dimensions;
+	return Object.freeze({
+		id,
+		...typeof entry.name === "string" && entry.name.length > 0 ? { name: entry.name } : {},
+		...typeof capabilities?.family === "string" && capabilities.family.length > 0 ? { family: capabilities.family } : {},
+		...maxInputTokens === void 0 ? {} : { maxInputTokens },
+		...maxInputs === void 0 ? {} : { maxInputs },
+		...typeof dimensions === "boolean" ? { supportsDimensions: dimensions } : {}
+	});
+}
+/**
+* Read the endpoint disclosure, and only a disclosure.
+*
+* `supports.responses === true` says `/responses`; `false` says `/chat/completions`
+* — the endpoint stated something either way. Anything else, including the field
+* being absent or holding a non-boolean, is UNKNOWN and stays `undefined`, which
+* is a different state from "not supported" (Requirement 8.6).
+*/
+function declaredEndpointOf$1(supports) {
+	const responses = supports?.responses;
+	if (responses === true) return "responses";
+	if (responses === false) return "chat-completions";
+}
+/**
+* Parse the catalog body, treating an unreadable body as structural.
+*
+* Both failures land on the same code because they are the same problem: the
+* response is not a catalog, and there is nothing here to guess a model list from
+* (Requirement 8.8).
+*/
+function parseCatalogBody(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (error) {
+		throw malformed$1("Copilot model catalog is not valid JSON", error);
+	}
+	if (!isRecord(parsed)) throw malformed$1("Copilot model catalog must be a JSON object");
+	return parsed;
+}
+/** Accept a numeric metadata field only when it can serve as a capacity. */
+function positiveInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+}
+/** A JSON object, excluding arrays — `data` being at the root is not a catalog. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function malformed$1(message, cause) {
+	return new AgentSdkError(message, COPILOT_ERROR_CODES.CATALOG_MALFORMED, cause === void 0 ? void 0 : { cause });
+}
+
+//#endregion
+//#region src/common/store-capture.ts
+/**
+* Store capture: decide which credential store variant the caller passed, and
+* take a snapshot of its identity and methods.
+*
+* The counterpart of `captureCodexStore`, and it holds the same two lines:
+*
+* - **No accessors.** Every property is read through
+*   `Object.getOwnPropertyDescriptor`, and a descriptor without a `value` is
+*   REJECTED rather than invoked. Telling the two variants apart must not run a
+*   line of the caller's code, because a getter here would run during provider
+*   construction, in an order the caller cannot see.
+* - **No I/O.** Methods are captured, not called. Nothing touches storage at
+*   construction time; the first read happens when an operation asks for a
+*   credential.
+*
+* Methods are invoked through `Reflect.apply` with the original object as the
+* receiver, so a store written against `this` keeps working after capture.
+*
+* @module ai-agent-sdk/providers/copilot/store-capture
+*/
+/** Capture store identity and methods without invoking accessors or doing storage I/O. */
+function captureCopilotStore(value) {
+	try {
+		if (value === null || typeof value !== "object") throw new TypeError("store must be an object");
+		const marker = dataValue(value, "kind", false);
+		if (marker === void 0) return captureLegacy(value);
+		if (marker !== "credential-store" || dataValue(value, "apiVersion") !== CREDENTIAL_CAPABILITY_API_VERSION) throw new TypeError("unsupported credential-store marker");
+		const id = boundedString(dataValue(value, "id"), 128, "credential store id");
+		const label = boundedString(dataValue(value, "label"), 256, "credential store label");
+		const read = capturedMethod(value, "read");
+		const commit = capturedMethod(value, "commit");
+		return Object.freeze({
+			kind: "versioned",
+			label,
+			store: Object.freeze({
+				kind: "credential-store",
+				apiVersion: CREDENTIAL_CAPABILITY_API_VERSION,
+				id,
+				label,
+				read,
+				commit
+			})
+		});
+	} catch (error) {
+		throw new AgentSdkError$1("Copilot authStore credential store is invalid", "CREDENTIAL_STORE_INVALID", { cause: error });
+	}
+}
+function captureLegacy(source) {
+	const location = boundedString(dataValue(source, "location"), 1024, "Copilot auth store location");
+	const read = capturedMethod(source, "read");
+	const write = capturedMethod(source, "write");
+	return Object.freeze({
+		kind: "legacy",
+		label: location,
+		store: Object.freeze({
+			location,
+			read,
+			write
+		})
+	});
+}
+function capturedMethod(source, key) {
+	const method = dataValue(source, key);
+	if (typeof method !== "function") throw new TypeError(`${String(key)} must be a function`);
+	return (...args) => Reflect.apply(method, source, args);
+}
+/**
+* Read an own-or-inherited DATA property. An accessor anywhere on the prototype
+* chain is an error: reading it would run caller code during construction.
+*/
+function dataValue(source, key, required = true) {
+	let owner = source;
+	while (owner !== null) {
+		const descriptor = Object.getOwnPropertyDescriptor(owner, key);
+		if (descriptor !== void 0) {
+			if (!("value" in descriptor)) throw new TypeError(`${String(key)} must not be an accessor`);
+			return descriptor.value;
+		}
+		owner = Object.getPrototypeOf(owner);
+	}
+	if (!required) return void 0;
+	throw new TypeError(`missing ${String(key)}`);
+}
+function boundedString(value, maxLength, label) {
+	if (typeof value !== "string" || value.length === 0 || value.length > maxLength) throw new TypeError(`${label} must be a bounded non-empty string`);
+	return value;
+}
+
+//#endregion
+//#region src/dual-protocol.ts
+/** Protocol id the HTTP layer reports for every Copilot request. */
+const COPILOT_DUAL_PROTOCOL_ID = "copilot-dual";
+/**
+* Conservative defaults, matching each sub-protocol's own defaults where the two
+* agree.
+*
+* `store: false` because retaining prompts on someone else's server is an explicit
+* decision, `include` carries `reasoning.encrypted_content` because without it a
+* reasoning model loses its chain of thought across a tool call, and
+* `parallelToolCalls: false` because older gateways reject the field outright.
+*/
+const COPILOT_DEFAULT_DIALECT = Object.freeze({
+	sampling: true,
+	maxOutputTokens: true,
+	structuredOutputs: true,
+	tools: true,
+	store: false,
+	include: Object.freeze(["reasoning.encrypted_content"]),
+	reasoningSummary: "auto",
+	streamUsage: true,
+	systemRole: "system",
+	parallelToolCalls: false
+});
+/**
+* Project the Copilot dialect onto the Responses dialect.
+*
+* PURE and TOTAL: every {@link CopilotDialect} flag has exactly one destination
+* here or none at all. `tools`, `streamUsage`, `systemRole` and
+* `parallelToolCalls` have no Responses destination and are DROPPED rather than
+* bent into a nearby flag — Responses declares tools from the request itself and
+* has no `reasoning_effort`-style neighbour worth guessing at.
+*
+* `reasoningSummary: 'none'` is expressed by ABSENCE, because that is how the
+* Responses serializer spells "ask for no summary" (`summary` is only sent when
+* the knob is defined). {@link resolvedResponsesDialect} therefore drops the
+* sub-protocol's own `reasoningSummary` default before merging, so this branch of
+* the projection is not overwritten by it.
+* @param dialect - the resolved Copilot dialect for this request.
+* @returns the Responses knobs this dialect determines, and only those.
+*/
+function toResponsesDialect(dialect) {
+	return {
+		sampling: dialect.sampling,
+		maxOutputTokens: dialect.maxOutputTokens,
+		structuredOutputs: dialect.structuredOutputs,
+		store: dialect.store,
+		include: [...dialect.include],
+		...dialect.reasoningSummary === "none" ? {} : { reasoningSummary: dialect.reasoningSummary },
+		...dialect.promptCacheKey === void 0 ? {} : { promptCacheKey: dialect.promptCacheKey }
+	};
+}
+/**
+* Project the Copilot dialect onto the Chat Completions dialect.
+*
+* PURE and TOTAL, same rule as {@link toResponsesDialect}: `store`, `include` and
+* `reasoningSummary` have no Chat Completions destination and are dropped —
+* `reasoningEffort` is a different knob (how hard to think, not whether to report
+* a summary), so mapping onto it would be a guess dressed as a translation.
+*
+* Two flags change type on the way across, and each mapping is total:
+*
+* | Copilot | Chat Completions |
+* | --- | --- |
+* | `maxOutputTokens: true` | `maxTokensField: 'max_tokens'` |
+* | `maxOutputTokens: false` | `maxTokensField: false` |
+* | `structuredOutputs: true` | `structuredOutputs: 'json-schema'` |
+* | `structuredOutputs: false` | `structuredOutputs: false` |
+*
+* The accepted cost of the first row: a caller cannot reach
+* `'max_completion_tokens'` through {@link CopilotDialect}. Copilot's
+* `/chat/completions` takes `max_tokens`, and the models that demand the newer
+* spelling are the ones the router sends to `/responses` anyway, so the boolean
+* buys a flag a caller can reason about and costs a spelling no Copilot model has
+* been observed to need.
+* @param dialect - the resolved Copilot dialect for this request.
+* @returns the Chat Completions knobs this dialect determines, and only those.
+*/
+function toChatCompletionsDialect(dialect) {
+	return {
+		sampling: dialect.sampling,
+		maxTokensField: dialect.maxOutputTokens ? "max_tokens" : false,
+		structuredOutputs: dialect.structuredOutputs ? "json-schema" : false,
+		tools: dialect.tools,
+		streamUsage: dialect.streamUsage,
+		systemRole: dialect.systemRole,
+		parallelToolCalls: dialect.parallelToolCalls,
+		...dialect.promptCacheKey === void 0 ? {} : { promptCacheKey: dialect.promptCacheKey }
+	};
+}
+/**
+* Build the composite protocol.
+*
+* @param options - the router, the two sub-protocols, and the optional observer.
+* @returns a `RuntimeWireProtocol<CopilotDialect>` with id `'copilot-dual'`.
+*/
+function copilotDualProtocol(options) {
+	const { router, responses, chat } = options;
+	const onDecision = options.onDecision;
+	/**
+	* The Responses dialect for one request.
+	*
+	* Merged with the SUB-PROTOCOL's defaults, not the composite's: the composite's
+	* defaults are already inside `dialect` by the time the runtime calls us, and
+	* what is missing is everything the Responses dialect knows about but Copilot
+	* does not expose (`messagePhase`). `reasoningSummary` is dropped from the base
+	* because the projection owns that key outright — see {@link toResponsesDialect}.
+	*/
+	const resolvedResponsesDialect = (dialect) => {
+		const { reasoningSummary: _ownedByProjection, ...base } = responses.defaultDialect;
+		return Object.freeze({
+			...base,
+			...toResponsesDialect(dialect)
+		});
+	};
+	/**
+	* The Chat Completions dialect for one request.
+	*
+	* Same rule; the sub-protocol supplies `path`, `stop`, `seed` and
+	* `reasoningEffort`, which {@link CopilotDialect} deliberately does not expose.
+	*/
+	const resolvedChatDialect = (dialect) => Object.freeze({
+		...chat.defaultDialect,
+		...toChatCompletionsDialect(dialect)
+	});
+	/** Route one request, reporting the decision on the way through. */
+	const decide = (request) => {
+		const decision = router.decide(request.model.id);
+		report(decision);
+		return decision;
+	};
+	/** Hand the decision to the observer, swallowing whatever it does with it. */
+	const report = (decision) => {
+		if (onDecision === void 0) return;
+		try {
+			onDecision(decision);
+		} catch {}
+	};
+	return defineWireProtocol({
+		id: COPILOT_DUAL_PROTOCOL_ID,
+		defaultDialect: COPILOT_DEFAULT_DIALECT,
+		endpointPath: (request, dialect) => decide(request).endpoint === "responses" ? responses.endpointPath(request, resolvedResponsesDialect(dialect)) : chat.endpointPath(request, resolvedChatDialect(dialect)),
+		...protocolHeadersOf(responses, chat),
+		serialize: (request, dialect) => router.decide(request.model.id).endpoint === "responses" ? responses.serialize(request, resolvedResponsesDialect(dialect)) : chat.serialize(request, resolvedChatDialect(dialect)),
+		translate: (events, request, displayName) => router.decide(request.model.id).endpoint === "responses" ? responses.translate(events, request, displayName) : chat.translate(events, request, displayName)
+	});
+}
+/**
+* The composite's `protocolHeaders`, or nothing.
+*
+* This is the one method whose signature carries NO `ProtocolRequest`, so the
+* routing key that makes the other three work is absent here. Two things follow.
+* The union of both branches' headers is wrong — it would put a header belonging
+* to the branch NOT taken on the wire. And a guess is wrong for the same reason.
+* So the composite exposes a header set only when both branches produce the SAME
+* one, in which case that set is the selected branch's set whichever branch is
+* selected; when they diverge, it exposes none, and a protocol header that only
+* one branch needs has to travel through the adapter's request-scoped header path
+* where the model id is in hand.
+*
+* Today neither sub-protocol declares `protocolHeaders` — Copilot's mandatory
+* headers are endpoint identity (`editor-version`, `editor-plugin-version`), not
+* protocol facts — so this returns nothing and the branch above is the
+* forward-looking half of the rule.
+* @param responses - the `/responses` sub-protocol.
+* @param chat - the `/chat/completions` sub-protocol.
+* @returns a one-key spread carrying `protocolHeaders`, or an empty one.
+*/
+function protocolHeadersOf(responses, chat) {
+	const fromResponses = responses.protocolHeaders;
+	const fromChat = chat.protocolHeaders;
+	if (fromResponses === void 0 && fromChat === void 0) return {};
+	return { protocolHeaders: (dialect) => {
+		const left = fromResponses?.(Object.freeze({
+			...responses.defaultDialect,
+			...toResponsesDialect(dialect)
+		})) ?? {};
+		return sameHeaders(left, fromChat?.(Object.freeze({
+			...chat.defaultDialect,
+			...toChatCompletionsDialect(dialect)
+		})) ?? {}) ? Object.freeze({ ...left }) : Object.freeze({});
+	} };
+}
+/** Whether two header maps are equal name-for-name and value-for-value. */
+function sameHeaders(left, right) {
+	const names = Object.keys(left);
+	if (names.length !== Object.keys(right).length) return false;
+	return names.every((name) => left[name] === right[name]);
+}
+
+//#endregion
+//#region src/exchange.ts
+/**
+* `Copilot_Token_Exchange`: turn the long-lived `GitHub_User_Token` into the
+* short-lived `Copilot_Api_Token` the Copilot surface accepts.
+*
+* ```text
+* GET https://api.github.com/copilot_internal/v2/token
+* Authorization: Bearer ghu_…
+* Accept: application/json
+* Editor-Version / Editor-Plugin-Version
+* → 200 { token, expires_at, refresh_in?, endpoints?: { api?: string }, … }
+* ```
+*
+* ## The classification order is the contract
+*
+* Nine rows, in this order, each for a concrete reason:
+*
+* ```text
+* 1. host is 'ghe.com' or ends with a '.ghe.com' label ⇒ TENANT_UNSUPPORTED   (before any I/O)
+* 2. origin is not the pinned githubApiBaseUrl origin   ⇒ ENDPOINT_ORIGIN_INVALID (before any I/O)
+* 3. the response is a redirect, in any of its shapes   ⇒ REDIRECT_REJECTED
+* 4. HTTP 404                                          ⇒ TENANT_UNSUPPORTED
+* 5. HTTP 401                                          ⇒ CREDENTIAL_REJECTED   (permanent)
+* 6. HTTP 403                                          ⇒ CREDENTIAL_REJECTED   (permanent)
+* 7. HTTP 429, HTTP 5xx, a network error, or a timeout ⇒ TOKEN_EXCHANGE_FAILED (transient)
+* 8. any remaining 4xx                                 ⇒ TOKEN_EXCHANGE_FAILED (permanent)
+* 9. body is not JSON, or expires_at is unreadable     ⇒ TOKEN_MALFORMED
+* ```
+*
+* Rows 1 and 2 run BEFORE a request is dispatched. A data-residency tenant has no
+* token-exchange surface at all, so asking it is pointless; and an origin check
+* performed after the fact would already have handed the bearer token to whatever
+* origin the URL named (Requirements 3.6, 3.7).
+*
+* Row 1 detects the tenant by DOMAIN LABEL SUFFIX, never by substring: with
+* `includes('ghe.com')`, `ghe.com.evil.tld` and `notghe.com` would both be
+* misread as data-residency tenants, one of which is an attacker-chosen host.
+*
+* Row 6 does the most work of the nine. The endpoint answers 403 both for a
+* personal access token and for a token minted by an OAuth App that is not on
+* GitHub's allowlist, and the response does not distinguish the two — so the
+* message names BOTH possibilities alongside the single instruction that helps in
+* either case (Requirements 3.5, 13.2).
+*
+* ## What is read from the body, and what is refused
+*
+* `expires_at` is MANDATORY and has to be a positive finite number: without it
+* there is no second source for the lifetime, and an invented TTL is exactly the
+* inference this SDK does not make. `refresh_in` is advisory and a bad value is
+* dropped rather than fatal — it can only shorten the refresh moment, so losing
+* it costs nothing. `endpoints.api` is read and exposed for diagnostics but is
+* NEVER used as the base URL: a server-designated base URL is a redirect under
+* another name, and this SDK does not follow provider-controlled redirects
+* (DD-6, Requirements 3.8, 7.8).
+*
+* @module ai-agent-sdk/providers/copilot/exchange
+*/
+/** GitHub's API base, where the token-exchange surface lives. */
+const DEFAULT_GITHUB_API_BASE_URL = "https://api.github.com";
+/** Path of the token-exchange surface. */
+const COPILOT_TOKEN_EXCHANGE_PATH = "/copilot_internal/v2/token";
+/** Marker used in place of a credential value that appeared in a response body. */
+const REDACTED$1 = "[REDACTED]";
+/**
+* Exchange a `GitHub_User_Token` for a `Copilot_Api_Token`.
+*
+* The long-lived credential is NOT consumed: nothing here writes to a store, and
+* the persisted value is left exactly as it was (Requirement 3.4).
+* @param github - the long-lived GitHub user token. Its value never reaches an
+*   error message, and any occurrence of it in a response body is redacted before
+*   the body is retained as a cause (Requirement 13.7).
+* @param options - base URL override, injected fetch, signal, and the read bounds.
+* @returns the short-lived token plus its expiry and the advisory fields.
+* @throws AgentSdkError with `COPILOT_ENDPOINT_ORIGIN_INVALID` or
+*   `COPILOT_REDIRECT_REJECTED`, or {@link CopilotTokenExchangeError} with
+*   `COPILOT_TENANT_UNSUPPORTED`, `COPILOT_CREDENTIAL_REJECTED`,
+*   `COPILOT_TOKEN_EXCHANGE_FAILED` or `COPILOT_TOKEN_MALFORMED`, per the
+*   classification order in the module note.
+*/
+async function exchangeCopilotToken(github, options = {}) {
+	rejectDataResidencyTenant(options.githubApiBaseUrl);
+	const pinned = issuerOf("githubApiBaseUrl", options.githubApiBaseUrl, DEFAULT_GITHUB_API_BASE_URL, options);
+	const url = copilotUrl(pinned, COPILOT_TOKEN_EXCHANGE_PATH);
+	const host = new URL(pinned.origin).hostname;
+	let response;
+	try {
+		response = await copilotFetch({
+			pinned,
+			url,
+			operation: "token exchange",
+			init: {
+				method: "GET",
+				headers: exchangeHeaders(github, options.editorHeaders)
+			}
+		}, options);
+	} catch (error) {
+		throw transportFailure(error, host, options);
+	}
+	const secrets = [github.token, ...options.additionalSecrets ?? []];
+	if (!response.ok) throw await statusFailure(response, host, secrets, options);
+	return readApiToken(await readCopilotResponseText(response, options), secrets);
+}
+/**
+* Row 1: refuse a `*.ghe.com` tenant by domain label, before anything is sent.
+*
+* An unparsable value is left alone rather than reported here — {@link issuerOf}
+* owns that message, and reporting it as a tenant problem would name the wrong
+* cause.
+* @param configured - the caller's `githubApiBaseUrl`, when they set one.
+* @throws CopilotTokenExchangeError with `COPILOT_TENANT_UNSUPPORTED`, naming the
+*   detected domain (Requirement 13.3).
+*/
+function rejectDataResidencyTenant(configured) {
+	if (configured === void 0) return;
+	let host;
+	try {
+		host = new URL(configured).hostname;
+	} catch {
+		return;
+	}
+	if (!isDataResidencyHost(host)) return;
+	throw new CopilotTokenExchangeError(credentialFailure(tenantMessage(host)), COPILOT_ERROR_CODES.TENANT_UNSUPPORTED, "permanent");
+}
+/**
+* Whether a hostname belongs to the `ghe.com` data-residency namespace.
+*
+* Matched on DOMAIN LABELS, which is the whole point: `ghe.com.evil.tld` and
+* `notghe.com` are not data-residency hosts, and a substring test would call both
+* of them one.
+* @param host - a hostname, without a port.
+* @returns true for `ghe.com` itself and for any host under it.
+*/
+function isDataResidencyHost(host) {
+	const normalized = host.toLowerCase().replace(/\.$/, "");
+	return normalized === "ghe.com" || normalized.endsWith(".ghe.com");
+}
+/**
+* Headers for the exchange request.
+*
+* Both editor headers are mandatory: with either one missing the endpoint answers
+* HTTP 400 and the request never runs. An override of one leaves the other at its
+* exported default rather than dropping it.
+* @param github - the credential whose value goes in `Authorization`.
+* @param headers - per-call overrides for the editor identity.
+* @returns the header map for the request init.
+*/
+function exchangeHeaders(github, headers) {
+	return {
+		authorization: `Bearer ${github.token}`,
+		accept: "application/json",
+		"editor-version": headers?.editorVersion ?? "vscode/1.99.0",
+		"editor-plugin-version": headers?.editorPluginVersion ?? "copilot-chat/0.26.0"
+	};
+}
+/**
+* Rows 3 and 7 on the dispatch path: keep the structural refusals, classify the
+* rest as transient.
+*
+* Four kinds of failure pass through UNCHANGED, because wrapping each one would
+* replace a precise diagnosis with a vaguer one:
+*
+* - the origin refusal and the redirect refusal, which are rows 2 and 3 and
+*   already carry their own codes;
+* - a caller abort, which keeps the SDK's abort code rather than becoming a
+*   Copilot failure the caller did not ask about (Requirement 4.6);
+* - a `RangeError` from a bound, which names the limit that was exceeded and is
+*   neither a network fault nor a server fault (Requirement 13.6).
+*
+* Everything else — DNS, connection reset, TLS, and the per-request deadline —
+* is transient: it is exactly the class of failure that a later attempt can win.
+* @param error - the caught value.
+* @param host - the host that was contacted, for the message.
+* @param options - read for the caller's signal only.
+* @returns the value to throw.
+*/
+function transportFailure(error, host, options) {
+	if (options.signal?.aborted === true) return error;
+	if (error instanceof RangeError) return error;
+	if (error instanceof AgentSdkError && (error.code === COPILOT_ERROR_CODES.ENDPOINT_ORIGIN_INVALID || error.code === COPILOT_ERROR_CODES.REDIRECT_REJECTED)) return error;
+	return new CopilotTokenExchangeError(credentialFailure(`Copilot token exchange could not reach ${host}; the request failed before a response`, error), COPILOT_ERROR_CODES.TOKEN_EXCHANGE_FAILED, "transient");
+}
+/**
+* Rows 4 through 8: classify a response that arrived but was not a success.
+*
+* The body is read through the bounded reader first, so the cause carries the
+* endpoint's own words — with every occurrence of the credential replaced —
+* rather than nothing at all (Requirements 13.6, 13.7). A read that fails is not
+* allowed to hide the status: the classification stands either way.
+* @param response - a non-ok response, already cleared by the redirect guard.
+* @param host - the host that answered, for the tenant message.
+* @param secrets - every live credential value to redact out of the body.
+* @param options - the read bounds and the signal.
+* @returns the classified error to throw.
+*/
+async function statusFailure(response, host, secrets, options) {
+	const body = await readFailureBody(response, secrets, options);
+	const cause = body === void 0 ? void 0 : new Error(body);
+	if (response.status === 404) return new CopilotTokenExchangeError(credentialFailure(tenantMessage(host), cause), COPILOT_ERROR_CODES.TENANT_UNSUPPORTED, "permanent");
+	if (response.status === 401) return new CopilotTokenExchangeError(credentialFailure(`the Copilot token-exchange surface rejected the stored GitHub credential (HTTP 401); run \`${COPILOT_LOGIN_COMMAND}\` to sign in again`, cause), COPILOT_ERROR_CODES.CREDENTIAL_REJECTED, "permanent");
+	if (response.status === 403) return new CopilotTokenExchangeError(credentialFailure(`the Copilot token-exchange surface refused this credential type (HTTP 403). It accepts only a token minted by an OAuth App on GitHub's allowlist: a personal access token cannot be used here, and neither can a token from an OAuth App that is not allowlisted. Run \`${COPILOT_LOGIN_COMMAND}\` to sign in with the supported client.`, cause), COPILOT_ERROR_CODES.CREDENTIAL_REJECTED, "permanent");
+	const transient = response.status >= 500 || response.status === 429;
+	return new CopilotTokenExchangeError(credentialFailure(`Copilot token exchange failed (HTTP ${response.status})`, cause), COPILOT_ERROR_CODES.TOKEN_EXCHANGE_FAILED, transient ? "transient" : "permanent");
+}
+/**
+* Read an error body within the configured bounds, redacted, or give up quietly.
+*
+* Giving up quietly is deliberate: the status has already decided the
+* classification, and a body that could not be read must not turn a precise 403
+* into a read error.
+* @param response - the non-ok response.
+* @param secrets - every live credential value to redact.
+* @param options - the read bounds and the signal.
+* @returns the redacted text, or `undefined` when it could not be read.
+*/
+async function readFailureBody(response, secrets, options) {
+	try {
+		const text = await readCopilotResponseText(response, options);
+		return text.length === 0 ? void 0 : redact(text, secrets);
+	} catch {
+		return;
+	}
+}
+/**
+* Row 9: read the success body, requiring exactly what cannot be inferred.
+*
+* `token` and `expires_at` are mandatory; everything else is advisory and a
+* useless value is dropped rather than raised, because a dropped hint changes
+* nothing about correctness while a raised one would fail an exchange that
+* actually produced a usable token.
+* @param raw - the bounded response text.
+* @param secrets - every live credential value to redact out of the cause.
+* @returns the token this exchange produced.
+* @throws CopilotTokenExchangeError with `COPILOT_TOKEN_MALFORMED` when the body
+*   is not a JSON object, `token` is not a non-empty string, or `expires_at` is
+*   not a positive finite number.
+*/
+function readApiToken(raw, secrets) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (error) {
+		throw malformed("the Copilot token-exchange response was not JSON", error);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw malformed("the Copilot token-exchange response was not a JSON object");
+	const body = parsed;
+	const token = body["token"];
+	if (typeof token !== "string" || token.length === 0) throw malformed("the Copilot token-exchange response carried no token");
+	const expiresAt = body["expires_at"];
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || expiresAt <= 0) throw malformed("the Copilot token-exchange response carried no readable expires_at; this SDK does not invent a token lifetime", new Error(redact(raw, secrets)));
+	const refreshIn = body["refresh_in"];
+	const declared = declaredEndpointOf(body["endpoints"]);
+	return Object.freeze({
+		token,
+		expiresAtMs: expiresAt * 1e3,
+		...typeof refreshIn === "number" && Number.isFinite(refreshIn) && refreshIn > 0 ? { refreshInSeconds: refreshIn } : {},
+		...declared === void 0 ? {} : { declaredApiEndpoint: declared }
+	});
+}
+/**
+* Read `endpoints.api` for diagnostics only.
+*
+* Never returned as something to request against — see {@link
+* CopilotApiToken.declaredApiEndpoint} and DD-6.
+* @param endpoints - the `endpoints` member of the response, unvalidated.
+* @returns the declared API endpoint, when it is a non-empty string.
+*/
+function declaredEndpointOf(endpoints) {
+	if (typeof endpoints !== "object" || endpoints === null) return void 0;
+	const api = endpoints["api"];
+	return typeof api === "string" && api.length > 0 ? api : void 0;
+}
+/**
+* The one tenant message, so the two paths that reach row 1 and row 4 say the
+* same thing.
+* @param host - the detected host, named in the message (Requirement 13.3).
+* @returns the message text.
+*/
+function tenantMessage(host) {
+	return `'${host}' is a GitHub data-residency tenant, which does not provide the Copilot token-exchange surface; use a github.com account for this provider`;
+}
+/**
+* Replace every occurrence of every live credential value in text with
+* {@link REDACTED}.
+*
+* A response body is endpoint-authored text, and an endpoint that echoes the
+* `Authorization` header back is exactly how a token ends up in a log. The list
+* is plural because Requirement 13.7 covers BOTH tokens: this request carries one
+* of them, and the other arrives through
+* {@link CopilotExchangeOptions.additionalSecrets}.
+* @param text - the body text.
+* @param secrets - the credential values; empty entries are ignored.
+* @returns the text with every value removed.
+*/
+function redact(text, secrets) {
+	let result = text;
+	for (const secret of secrets) {
+		if (secret.length === 0) continue;
+		result = result.split(secret).join(REDACTED$1);
+	}
+	return result;
+}
+/**
+* Build the row-9 error.
+* @param message - SDK-authored text.
+* @param cause - the caught value or the redacted body, when there is one.
+* @returns the malformed-token error.
+*/
+function malformed(message, cause) {
+	return new CopilotTokenExchangeError(credentialFailure(message, cause), COPILOT_ERROR_CODES.TOKEN_MALFORMED, "permanent");
+}
+/** Provider name recorded on the credential-operation observation by default. */
+const COPILOT_PROVIDER_ID = "copilot";
+/**
+* Build a token cache over one set of exchange settings.
+*
+* ## The mistake this is written to avoid
+*
+* The shared exchange gets its OWN `AbortController` plus its own deadline, and
+* NEVER any single caller's signal. Were the caller's signal handed to it, the
+* first caller to abort would cancel the exchange every other caller is waiting
+* on, and those callers would fail for a reason that has nothing to do with them.
+* Instead each caller — the one that started the exchange included — races the
+* shared promise against its OWN signal: an aborted caller leaves, and the
+* exchange still completes for everyone else (Property 18).
+*
+* The observation therefore counts exchanges actually DISPATCHED rather than
+* callers served, which is what makes the coalescing observable instead of merely
+* claimed (Property 52). It is recorded with the `'refresh'` operation name: that
+* parameter's union is closed at `'resolve' | 'refresh' | 'login'`, widening it
+* would change a public type of `provider-http`, and Requirement 18.4 forbids
+* that — see DD-7.
+*
+* ## Two paths deliberately absent
+*
+* There is no revision-conflict recovery, unlike `provider-codex`. That path
+* exists there because a Codex refresh token rotates and is single-use, so a lost
+* race destroys a credential. A `GitHub_User_Token` does not rotate and an
+* exchange does not consume it, so two racing processes simply exchange twice —
+* and a branch no situation reaches is a branch nothing verifies (DD-8).
+*
+* Nothing here writes to a store. The `Copilot_Api_Token` is never persisted: it
+* lives ~25 minutes, so persisting it would add a second secret on disk, a second
+* write path, and a new state to reason about, to save one request inside a
+* 25-minute window (DD-9, Requirement 3.3).
+*
+* A failure is returned to every waiting caller as-is and never retried here — an
+* endpoint that rejected the credential will reject it again, and this layer has
+* no way to change that (Requirement 5.8, Property 19).
+* @param options - exchange settings, the observation provider name, the margin
+*   and the clock. `options.signal` is deliberately IGNORED for the exchange
+*   itself; per-caller cancellation travels through `operation.signal`.
+* @returns a cache over a single credential slot.
+*/
+function createCopilotTokenCache(options = {}) {
+	const provider = options.providerId ?? "copilot";
+	const now = options.now ?? (() => Date.now());
+	const marginMs = options.marginMs === void 0 ? COPILOT_TOKEN_EXCHANGE_MARGIN_MS : positiveSafeInteger(options.marginMs, "marginMs");
+	let entry;
+	let inflight;
+	let inflightToken;
+	let ticket = 0;
+	return {
+		async acquire(source, operation, context) {
+			operation.signal.throwIfAborted();
+			const github = requireGitHubToken(source.file, source.label);
+			const cached = entry;
+			if (cached !== void 0 && cached.sourceToken === github.token && cached.sourceRevision === source.revision && !shouldExchange(cached.api, now(), marginMs)) return cached.api;
+			if (inflight !== void 0 && inflightToken === github.token) return await raceAbort(inflight, operation.signal);
+			ticket++;
+			const pending = runExchange(ticket);
+			inflight = pending;
+			inflightToken = github.token;
+			return await raceAbort(pending, operation.signal);
+			/**
+			* Dispatch the one shared exchange and record its result.
+			* @param slot - this exchange's ticket, so a later exchange's teardown does
+			*   not clear a newer in-flight one.
+			* @returns the exchanged token.
+			*/
+			async function runExchange(slot) {
+				const held = entry?.api.token;
+				try {
+					const api = await observeCredentialOperation(context, provider, "refresh", () => exchangeCopilotToken(github, {
+						...options,
+						...held === void 0 ? {} : { additionalSecrets: [...options.additionalSecrets ?? [], held] },
+						signal: sharedExchangeSignal(options)
+					}));
+					entry = Object.freeze({
+						api,
+						sourceToken: github.token,
+						sourceRevision: source.revision
+					});
+					return api;
+				} finally {
+					if (ticket === slot) {
+						inflight = void 0;
+						inflightToken = void 0;
+					}
+				}
+			}
+		},
+		invalidate() {
+			entry = void 0;
+		}
+	};
+}
+/**
+* The shared exchange's own cancellation source: one controller, driven by one
+* deadline, and reachable by no caller.
+*
+* The deadline is what makes the controller more than ceremony. `copilotFetch`
+* bounds its own dispatch, but the bounded body read afterwards races only the
+* signal it was given — so without a deadline on this signal a stalled read would
+* hold the in-flight slot open indefinitely and every coalesced caller with it.
+* @param options - read for `requestTimeoutMs`.
+* @returns a signal that aborts on the exchange deadline and on nothing else.
+* @throws RangeError when `requestTimeoutMs` cannot serve as a bound.
+*/
+function sharedExchangeSignal(options) {
+	const controller = new AbortController();
+	const deadline = AbortSignal.timeout(positiveSafeInteger(options.requestTimeoutMs ?? 3e4, "requestTimeoutMs"));
+	deadline.addEventListener("abort", () => {
+		controller.abort(deadline.reason);
+	}, { once: true });
+	return controller.signal;
+}
+
+//#endregion
+//#region src/router.ts
+/**
+* `Copilot_Endpoint_Router`: decide, ONCE per model id, which endpoint a
+* generation request is dispatched to.
+*
+* ## The decision order, and what is deliberately missing from it
+*
+* ```text
+* 1. endpointOverrides[modelId]          ⇒ source 'override'
+* 2. catalog disclosure (via learn())    ⇒ source 'catalog'
+* 3. responses-model prefix allowlist    ⇒ source 'allowlist'
+* 4. /chat/completions                   ⇒ source 'default'
+* ```
+*
+* What is missing is a PROBE. Trying `/responses` to find out whether a model
+* accepts it was rejected (DD-4): a probe is a real request that spends real
+* quota and needs a real prompt, so it has an observable side effect on the
+* user's account purely to answer a metadata question. Its result is not safely
+* cacheable across accounts either, since which models an account may call
+* depends on its plan.
+*
+* ## Why the default is `/chat/completions`
+*
+* The two ways of guessing wrong are ASYMMETRIC:
+*
+* | Guessed wrong | Consequence |
+* | --- | --- |
+* | Model supports `/responses`, we sent `/chat/completions` | works, minus some Responses-specific features |
+* | Model does not support `/responses`, we sent `/responses` | HTTP 400, dead request |
+*
+* Losing a feature is recoverable at the next call; losing the call is not. So
+* the fallback leans to the endpoint every Copilot generation model answers.
+*
+* ## Why `decisions` is append-only
+*
+* Requirement 9.7 asks that the endpoint chosen for a `Logical_Call` hold for
+* that whole call, retries included. The catalog has a TTL and may refresh
+* between two retries, so a router that recomputed could answer `/responses` on
+* the first attempt and `/chat/completions` on the second — one logical call
+* split across two wire protocols, with a serialized body that no longer matches
+* the endpoint it is going to.
+*
+* This module makes that STRUCTURALLY impossible rather than conventionally
+* avoided: once a model id has a decision, no code path rewrites it.
+* {@link CopilotEndpointRouter.learn} only adds keys that have no decision yet,
+* so a later catalog refresh returning different metadata changes nothing.
+*
+* The accepted cost (DD-5): a model misclassified on the first call keeps that
+* classification for the lifetime of the adapter instance. `endpointOverrides`
+* is the instant fix, `--models` is the discovery path, and rebuilding the
+* runtime is the reset. The trade is an invariant with no exceptions instead of
+* an invariant that holds "unless the catalog refreshed".
+*
+* @module ai-agent-sdk/providers/copilot/router
+*/
+/**
+* Model id prefixes dispatched to `/responses` when the catalog says nothing.
+*
+* Exported and overridable for the same reason `COPILOT_EDITOR_VERSION` is: this
+* is a fact about a remote endpoint that WILL go stale, and a user has to be able
+* to correct it without waiting for a release.
+* `CopilotProviderOptions.responsesModelPrefixes` ADDS to this list rather than
+* replacing it, so an override cannot silently drop the prefixes shipped here.
+*
+* Kept deliberately short. A prefix that matches too much pushes models toward
+* the endpoint where guessing wrong costs the request (see the module note), so
+* an absent prefix is the cheaper error.
+*/
+const COPILOT_RESPONSES_MODEL_PREFIXES = Object.freeze(["codex-", "gpt-5"]);
+/** The two endpoints, so an override value can be checked against something. */
+const COPILOT_ENDPOINTS = Object.freeze(["responses", "chat-completions"]);
+/** Protocol id per endpoint, the one place the two are tied together. */
+const PROTOCOL_IDS = Object.freeze({
+	"responses": OPENAI_RESPONSES_PROTOCOL_ID,
+	"chat-completions": OPENAI_CHAT_COMPLETIONS_PROTOCOL_ID
+});
+/**
+* Build a router for one adapter instance.
+*
+* Overrides are validated HERE, not at dispatch: a typo in
+* `endpointOverrides` is a configuration mistake, and a configuration mistake
+* that surfaces while building the provider is cheaper than one that surfaces on
+* the first request to one particular model.
+* @param options - overrides and the merged prefix allowlist.
+* @returns a router whose `decisions` map only ever grows.
+* @throws AgentSdkError with `COPILOT_ENDPOINT_OVERRIDE_INVALID` when an
+*   override pins an endpoint that does not exist.
+*/
+function createCopilotEndpointRouter(options = {}) {
+	const overrides = validateOverrides(options.overrides ?? {});
+	const prefixes = normalizePrefixes(options.prefixes ?? COPILOT_RESPONSES_MODEL_PREFIXES);
+	const decisions = /* @__PURE__ */ new Map();
+	/** Write a decision for a key that has none. The single mutation point. */
+	const record = (modelId, endpoint, source) => {
+		const decision = Object.freeze({
+			model: modelId,
+			endpoint,
+			protocolId: PROTOCOL_IDS[endpoint],
+			source
+		});
+		decisions.set(modelId, decision);
+		return decision;
+	};
+	/**
+	* The decision order for a key with no recorded decision.
+	*
+	* `declared` is `undefined` for {@link CopilotEndpointRouter.decide}, because a
+	* bare dispatch carries no catalog metadata — a disclosure only arrives through
+	* {@link CopilotEndpointRouter.learn}. `undefined` is UNKNOWN, so it falls
+	* through to the allowlist; `'chat-completions'` is a stated fact and stops
+	* there with `source: 'catalog'`.
+	*/
+	const resolve = (modelId, declared) => {
+		const override = overrides[modelId];
+		if (override !== void 0) return record(modelId, override, "override");
+		if (declared !== void 0) return record(modelId, declared, "catalog");
+		if (matchesPrefix(modelId, prefixes)) return record(modelId, "responses", "allowlist");
+		return record(modelId, "chat-completions", "default");
+	};
+	return Object.freeze({
+		decide(modelId) {
+			return decisions.get(modelId) ?? resolve(modelId, void 0);
+		},
+		learn(models) {
+			for (const entry of models) {
+				const modelId = entry.model.id;
+				if (decisions.has(modelId)) continue;
+				resolve(modelId, entry.declaredEndpoint);
+			}
+		},
+		snapshot() {
+			return Object.freeze([...decisions.values()]);
+		}
+	});
+}
+/**
+* Copy the overrides and reject any value that is not an endpoint.
+*
+* A copy rather than the caller's object, so a later mutation of what was passed
+* in cannot introduce an unvalidated endpoint after construction.
+*/
+function validateOverrides(overrides) {
+	const validated = Object.create(null);
+	for (const [modelId, endpoint] of Object.entries(overrides)) {
+		if (!COPILOT_ENDPOINTS.includes(endpoint)) throw new AgentSdkError(`Copilot endpoint override for model '${modelId}' must be one of ${COPILOT_ENDPOINTS.map((value) => `'${value}'`).join(", ")}`, COPILOT_ERROR_CODES.ENDPOINT_OVERRIDE_INVALID);
+		validated[modelId] = endpoint;
+	}
+	return Object.freeze(validated);
+}
+/**
+* Lower-case the prefixes and drop the ones that cannot select anything.
+*
+* An empty string is dropped rather than honoured: as a prefix it matches every
+* model id, which would route the whole catalog to `/responses` — the direction
+* where guessing wrong costs the request. Dropping it leaves the shipped
+* prefixes intact, which is what a caller adding to the list asked for.
+*/
+function normalizePrefixes(prefixes) {
+	const normalized = [];
+	for (const prefix of prefixes) {
+		if (typeof prefix !== "string" || prefix.length === 0) continue;
+		const lower = prefix.toLowerCase();
+		if (!normalized.includes(lower)) normalized.push(lower);
+	}
+	return Object.freeze(normalized);
+}
+/** Case-insensitive prefix match; Copilot model ids are lower-case in practice. */
+function matchesPrefix(modelId, prefixes) {
+	const lower = modelId.toLowerCase();
+	return prefixes.some((prefix) => lower.startsWith(prefix));
+}
+
+//#endregion
+//#region src/adapter.ts
+/**
+* The Copilot provider: the Copilot API surface, authenticated with a GitHub user
+* token this project's own credential store holds.
+*
+* ## Configured, not subclassed
+*
+* `copilotAdapter` is built with `createRuntimeHttpProvider` and extends nothing
+* (Requirement 7.1). Everything Copilot needs beyond a plain API-key provider —
+* a two-tier credential, a token exchange with its own cache, two wire protocols
+* on one route, endpoint-driven discovery — is expressed as DATA:
+* `auth: { kind: 'dynamic' }` for the credential path, a composite protocol for
+* the two endpoints, `discoverModels` for the catalog. That is the point of the
+* exercise: the configuration path is proven by the provider with the most
+* demanding requirements in this repository, not by the simplest one.
+*
+* ## Client identity
+*
+* `COPILOT_EDITOR_VERSION` and `COPILOT_EDITOR_PLUGIN_VERSION` are two of the
+* three `Client_Identity_Constants` in this package; the third is
+* `COPILOT_OAUTH_CLIENT_ID` in `./oauth.ts`. Their defaults make this SDK
+* identify itself AS AN EDITOR CLIENT on every request to the Copilot surface.
+*
+* They are EXPORTED, OVERRIDABLE constants — not hidden values — precisely
+* because of that: presenting as another client is something the caller should be
+* able to read off the source and change without forking, so each one is a named
+* option (`editorHeaders`) with a visible default. Same reason
+* `CODEX_CLIENT_VERSION` is an exported constant in `provider-codex`. All three
+* values will also go stale, which is a second reason to keep them where a caller
+* can reach them.
+*
+* Use your own account, and prefer a provider's official first-party surface for
+* production. The README and the "Client identity" section of the docs carry the
+* full tradeoff.
+*
+* @module ai-agent-sdk/providers/copilot/adapter
+*/
+/** Registry id, provider family, and observation label when the caller sets none. */
+const COPILOT_ROUTE_ID = "copilot";
+/** Display name reported by the adapter and the plugin. */
+const COPILOT_DISPLAY_NAME = "GitHub Copilot";
+/** Never-aborting logger sink for a resolve that arrives without a context. */
+const NULL_LOGGER$1 = Object.freeze({
+	child: () => NULL_LOGGER$1,
+	trace: () => void 0,
+	debug: () => void 0,
+	info: () => void 0,
+	warn: () => void 0,
+	error: () => void 0,
+	fatal: () => void 0
+});
+/** Marker written in place of a token value that appeared in a response body. */
+const REDACTED = "[REDACTED]";
+/**
+* The two transport-owned headers, sent on every request (Requirement 2.3).
+*
+* `content-type` cannot come from the auth layer — `provider-http` owns the name
+* at the transport layer and refuses a second owner — so it is declared here,
+* where it is allowed and where it is visible.
+*/
+const COPILOT_TRANSPORT_HEADERS = Object.freeze({
+	"content-type": "application/json",
+	accept: "text/event-stream"
+});
+/** Bytes read from a non-success response when the caller configures no bound. */
+const DEFAULT_MAX_ERROR_BODY_BYTES = 1048576;
+function copilotAdapter(options) {
+	return buildCopilotAdapter(options, captureCopilotStore(options?.authStore));
+}
+/**
+* The one adapter body, shared by both store variants and by the plugin.
+*
+* Four things are worth reading closely.
+*
+* **`auth.resolve` is the only place a token enters a request.** It reads the
+* store, demands a long-lived token, then asks the cache — which decides on its
+* own whether an exchange is due. `provider-http` calls `resolve` ONCE PER
+* OPERATION (Requirement 7.2), not once per retry, so the number of store reads
+* equals the number of operations and every attempt of one operation carries the
+* credential and the endpoint from a single snapshot.
+*
+* **`requireGitHubToken` runs BEFORE `cache.acquire`.** With no credential the
+* failure is `MISSING_CREDENTIAL` naming the login command, rather than an HTTP
+* error from an exchange that never had anything to exchange (Requirement 13.4).
+*
+* **`x-request-id` is the CLIENT's id, not the server's.** It exists to line up
+* two logs and carries nothing about the user.
+*
+* **`router.learn` only ADDS.** A catalog refresh never rewrites a decision that
+* already exists, which is how Requirement 9.7 holds structurally rather than by
+* convention.
+*
+* Every absent option is spread away instead of passed as `undefined`: a key
+* carrying `undefined` still overrides the runtime's own default, which turns
+* "I did not configure this" into "I configured this to nothing"
+* (Requirement 8.7).
+* @param options - the caller's options, either store variant.
+* @param captured - the already-captured store.
+* @returns the configured adapter.
+*/
+function buildCopilotAdapter(options, captured) {
+	const router = createCopilotEndpointRouter({
+		overrides: options.endpointOverrides ?? {},
+		prefixes: [...COPILOT_RESPONSES_MODEL_PREFIXES, ...options.responsesModelPrefixes ?? []]
+	});
+	const editorHeaders = resolveCopilotEditorHeaders(options.editorHeaders);
+	const secrets = createCopilotSecrets();
+	const catalogLimits = resolveCopilotCatalogLimits(options);
+	const providerId = options.id ?? "copilot";
+	const cache = options.tokenCache ?? createCopilotTokenCache({
+		providerId,
+		editorHeaders,
+		...options.githubApiBaseUrl === void 0 ? {} : { githubApiBaseUrl: options.githubApiBaseUrl },
+		...options.exchangeMarginMs === void 0 ? {} : { marginMs: options.exchangeMarginMs },
+		...options.requestTimeoutMs === void 0 ? {} : { requestTimeoutMs: options.requestTimeoutMs },
+		...options.maxResponseBytes === void 0 ? {} : { maxResponseBytes: options.maxResponseBytes },
+		...options.maxResponseChunks === void 0 ? {} : { maxResponseChunks: options.maxResponseChunks },
+		...options.allowInsecureHttp === void 0 ? {} : { allowInsecureIssuer: options.allowInsecureHttp },
+		...options.fetch === void 0 ? {} : { fetch: options.fetch }
+	});
+	const sessionId = options.dialect?.promptCacheKey ?? randomId();
+	return createRuntimeHttpProvider({
+		displayName: COPILOT_DISPLAY_NAME,
+		protocol: copilotDualProtocol({
+			router,
+			responses: openAiResponsesProtocol,
+			chat: openAiChatCompletionsProtocol,
+			...options.onEndpointDecision === void 0 ? {} : { onDecision: options.onEndpointDecision }
+		}),
+		baseUrl: options.baseUrl ?? "https://api.githubcopilot.com",
+		...options.allowInsecureHttp === void 0 ? {} : { allowInsecureHttp: options.allowInsecureHttp },
+		dialect: {
+			...options.dialect,
+			promptCacheKey: sessionId
+		},
+		auth: {
+			kind: "dynamic",
+			resolve: async ({ signal, context }) => {
+				const operation = {
+					signal,
+					logger: context?.logger ?? NULL_LOGGER$1
+				};
+				const snapshot = await readCopilotSnapshot(captured, operation);
+				const github = requireGitHubToken(snapshot.file, snapshot.label);
+				secrets.remember("github", github.token);
+				const api = await cache.acquire(snapshot, operation, context);
+				secrets.remember("api", api.token);
+				return {
+					authorization: `Bearer ${api.token}`,
+					"editor-version": editorHeaders.editorVersion,
+					"editor-plugin-version": editorHeaders.editorPluginVersion,
+					"x-request-id": randomId()
+				};
+			}
+		},
+		...options.models === void 0 ? { discoverModels: async (context) => {
+			const snapshot = await discoverCopilotModels(context, catalogLimits, options.fetch ?? globalThis.fetch);
+			router.learn(snapshot.generation);
+			return snapshot.generation.map((entry) => entry.model);
+		} } : { models: options.models },
+		...copilotCatalogCacheOptions(options),
+		...options.maxCatalogModels === void 0 ? {} : { maxCatalogModels: options.maxCatalogModels },
+		...options.maxCatalogBytes === void 0 ? {} : { maxCatalogBytes: options.maxCatalogBytes },
+		...options.defaultMaxTokens === void 0 ? {} : { defaultMaxTokens: options.defaultMaxTokens },
+		...options.defaultContextWindow === void 0 ? {} : { defaultContextWindow: options.defaultContextWindow },
+		...transportLimits(options),
+		baseHeaders: COPILOT_TRANSPORT_HEADERS,
+		...options.retryPolicy === void 0 ? {} : { retryPolicy: options.retryPolicy },
+		...options.requestLogger === void 0 ? {} : { requestLogger: options.requestLogger },
+		errorCode: (status, detail) => isMissingEditorHeaderFailure(status, detail) ? COPILOT_ERROR_CODES.EDITOR_HEADERS_MISSING : void 0,
+		fetch: copilotProviderFetch(options, secrets)
+	});
+}
+/**
+* The transactional plugin for installing the Copilot provider.
+*
+* Composition follows `codexPlugin`: `id` defaults to {@link COPILOT_ROUTE_ID},
+* `family` is `'copilot'`, `routes` defaults to `[id]`, and a string
+* `defaultModel` requires exactly one route so the model target's provider can be
+* inferred (Requirements 7.4, 7.5).
+*
+* One difference from Codex: there is no overload per store variant. The
+* compare-and-swap store is the main path here, the read/write variant exists for
+* symmetry, and {@link copilotAdapter} is where it is accepted (Requirement 6.2).
+* The marker is checked at construction rather than at setup so a wrong store is
+* reported while the runtime is being composed, not on the first generation.
+* @param options - the same options {@link copilotAdapter} takes, CAS store only.
+* @returns a composable plugin registering one Copilot adapter.
+* @throws TypeError when `authStore` is not the compare-and-swap variant, or when
+*   a string `defaultModel` is paired with anything but exactly one route.
+*/
+function copilotPlugin(options) {
+	if (!isCredentialStoreInput(options?.authStore)) throw new TypeError("copilotPlugin requires a Copilot credential store (the CAS variant)");
+	const id = options.id ?? "copilot";
+	const routes = Object.freeze([...options.routes ?? [id]]);
+	return defineModelProviderPlugin({
+		id,
+		family: "copilot",
+		displayName: COPILOT_DISPLAY_NAME,
+		routes,
+		...runtimeDefaultModel(options.defaultModel, routes),
+		setup(registrar) {
+			const adapter = buildCopilotAdapter(options, captureCopilotStore(options.authStore));
+			const remove = registrar.registerAdapter(adapter);
+			return () => {
+				remove();
+			};
+		}
+	});
+}
+/**
+* Marker inspection only: no accessor is invoked and no method is captured.
+*
+* Full capture stays deferred to {@link buildCopilotAdapter}, so this check
+* cannot be the thing that runs the caller's code.
+* @param value - the `authStore` as passed in.
+* @returns true when it carries the credential-store marker.
+*/
+function isCredentialStoreInput(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const marker = Object.getOwnPropertyDescriptor(value, "kind");
+	return marker !== void 0 && "value" in marker && marker.value === "credential-store";
+}
+/**
+* Resolve `defaultModel`, demanding one route for the string form.
+*
+* A string names a model but not a provider, and the provider is inferred from
+* the route. With two routes there is no answer, and picking the first would
+* install a default nobody chose (Requirement 7.5).
+* @param value - the caller's default model, when they set one.
+* @param routes - the routes this plugin installs.
+* @returns a one-key spread carrying `defaultModel`, or an empty one.
+* @throws TypeError when a string is paired with anything but exactly one route.
+*/
+function runtimeDefaultModel(value, routes) {
+	if (value === void 0) return {};
+	if (typeof value !== "string") return { defaultModel: value };
+	if (routes.length !== 1) throw new TypeError("A string defaultModel requires exactly one Copilot route");
+	return { defaultModel: Object.freeze({
+		provider: routes[0] ?? "copilot",
+		id: value
+	}) };
+}
+/**
+* Read the credential store once, through whichever variant was captured.
+*
+* The read/write variant has no revisions, so its snapshot revision is `null` —
+* which the token cache compares just as strictly as a real revision, it simply
+* never changes on its own.
+* @param captured - the captured store.
+* @param operation - the calling operation, whose signal bounds the read.
+* @returns the file, its revision and the store label, as one snapshot.
+* @throws AgentSdkError with the SDK's missing-credential code when the store is
+*   empty (Requirement 13.4).
+*/
+async function readCopilotSnapshot(captured, operation) {
+	const record = captured.kind === "versioned" ? await captured.store.read(operation) : {
+		value: await captured.store.read(),
+		revision: null
+	};
+	return Object.freeze({
+		file: requireCopilotFile(record?.value, captured.label),
+		revision: record?.revision ?? null,
+		label: captured.label
+	});
+}
+/**
+* Demand a credential file, reusing the one message that says how to get one.
+*
+* `requireGitHubToken` owns the message and the code for all three shapes of "no
+* credential", so it is asked first. The throw after it is UNREACHABLE — an
+* absent file already failed there — and exists only so the type narrows without
+* a non-null assertion.
+* @param file - the file the store returned, or `undefined` for an empty store.
+* @param label - the store location named in the diagnostic.
+* @returns the file.
+*/
+function requireCopilotFile(file, label) {
+	requireGitHubToken(file, label);
+	if (file === void 0) throw new AgentSdkError(`no GitHub Copilot credentials at ${label}`, MISSING_CREDENTIAL_CODE);
+	return file;
+}
+/** Build the two-slot secret registry. */
+function createCopilotSecrets() {
+	let github = "";
+	let api = "";
+	return {
+		remember(kind, value) {
+			if (value.length === 0) return;
+			if (kind === "github") github = value;
+			else api = value;
+		},
+		redact(text) {
+			let result = text;
+			for (const secret of [github, api]) {
+				if (secret.length === 0) continue;
+				result = result.split(secret).join(REDACTED);
+			}
+			return result;
+		}
+	};
+}
+/**
+* The fetch the provider dispatches through: identical to the injected one,
+* except that an error body is redacted — and, for the one case the endpoint is
+* known to be unhelpful about, explained — before anything retains it.
+*
+* Why here and not in an error mapper: `provider-http` puts the raw error body
+* into the failure's `cause`, and by the time a mapper sees it the text is
+* already retained. Redacting at the transport is the only point that runs BEFORE
+* that, and an endpoint echoing the `Authorization` header back in an error body
+* is something that has actually happened (Requirement 13.7).
+*
+* What is deliberately NOT touched:
+*
+* - **Successful responses.** The body is a live SSE stream and must reach the
+*   pipeline unread and unwrapped.
+* - **Redirects, in every shape.** Rebuilding a `Response` loses `type`,
+*   `redirected` and `url` — the three signals the transport's redirect guard
+*   reads — so anything that is not a 4xx/5xx passes through untouched and the
+*   guard still sees the original (Requirement 7.8).
+* @param options - read for the injected fetch and the error-body bound.
+* @param secrets - the live token values to redact.
+* @returns a fetch implementation to hand to the runtime provider.
+*/
+function copilotProviderFetch(options, secrets) {
+	const inner = options.fetch ?? globalThis.fetch;
+	const maxBytes = options.maxErrorBodyBytes ?? DEFAULT_MAX_ERROR_BODY_BYTES;
+	return async (...args) => {
+		const response = await inner(...args);
+		if (response.status < 400 || response.type === "opaqueredirect" || response.redirected) return response;
+		let raw;
+		try {
+			raw = await readErrorBody(response, maxBytes);
+		} catch {
+			return response;
+		}
+		const redacted = secrets.redact(raw);
+		const body = isMissingEditorHeaderFailure(response.status, redacted) ? editorHeaderDiagnostic(redacted) : redacted;
+		const headers = new Headers(response.headers);
+		headers.delete("content-length");
+		return new Response(body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	};
+}
+/**
+* Read an error body up to a byte bound, marking a truncation rather than hiding it.
+* @param response - the non-success response.
+* @param maxBytes - the configured bound (Requirement 13.6).
+* @returns the decoded text, truncated with a note when it hit the bound.
+*/
+async function readErrorBody(response, maxBytes) {
+	if (response.body === null) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let bytes = 0;
+	let text = "";
+	try {
+		while (true) {
+			const next = await reader.read();
+			if (next.done) return text + decoder.decode();
+			if (next.value === void 0) continue;
+			const remaining = maxBytes - bytes;
+			if (remaining <= 0 || next.value.byteLength > remaining) {
+				const kept = remaining <= 0 ? void 0 : next.value.subarray(0, remaining);
+				const partial = kept === void 0 ? "" : decoder.decode(kept, { stream: true });
+				await reader.cancel().catch(() => void 0);
+				return `${text}${partial}${decoder.decode()}\n[error body truncated at ${maxBytes} bytes]`;
+			}
+			bytes += next.value.byteLength;
+			text += decoder.decode(next.value, { stream: true });
+		}
+	} finally {
+		reader.releaseLock();
+	}
+}
+/**
+* Whether a failure looks like the endpoint refusing a request for a missing
+* editor header.
+*
+* Matched BROADLY on purpose. The endpoint's wording is not a contract — it is
+* one sentence that can be rephrased at any time — so this looks for the header
+* names in any plausible spelling, or for the word "editor" beside a complaint
+* about a header. It is also bounded to status 400: a 400 that says nothing about
+* editors keeps `REQUEST_INVALID` from the shared mapping rather than being
+* relabelled into a Copilot-specific failure it is not (Requirement 2.5).
+* @param status - the response status.
+* @param detail - the provider's error text, joined by the shared parser.
+* @returns true when the missing-header diagnosis is warranted.
+*/
+function isMissingEditorHeaderFailure(status, detail) {
+	if (status !== 400) return false;
+	if (/editor[\s_-]*(?:plugin[\s_-]*)?version/i.test(detail)) return true;
+	return /\beditor\b/i.test(detail) && /(missing|required|absent|invalid|unsupported|unrecogni[sz]ed|header)/i.test(detail);
+}
+/**
+* Wrap the endpoint's 400 in a body that names both headers and how to set them.
+*
+* The endpoint's own text is kept beside it rather than replaced: it is the
+* evidence, and the shared classifier reads it too.
+* @param endpointText - the endpoint's error body, already redacted.
+* @returns a JSON error body carrying the SDK-authored diagnosis.
+*/
+function editorHeaderDiagnostic(endpointText) {
+	return JSON.stringify({ error: {
+		code: COPILOT_ERROR_CODES.EDITOR_HEADERS_MISSING,
+		message: `the Copilot endpoint rejected this request for a missing or unaccepted editor header. Both \`Editor-Version\` and \`Editor-Plugin-Version\` are mandatory; configure them with the \`editorHeaders\` option (\`editorVersion\`, \`editorPluginVersion\`), whose defaults are the exported COPILOT_EDITOR_VERSION and COPILOT_EDITOR_PLUGIN_VERSION constants. The endpoint said: ${endpointText}`
+	} });
+}
+/**
+* Forward every transport bound the caller set, and only those.
+* @param options - the caller's options.
+* @returns an object carrying the configured transport limits.
+*/
+function transportLimits(options) {
+	return {
+		...options.streamIdleTimeoutMs === void 0 ? {} : { streamIdleTimeoutMs: options.streamIdleTimeoutMs },
+		...options.requestTimeoutMs === void 0 ? {} : { requestTimeoutMs: options.requestTimeoutMs },
+		...options.maxRequestBytes === void 0 ? {} : { maxRequestBytes: options.maxRequestBytes },
+		...options.maxResponseBytes === void 0 ? {} : { maxResponseBytes: options.maxResponseBytes },
+		...options.maxResponseChunks === void 0 ? {} : { maxResponseChunks: options.maxResponseChunks },
+		...options.maxSseEvents === void 0 ? {} : { maxSseEvents: options.maxSseEvents },
+		...options.maxSseEventChars === void 0 ? {} : { maxSseEventChars: options.maxSseEventChars },
+		...options.maxErrorBodyBytes === void 0 ? {} : { maxErrorBodyBytes: options.maxErrorBodyBytes },
+		...options.requestLoggerTimeoutMs === void 0 ? {} : { requestLoggerTimeoutMs: options.requestLoggerTimeoutMs }
+	};
+}
+/** A client-side correlation id; carries nothing about the account or the prompt. */
+function randomId() {
+	return globalThis.crypto?.randomUUID?.() ?? `sdk-${Date.now().toString(36)}`;
+}
+
+//#endregion
+//#region src/oauth.ts
+/** GitHub's OAuth issuer. */
+const DEFAULT_COPILOT_OAUTH_ISSUER = "https://github.com";
+/**
+* Default OAuth client id. Public, not a secret.
+*
+* This is the client id published in GitHub's own editor-plugin sources (the
+* value `copilot.vim` and the other Copilot editor integrations ship in the
+* clear), which is why it is on the allowlist that
+* `copilot_internal/v2/token` checks. Sending it means this SDK signs in AS that
+* editor client. See the module note for why that makes it a named option
+* instead of a hidden constant.
+*
+* ⚠ UNVERIFIED against a live account. Recorded 2026-09-10 from public editor
+* integration sources only; no sign-in against a real Copilot account has
+* confirmed THIS client id.
+*
+* The 2026-09-10 live run that confirmed the two editor headers did NOT confirm
+* this value, and could not: it was handed an existing `ghu_` user-to-server token
+* out of band, so it exercised the EXCHANGE (which answered 200 for that token)
+* while never running the device flow that would put this `client_id` on the wire.
+* What that run does establish is the shape of the claim still outstanding — the
+* exchange endpoint and the allowlist check are live and reachable, and the only
+* untested link is whether they accept a token minted by this particular app.
+*
+* TODO(copilot-identity): confirm on a real Copilot account, then replace this
+* warning with the confirmation date. To confirm: run the device flow against
+* `https://github.com/login/device/code` with this `client_id` and
+* `scope=read:user`, approve it on a Copilot-enabled account, then exchange the
+* resulting user token at `GET https://api.github.com/copilot_internal/v2/token`.
+* The client id is confirmed when that exchange returns a Copilot token rather
+* than 401/403. A non-allowlisted client id fails at the exchange, not at
+* sign-in, so the device flow succeeding on its own proves nothing — and equally,
+* an exchange that succeeds for a token this flow did not mint proves nothing
+* about this constant.
+*/
+const COPILOT_OAUTH_CLIENT_ID = "Iv1.b507a08c87ecfe98";
+/** Requested scope; enough to exchange a token and read identity, no more. */
+const COPILOT_OAUTH_SCOPE = "read:user";
+/**
+* The absolute ceiling on one device login, INDEPENDENT of the server's
+* `expires_in`.
+*
+* `expires_in` is honoured when it is shorter — there is no point polling a code
+* the server has already retired. It is not honoured when it is longer: a server
+* that answers `expires_in: 86400` would otherwise hang a CLI for a day, and this
+* SDK is not the right place to hold that terminal hostage (Requirement 4.3).
+*/
+const COPILOT_DEVICE_CODE_MAX_WAIT_MS = 9e5;
+/** Poll interval used when the device-code response states none. */
+const COPILOT_DEFAULT_POLL_INTERVAL_SECONDS = 5;
+/**
+* Seconds added on every `slow_down`, per RFC 8628 §3.5.
+*
+* The increment is what makes the wait STRICTLY increase even when the server
+* repeats `slow_down` without a new `interval`. Without it, a server that only
+* ever says "slow down" would be polled at exactly the rate it just objected to.
+*/
+const COPILOT_SLOW_DOWN_INCREMENT_SECONDS = 5;
+/**
+* The warning shown beside the user code, worded exactly as the Codex device
+* prompt words it.
+*
+* A device code is a bearer of authorization that the user types into a page they
+* navigated to themselves. The one attack that works is getting somebody to type
+* an attacker's code, so the prompt has to say so; and it lives here rather than
+* in the CLI so every front end that renders a Copilot prompt renders the same
+* sentence.
+*/
+const COPILOT_DEVICE_LOGIN_WARNING = "Only continue if YOU started this login. If someone sent you this code, stop.";
+/** GitHub's device-authorization leg. */
+const DEVICE_CODE_PATH = "/login/device/code";
+/** GitHub's device-token leg. */
+const DEVICE_TOKEN_PATH = "/login/oauth/access_token";
+/** The device-code grant type, spelled as RFC 8628 requires. */
+const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** The command that produces a credential, named when a login ends without one. */
+const COPILOT_LOGIN_COMMAND$1 = "npm run provider:copilot:login-device";
+const NEVER_ABORTED_SIGNAL = new AbortController().signal;
+const NULL_LOGGER = Object.freeze({
+	child: () => NULL_LOGGER,
+	trace: () => void 0,
+	debug: () => void 0,
+	info: () => void 0,
+	warn: () => void 0,
+	error: () => void 0,
+	fatal: () => void 0
+});
+/** The real scheduler: `setTimeout`, `clearTimeout` and `Date.now`. */
+const DEFAULT_COPILOT_TIMER = Object.freeze({
+	setTimeout: (handler, ms) => setTimeout(handler, ms),
+	clearTimeout: (handle) => clearTimeout(handle),
+	now: () => Date.now()
+});
+/**
+* Start a device authorization.
+*
+* `Accept: application/json` is set here as well as on the token leg. It is
+* load-bearing on the token leg (see {@link pollForCopilotToken}) and harmless
+* here, and setting it on both keeps the pair from drifting into "one of the two
+* legs parses JSON".
+* @param options - issuer, client id, scope, cancellation and read bounds.
+* @returns the code, the URL and the timings to show the user.
+* @throws CopilotDeviceLoginError with `reason: 'aborted'` when the caller's
+*   signal aborts, or `reason: 'failed'` when the endpoint answers with anything
+*   other than a usable device authorization.
+*/
+async function requestCopilotDeviceCode(options = {}) {
+	const pinned = issuerOf("oauthIssuer", options.oauthIssuer, DEFAULT_COPILOT_OAUTH_ISSUER, options);
+	const body = await deviceJson({
+		pinned,
+		url: copilotUrl(pinned, DEVICE_CODE_PATH),
+		operation: "device code",
+		init: {
+			method: "POST",
+			headers: {
+				accept: "application/json",
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				client_id: options.clientId ?? "Iv1.b507a08c87ecfe98",
+				scope: options.scope ?? "read:user"
+			})
+		}
+	}, "the device-code endpoint", options);
+	if (!body.ok) throw deviceFailure(`the device-code endpoint failed (HTTP ${body.status})`, "failed", body.parseError);
+	return Object.freeze({
+		verificationUrl: verificationUrlOf(body.json, options),
+		userCode: requireDeviceString(body.json, "user_code"),
+		deviceCode: requireDeviceString(body.json, "device_code"),
+		intervalSeconds: positiveSecondsOf(body.json.interval, 5),
+		expiresInSeconds: positiveSecondsOf(body.json.expires_in, COPILOT_DEVICE_CODE_MAX_WAIT_MS / 1e3)
+	});
+}
+async function runCopilotDeviceLogin(store, options = {}, progress = {}) {
+	const captured = captureCopilotStore(store);
+	const operation = {
+		signal: options.signal ?? NEVER_ABORTED_SIGNAL,
+		logger: NULL_LOGGER
+	};
+	const initial = await readStore(captured, operation);
+	const code = await requestCopilotDeviceCode(options);
+	notify(() => progress.onPrompt?.(code));
+	const token = await pollForCopilotToken(code, options, progress);
+	await commitStore(captured, {
+		version: 1,
+		github: {
+			token: token.accessToken,
+			...token.tokenType === void 0 ? {} : { tokenType: token.tokenType },
+			...token.scope === void 0 ? {} : { scope: token.scope }
+		},
+		...token.account === void 0 ? {} : { account: token.account },
+		clientId: options.clientId ?? "Iv1.b507a08c87ecfe98",
+		obtainedAt: new Date(timerOf(options).now()).toISOString()
+	}, initial.revision, operation);
+	return Object.freeze({
+		location: captured.label,
+		login: token.account?.login,
+		accountId: token.account?.id,
+		scope: token.scope
+	});
+}
+/**
+* Poll the token leg until the user approves, the server refuses, or a bound
+* passes.
+*
+* Two things make this loop different from the Codex one, and both are easy to
+* get wrong:
+*
+* - **`Accept: application/json` is mandatory.** Without it GitHub's token
+*   endpoint answers FORM-ENCODED, so a JSON parser meets
+*   `error=authorization_pending&interval=10` and throws — which turns the "not
+*   approved yet" branch into a hard-failure branch, and the flow can then never
+*   succeed at all.
+* - **The error channel is HTTP 200 with `error` in the body.** Codex surfaces
+*   "pending" as 403/404; GitHub surfaces it as a 200. So classification reads the
+*   BODY FIRST and the status second. A status-first reader treats every pending
+*   poll as a success and then fails looking for `access_token`.
+* @param code - the pending authorization.
+* @param options - issuer, client id, bounds and the injectable timer.
+* @param progress - poll notifications.
+* @returns the access token and whatever the endpoint disclosed beside it.
+*/
+async function pollForCopilotToken(code, options, progress) {
+	const pinned = issuerOf("oauthIssuer", options.oauthIssuer, DEFAULT_COPILOT_OAUTH_ISSUER, options);
+	const url = copilotUrl(pinned, DEVICE_TOKEN_PATH);
+	const timer = timerOf(options);
+	const startedAt = timer.now();
+	const deadlineAt = startedAt + Math.min(COPILOT_DEVICE_CODE_MAX_WAIT_MS, code.expiresInSeconds * 1e3);
+	let intervalSeconds = code.intervalSeconds;
+	while (true) {
+		throwIfAborted(options.signal);
+		if (timer.now() >= deadlineAt) throw deviceTimeout(startedAt, timer.now());
+		notify(() => progress.onPoll?.(timer.now() - startedAt, intervalSeconds));
+		const body = await deviceJson({
+			pinned,
+			url,
+			operation: "device token",
+			init: {
+				method: "POST",
+				headers: {
+					accept: "application/json",
+					"content-type": "application/json"
+				},
+				body: JSON.stringify({
+					client_id: options.clientId ?? "Iv1.b507a08c87ecfe98",
+					device_code: code.deviceCode,
+					grant_type: DEVICE_GRANT_TYPE
+				})
+			}
+		}, "the device-token endpoint", options);
+		const error = typeof body.json.error === "string" ? body.json.error : void 0;
+		if (error === "authorization_pending" || error === "slow_down") {
+			intervalSeconds = nextIntervalSeconds(intervalSeconds, body.json.interval, error);
+			const remaining = deadlineAt - timer.now();
+			if (remaining <= 0) throw deviceTimeout(startedAt, timer.now());
+			await sleep(Math.min(intervalSeconds * 1e3, remaining), options.signal, timer);
+			continue;
+		}
+		if (error === "access_denied") throw deviceFailure(`the device login was denied on GitHub; run \`${COPILOT_LOGIN_COMMAND$1}\` again if you did mean to approve it`, "denied");
+		if (error === "expired_token") throw deviceFailure(`the device code expired before it was approved; run \`${COPILOT_LOGIN_COMMAND$1}\` again to request a new code`, "expired");
+		if (error !== void 0) throw deviceFailure(`the device-token endpoint refused the request (${error}, HTTP ${body.status})`, "failed");
+		if (!body.ok) throw deviceFailure(`the device-token endpoint failed (HTTP ${body.status})`, "failed", body.parseError);
+		return Object.freeze({
+			accessToken: requireDeviceString(body.json, "access_token"),
+			tokenType: optionalString(body.json.token_type),
+			scope: optionalString(body.json.scope),
+			account: accountIdentityOf(body.json)
+		});
+	}
+}
+/**
+* The effective wait after a `slow_down`, which must STRICTLY increase.
+*
+* `max(current, server-requested, current + 5)` — the third term is what keeps
+* the sequence increasing when the server sends no new `interval`, and taking the
+* max of all three keeps it from ever decreasing when the server sends a smaller
+* one. `authorization_pending` may carry a new interval too; there it is honoured
+* without the increment, so an ordinary pending poll does not back off forever.
+*/
+function nextIntervalSeconds(current, requested, error) {
+	const server = positiveSecondsOf(requested, 0);
+	return error === "slow_down" ? Math.max(current, server, current + 5) : Math.max(current, server);
+}
+/**
+* Wait `ms`, losing the race to `signal` the instant it aborts.
+*
+* The timer is injected rather than closed over, so a test can drive the poll
+* loop through fifteen virtual minutes in a millisecond. Aborting rejects instead
+* of resolving early, because a caller who pressed Ctrl-C wants the flow to END,
+* not to take one more turn round the loop.
+*/
+function sleep(ms, signal, timer) {
+	if (signal?.aborted === true) return Promise.reject(deviceAborted());
+	return new Promise((resolve, reject) => {
+		const onAbort = () => {
+			timer.clearTimeout(handle);
+			reject(deviceAborted());
+		};
+		const handle = timer.setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/**
+* Dispatch one OAuth leg and read its body within the configured bounds.
+*
+* A body that is not a JSON object yields an EMPTY object plus `parseError`
+* rather than throwing: the status still has to be classified, and on the token
+* leg an unreadable body is one of the shapes a misconfigured `Accept` header
+* produces. Callers therefore always get to the body-first branch, and reach a
+* hard failure only after it finds no `error`.
+*/
+async function deviceJson(request, what, options) {
+	let response;
+	try {
+		response = await copilotFetch(request, options);
+	} catch (error) {
+		throwIfAborted(options.signal);
+		throw error instanceof CopilotDeviceLoginError ? error : deviceFailure(`${what} could not be reached`, "failed", error);
+	}
+	let raw;
+	try {
+		raw = await readCopilotResponseText(response, options);
+	} catch (error) {
+		throwIfAborted(options.signal);
+		throw deviceFailure(`${what} returned a response beyond the configured limits`, "failed", error);
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new TypeError(`${what} returned JSON that is not an object`);
+		return {
+			ok: response.ok,
+			status: response.status,
+			json: parsed,
+			parseError: void 0
+		};
+	} catch (error) {
+		return {
+			ok: response.ok,
+			status: response.status,
+			json: {},
+			parseError: error
+		};
+	}
+}
+/**
+* Read the verification URL the user is told to open.
+*
+* Only the SCHEME is constrained, not the origin. This SDK never fetches this
+* URL — it prints it — and GitHub Enterprise deployments legitimately answer with
+* a host other than the issuer, so an origin pin here would reject working
+* installations to guard a request that is never made. The scheme check remains
+* because a `javascript:` or `data:` URL handed to a browser opener is a real
+* problem, and {@link COPILOT_DEVICE_LOGIN_WARNING} covers the rest.
+*/
+function verificationUrlOf(body, options) {
+	const raw = requireDeviceString(body, "verification_uri");
+	let url;
+	try {
+		url = new URL(raw);
+	} catch (error) {
+		throw deviceFailure("the device-code endpoint returned an unusable verification URL", "failed", error);
+	}
+	if (url.protocol !== "https:" && !(options.allowInsecureIssuer === true && url.protocol === "http:")) throw deviceFailure("the device-code verification URL must use https", "failed");
+	return url.href;
+}
+/** Identity fields, present only when the endpoint disclosed them (Property 16). */
+function accountIdentityOf(body) {
+	const login = optionalString(body.login);
+	const name = optionalString(body.name);
+	const id = typeof body.id === "number" && Number.isFinite(body.id) ? body.id : void 0;
+	if (login === void 0 && name === void 0 && id === void 0) return void 0;
+	return Object.freeze({
+		...login === void 0 ? {} : { login },
+		...name === void 0 ? {} : { name },
+		...id === void 0 ? {} : { id }
+	});
+}
+function optionalString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function requireDeviceString(body, key) {
+	const value = body[key];
+	if (typeof value !== "string" || value.length === 0) throw deviceFailure(`the device flow response omitted "${key}"`, "failed");
+	return value;
+}
+/**
+* Read a seconds value that the endpoint may send as a number, as a numeric
+* string, or not at all.
+*
+* GitHub has been observed sending `interval` as a string, so both forms are
+* accepted; anything unparsable falls back rather than failing the login, because
+* a bad hint about pacing is not a reason to refuse a working authorization.
+*/
+function positiveSecondsOf(value, fallbackSeconds) {
+	const parsed = typeof value === "number" ? value : typeof value === "string" ? Number.parseInt(value.trim(), 10) : NaN;
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds;
+}
+function timerOf(options) {
+	return options.timer ?? DEFAULT_COPILOT_TIMER;
+}
+/** Run a progress observer; observers do not own authentication. */
+function notify(report) {
+	try {
+		report();
+	} catch {}
+}
+function throwIfAborted(signal) {
+	if (signal?.aborted === true) throw deviceAborted();
+}
+function deviceAborted() {
+	return deviceFailure("the device login was cancelled", "aborted");
+}
+function deviceTimeout(startedAt, now) {
+	return deviceFailure(`the device login was not approved within ${Math.round((now - startedAt) / 1e3)}s (bound: ${COPILOT_DEVICE_CODE_MAX_WAIT_MS / 6e4} minutes); run \`${COPILOT_LOGIN_COMMAND$1}\` again`, "timeout");
+}
+function deviceFailure(message, reason, cause) {
+	return new CopilotDeviceLoginError(credentialFailure(message, cause), reason);
+}
+async function readStore(captured, operation) {
+	if (captured.kind === "versioned") {
+		const record = await captured.store.read(operation);
+		return record === void 0 ? {
+			file: void 0,
+			revision: null
+		} : {
+			file: record.value,
+			revision: record.revision
+		};
+	}
+	return {
+		file: await captured.store.read(),
+		revision: null
+	};
+}
+async function commitStore(captured, file, expectedRevision, operation) {
+	if (captured.kind === "versioned") {
+		await captured.store.commit({
+			value: file,
+			expectedRevision
+		}, operation);
+		return;
+	}
+	await captured.store.write(file);
+}
+
+//#endregion
+export { COPILOT_BASE_URL, COPILOT_CATALOG_PATH, COPILOT_DEFAULT_CATALOG_TIMEOUT_MS, COPILOT_DEFAULT_DIALECT, COPILOT_DEFAULT_MAX_CATALOG_BYTES, COPILOT_DEFAULT_MAX_CATALOG_CHUNKS, COPILOT_DEFAULT_MAX_CATALOG_MODELS, COPILOT_DEFAULT_POLL_INTERVAL_SECONDS, COPILOT_DEVICE_CODE_MAX_WAIT_MS, COPILOT_DEVICE_LOGIN_WARNING, COPILOT_DISPLAY_NAME, COPILOT_DUAL_PROTOCOL_ID, COPILOT_EDITOR_PLUGIN_VERSION, COPILOT_EDITOR_VERSION, COPILOT_ERROR_CODES, COPILOT_LOGIN_COMMAND, COPILOT_OAUTH_CLIENT_ID, COPILOT_OAUTH_SCOPE, COPILOT_PROVIDER_ID, COPILOT_RESPONSES_MODEL_PREFIXES, COPILOT_ROUTE_ID, COPILOT_SLOW_DOWN_INCREMENT_SECONDS, COPILOT_TOKEN_EXCHANGE_MARGIN_MS, COPILOT_TOKEN_EXCHANGE_PATH, CopilotDeviceLoginError, CopilotTokenExchangeError, DEFAULT_COPILOT_OAUTH_ISSUER, DEFAULT_COPILOT_TIMER, DEFAULT_GITHUB_API_BASE_URL, copilotAdapter, copilotCatalogCacheOptions, copilotDualProtocol, copilotPlugin, createCopilotEndpointRouter, createCopilotTokenCache, credentialFailure, discoverCopilotModels, exchangeCopilotToken, memoryCopilotAuthStore, memoryCopilotCredentialStore, partitionCopilotCatalog, requestCopilotDeviceCode, requireGitHubToken, resolveCopilotCatalogLimits, runCopilotDeviceLogin, shouldExchange, toChatCompletionsDialect, toResponsesDialect };
+//# sourceMappingURL=index.js.map