@bastani/atomic 0.9.10 → 0.9.11-alpha.10

package/dist/cli/credential-print.js

@@ -0,0 +1,513 @@
+/**
+ * `atomic auth print-api-key` / `atomic auth print-bearer-token`.
+ *
+ * The only door in Atomic whose purpose is emitting a secret. Everything here
+ * exists to keep that egress narrow:
+ *
+ * - the secret leaves as a `Secret`, which cannot be interpolated, serialized,
+ *   or inspected, and is consumed exactly once by the stdout writer;
+ * - `--model` is required, so no ambient "current model" can emit a credential
+ *   the caller did not name;
+ * - there is no `--output <file>` and no clipboard path — stdout only;
+ * - every failure is a distinct exit code, and stdout stays empty on all of
+ *   them but one — `CredentialTruncated` (exit 9) exists to report the case
+ *   where it cannot be, because bytes already left and cannot be recalled;
+ * - a failed OAuth refresh never mutates the stored credential.
+ *
+ * One residual, and it is upstream: when a model infers several eligible
+ * providers, each is asked for its credential before the ambiguity is known, so
+ * a *successful* refresh can rotate and persist a credential this command then
+ * declines to emit (exit 3). See the note on the `getAuth()` call in the
+ * candidate loop.
+ */
+import { inspect } from "node:util";
+import { ModelsError } from "@earendil-works/pi-ai";
+import { APP_NAME } from "../config.js";
+import { resolveCliModel } from "../core/model-resolver.js";
+import { flushRawStdout, RawStdoutWriteError, writeRawStdoutOnce } from "../core/output-guard.js";
+/** Bearer tokens are refreshed unless they still have this much life left. */
+export const DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;
+/**
+ * Exported so a test can walk the whole taxonomy: every declared code has to
+ * name an exercised path, and the record type makes a new member without an
+ * exit code a compile error rather than a review miss.
+ *
+ * Every one of these leaves stdout empty except `CredentialTruncated`, which
+ * exists to report the one case where it cannot be: bytes already went out and
+ * cannot be recalled. `STDOUT_EMPTY_ON_EXIT` names that split so the taxonomy
+ * test asserts it rather than assuming it.
+ */
+export const EXIT_CODES = {
+    Usage: 1,
+    NoCredentialConfigured: 2,
+    ProviderAmbiguous: 3,
+    KindUnsupportedForProvider: 4,
+    RefreshFailed: 5,
+    MinValidityUnreachable: 6,
+    OAuthUnavailable: 7,
+    CredentialNotEmitted: 8,
+    CredentialTruncated: 9,
+};
+/** The codes whose contract is an empty stdout. See `EXIT_CODES`. */
+export const STDOUT_EMPTY_ON_EXIT = new Set(Object.keys(EXIT_CODES).filter((code) => code !== "CredentialTruncated"));
+export class CredentialPrintError extends Error {
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = "CredentialPrintError";
+        this.code = code;
+        this.exitCode = EXIT_CODES[code];
+    }
+}
+/**
+ * A credential in transit.
+ *
+ * Every path that would copy the value into a string is closed: `toString`,
+ * `toJSON`, and `Symbol.toPrimitive` throw rather than return, so a template
+ * literal, `JSON.stringify`, or string concatenation fails loudly instead of
+ * leaking into a log line, a transcript, or an error message. `inspect` — which
+ * `console.log` and Node's error formatting use — renders a placeholder.
+ *
+ * `take()` is the single exit, and it works once.
+ */
+export class Secret {
+    #value;
+    constructor(value) {
+        this.#value = value;
+    }
+    /** Consume the secret. A second call is a bug, not a second read. */
+    take() {
+        const value = this.#value;
+        if (value === undefined) {
+            throw new Error("Secret has already been consumed");
+        }
+        this.#value = undefined;
+        return value;
+    }
+    toString() {
+        throw new Error("A Secret cannot be converted to a string; use take()");
+    }
+    toJSON() {
+        throw new Error("A Secret cannot be serialized; use take()");
+    }
+    [Symbol.toPrimitive]() {
+        throw new Error("A Secret cannot be interpolated; use take()");
+    }
+    [inspect.custom]() {
+        return "[Secret]";
+    }
+}
+/**
+ * The single credential egress in `src`.
+ *
+ * `Secret.take()` is called here and nowhere else in the source tree, so this
+ * is the one statement that can turn a configured credential back into a string
+ * and the one that hands it to the real stdout. A caller — `main.ts` included —
+ * receives a `Secret` it cannot read, print, or serialize, so a second export
+ * path cannot be grafted on without moving this function.
+ *
+ * A failed payload write is answered from the stream rather than from the shape
+ * of the error, because `bytesWritten` says how much of the credential actually
+ * left and the right report differs for each amount.
+ *
+ * Nothing left — the write call threw, or the callback failed with the counter
+ * unmoved — is `CredentialNotEmitted` (exit 8) with stdout provably empty,
+ * which is what that exit promises. It must not fall through to the caller's
+ * credential-resolution catch, which would report exit 2.
+ *
+ * All of it left and the failure came after: the caller holds the credential it
+ * asked for, so this is reported on stderr with the exit code left at 0, for
+ * the same reason the trailing drain is. A non-zero exit over a stream carrying
+ * a whole credential is the thing this door never produces.
+ *
+ * Part of it left is neither. Those bytes cannot be recalled, so stdout is not
+ * empty and cannot be made empty; but they are a fragment, not a credential,
+ * and reporting success over them would hand a caller a truncated secret it
+ * cannot tell from a whole one. That case gets `CredentialTruncated` (exit 9),
+ * the one code in this taxonomy whose contract is *not* an empty stdout —
+ * stated as such in `EXIT_CODES` and asserted through `STDOUT_EMPTY_ON_EXIT`,
+ * rather than left for a caller to discover.
+ *
+ * `test/credential-print.test.ts` asserts that chokepoint against the whole of
+ * `packages/coding-agent/src`.
+ */
+export async function emitCredential(secret) {
+    // take() returns a plain string; the Secret itself is never interpolated.
+    const payload = `${secret.take()}\n`;
+    try {
+        await writeRawStdoutOnce(payload);
+    }
+    catch (error) {
+        if (error instanceof RawStdoutWriteError && error.emitted === "all") {
+            // The caller holds the whole credential. Exiting non-zero here would be
+            // a non-zero exit over a stream carrying it, which this door never does.
+            console.error(`Warning: the credential reached stdout but the write did not complete cleanly: ${error.message}`);
+            return;
+        }
+        if (error instanceof RawStdoutWriteError && error.emitted === "partial") {
+            throw new CredentialPrintError("CredentialTruncated", "Only part of the credential reached stdout; discard the output, it is not a usable credential", { cause: error });
+        }
+        throw new CredentialPrintError("CredentialNotEmitted", "Failed to write the credential to stdout; nothing was emitted", { cause: error });
+    }
+    try {
+        await flushRawStdout();
+    }
+    catch (error) {
+        console.error(`Warning: the credential was written to stdout but the stream did not drain cleanly: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * The single place a thrown value becomes an exit code for this door.
+ *
+ * `main.ts` routes every failure through here. Every code it can produce leaves
+ * stdout empty, so an exit code from this door never contradicts the stream.
+ */
+export function toCredentialPrintError(error) {
+    if (error instanceof CredentialPrintError)
+        return error;
+    return new CredentialPrintError("NoCredentialConfigured", error instanceof Error ? error.message : "Failed to resolve credential", { cause: error });
+}
+export function isCredentialPrintHelp(args) {
+    return (args[0] === "auth" && (args[1] === undefined || args[1] === "help" || args[1] === "--help" || args[1] === "-h"));
+}
+export function printCredentialPrintHelp() {
+    // Branded through APP_NAME: Atomic's binary is `atomic`, and help output must
+    // never render upstream's `pi`.
+    console.error(`Usage:
+  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]
+  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]
+
+Prints one configured credential alone on stdout. Everything else — warnings,
+provider selection, refresh notices — goes to stderr, and stdout stays empty on
+every failure but exit 9, which reports that it could not be.
+
+--model is required: there is no ambient "current model". Provider inference
+uses configured credentials; pass --provider to select one explicitly.
+
+--min-expiry accepts ms, s, m, or h (for example 30m) and applies only to
+print-bearer-token, where it defaults to 30m. A token with less than that
+remaining is refreshed first.
+
+Exit codes:
+  0  credential written to stdout
+  1  usage error
+  2  no credential configured
+  3  provider ambiguous
+  4  credential kind unsupported for that provider
+  5  refresh failed (the stored credential is left untouched)
+  6  provider cannot mint a token that lives long enough
+  7  the provider's OAuth credential could not be used
+  8  the credential could not be written (nothing was emitted)
+  9  the credential was written only in part; stdout holds an unusable
+     fragment, which the caller must discard rather than use`);
+}
+function parseDuration(value) {
+    const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
+    if (!match) {
+        throw new CredentialPrintError("Usage", "--min-expiry must use a duration such as 30m or 1h");
+    }
+    const unit = match[2].toLowerCase();
+    const scale = unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000;
+    return Number(match[1]) * scale;
+}
+/** Parse the `auth` command surface before normal startup. */
+export function parseCredentialPrintCommand(args) {
+    if (args[0] !== "auth")
+        return undefined;
+    const kind = args[1] === "print-api-key" ? "api_key" : args[1] === "print-bearer-token" ? "bearer_token" : undefined;
+    if (!kind) {
+        throw new CredentialPrintError("Usage", `Unknown auth command "${args[1] ?? ""}". Use "${APP_NAME} auth print-api-key" or "${APP_NAME} auth print-bearer-token".`);
+    }
+    const INLINE_MIN_EXPIRY = "--min-expiry=";
+    const commandArgs = [];
+    let minExpiryMs;
+    for (let index = 2; index < args.length; index++) {
+        const arg = args[index];
+        const inline = arg.startsWith(INLINE_MIN_EXPIRY) ? arg.slice(INLINE_MIN_EXPIRY.length) : undefined;
+        if (arg !== "--min-expiry" && inline === undefined) {
+            commandArgs.push(arg);
+            continue;
+        }
+        // An API key has no expiry, so the option is an error rather than a
+        // silently ignored no-op that would imply a guarantee it cannot give.
+        // Both spellings are refused: `--min-expiry=30m` reaching the ordinary
+        // parser as an unknown flag would report the wrong cause.
+        if (kind !== "bearer_token") {
+            throw new CredentialPrintError("Usage", "--min-expiry is only supported by print-bearer-token");
+        }
+        minExpiryMs = parseDuration(inline ?? args[++index]);
+    }
+    return minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };
+}
+/**
+ * The only two fields of `Args` this door accepts.
+ *
+ * Validation is an allowlist rather than a list of refusals, because the
+ * refusal list only held while the dispatcher happened to ignore every other
+ * flag. `--export <path>`, `--session-dir <path>`, `--print`, and `--help` are
+ * all parsed by `parseArgs`; under an exclusion check they passed silently and
+ * the door's "no file sink" guarantee rested on a downstream accident.
+ */
+const ACCEPTED_ARG_FIELDS = new Set(["model", "provider"]);
+/** Names every field of a parsed `Args` that the caller actually set. */
+function populatedArgFields(args) {
+    const populated = [];
+    for (const [field, value] of Object.entries(args)) {
+        if (ACCEPTED_ARG_FIELDS.has(field) || value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            if (value.length > 0)
+                populated.push(field);
+        }
+        else if (value instanceof Map) {
+            if (value.size > 0)
+                populated.push(field);
+        }
+        else {
+            populated.push(field);
+        }
+    }
+    return populated;
+}
+export function validateCredentialPrintArgs(args) {
+    if (!args.model?.trim()) {
+        throw new CredentialPrintError("Usage", "Credential printing requires --model <model>");
+    }
+    if (args.apiKey !== undefined) {
+        throw new CredentialPrintError("Usage", "Credential printing reads configured credentials; --api-key is not supported");
+    }
+    const refused = populatedArgFields(args);
+    if (refused.length > 0) {
+        throw new CredentialPrintError("Usage", `Credential printing only accepts --provider and --model (refused: ${refused.join(", ")})`);
+    }
+}
+/**
+ * Provider-supplied text with anything credential-bearing masked.
+ *
+ * A failed refresh is reported on stderr, and the provider composes that
+ * message. Most describe the failure; some quote the request they sent or the
+ * body they got back, either of which can carry the very value this door exists
+ * to keep off every stream except stdout. Masking keeps the diagnosis — which
+ * is what makes the exit code actionable — without putting the secret in a log,
+ * a terminal scrollback, or a CI transcript.
+ *
+ * Two passes, because either alone leaves a gap. Shape catches a value wherever
+ * it appears, but only for the formats that announce themselves. Context
+ * catches an opaque value — an `x-api-key`, which is just bytes — by the name it
+ * is filed under, in the header, JSON, and query spellings a quoted request or
+ * response body uses.
+ */
+const CREDENTIAL_SHAPES = [
+    // `Authorization: Bearer <token>`, the form an echoed request header takes.
+    /\bBearer\s+[\w.~+/-]+=*/giu,
+    // JWTs, which several providers return verbatim in an error body.
+    /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]+/gu,
+    // Prefixed API keys: sk-…, sk_live_…, api-key-…, and the same shapes again.
+    /\b(?:sk|pk|rk|api|key|tok|token|secret)[-_][\w-]{12,}/giu,
+];
+/**
+ * Field names whose value is the credential, however opaque that value looks.
+ * `x-api-key` is the case shape-matching cannot reach: the value is just bytes.
+ */
+const CREDENTIAL_FIELD_NAME = "(?:x-)?(?:api[-_]?key|apikey|auth(?:orization)?|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|secret[-_]?key|private[-_]?key|session[-_]?key|password|passwd|token|secret|key)";
+/**
+ * Auth schemes that stand between the field name and the value it introduces.
+ *
+ * Without them the header matcher stops at the space after `Bearer`: it redacts
+ * the scheme and leaves the token, and having consumed the `Bearer` the shape
+ * pass depends on, that pass can no longer reach the token either. An opaque
+ * `Authorization: Bearer <token>` then survives both passes.
+ */
+const CREDENTIAL_AUTH_SCHEME = "(?:Bearer|Basic|Digest|Token|ApiKey|OAuth)";
+const CREDENTIAL_CONTEXTS = [
+    // Header or YAML-ish: `x-api-key: abc123`, to end of line, and the scheme
+    // form `Authorization: Bearer abc123` with it.
+    new RegExp(String.raw `\b${CREDENTIAL_FIELD_NAME}\s*:\s*(?:${CREDENTIAL_AUTH_SCHEME}\s+)?[^\s,;}"']+`, "giu"),
+    // JSON: `"api_key": "abc123"` / `'token':'abc123'`, quoted value.
+    new RegExp(String.raw `(["']?)${CREDENTIAL_FIELD_NAME}\1\s*:\s*(["'])(?:(?!\2).)*\2`, "giu"),
+    // Query string or form body: `?api_key=abc123&…`.
+    new RegExp(String.raw `\b${CREDENTIAL_FIELD_NAME}\s*=\s*[^\s&,;}"']+`, "giu"),
+];
+export function redactCredentialShapes(text) {
+    const byContext = CREDENTIAL_CONTEXTS.reduce((masked, context) => masked.replace(context, (match) => {
+        // Keep the field name so the diagnosis still says which one failed;
+        // replace only what follows the separator.
+        const separator = /[:=]/u.exec(match);
+        return separator ? `${match.slice(0, separator.index + 1)} [redacted]` : "[redacted]";
+    }), text);
+    return CREDENTIAL_SHAPES.reduce((masked, shape) => masked.replace(shape, "[redacted]"), byContext);
+}
+/**
+ * The literal phrase pi-ai throws when a refresh itself failed, from inside
+ * `credentials.modify` and therefore before anything is persisted. This is the
+ * only oauth-coded error that can claim the stored credential was left alone.
+ */
+export const OAUTH_REFRESH_FAILED_PHRASE = "OAuth refresh failed for";
+/**
+ * The literal phrase pi-ai throws when a refresh succeeded but the rotated
+ * token still expires inside the requested window. It is the only signal that
+ * separates exit 6 from exit 5.
+ */
+export const OAUTH_EXPIRES_TOO_SOON_PHRASE = "expires too soon";
+/**
+ * pi-ai raises three different `oauth`-coded failures from
+ * `dist/auth/resolve.js`, and only one of them is a failed refresh.
+ *
+ * `OAuth auth derivation failed for <provider>` is thrown after
+ * `credentials.modify` has already persisted a rotated credential, and also on
+ * the branch where no refresh was attempted at all — so it gets its own code
+ * and a message that makes no claim about the stored credential. Treating it as
+ * `RefreshFailed` asserted a rollback the command never verified.
+ *
+ * Classification reads the raw message, because redaction could rewrite the
+ * phrase it matches on; only the text that becomes a user-facing message is
+ * redacted. The unredacted error stays reachable as `cause`, which this door
+ * never logs.
+ *
+ * `test/credential-print.test.ts` pins both phrases against the installed
+ * pi-ai build, so an upstream rewording fails the suite rather than silently
+ * collapsing exit 6 into exit 5.
+ */
+export function classifyOAuthFailure(error) {
+    const detail = redactCredentialShapes(error.message);
+    if (error.message.includes(OAUTH_EXPIRES_TOO_SOON_PHRASE)) {
+        return new CredentialPrintError("MinValidityUnreachable", `The provider refreshed the token but it still expires sooner than requested: ${detail}`, { cause: error });
+    }
+    if (error.message.startsWith(OAUTH_REFRESH_FAILED_PHRASE)) {
+        return new CredentialPrintError("RefreshFailed", `${detail} (the stored credential was left untouched)`, {
+            cause: error,
+        });
+    }
+    return new CredentialPrintError("OAuthUnavailable", detail, { cause: error });
+}
+/**
+ * Providers whose credential the caller could have meant.
+ *
+ * With `--provider` the caller named one, so failing to resolve it is an error.
+ * Without it, eligibility is *not* narrowed to providers holding a persisted
+ * credential: a provider authenticated by an environment variable or a custom
+ * resolver has nothing in `auth.json`, and filtering on that list dropped it
+ * before `getAuth()` could produce its working key. Candidacy is therefore
+ * "offers the named model", and `getAuth()` — the same call a real request
+ * makes — decides which candidate actually authenticates.
+ */
+function candidateModels(args, modelRuntime) {
+    if (args.provider) {
+        const resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });
+        if (resolved.error || !resolved.model) {
+            throw new CredentialPrintError("NoCredentialConfigured", resolved.error ?? "Unable to resolve the requested provider/model");
+        }
+        return [resolved.model];
+    }
+    const models = [];
+    for (const provider of modelRuntime.getProviders()) {
+        const resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });
+        if (resolved.model && !resolved.error && !resolved.warning?.includes("Using custom model id")) {
+            models.push(resolved.model);
+        }
+    }
+    if (models.length === 0) {
+        throw new CredentialPrintError("NoCredentialConfigured", `Model "${args.model}" not found among the available providers. Use --list-models to see available models.`);
+    }
+    return models;
+}
+function bearerFromHeaders(headers) {
+    const authorization = Object.entries(headers ?? {}).find(([name]) => name.toLowerCase() === "authorization")?.[1];
+    return typeof authorization === "string" ? /^Bearer\s+(.+)$/iu.exec(authorization)?.[1] : undefined;
+}
+/**
+ * Resolve exactly one credential for a named provider/model pair.
+ *
+ * Goes through `ModelRuntime.getAuth()`, the same request-auth path a real
+ * model call uses, so an OAuth credential is refreshed and persisted by the one
+ * implementation that already handles concurrent refresh under a lock.
+ */
+export async function resolveCredentialForPrint(args, modelRuntime, kind, minExpiryMs) {
+    validateCredentialPrintArgs(args);
+    // The effective auth type per candidate provider, taken from the runtime
+    // rather than from auth.json.
+    //
+    // `checkAuth` reports what a provider would actually authenticate with,
+    // including a credential supplied by an environment variable or a custom
+    // resolver that persists nothing, and it answers without refreshing OAuth.
+    // `listCredentials()` sees only what was stored, which both hid working
+    // credentials and — for a provider offering an API key *and* OAuth — could not
+    // say which of the two a request would use. Provider capability cannot say
+    // either: several providers send an API key as `Authorization: Bearer`, so
+    // neither that header nor `apiKey` identifies the credential's kind on its own.
+    const wantedAuthType = kind === "api_key" ? "api_key" : "oauth";
+    const resolvedAuthTypes = new Map();
+    const models = candidateModels(args, modelRuntime);
+    for (const { provider } of models) {
+        if (resolvedAuthTypes.has(provider))
+            continue;
+        resolvedAuthTypes.set(provider, (await modelRuntime.checkAuth(provider))?.type);
+    }
+    // A named provider, or a single candidate, is the one the caller meant, so its
+    // authentication failure is reported with its own exit code. Among several
+    // inferred candidates a failure only means "not this one" — reporting it would
+    // let an unrelated provider that happens to offer the model decide the exit
+    // code for a request another candidate can satisfy.
+    const authFailureIsFatal = args.provider !== undefined || models.length === 1;
+    const credentials = [];
+    // The classified diagnosis from a candidate that could not authenticate.
+    // Skipping a candidate must not discard why it failed: a refresh that failed,
+    // or a token that cannot reach the requested validity, is the real answer if
+    // nothing else produces a credential, and keeping it is what leaves exits 5
+    // and 6 reachable instead of collapsing every inferred failure into exit 2.
+    // It holds a `CredentialPrintError`, never a credential — the provider's text
+    // is redacted on the way in.
+    let deferredDiagnosis;
+    for (const model of models) {
+        const type = resolvedAuthTypes.get(model.provider);
+        if (type !== wantedAuthType)
+            continue;
+        // Every eligible candidate is asked here, before `ProviderAmbiguous` is
+        // known, so an ambiguous export can refresh and persist credentials it
+        // emits nothing for. Deciding eligibility earlier is not available:
+        // `checkAuth()` is the only non-mutating probe and cannot tell a candidate
+        // that will authenticate from one that will fail, which is what keeps
+        // exits 5 and 6 reachable. Nor does resolving without refreshing exist —
+        // `resolveStoredOAuth` in `@earendil-works/pi-ai` refreshes whenever the
+        // token falls inside `max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS,
+        // minOAuthValidityMs ?? 0)`, so omitting `minOAuthValidityMs` only lowers
+        // that window to five minutes and drops the post-refresh check exit 6 is
+        // decided by. Bounded: the refresh rotates a valid credential, it does not
+        // invalidate one. Closing it needs a non-mutating probe upstream.
+        let auth;
+        try {
+            auth = await modelRuntime.getAuth(model, kind === "bearer_token" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {});
+        }
+        catch (error) {
+            const diagnosis = error instanceof ModelsError && error.code === "oauth" ? classifyOAuthFailure(error) : undefined;
+            if (!authFailureIsFatal) {
+                deferredDiagnosis ??= diagnosis;
+                continue;
+            }
+            if (diagnosis)
+                throw diagnosis;
+            throw new CredentialPrintError("NoCredentialConfigured", redactCredentialShapes(error instanceof Error ? error.message : String(error)), { cause: error });
+        }
+        const value = kind === "bearer_token" ? (auth?.auth.apiKey ?? bearerFromHeaders(auth?.auth.headers)) : auth?.auth.apiKey;
+        if (value)
+            credentials.push({ providerId: model.provider, value });
+    }
+    if (credentials.length === 1)
+        return new Secret(credentials[0].value);
+    if (credentials.length === 0) {
+        if (deferredDiagnosis)
+            throw deferredDiagnosis;
+        const providerId = models[0]?.provider;
+        const type = providerId ? resolvedAuthTypes.get(providerId) : undefined;
+        if (args.provider && kind === "api_key" && type === "oauth") {
+            throw new CredentialPrintError("KindUnsupportedForProvider", `Provider "${providerId}" is configured with OAuth, not an API key`);
+        }
+        if (args.provider && kind === "bearer_token" && type === "api_key") {
+            throw new CredentialPrintError("KindUnsupportedForProvider", `Provider "${providerId}" is not configured with an OAuth bearer token`);
+        }
+        throw new CredentialPrintError("NoCredentialConfigured", `No usable ${kind === "api_key" ? "API key" : "OAuth bearer token"} is configured`);
+    }
+    throw new CredentialPrintError("ProviderAmbiguous", `Model "${args.model}" has multiple configured providers (${credentials
+        .map(({ providerId }) => providerId)
+        .join(", ")}). Specify --provider.`);
+}
+//# sourceMappingURL=credential-print.js.map

package/dist/cli/credential-print.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-print.js","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlG,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,MAAM,CAAC;AAiB9D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAA6C;IACnE,KAAK,EAAE,CAAC;IACR,sBAAsB,EAAE,CAAC;IACzB,iBAAiB,EAAE,CAAC;IACpB,0BAA0B,EAAE,CAAC;IAC7B,aAAa,EAAE,CAAC;IAChB,sBAAsB,EAAE,CAAC;IACzB,gBAAgB,EAAE,CAAC;IACnB,oBAAoB,EAAE,CAAC;IACvB,mBAAmB,EAAE,CAAC;CACtB,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAA0C,IAAI,GAAG,CAChF,MAAM,CAAC,IAAI,CAAC,UAAU,CAAgC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,qBAAqB,CAAC,CACxG,CAAC;AAEF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAI9C,YAAY,IAA8B,EAAE,OAAe,EAAE,OAA6B;QACzF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,MAAM;IAClB,MAAM,CAAqB;IAE3B,YAAY,KAAa;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,qEAAqE;IACrE,IAAI;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,QAAQ;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM;QACL,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC9D,CAAC;IAED,CAAC,MAAM,CAAC,WAAW,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IAED,CAAC,OAAO,CAAC,MAAM,CAAC;QACf,OAAO,UAAU,CAAC;IACnB,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc;IAClD,0EAA0E;IAC1E,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;IACrC,IAAI,CAAC;QACJ,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,OAAO,CAAC,KAAK,CACZ,kFAAkF,KAAK,CAAC,OAAO,EAAE,CACjG,CAAC;YACF,OAAO;QACR,CAAC;QACD,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,oBAAoB,CAC7B,qBAAqB,EACrB,+FAA+F,EAC/F,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,sBAAsB,EACtB,+DAA+D,EAC/D,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,cAAc,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CACZ,uFACC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACtD,EAAE,CACF,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,oBAAoB,CAC9B,wBAAwB,EACxB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;AACH,CAAC;AASD,MAAM,UAAU,qBAAqB,CAAC,IAAc;IACnD,OAAO,CACN,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC/G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB;IACvC,8EAA8E;IAC9E,gCAAgC;IAChC,OAAO,CAAC,KAAK,CAAC;IACX,QAAQ;IACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;6DAwBiD,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AACjC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,2BAA2B,CAAC,IAAc;IACzD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GACT,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAC7B,OAAO,EACP,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,QAAQ,4BAA4B,QAAQ,4BAA4B,CACzH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,eAAe,CAAC;IAC1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,WAA+B,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,IAAI,GAAG,KAAK,cAAc,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACV,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,0DAA0D;QAC1D,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,sDAAsD,CAAC,CAAC;QACjG,CAAC;QACD,WAAW,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAC3G,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,IAAU;IACrC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAU;IACrD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAC7B,OAAO,EACP,8EAA8E,CAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,oBAAoB,CAC7B,OAAO,EACP,qEAAqE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1F,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,iBAAiB,GAAsB;IAC5C,4EAA4E;IAC5E,4BAA4B;IAC5B,kEAAkE;IAClE,qCAAqC;IACrC,4EAA4E;IAC5E,0DAA0D;CAC1D,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAC1B,oMAAoM,CAAC;AAEtM;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,4CAA4C,CAAC;AAE5E,MAAM,mBAAmB,GAAsB;IAC9C,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,qBAAqB,aAAa,sBAAsB,kBAAkB,EAAE,KAAK,CAAC;IAC5G,kEAAkE;IAClE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,UAAU,qBAAqB,+BAA+B,EAAE,KAAK,CAAC;IAC3F,kDAAkD;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,qBAAqB,qBAAqB,EAAE,KAAK,CAAC;CAC5E,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CACnB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjC,oEAAoE;QACpE,2CAA2C;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IACvF,CAAC,CAAC,EACH,IAAI,CACJ,CAAC;IACF,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,oBAAoB,CAC9B,wBAAwB,EACxB,gFAAgF,MAAM,EAAE,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,oBAAoB,CAAC,eAAe,EAAE,GAAG,MAAM,6CAA6C,EAAE;YACxG,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,IAAU,EAAE,YAA0B;IAC9D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAClE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,UAAU,IAAI,CAAC,KAAK,uFAAuF,CAC3G,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4C;IACtE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAU,EACV,YAA0B,EAC1B,IAAyB,EACzB,WAAoB;IAEpB,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAElC,yEAAyE;IACzE,8BAA8B;IAC9B,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,cAAc,GAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnD,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC9C,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,6BAA6B;IAC7B,IAAI,iBAAmD,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QAEtC,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,IAAkD,CAAC;QACvD,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAChC,KAAK,EACL,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,IAAI,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,SAAS,GACd,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,iBAAiB,KAAK,SAAS,CAAC;gBAChC,SAAS;YACV,CAAC;YACD,IAAI,SAAS;gBAAE,MAAM,SAAS,CAAC;YAC/B,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC9E,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GACV,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC5G,IAAI,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEtE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,iBAAiB;YAAE,MAAM,iBAAiB,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAC7B,4BAA4B,EAC5B,aAAa,UAAU,4CAA4C,CACnE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,oBAAoB,CAC7B,4BAA4B,EAC5B,aAAa,UAAU,gDAAgD,CACvE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,aAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,gBAAgB,CAClF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,EACnB,UAAU,IAAI,CAAC,KAAK,wCAAwC,WAAW;SACrE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC;SACnC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACpC,CAAC;AACH,CAAC","sourcesContent":["/**\n * `atomic auth print-api-key` / `atomic auth print-bearer-token`.\n *\n * The only door in Atomic whose purpose is emitting a secret. Everything here\n * exists to keep that egress narrow:\n *\n * - the secret leaves as a `Secret`, which cannot be interpolated, serialized,\n *   or inspected, and is consumed exactly once by the stdout writer;\n * - `--model` is required, so no ambient \"current model\" can emit a credential\n *   the caller did not name;\n * - there is no `--output <file>` and no clipboard path — stdout only;\n * - every failure is a distinct exit code, and stdout stays empty on all of\n *   them but one — `CredentialTruncated` (exit 9) exists to report the case\n *   where it cannot be, because bytes already left and cannot be recalled;\n * - a failed OAuth refresh never mutates the stored credential.\n *\n * One residual, and it is upstream: when a model infers several eligible\n * providers, each is asked for its credential before the ambiguity is known, so\n * a *successful* refresh can rotate and persist a credential this command then\n * declines to emit (exit 3). See the note on the `getAuth()` call in the\n * candidate loop.\n */\n\nimport { inspect } from \"node:util\";\nimport type { Api, AuthType, Model } from \"@earendil-works/pi-ai\";\nimport { ModelsError } from \"@earendil-works/pi-ai\";\nimport { APP_NAME } from \"../config.ts\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport { flushRawStdout, RawStdoutWriteError, writeRawStdoutOnce } from \"../core/output-guard.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type CredentialPrintKind = \"api_key\" | \"bearer_token\";\n\n/** Bearer tokens are refreshed unless they still have this much life left. */\nexport const DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\n/**\n * Failure taxonomy. Each member owns one exit code, so a caller can branch on\n * the status without parsing stderr.\n */\nexport type CredentialPrintErrorCode =\n\t| \"Usage\"\n\t| \"NoCredentialConfigured\"\n\t| \"ProviderAmbiguous\"\n\t| \"KindUnsupportedForProvider\"\n\t| \"RefreshFailed\"\n\t| \"MinValidityUnreachable\"\n\t| \"OAuthUnavailable\"\n\t| \"CredentialNotEmitted\"\n\t| \"CredentialTruncated\";\n\n/**\n * Exported so a test can walk the whole taxonomy: every declared code has to\n * name an exercised path, and the record type makes a new member without an\n * exit code a compile error rather than a review miss.\n *\n * Every one of these leaves stdout empty except `CredentialTruncated`, which\n * exists to report the one case where it cannot be: bytes already went out and\n * cannot be recalled. `STDOUT_EMPTY_ON_EXIT` names that split so the taxonomy\n * test asserts it rather than assuming it.\n */\nexport const EXIT_CODES: Record<CredentialPrintErrorCode, number> = {\n\tUsage: 1,\n\tNoCredentialConfigured: 2,\n\tProviderAmbiguous: 3,\n\tKindUnsupportedForProvider: 4,\n\tRefreshFailed: 5,\n\tMinValidityUnreachable: 6,\n\tOAuthUnavailable: 7,\n\tCredentialNotEmitted: 8,\n\tCredentialTruncated: 9,\n};\n\n/** The codes whose contract is an empty stdout. See `EXIT_CODES`. */\nexport const STDOUT_EMPTY_ON_EXIT: ReadonlySet<CredentialPrintErrorCode> = new Set(\n\t(Object.keys(EXIT_CODES) as CredentialPrintErrorCode[]).filter((code) => code !== \"CredentialTruncated\"),\n);\n\nexport class CredentialPrintError extends Error {\n\treadonly code: CredentialPrintErrorCode;\n\treadonly exitCode: number;\n\n\tconstructor(code: CredentialPrintErrorCode, message: string, options?: { cause?: unknown }) {\n\t\tsuper(message, options);\n\t\tthis.name = \"CredentialPrintError\";\n\t\tthis.code = code;\n\t\tthis.exitCode = EXIT_CODES[code];\n\t}\n}\n\n/**\n * A credential in transit.\n *\n * Every path that would copy the value into a string is closed: `toString`,\n * `toJSON`, and `Symbol.toPrimitive` throw rather than return, so a template\n * literal, `JSON.stringify`, or string concatenation fails loudly instead of\n * leaking into a log line, a transcript, or an error message. `inspect` — which\n * `console.log` and Node's error formatting use — renders a placeholder.\n *\n * `take()` is the single exit, and it works once.\n */\nexport class Secret {\n\t#value: string | undefined;\n\n\tconstructor(value: string) {\n\t\tthis.#value = value;\n\t}\n\n\t/** Consume the secret. A second call is a bug, not a second read. */\n\ttake(): string {\n\t\tconst value = this.#value;\n\t\tif (value === undefined) {\n\t\t\tthrow new Error(\"Secret has already been consumed\");\n\t\t}\n\t\tthis.#value = undefined;\n\t\treturn value;\n\t}\n\n\ttoString(): never {\n\t\tthrow new Error(\"A Secret cannot be converted to a string; use take()\");\n\t}\n\n\ttoJSON(): never {\n\t\tthrow new Error(\"A Secret cannot be serialized; use take()\");\n\t}\n\n\t[Symbol.toPrimitive](): never {\n\t\tthrow new Error(\"A Secret cannot be interpolated; use take()\");\n\t}\n\n\t[inspect.custom](): string {\n\t\treturn \"[Secret]\";\n\t}\n}\n\n/**\n * The single credential egress in `src`.\n *\n * `Secret.take()` is called here and nowhere else in the source tree, so this\n * is the one statement that can turn a configured credential back into a string\n * and the one that hands it to the real stdout. A caller — `main.ts` included —\n * receives a `Secret` it cannot read, print, or serialize, so a second export\n * path cannot be grafted on without moving this function.\n *\n * A failed payload write is answered from the stream rather than from the shape\n * of the error, because `bytesWritten` says how much of the credential actually\n * left and the right report differs for each amount.\n *\n * Nothing left — the write call threw, or the callback failed with the counter\n * unmoved — is `CredentialNotEmitted` (exit 8) with stdout provably empty,\n * which is what that exit promises. It must not fall through to the caller's\n * credential-resolution catch, which would report exit 2.\n *\n * All of it left and the failure came after: the caller holds the credential it\n * asked for, so this is reported on stderr with the exit code left at 0, for\n * the same reason the trailing drain is. A non-zero exit over a stream carrying\n * a whole credential is the thing this door never produces.\n *\n * Part of it left is neither. Those bytes cannot be recalled, so stdout is not\n * empty and cannot be made empty; but they are a fragment, not a credential,\n * and reporting success over them would hand a caller a truncated secret it\n * cannot tell from a whole one. That case gets `CredentialTruncated` (exit 9),\n * the one code in this taxonomy whose contract is *not* an empty stdout —\n * stated as such in `EXIT_CODES` and asserted through `STDOUT_EMPTY_ON_EXIT`,\n * rather than left for a caller to discover.\n *\n * `test/credential-print.test.ts` asserts that chokepoint against the whole of\n * `packages/coding-agent/src`.\n */\nexport async function emitCredential(secret: Secret): Promise<void> {\n\t// take() returns a plain string; the Secret itself is never interpolated.\n\tconst payload = `${secret.take()}\\n`;\n\ttry {\n\t\tawait writeRawStdoutOnce(payload);\n\t} catch (error) {\n\t\tif (error instanceof RawStdoutWriteError && error.emitted === \"all\") {\n\t\t\t// The caller holds the whole credential. Exiting non-zero here would be\n\t\t\t// a non-zero exit over a stream carrying it, which this door never does.\n\t\t\tconsole.error(\n\t\t\t\t`Warning: the credential reached stdout but the write did not complete cleanly: ${error.message}`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\tif (error instanceof RawStdoutWriteError && error.emitted === \"partial\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"CredentialTruncated\",\n\t\t\t\t\"Only part of the credential reached stdout; discard the output, it is not a usable credential\",\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t\"CredentialNotEmitted\",\n\t\t\t\"Failed to write the credential to stdout; nothing was emitted\",\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\ttry {\n\t\tawait flushRawStdout();\n\t} catch (error) {\n\t\tconsole.error(\n\t\t\t`Warning: the credential was written to stdout but the stream did not drain cleanly: ${\n\t\t\t\terror instanceof Error ? error.message : String(error)\n\t\t\t}`,\n\t\t);\n\t}\n}\n\n/**\n * The single place a thrown value becomes an exit code for this door.\n *\n * `main.ts` routes every failure through here. Every code it can produce leaves\n * stdout empty, so an exit code from this door never contradicts the stream.\n */\nexport function toCredentialPrintError(error: unknown): CredentialPrintError {\n\tif (error instanceof CredentialPrintError) return error;\n\treturn new CredentialPrintError(\n\t\t\"NoCredentialConfigured\",\n\t\terror instanceof Error ? error.message : \"Failed to resolve credential\",\n\t\t{ cause: error },\n\t);\n}\n\nexport interface CredentialPrintCommand {\n\tkind: CredentialPrintKind;\n\t/** Remaining argv for the normal parser (`--model`, `--provider`). */\n\targs: string[];\n\tminExpiryMs?: number;\n}\n\nexport function isCredentialPrintHelp(args: string[]): boolean {\n\treturn (\n\t\targs[0] === \"auth\" && (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\")\n\t);\n}\n\nexport function printCredentialPrintHelp(): void {\n\t// Branded through APP_NAME: Atomic's binary is `atomic`, and help output must\n\t// never render upstream's `pi`.\n\tconsole.error(`Usage:\n  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]\n  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n\nPrints one configured credential alone on stdout. Everything else — warnings,\nprovider selection, refresh notices — goes to stderr, and stdout stays empty on\nevery failure but exit 9, which reports that it could not be.\n\n--model is required: there is no ambient \"current model\". Provider inference\nuses configured credentials; pass --provider to select one explicitly.\n\n--min-expiry accepts ms, s, m, or h (for example 30m) and applies only to\nprint-bearer-token, where it defaults to 30m. A token with less than that\nremaining is refreshed first.\n\nExit codes:\n  0  credential written to stdout\n  1  usage error\n  2  no credential configured\n  3  provider ambiguous\n  4  credential kind unsupported for that provider\n  5  refresh failed (the stored credential is left untouched)\n  6  provider cannot mint a token that lives long enough\n  7  the provider's OAuth credential could not be used\n  8  the credential could not be written (nothing was emitted)\n  9  the credential was written only in part; stdout holds an unusable\n     fragment, which the caller must discard rather than use`);\n}\n\nfunction parseDuration(value: string | undefined): number {\n\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\tif (!match) {\n\t\tthrow new CredentialPrintError(\"Usage\", \"--min-expiry must use a duration such as 30m or 1h\");\n\t}\n\tconst unit = match[2].toLowerCase();\n\tconst scale = unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000;\n\treturn Number(match[1]) * scale;\n}\n\n/** Parse the `auth` command surface before normal startup. */\nexport function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind: CredentialPrintKind | undefined =\n\t\targs[1] === \"print-api-key\" ? \"api_key\" : args[1] === \"print-bearer-token\" ? \"bearer_token\" : undefined;\n\tif (!kind) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"Usage\",\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\" or \"${APP_NAME} auth print-bearer-token\".`,\n\t\t);\n\t}\n\n\tconst INLINE_MIN_EXPIRY = \"--min-expiry=\";\n\tconst commandArgs: string[] = [];\n\tlet minExpiryMs: number | undefined;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tconst inline = arg.startsWith(INLINE_MIN_EXPIRY) ? arg.slice(INLINE_MIN_EXPIRY.length) : undefined;\n\t\tif (arg !== \"--min-expiry\" && inline === undefined) {\n\t\t\tcommandArgs.push(arg);\n\t\t\tcontinue;\n\t\t}\n\t\t// An API key has no expiry, so the option is an error rather than a\n\t\t// silently ignored no-op that would imply a guarantee it cannot give.\n\t\t// Both spellings are refused: `--min-expiry=30m` reaching the ordinary\n\t\t// parser as an unknown flag would report the wrong cause.\n\t\tif (kind !== \"bearer_token\") {\n\t\t\tthrow new CredentialPrintError(\"Usage\", \"--min-expiry is only supported by print-bearer-token\");\n\t\t}\n\t\tminExpiryMs = parseDuration(inline ?? args[++index]);\n\t}\n\n\treturn minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };\n}\n\n/**\n * The only two fields of `Args` this door accepts.\n *\n * Validation is an allowlist rather than a list of refusals, because the\n * refusal list only held while the dispatcher happened to ignore every other\n * flag. `--export <path>`, `--session-dir <path>`, `--print`, and `--help` are\n * all parsed by `parseArgs`; under an exclusion check they passed silently and\n * the door's \"no file sink\" guarantee rested on a downstream accident.\n */\nconst ACCEPTED_ARG_FIELDS: ReadonlySet<string> = new Set([\"model\", \"provider\"]);\n\n/** Names every field of a parsed `Args` that the caller actually set. */\nfunction populatedArgFields(args: Args): string[] {\n\tconst populated: string[] = [];\n\tfor (const [field, value] of Object.entries(args)) {\n\t\tif (ACCEPTED_ARG_FIELDS.has(field) || value === undefined) continue;\n\t\tif (Array.isArray(value)) {\n\t\t\tif (value.length > 0) populated.push(field);\n\t\t} else if (value instanceof Map) {\n\t\t\tif (value.size > 0) populated.push(field);\n\t\t} else {\n\t\t\tpopulated.push(field);\n\t\t}\n\t}\n\treturn populated;\n}\n\nexport function validateCredentialPrintArgs(args: Args): void {\n\tif (!args.model?.trim()) {\n\t\tthrow new CredentialPrintError(\"Usage\", \"Credential printing requires --model <model>\");\n\t}\n\tif (args.apiKey !== undefined) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"Usage\",\n\t\t\t\"Credential printing reads configured credentials; --api-key is not supported\",\n\t\t);\n\t}\n\tconst refused = populatedArgFields(args);\n\tif (refused.length > 0) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"Usage\",\n\t\t\t`Credential printing only accepts --provider and --model (refused: ${refused.join(\", \")})`,\n\t\t);\n\t}\n}\n\n/**\n * Provider-supplied text with anything credential-bearing masked.\n *\n * A failed refresh is reported on stderr, and the provider composes that\n * message. Most describe the failure; some quote the request they sent or the\n * body they got back, either of which can carry the very value this door exists\n * to keep off every stream except stdout. Masking keeps the diagnosis — which\n * is what makes the exit code actionable — without putting the secret in a log,\n * a terminal scrollback, or a CI transcript.\n *\n * Two passes, because either alone leaves a gap. Shape catches a value wherever\n * it appears, but only for the formats that announce themselves. Context\n * catches an opaque value — an `x-api-key`, which is just bytes — by the name it\n * is filed under, in the header, JSON, and query spellings a quoted request or\n * response body uses.\n */\nconst CREDENTIAL_SHAPES: readonly RegExp[] = [\n\t// `Authorization: Bearer <token>`, the form an echoed request header takes.\n\t/\\bBearer\\s+[\\w.~+/-]+=*/giu,\n\t// JWTs, which several providers return verbatim in an error body.\n\t/\\beyJ[\\w-]{8,}\\.[\\w-]{8,}\\.[\\w-]+/gu,\n\t// Prefixed API keys: sk-…, sk_live_…, api-key-…, and the same shapes again.\n\t/\\b(?:sk|pk|rk|api|key|tok|token|secret)[-_][\\w-]{12,}/giu,\n];\n\n/**\n * Field names whose value is the credential, however opaque that value looks.\n * `x-api-key` is the case shape-matching cannot reach: the value is just bytes.\n */\nconst CREDENTIAL_FIELD_NAME =\n\t\"(?:x-)?(?:api[-_]?key|apikey|auth(?:orization)?|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|secret[-_]?key|private[-_]?key|session[-_]?key|password|passwd|token|secret|key)\";\n\n/**\n * Auth schemes that stand between the field name and the value it introduces.\n *\n * Without them the header matcher stops at the space after `Bearer`: it redacts\n * the scheme and leaves the token, and having consumed the `Bearer` the shape\n * pass depends on, that pass can no longer reach the token either. An opaque\n * `Authorization: Bearer <token>` then survives both passes.\n */\nconst CREDENTIAL_AUTH_SCHEME = \"(?:Bearer|Basic|Digest|Token|ApiKey|OAuth)\";\n\nconst CREDENTIAL_CONTEXTS: readonly RegExp[] = [\n\t// Header or YAML-ish: `x-api-key: abc123`, to end of line, and the scheme\n\t// form `Authorization: Bearer abc123` with it.\n\tnew RegExp(String.raw`\\b${CREDENTIAL_FIELD_NAME}\\s*:\\s*(?:${CREDENTIAL_AUTH_SCHEME}\\s+)?[^\\s,;}\"']+`, \"giu\"),\n\t// JSON: `\"api_key\": \"abc123\"` / `'token':'abc123'`, quoted value.\n\tnew RegExp(String.raw`([\"']?)${CREDENTIAL_FIELD_NAME}\\1\\s*:\\s*([\"'])(?:(?!\\2).)*\\2`, \"giu\"),\n\t// Query string or form body: `?api_key=abc123&…`.\n\tnew RegExp(String.raw`\\b${CREDENTIAL_FIELD_NAME}\\s*=\\s*[^\\s&,;}\"']+`, \"giu\"),\n];\n\nexport function redactCredentialShapes(text: string): string {\n\tconst byContext = CREDENTIAL_CONTEXTS.reduce(\n\t\t(masked, context) =>\n\t\t\tmasked.replace(context, (match) => {\n\t\t\t\t// Keep the field name so the diagnosis still says which one failed;\n\t\t\t\t// replace only what follows the separator.\n\t\t\t\tconst separator = /[:=]/u.exec(match);\n\t\t\t\treturn separator ? `${match.slice(0, separator.index + 1)} [redacted]` : \"[redacted]\";\n\t\t\t}),\n\t\ttext,\n\t);\n\treturn CREDENTIAL_SHAPES.reduce((masked, shape) => masked.replace(shape, \"[redacted]\"), byContext);\n}\n\n/**\n * The literal phrase pi-ai throws when a refresh itself failed, from inside\n * `credentials.modify` and therefore before anything is persisted. This is the\n * only oauth-coded error that can claim the stored credential was left alone.\n */\nexport const OAUTH_REFRESH_FAILED_PHRASE = \"OAuth refresh failed for\";\n\n/**\n * The literal phrase pi-ai throws when a refresh succeeded but the rotated\n * token still expires inside the requested window. It is the only signal that\n * separates exit 6 from exit 5.\n */\nexport const OAUTH_EXPIRES_TOO_SOON_PHRASE = \"expires too soon\";\n\n/**\n * pi-ai raises three different `oauth`-coded failures from\n * `dist/auth/resolve.js`, and only one of them is a failed refresh.\n *\n * `OAuth auth derivation failed for <provider>` is thrown after\n * `credentials.modify` has already persisted a rotated credential, and also on\n * the branch where no refresh was attempted at all — so it gets its own code\n * and a message that makes no claim about the stored credential. Treating it as\n * `RefreshFailed` asserted a rollback the command never verified.\n *\n * Classification reads the raw message, because redaction could rewrite the\n * phrase it matches on; only the text that becomes a user-facing message is\n * redacted. The unredacted error stays reachable as `cause`, which this door\n * never logs.\n *\n * `test/credential-print.test.ts` pins both phrases against the installed\n * pi-ai build, so an upstream rewording fails the suite rather than silently\n * collapsing exit 6 into exit 5.\n */\nexport function classifyOAuthFailure(error: ModelsError): CredentialPrintError {\n\tconst detail = redactCredentialShapes(error.message);\n\tif (error.message.includes(OAUTH_EXPIRES_TOO_SOON_PHRASE)) {\n\t\treturn new CredentialPrintError(\n\t\t\t\"MinValidityUnreachable\",\n\t\t\t`The provider refreshed the token but it still expires sooner than requested: ${detail}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\tif (error.message.startsWith(OAUTH_REFRESH_FAILED_PHRASE)) {\n\t\treturn new CredentialPrintError(\"RefreshFailed\", `${detail} (the stored credential was left untouched)`, {\n\t\t\tcause: error,\n\t\t});\n\t}\n\treturn new CredentialPrintError(\"OAuthUnavailable\", detail, { cause: error });\n}\n\n/**\n * Providers whose credential the caller could have meant.\n *\n * With `--provider` the caller named one, so failing to resolve it is an error.\n * Without it, eligibility is *not* narrowed to providers holding a persisted\n * credential: a provider authenticated by an environment variable or a custom\n * resolver has nothing in `auth.json`, and filtering on that list dropped it\n * before `getAuth()` could produce its working key. Candidacy is therefore\n * \"offers the named model\", and `getAuth()` — the same call a real request\n * makes — decides which candidate actually authenticates.\n */\nfunction candidateModels(args: Args, modelRuntime: ModelRuntime): Model<Api>[] {\n\tif (args.provider) {\n\t\tconst resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"NoCredentialConfigured\",\n\t\t\t\tresolved.error ?? \"Unable to resolve the requested provider/model\",\n\t\t\t);\n\t\t}\n\t\treturn [resolved.model];\n\t}\n\n\tconst models: Model<Api>[] = [];\n\tfor (const provider of modelRuntime.getProviders()) {\n\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });\n\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\tmodels.push(resolved.model);\n\t\t}\n\t}\n\tif (models.length === 0) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"NoCredentialConfigured\",\n\t\t\t`Model \"${args.model}\" not found among the available providers. Use --list-models to see available models.`,\n\t\t);\n\t}\n\treturn models;\n}\n\nfunction bearerFromHeaders(headers: Record<string, unknown> | undefined): string | undefined {\n\tconst authorization = Object.entries(headers ?? {}).find(([name]) => name.toLowerCase() === \"authorization\")?.[1];\n\treturn typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n}\n\n/**\n * Resolve exactly one credential for a named provider/model pair.\n *\n * Goes through `ModelRuntime.getAuth()`, the same request-auth path a real\n * model call uses, so an OAuth credential is refreshed and persisted by the one\n * implementation that already handles concurrent refresh under a lock.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n): Promise<Secret> {\n\tvalidateCredentialPrintArgs(args);\n\n\t// The effective auth type per candidate provider, taken from the runtime\n\t// rather than from auth.json.\n\t//\n\t// `checkAuth` reports what a provider would actually authenticate with,\n\t// including a credential supplied by an environment variable or a custom\n\t// resolver that persists nothing, and it answers without refreshing OAuth.\n\t// `listCredentials()` sees only what was stored, which both hid working\n\t// credentials and — for a provider offering an API key *and* OAuth — could not\n\t// say which of the two a request would use. Provider capability cannot say\n\t// either: several providers send an API key as `Authorization: Bearer`, so\n\t// neither that header nor `apiKey` identifies the credential's kind on its own.\n\tconst wantedAuthType: AuthType = kind === \"api_key\" ? \"api_key\" : \"oauth\";\n\tconst resolvedAuthTypes = new Map<string, AuthType | undefined>();\n\tconst models = candidateModels(args, modelRuntime);\n\tfor (const { provider } of models) {\n\t\tif (resolvedAuthTypes.has(provider)) continue;\n\t\tresolvedAuthTypes.set(provider, (await modelRuntime.checkAuth(provider))?.type);\n\t}\n\t// A named provider, or a single candidate, is the one the caller meant, so its\n\t// authentication failure is reported with its own exit code. Among several\n\t// inferred candidates a failure only means \"not this one\" — reporting it would\n\t// let an unrelated provider that happens to offer the model decide the exit\n\t// code for a request another candidate can satisfy.\n\tconst authFailureIsFatal = args.provider !== undefined || models.length === 1;\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\t// The classified diagnosis from a candidate that could not authenticate.\n\t// Skipping a candidate must not discard why it failed: a refresh that failed,\n\t// or a token that cannot reach the requested validity, is the real answer if\n\t// nothing else produces a credential, and keeping it is what leaves exits 5\n\t// and 6 reachable instead of collapsing every inferred failure into exit 2.\n\t// It holds a `CredentialPrintError`, never a credential — the provider's text\n\t// is redacted on the way in.\n\tlet deferredDiagnosis: CredentialPrintError | undefined;\n\tfor (const model of models) {\n\t\tconst type = resolvedAuthTypes.get(model.provider);\n\t\tif (type !== wantedAuthType) continue;\n\n\t\t// Every eligible candidate is asked here, before `ProviderAmbiguous` is\n\t\t// known, so an ambiguous export can refresh and persist credentials it\n\t\t// emits nothing for. Deciding eligibility earlier is not available:\n\t\t// `checkAuth()` is the only non-mutating probe and cannot tell a candidate\n\t\t// that will authenticate from one that will fail, which is what keeps\n\t\t// exits 5 and 6 reachable. Nor does resolving without refreshing exist —\n\t\t// `resolveStoredOAuth` in `@earendil-works/pi-ai` refreshes whenever the\n\t\t// token falls inside `max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS,\n\t\t// minOAuthValidityMs ?? 0)`, so omitting `minOAuthValidityMs` only lowers\n\t\t// that window to five minutes and drops the post-refresh check exit 6 is\n\t\t// decided by. Bounded: the refresh rotates a valid credential, it does not\n\t\t// invalidate one. Closing it needs a non-mutating probe upstream.\n\t\tlet auth: Awaited<ReturnType<ModelRuntime[\"getAuth\"]>>;\n\t\ttry {\n\t\t\tauth = await modelRuntime.getAuth(\n\t\t\t\tmodel,\n\t\t\t\tkind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {},\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconst diagnosis =\n\t\t\t\terror instanceof ModelsError && error.code === \"oauth\" ? classifyOAuthFailure(error) : undefined;\n\t\t\tif (!authFailureIsFatal) {\n\t\t\t\tdeferredDiagnosis ??= diagnosis;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (diagnosis) throw diagnosis;\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"NoCredentialConfigured\",\n\t\t\t\tredactCredentialShapes(error instanceof Error ? error.message : String(error)),\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\n\t\tconst value =\n\t\t\tkind === \"bearer_token\" ? (auth?.auth.apiKey ?? bearerFromHeaders(auth?.auth.headers)) : auth?.auth.apiKey;\n\t\tif (value) credentials.push({ providerId: model.provider, value });\n\t}\n\n\tif (credentials.length === 1) return new Secret(credentials[0].value);\n\n\tif (credentials.length === 0) {\n\t\tif (deferredDiagnosis) throw deferredDiagnosis;\n\t\tconst providerId = models[0]?.provider;\n\t\tconst type = providerId ? resolvedAuthTypes.get(providerId) : undefined;\n\t\tif (args.provider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"KindUnsupportedForProvider\",\n\t\t\t\t`Provider \"${providerId}\" is configured with OAuth, not an API key`,\n\t\t\t);\n\t\t}\n\t\tif (args.provider && kind === \"bearer_token\" && type === \"api_key\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"KindUnsupportedForProvider\",\n\t\t\t\t`Provider \"${providerId}\" is not configured with an OAuth bearer token`,\n\t\t\t);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t\"NoCredentialConfigured\",\n\t\t\t`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`,\n\t\t);\n\t}\n\n\tthrow new CredentialPrintError(\n\t\t\"ProviderAmbiguous\",\n\t\t`Model \"${args.model}\" has multiple configured providers (${credentials\n\t\t\t.map(({ providerId }) => providerId)\n\t\t\t.join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}

package/dist/cli/list-models.d.ts

@@ -1,9 +1,9 @@
 /**
  * List available models with optional fuzzy search
  */
-import type { ModelRegistry } from "../core/model-registry.ts";
+import type { ModelRuntime } from "../core/model-runtime.ts";
 /**
  * List available models, optionally filtered by search pattern
  */
-export declare function listModels(modelRegistry: ModelRegistry, searchPattern?: string): Promise<void>;
+export declare function listModels(modelRuntime: ModelRuntime, searchPattern?: string): Promise<void>;
 //# sourceMappingURL=list-models.d.ts.map

package/dist/cli/list-models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-models.d.ts","sourceRoot":"","sources":["../../src/cli/list-models.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAiB/D;;GAEG;AACH,wBAAsB,UAAU,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFpG"}
+{"version":3,"file":"list-models.d.ts","sourceRoot":"","sources":["../../src/cli/list-models.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiB7D;;GAEG;AACH,wBAAsB,UAAU,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFlG"}