@bastani/atomic 0.9.14 → 0.9.15

package/dist/builtin/workflows/src/extension/public-types.ts

@@ -1,5 +1,5 @@
 import type { CreateAgentSessionOptions, DefaultResourceLoaderInheritanceSnapshot } from "@bastani/atomic";
-import type { Api, Model } from "@earendil-works/pi-ai/compat";
+import type { Api, Model } from "@bastani/pi-ai/compat";
 import type { StageSessionRuntime } from "../runs/foreground/stage-runner.js";
 import type { SessionManager } from "../shared/persistence-restore.js";
 import type { RunStatus, StageStatus } from "../shared/store-types.js";

package/dist/builtin/workflows/src/extension/wiring.ts

@@ -327,7 +327,7 @@ function makeWorkflowStageOrchestrationContext(
 		workflowRunId: meta.runId,
 		workflowStageId: meta.stageId,
 		workflowStageName: meta.stageName,
-		constraints: { disableWorkflowTool: true, maxSubagentDepth: 5 },
+		constraints: { disableWorkflowTool: true },
 		...(intercomGroup ? { intercomGroup } : {}),
 		lateMessageRouter: {
 			routeMessage(message, options) {

package/dist/builtin/workflows/src/extension/workflow-heartbeat-delivery.ts

@@ -24,6 +24,13 @@ export const defaultWorkflowHeartbeatTimerApi: WorkflowHeartbeatTimerApi = {
  */
 export const WORKFLOW_HEARTBEAT_MAX_DELIVERY_ATTEMPTS = 5;
 
+/**
+ * Maximum time a single host admission may remain in flight. Two minutes is
+ * comfortably shorter than the default fifteen-minute heartbeat cadence while
+ * leaving a legitimately slow host enough time to admit a card.
+ */
+export const WORKFLOW_HEARTBEAT_DELIVERY_TIMEOUT_MS = 120_000;
+
 interface WorkflowHeartbeatDeliveryOptions {
 	readonly emit: (details: WorkflowHeartbeatEventDetails) => boolean | Promise<boolean>;
 	/**
@@ -83,6 +90,9 @@ export function createWorkflowHeartbeatDelivery(options: WorkflowHeartbeatDelive
 	const retryTimers = new Set<WorkflowHeartbeatTimerHandle>();
 	const queue: WorkflowHeartbeatEventDetails[] = [];
 	let attempt = 0;
+	let attemptToken = 0;
+	let activeAttemptToken: number | undefined;
+	let watchdogHandle: WorkflowHeartbeatTimerHandle | undefined;
 	let running = false;
 	let active = true;
 	/**
@@ -97,8 +107,16 @@ export function createWorkflowHeartbeatDelivery(options: WorkflowHeartbeatDelive
 	 */
 	let headDiscarded = false;
 
+	const clearWatchdog = (): void => {
+		if (watchdogHandle === undefined) return;
+		options.timers.clearTimeout(watchdogHandle);
+		watchdogHandle = undefined;
+	};
+
 	/** Finish the head identity and start the next one, in handover order. */
 	const settleHead = (details: WorkflowHeartbeatEventDetails, delivered: boolean): void => {
+		clearWatchdog();
+		activeAttemptToken = undefined;
 		queue.shift();
 		attempt = 0;
 		running = false;
@@ -123,7 +141,12 @@ export function createWorkflowHeartbeatDelivery(options: WorkflowHeartbeatDelive
 		running = true;
 		attempt += 1;
 		const thisAttempt = attempt;
+		const thisAttemptToken = ++attemptToken;
+		activeAttemptToken = thisAttemptToken;
 		const settle = (delivered: boolean): void => {
+			if (activeAttemptToken !== thisAttemptToken) return;
+			activeAttemptToken = undefined;
+			clearWatchdog();
 			// A discarded head settles straight through, whatever the host answered:
 			// no retry, and the real result is still reported once.
 			if (delivered || headDiscarded || thisAttempt >= WORKFLOW_HEARTBEAT_MAX_DELIVERY_ATTEMPTS || !active) {
@@ -141,9 +164,29 @@ export function createWorkflowHeartbeatDelivery(options: WorkflowHeartbeatDelive
 			handle.unref?.();
 			retryTimers.add(handle);
 		};
-		const result = options.emit(details);
-		if (typeof result === "boolean") settle(result);
-		else void result.then(settle);
+		let result: boolean | Promise<boolean>;
+		try {
+			result = options.emit(details);
+		} catch {
+			// A host can throw synchronously before returning its admission result.
+			// Treat that exactly like an asynchronous rejection so the failed head
+			// enters capped backoff instead of leaving `running` set forever.
+			settle(false);
+			return;
+		}
+		if (typeof result === "boolean") {
+			settle(result);
+			return;
+		}
+		const watchdog = options.timers.setTimeout(() => {
+			if (activeAttemptToken !== thisAttemptToken) return;
+			activeAttemptToken = undefined;
+			watchdogHandle = undefined;
+			settleHead(details, false);
+		}, WORKFLOW_HEARTBEAT_DELIVERY_TIMEOUT_MS);
+		watchdogHandle = watchdog;
+		watchdog.unref?.();
+		void result.then(settle, () => settle(false));
 	};
 
 	const deliver = (details: WorkflowHeartbeatEventDetails): void => {
@@ -187,11 +230,12 @@ export function createWorkflowHeartbeatDelivery(options: WorkflowHeartbeatDelive
 		discard,
 		dispose() {
 			active = false;
+			clearWatchdog();
 			for (const handle of retryTimers) options.timers.clearTimeout(handle);
 			retryTimers.clear();
 			queue.length = 0;
 			// An in-flight send is left to settle on its own; `active` keeps it from
-			// starting a further retry.
+			// starting a further retry. Its watchdog is cleared with the other timers.
 		},
 	};
 }

package/dist/builtin/workflows/src/extension/workflow-tool.ts

@@ -1,4 +1,4 @@
-import { getSupportedThinkingLevels } from "@earendil-works/pi-ai/compat";
+import { getSupportedThinkingLevels } from "@bastani/pi-ai/compat";
 import { inspectRun } from "../runs/background/status.js";
 import { store } from "../shared/store.js";
 import type { WorkflowExecutionPolicy } from "../shared/types.js";

package/dist/builtin/workflows/src/runs/foreground/executor-stage-factory.ts

@@ -274,6 +274,11 @@ export function createWorkflowStageFactory(input: {
 		};
 		const dropStageControlForCompletion = async (): Promise<void> => {
 			runtime.dropStageControlHandle();
+			// A registry/session clear can release a confirmed-paused handle before
+			// its owner resumes. The handle is then ownerless, so normal completion
+			// must make the second disposal call that drains the controller's deferred
+			// cleanup instead of retaining the session and its listeners forever.
+			if (state.liveHandleReleased) await disposeInnerContext();
 		};
 		const throwIfStageMutationBlocked = (): void => {
 			if (state.stageClosedByWorkflowExit) {

package/dist/builtin/workflows/src/runs/foreground/stage-runner-controller.ts

@@ -229,6 +229,8 @@ export class StageSessionController {
 	private unresolvedContextOverflowMessage: string | undefined;
 	private generationSealed = false;
 	private disposed = false;
+	private pendingDisposal = false;
+	private disposalPromise: Promise<void> | undefined;
 	private pendingThinkingLevel: Parameters<StageContext["setThinkingLevel"]>[0] | undefined;
 	private readonly pendingListeners = new Set<(event: StageSessionEvent) => void>();
 	private readonly listenerUnsubscribes = new Map<(event: StageSessionEvent) => void, () => void>();
@@ -530,6 +532,17 @@ export class StageSessionController {
 	}
 
 	async disposeAll(): Promise<void> {
+		if (this.disposalPromise !== undefined) return this.disposalPromise;
+		if (this.pauseControl.isConfirmedPaused()) {
+			this.pendingDisposal = true;
+			return;
+		}
+		this.pendingDisposal = false;
+		this.disposalPromise = this.finishDisposeAll();
+		return this.disposalPromise;
+	}
+
+	private async finishDisposeAll(): Promise<void> {
 		this.disposed = true;
 		const reason = new Error(`atomic-workflows: stage "${this.opts.stageName}" session has been disposed`);
 		this.markAbort(reason);
@@ -546,11 +559,25 @@ export class StageSessionController {
 		await disposeStageSession(this.session);
 	}
 
+	/**
+	 * A disposal deferred by a confirmed pause still has to happen once that
+	 * pause is gone. Abort/kill rejects the parked waiter, so the session and its
+	 * listeners must be torn down here rather than leaked.
+	 */
+	private async drainPendingDisposal(): Promise<void> {
+		if (!this.pendingDisposal) return;
+		await this.disposeAll();
+	}
+
 	async abort(): Promise<void> {
 		const reason = new DOMException("stage aborted", "AbortError");
 		this.markAbort(reason);
 		this.pauseControl.reject(reason);
-		await this.session?.abort();
+		try {
+			await this.session?.abort();
+		} finally {
+			await this.drainPendingDisposal();
+		}
 	}
 	requestPause(): Promise<void> {
 		const pause = this.pauseControl.requestPause();
@@ -572,7 +599,12 @@ export class StageSessionController {
 		beforeResolve?: (result: StageSessionPauseResumeResult) => void,
 		beforeRelease?: () => void,
 	): Promise<StageSessionPauseResumeResult> {
-		return this.pauseControl.resume(message, beforeResolve, beforeRelease);
+		return this.pauseControl.resume(message, beforeResolve, beforeRelease).then((result) => {
+			// Ownership has returned to live execution, but a handle released while
+			// paused may already be gone from the registry. Keep the deferred-disposal
+			// marker so terminal teardown can drain it for this ownerless execution.
+			return result;
+		});
 	}
 	isPaused(): boolean {
 		return this.pauseControl.isPaused();
@@ -600,6 +632,7 @@ export class StageSessionController {
 			this.markAbort(reason);
 			void this.session?.abort().catch(() => {});
 			this.pauseControl.reject(reason);
+			void this.drainPendingDisposal().catch(() => {});
 		};
 		if (signal.aborted) onAbort();
 		else signal.addEventListener("abort", onAbort, { once: true });

package/dist/builtin/workflows/src/runs/foreground/stage-runner-options.ts

@@ -19,7 +19,7 @@ function workflowOrchestrationContext(
 		workflowRunId: meta.runId,
 		workflowStageId: meta.stageId,
 		workflowStageName: meta.stageName,
-		constraints: { disableWorkflowTool: true as const, maxSubagentDepth: 5 },
+		constraints: { disableWorkflowTool: true as const },
 	};
 	const intercomGroup = stageHasIntercomAccess(stageOptions)
 		? resolveStageGroup(stageOptions, meta.workflowIntercomGroup)

package/dist/builtin/workflows/src/runs/foreground/stage-runner-pause.ts

@@ -29,6 +29,7 @@ interface PauseRequest {
 	readonly abortBoundary: PromiseWithResolvers<void>;
 	readonly runnerOwnedDeliveries: Set<Promise<void>>;
 	readonly nativeQueuePause?: NativeQueuePauseControl;
+	confirmed: boolean;
 	resumePromise?: Promise<StageSessionPauseResumeResult>;
 }
 
@@ -47,6 +48,9 @@ export class StageSessionPause {
 	isPaused(): boolean {
 		return this.request !== null;
 	}
+	isConfirmedPaused(): boolean {
+		return this.request?.confirmed === true;
+	}
 
 	async requestPause(): Promise<void> {
 		if (this.request) return this.request.abortBoundary.promise;
@@ -56,6 +60,7 @@ export class StageSessionPause {
 			deferred: Promise.withResolvers<PauseResumeResolution>(),
 			abortBoundary: Promise.withResolvers<void>(),
 			runnerOwnedDeliveries: new Set(),
+			confirmed: false,
 			...(nativeQueuePause === undefined ? {} : { nativeQueuePause }),
 		};
 		void request.deferred.promise.catch(() => {});
@@ -67,6 +72,7 @@ export class StageSessionPause {
 			await session?.abort();
 			request.abortBoundary.resolve();
 			await request.abortBoundary.promise;
+			request.confirmed = true;
 		} catch (error) {
 			failed = true;
 			request.abortBoundary.reject(error);

package/dist/builtin/workflows/src/tui/chat-surface-message.ts

@@ -221,19 +221,21 @@ export function emitChatSurface(
 	// the stored `content`. Default to a complete printable rendering so
 	// headless `/workflow list|status|status <id>` is useful without a TUI.
 	const content = options.content ?? renderChatSurfacePlainText(payload);
-	(
-		send as unknown as (msg: {
-			customType: string;
-			content: string;
-			display: boolean;
-			details: ChatSurfacePayload;
-		}) => void
-	).call(pi, {
-		customType: CHAT_SURFACE_CUSTOM_TYPE,
-		content,
-		display: true,
-		details: payload,
-	});
+	void send.call(
+		pi,
+		{
+			customType: CHAT_SURFACE_CUSTOM_TYPE,
+			content,
+			display: true,
+			details: payload,
+		},
+		// A workflow card is an already-rendered transcript surface, not a request
+		// for a model turn. Without this, a card emitted while a turn is streaming
+		// is queued as steering behind that turn and does not appear until the turn
+		// ends — so `/workflow` dispatch/list/status cards raced any lifecycle
+		// notice that had just started a turn.
+		{ triggerTurn: false },
+	);
 }
 
 // ---------------------------------------------------------------------------

package/dist/builtin/workflows/src/tui/store-widget-installer.ts

@@ -62,6 +62,8 @@ export type WidgetRenderState = ReactiveWidgetRenderState;
 interface UiSlice {
 	setWidget?: (key: string, factory: WidgetFactory | undefined, opts?: { placement?: string }) => void;
 	requestRender?: () => void;
+	onWidgetRelease?: (key: string, listener: () => void) => () => void;
+	notify?: (message: string, type?: "info" | "warning" | "error") => void;
 }
 
 interface TimerApi extends ReactiveWidgetTimerApi {}
@@ -82,6 +84,15 @@ export interface LiveWidgetAPI {
 
 const WIDGET_KEY = "workflow.run";
 
+function reportWidgetFailure(ui: UiSlice | undefined, message: string): void {
+	if (ui?.notify) {
+		ui.notify.call(ui, message, "warning");
+		return;
+	}
+	console.error(message);
+	return;
+}
+
 function liveWidgetSnapshot(storeInstance: Store): StoreSnapshot {
 	return {
 		runs: storeInstance.runs(),
@@ -100,13 +111,22 @@ export function installStoreWidget(
 	timers: TimerApi = defaultTimerApi,
 ): () => void {
 	const ui = pi.ui;
-	if (!ui?.setWidget) return () => {};
+	if (!ui?.setWidget) {
+		// An absent ui slice is normal during extension load: factories run
+		// before the host binds ctx.ui, and session_start re-installs against
+		// the real UI. Only a present-but-widget-less ui names a degraded host.
+		if (ui) reportWidgetFailure(ui, "Workflow progress widget is unavailable in this host.");
+		return () => {};
+	}
+	const setWidget = ui.setWidget;
 
 	const requestRender = ui.requestRender;
+	const onWidgetRelease = ui.onWidgetRelease;
 	const controller = installReactiveWidget<StoreSnapshot, unknown>({
 		ui: {
-			setWidget: (key, factory, opts) => ui.setWidget?.(key, factory, opts),
+			setWidget: (key, factory, opts) => setWidget.call(ui, key, factory, opts),
 			...(requestRender ? { requestRender: () => requestRender.call(ui) } : {}),
+			...(onWidgetRelease ? { onWidgetRelease: (key, listener) => onWidgetRelease.call(ui, key, listener) } : {}),
 		},
 		key: WIDGET_KEY,
 		placement: "belowEditor",
@@ -121,6 +141,9 @@ export function installStoreWidget(
 		// writes that fight native main-chat scrollback).
 		requestRenderOnStateNoop: false,
 		isStaleError: isStaleExtensionContextError,
+		onMountError: (error) => {
+			reportWidgetFailure(ui, `Workflow progress widget could not mount: ${error.message}`);
+		},
 	});
 
 	return () => controller.dispose();

package/dist/bun/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { registerBunOAuthFlows } from "@earendil-works/pi-ai/bun-oauth";
+import { registerBunOAuthFlows } from "@bastani/pi-ai/bun-oauth";
 // Register before the application graph loads so Bun's standalone compiler embeds every login adapter.
 registerBunOAuthFlows();
 import { APP_NAME } from "../config.js";

package/dist/bun/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/bun/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE,uGAAuG;AACvG,qBAAqB,EAAE,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;AACzB,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,GAAE,CAAC,CAA+B,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,iBAAiB,EAAE,CAAC;AAEpB,0EAA0E;AAC1E,mDAAmD;AACnD,KAAK,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { registerBunOAuthFlows } from \"@earendil-works/pi-ai/bun-oauth\";\n\n// Register before the application graph loads so Bun's standalone compiler embeds every login adapter.\nregisterBunOAuthFlows();\n\nimport { APP_NAME } from \"../config.ts\";\n\nprocess.title = APP_NAME;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\nimport { restoreSandboxEnv } from \"./restore-sandbox-env.ts\";\n\nrestoreSandboxEnv();\n\n// No top-level await: the compiled binary is built with --bytecode (CJS),\n// which forbids TLA anywhere in the bundled graph.\nvoid import(\"./register-bedrock.ts\").then(() => import(\"../cli.ts\"));\n"]}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/bun/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,uGAAuG;AACvG,qBAAqB,EAAE,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;AACzB,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,GAAE,CAAC,CAA+B,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,iBAAiB,EAAE,CAAC;AAEpB,0EAA0E;AAC1E,mDAAmD;AACnD,KAAK,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { registerBunOAuthFlows } from \"@bastani/pi-ai/bun-oauth\";\n\n// Register before the application graph loads so Bun's standalone compiler embeds every login adapter.\nregisterBunOAuthFlows();\n\nimport { APP_NAME } from \"../config.ts\";\n\nprocess.title = APP_NAME;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\nimport { restoreSandboxEnv } from \"./restore-sandbox-env.ts\";\n\nrestoreSandboxEnv();\n\n// No top-level await: the compiled binary is built with --bytecode (CJS),\n// which forbids TLA anywhere in the bundled graph.\nvoid import(\"./register-bedrock.ts\").then(() => import(\"../cli.ts\"));\n"]}

package/dist/bun/register-bedrock.js

@@ -1,4 +1,4 @@
-import { bedrockProviderModule } from "@earendil-works/pi-ai/bedrock-provider";
-import { setBedrockProviderModule } from "@earendil-works/pi-ai/compat";
+import { bedrockProviderModule } from "@bastani/pi-ai/bedrock-provider";
+import { setBedrockProviderModule } from "@bastani/pi-ai/compat";
 setBedrockProviderModule(bedrockProviderModule);
 //# sourceMappingURL=register-bedrock.js.map

package/dist/bun/register-bedrock.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-bedrock.js","sourceRoot":"","sources":["../../src/bun/register-bedrock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,wBAAwB,CAAC,qBAAqB,CAAC,CAAC","sourcesContent":["import { bedrockProviderModule } from \"@earendil-works/pi-ai/bedrock-provider\";\nimport { setBedrockProviderModule } from \"@earendil-works/pi-ai/compat\";\n\nsetBedrockProviderModule(bedrockProviderModule);\n"]}
+{"version":3,"file":"register-bedrock.js","sourceRoot":"","sources":["../../src/bun/register-bedrock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,wBAAwB,CAAC,qBAAqB,CAAC,CAAC","sourcesContent":["import { bedrockProviderModule } from \"@bastani/pi-ai/bedrock-provider\";\nimport { setBedrockProviderModule } from \"@bastani/pi-ai/compat\";\n\nsetBedrockProviderModule(bedrockProviderModule);\n"]}

package/dist/cli/auth-check.d.ts

@@ -1,4 +1,4 @@
-import { type CredentialStore } from "@earendil-works/pi-ai";
+import { type CredentialStore } from "@bastani/pi-ai";
 import { ModelRuntime } from "../core/model-runtime.js";
 import type { Args } from "./args.ts";
 import { Secret } from "./credential-print.ts";

package/dist/cli/auth-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-check.d.ts","sourceRoot":"","sources":["../../src/cli/auth-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,eAAe,EAAe,MAAM,uBAAuB,CAAC;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAsC,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AAChE,MAAM,MAAM,eAAe,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,oBAAoB,GACpB,0BAA0B,GAC1B,eAAe,CAAC;AAEnB,MAAM,MAAM,eAAe,GACxB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAA;CAAE,GACpE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAOrE,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,OAAO,GAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,eAAe,CAAA;CAAuB,GAC/E,OAAO,CAAC,eAAe,CAAC,CAqC1B;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMnH;AAUD,kGAAkG;AAClG,wBAAsB,qBAAqB,CAC1C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,eAAe,EAC5B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa7B;AAED,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAarG"}
+{"version":3,"file":"auth-check.d.ts","sourceRoot":"","sources":["../../src/cli/auth-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,eAAe,EAAe,MAAM,gBAAgB,CAAC;AAEpF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAsC,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEnF,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AAChE,MAAM,MAAM,eAAe,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,oBAAoB,GACpB,0BAA0B,GAC1B,eAAe,CAAC;AAEnB,MAAM,MAAM,eAAe,GACxB;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAA;CAAE,GACpE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAClE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAOrE,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,OAAO,GAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,eAAe,CAAA;CAAuB,GAC/E,OAAO,CAAC,eAAe,CAAC,CAqC1B;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMnH;AAUD,kGAAkG;AAClG,wBAAsB,qBAAqB,CAC1C,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,eAAe,EAC5B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAa7B;AAED,wBAAsB,2BAA2B,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAarG"}

package/dist/cli/auth-check.js

@@ -1,4 +1,4 @@
-import { ModelsError } from "@earendil-works/pi-ai";
+import { ModelsError } from "@bastani/pi-ai";
 import { findExactModelReferenceMatch, resolveCliModel } from "../core/model-resolver.js";
 import { ModelRuntime } from "../core/model-runtime.js";
 import { InMemoryCodingAgentModelsStore } from "../core/models-store.js";

package/dist/cli/auth-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-check.js","sourceRoot":"","sources":["../../src/cli/auth-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAenF,KAAK,UAAU,oBAAoB,CAAC,UAAkB,EAAE,WAAwC;IAC/F,MAAM,UAAU,GAAG,MAAM,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,OAAO,UAAU,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAU,EACV,YAA0B,EAC1B,OAAO,GAAwD,EAAE,OAAO,EAAE,KAAK,EAAE;IAEjF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,QAAQ,GAAG,WAAW,CAAC;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,4BAA4B,QAAQ,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IAChF,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAC1F,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YAChF,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACjG,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,IAAU,EAAE,YAA0B,EAAE,QAAgB;IACzG,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACzF,OAAO,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA4B;IACtD,IAAI,IAAI,EAAE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAClD,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,UAAkB,EAClB,YAA0B,EAC1B,WAA4B,EAC5B,OAA6B;IAE7B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,kCAAkC;gBACvE,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;IACF,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CACnC,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,kBAAkB,EAAE,kCAAkC,EAAE,CAAC,CAClG,CAAC;IACF,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAA4B;IAC7E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;QACzC,WAAW;QACX,WAAW,EAAE,IAAI,8BAA8B,EAAE;QACjD,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC;AAChB,CAAC","sourcesContent":["import { type AuthResult, type CredentialStore, ModelsError } from \"@earendil-works/pi-ai\";\nimport { findExactModelReferenceMatch, resolveCliModel } from \"../core/model-resolver.ts\";\nimport { ModelRuntime } from \"../core/model-runtime.js\";\nimport { InMemoryCodingAgentModelsStore } from \"../core/models-store.ts\";\nimport type { Args } from \"./args.ts\";\nimport { AuthCommandError, validateAuthCheckArgs } from \"./auth-command.ts\";\nimport { DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS, Secret } from \"./credential-print.ts\";\n\nexport type AuthCheckStatus = \"ready\" | \"not_ready\" | \"invalid\";\nexport type AuthCheckReason =\n\t| \"provider_not_found\"\n\t| \"credentials_not_configured\"\n\t| \"credential_expired\"\n\t| \"credential_not_available\"\n\t| \"invalid_state\";\n\nexport type AuthCheckResult =\n\t| { status: \"ready\"; provider: string; authType: \"api_key\" | \"oauth\" }\n\t| { status: \"not_ready\"; provider: string; reason: AuthCheckReason }\n\t| { status: \"invalid\"; provider?: string; reason: \"invalid_state\" };\n\nasync function storedOAuthIsExpired(providerId: string, credentials: CredentialStore | undefined): Promise<boolean> {\n\tconst credential = await credentials?.read(providerId);\n\treturn credential?.type === \"oauth\" && Date.now() >= credential.expires;\n}\n\nexport async function checkProviderAuth(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\toptions: { refresh: boolean; credentials?: CredentialStore } = { refresh: false },\n): Promise<AuthCheckResult> {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCheckArgs(args);\n\tlet provider = cliProvider;\n\tif (cliModel) {\n\t\tconst resolved = resolveCliModel({ cliProvider, cliModel, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new AuthCommandError(resolved.error ?? `Unable to resolve model \"${cliModel}\"`);\n\t\t}\n\t\tprovider = resolved.model.provider;\n\t}\n\tif (!provider) throw new AuthCommandError(\"Unable to resolve an auth provider\");\n\tif (modelRuntime.getError()) {\n\t\treturn { status: \"invalid\", provider, reason: \"invalid_state\" };\n\t}\n\tif (!modelRuntime.getProvider(provider)) {\n\t\treturn { status: \"not_ready\", provider, reason: \"provider_not_found\" };\n\t}\n\ttry {\n\t\tconst auth = await modelRuntime.checkAuth(provider);\n\t\tif (!auth) return { status: \"not_ready\", provider, reason: \"credentials_not_configured\" };\n\t\tif (options.refresh) {\n\t\t\tif (!(await modelRuntime.getAuth(provider))) {\n\t\t\t\treturn { status: \"not_ready\", provider, reason: \"credentials_not_configured\" };\n\t\t\t}\n\t\t} else if (auth.type === \"oauth\" && (await storedOAuthIsExpired(provider, options.credentials))) {\n\t\t\t// checkAuth reports an OAuth credential's kind without considering its\n\t\t\t// expiry. A no-refresh probe cannot rescue an expired token, so report\n\t\t\t// it as not ready instead of claiming the next request would work.\n\t\t\treturn { status: \"not_ready\", provider, reason: \"credential_expired\" };\n\t\t}\n\t\treturn { status: \"ready\", provider, authType: auth.type };\n\t} catch (error) {\n\t\tif (error instanceof ModelsError && error.code === \"oauth\") {\n\t\t\treturn { status: \"not_ready\", provider, reason: \"credential_not_available\" };\n\t\t}\n\t\treturn { status: \"invalid\", provider, reason: \"invalid_state\" };\n\t}\n}\n\n/**\n * A credential export must name one target, not accept the CLI resolver's fuzzy\n * cross-provider match. Provider flags are explicit; a model-only export is\n * explicit only when its exact reference resolves uniquely to the provider.\n */\nexport function hasExplicitCredentialExportTarget(args: Args, modelRuntime: ModelRuntime, provider: string): boolean {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCheckArgs(args);\n\tif (cliProvider) return true;\n\tif (!cliModel) return false;\n\tconst exactModel = findExactModelReferenceMatch(cliModel, [...modelRuntime.getModels()]);\n\treturn exactModel?.provider.toLowerCase() === provider.toLowerCase();\n}\n\nfunction getAuthCredential(auth: AuthResult | undefined): string | undefined {\n\tif (auth?.auth.apiKey) return auth.auth.apiKey;\n\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t)?.[1];\n\treturn typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n}\n\n/** Resolve the credential that the checked provider would use, without exposing it to callers. */\nexport async function getProviderCredential(\n\tproviderId: string,\n\tmodelRuntime: ModelRuntime,\n\tcredentials: CredentialStore,\n\toptions: { refresh: boolean },\n): Promise<Secret | undefined> {\n\tif (!options.refresh) {\n\t\tconst stored = await credentials.read(providerId);\n\t\tif (stored?.type === \"oauth\") {\n\t\t\treturn stored.expires - Date.now() >= DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS\n\t\t\t\t? new Secret(stored.access)\n\t\t\t\t: undefined;\n\t\t}\n\t}\n\tconst credential = getAuthCredential(\n\t\tawait modelRuntime.getAuth(providerId, { minOAuthValidityMs: DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS }),\n\t);\n\treturn credential === undefined ? undefined : new Secret(credential);\n}\n\nexport async function createAuthCheckModelRuntime(credentials: CredentialStore): Promise<ModelRuntime> {\n\tconst runtime = await ModelRuntime.create({\n\t\tcredentials,\n\t\tmodelsStore: new InMemoryCodingAgentModelsStore(),\n\t\tallowModelNetwork: false,\n\t\trefreshOnCreate: false,\n\t});\n\t// The create-time refresh is intentionally skipped, so the snapshot has not\n\t// yet learned which stored providers are configured. Publish that metadata\n\t// without a catalog refresh, provider probe, network call, or auth.json write:\n\t// resolveCliModel needs it to choose a provider for an unqualified model ID.\n\tawait runtime.reloadCredentials({ refreshAvailability: false });\n\treturn runtime;\n}\n"]}
+{"version":3,"file":"auth-check.js","sourceRoot":"","sources":["../../src/cli/auth-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAenF,KAAK,UAAU,oBAAoB,CAAC,UAAkB,EAAE,WAAwC;IAC/F,MAAM,UAAU,GAAG,MAAM,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,OAAO,UAAU,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAU,EACV,YAA0B,EAC1B,OAAO,GAAwD,EAAE,OAAO,EAAE,KAAK,EAAE;IAEjF,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,QAAQ,GAAG,WAAW,CAAC;IAC3B,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,4BAA4B,QAAQ,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;IAChF,IAAI,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;QAC1F,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YAChF,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACjG,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,IAAU,EAAE,YAA0B,EAAE,QAAgB;IACzG,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACzF,OAAO,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA4B;IACtD,IAAI,IAAI,EAAE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAClD,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,UAAkB,EAClB,YAA0B,EAC1B,WAA4B,EAC5B,OAA6B;IAE7B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,kCAAkC;gBACvE,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,SAAS,CAAC;QACd,CAAC;IACF,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CACnC,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,kBAAkB,EAAE,kCAAkC,EAAE,CAAC,CAClG,CAAC;IACF,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,WAA4B;IAC7E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;QACzC,WAAW;QACX,WAAW,EAAE,IAAI,8BAA8B,EAAE;QACjD,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC;AAChB,CAAC","sourcesContent":["import { type AuthResult, type CredentialStore, ModelsError } from \"@bastani/pi-ai\";\nimport { findExactModelReferenceMatch, resolveCliModel } from \"../core/model-resolver.ts\";\nimport { ModelRuntime } from \"../core/model-runtime.js\";\nimport { InMemoryCodingAgentModelsStore } from \"../core/models-store.ts\";\nimport type { Args } from \"./args.ts\";\nimport { AuthCommandError, validateAuthCheckArgs } from \"./auth-command.ts\";\nimport { DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS, Secret } from \"./credential-print.ts\";\n\nexport type AuthCheckStatus = \"ready\" | \"not_ready\" | \"invalid\";\nexport type AuthCheckReason =\n\t| \"provider_not_found\"\n\t| \"credentials_not_configured\"\n\t| \"credential_expired\"\n\t| \"credential_not_available\"\n\t| \"invalid_state\";\n\nexport type AuthCheckResult =\n\t| { status: \"ready\"; provider: string; authType: \"api_key\" | \"oauth\" }\n\t| { status: \"not_ready\"; provider: string; reason: AuthCheckReason }\n\t| { status: \"invalid\"; provider?: string; reason: \"invalid_state\" };\n\nasync function storedOAuthIsExpired(providerId: string, credentials: CredentialStore | undefined): Promise<boolean> {\n\tconst credential = await credentials?.read(providerId);\n\treturn credential?.type === \"oauth\" && Date.now() >= credential.expires;\n}\n\nexport async function checkProviderAuth(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\toptions: { refresh: boolean; credentials?: CredentialStore } = { refresh: false },\n): Promise<AuthCheckResult> {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCheckArgs(args);\n\tlet provider = cliProvider;\n\tif (cliModel) {\n\t\tconst resolved = resolveCliModel({ cliProvider, cliModel, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new AuthCommandError(resolved.error ?? `Unable to resolve model \"${cliModel}\"`);\n\t\t}\n\t\tprovider = resolved.model.provider;\n\t}\n\tif (!provider) throw new AuthCommandError(\"Unable to resolve an auth provider\");\n\tif (modelRuntime.getError()) {\n\t\treturn { status: \"invalid\", provider, reason: \"invalid_state\" };\n\t}\n\tif (!modelRuntime.getProvider(provider)) {\n\t\treturn { status: \"not_ready\", provider, reason: \"provider_not_found\" };\n\t}\n\ttry {\n\t\tconst auth = await modelRuntime.checkAuth(provider);\n\t\tif (!auth) return { status: \"not_ready\", provider, reason: \"credentials_not_configured\" };\n\t\tif (options.refresh) {\n\t\t\tif (!(await modelRuntime.getAuth(provider))) {\n\t\t\t\treturn { status: \"not_ready\", provider, reason: \"credentials_not_configured\" };\n\t\t\t}\n\t\t} else if (auth.type === \"oauth\" && (await storedOAuthIsExpired(provider, options.credentials))) {\n\t\t\t// checkAuth reports an OAuth credential's kind without considering its\n\t\t\t// expiry. A no-refresh probe cannot rescue an expired token, so report\n\t\t\t// it as not ready instead of claiming the next request would work.\n\t\t\treturn { status: \"not_ready\", provider, reason: \"credential_expired\" };\n\t\t}\n\t\treturn { status: \"ready\", provider, authType: auth.type };\n\t} catch (error) {\n\t\tif (error instanceof ModelsError && error.code === \"oauth\") {\n\t\t\treturn { status: \"not_ready\", provider, reason: \"credential_not_available\" };\n\t\t}\n\t\treturn { status: \"invalid\", provider, reason: \"invalid_state\" };\n\t}\n}\n\n/**\n * A credential export must name one target, not accept the CLI resolver's fuzzy\n * cross-provider match. Provider flags are explicit; a model-only export is\n * explicit only when its exact reference resolves uniquely to the provider.\n */\nexport function hasExplicitCredentialExportTarget(args: Args, modelRuntime: ModelRuntime, provider: string): boolean {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCheckArgs(args);\n\tif (cliProvider) return true;\n\tif (!cliModel) return false;\n\tconst exactModel = findExactModelReferenceMatch(cliModel, [...modelRuntime.getModels()]);\n\treturn exactModel?.provider.toLowerCase() === provider.toLowerCase();\n}\n\nfunction getAuthCredential(auth: AuthResult | undefined): string | undefined {\n\tif (auth?.auth.apiKey) return auth.auth.apiKey;\n\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t)?.[1];\n\treturn typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n}\n\n/** Resolve the credential that the checked provider would use, without exposing it to callers. */\nexport async function getProviderCredential(\n\tproviderId: string,\n\tmodelRuntime: ModelRuntime,\n\tcredentials: CredentialStore,\n\toptions: { refresh: boolean },\n): Promise<Secret | undefined> {\n\tif (!options.refresh) {\n\t\tconst stored = await credentials.read(providerId);\n\t\tif (stored?.type === \"oauth\") {\n\t\t\treturn stored.expires - Date.now() >= DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS\n\t\t\t\t? new Secret(stored.access)\n\t\t\t\t: undefined;\n\t\t}\n\t}\n\tconst credential = getAuthCredential(\n\t\tawait modelRuntime.getAuth(providerId, { minOAuthValidityMs: DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS }),\n\t);\n\treturn credential === undefined ? undefined : new Secret(credential);\n}\n\nexport async function createAuthCheckModelRuntime(credentials: CredentialStore): Promise<ModelRuntime> {\n\tconst runtime = await ModelRuntime.create({\n\t\tcredentials,\n\t\tmodelsStore: new InMemoryCodingAgentModelsStore(),\n\t\tallowModelNetwork: false,\n\t\trefreshOnCreate: false,\n\t});\n\t// The create-time refresh is intentionally skipped, so the snapshot has not\n\t// yet learned which stored providers are configured. Publish that metadata\n\t// without a catalog refresh, provider probe, network call, or auth.json write:\n\t// resolveCliModel needs it to choose a provider for an unqualified model ID.\n\tawait runtime.reloadCredentials({ refreshAvailability: false });\n\treturn runtime;\n}\n"]}

package/dist/cli/credential-print.d.ts

@@ -22,7 +22,7 @@
  * candidate loop.
  */
 import { inspect } from "node:util";
-import { ModelsError } from "@earendil-works/pi-ai";
+import { ModelsError } from "@bastani/pi-ai";
 import type { ModelRuntime } from "../core/model-runtime.js";
 import type { Args } from "./args.ts";
 export type CredentialPrintKind = "api_key" | "bearer_token";

package/dist/cli/credential-print.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE7D,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAc,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC,OAAO,GACP,wBAAwB,GACxB,mBAAmB,GACnB,4BAA4B,GAC5B,eAAe,GACf,wBAAwB,GACxB,kBAAkB,GAClB,sBAAsB,GACtB,qBAAqB,CAAC;AAEzB;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAU/D,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,wBAAwB,CAEtE,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAKzF;CACD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,MAAM;;IAGlB,YAAY,KAAK,EAAE,MAAM,EAExB;IAED,qEAAqE;IACrE,IAAI,IAAI,MAAM,CAOb;IAED,QAAQ,IAAI,KAAK,CAEhB;IAED,MAAM,IAAI,KAAK,CAEd;IAED,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,CAE5B;IAED,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAEzB;CACD;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAO3E;AA6BD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAiB5D;AAsDD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY3D;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,6BAA6B,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,oBAAoB,CAe7E;AA8CD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CA6GjB"}
+{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE7D,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAc,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC,OAAO,GACP,wBAAwB,GACxB,mBAAmB,GACnB,4BAA4B,GAC5B,eAAe,GACf,wBAAwB,GACxB,kBAAkB,GAClB,sBAAsB,GACtB,qBAAqB,CAAC;AAEzB;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAU/D,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,wBAAwB,CAEtE,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAKzF;CACD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,MAAM;;IAGlB,YAAY,KAAK,EAAE,MAAM,EAExB;IAED,qEAAqE;IACrE,IAAI,IAAI,MAAM,CAOb;IAED,QAAQ,IAAI,KAAK,CAEhB;IAED,MAAM,IAAI,KAAK,CAEd;IAED,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,CAE5B;IAED,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAEzB;CACD;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAO3E;AA6BD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAiB5D;AAsDD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY3D;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,6BAA6B,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,oBAAoB,CAe7E;AA8CD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CA6GjB"}

package/dist/cli/credential-print.js

@@ -22,7 +22,7 @@
  * candidate loop.
  */
 import { inspect } from "node:util";
-import { ModelsError } from "@earendil-works/pi-ai";
+import { ModelsError } from "@bastani/pi-ai";
 import { resolveCliModel } from "../core/model-resolver.js";
 import { flushRawStdout, RawStdoutWriteError, writeRawStdoutOnce } from "../core/output-guard.js";
 /** Bearer tokens are refreshed unless they still have this much life left. */
@@ -421,7 +421,7 @@ export async function resolveCredentialForPrint(args, modelRuntime, kind, minExp
         // `checkAuth()` is the only non-mutating probe and cannot tell a candidate
         // that will authenticate from one that will fail, which is what keeps
         // exits 5 and 6 reachable. Nor does resolving without refreshing exist —
-        // `resolveStoredOAuth` in `@earendil-works/pi-ai` refreshes whenever the
+        // `resolveStoredOAuth` in `@bastani/pi-ai` refreshes whenever the
         // token falls inside `max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS,
         // minOAuthValidityMs ?? 0)`, so omitting `minOAuthValidityMs` only lowers
         // that window to five minutes and drops the post-refresh check exit 6 is