@bastani/atomic 0.9.21-alpha.1 → 0.9.21-alpha.2

package/dist/builtin/workflows/src/index.js

@@ -51078,7 +51078,9 @@ import { createStructuredOutputCapture, runCallback as runCallback2 } from "@bas
 import {
   AutoRoutingInferenceError,
   convertToLlm,
-  parseModelConstraints
+  isModelRoutingDebugEnabled,
+  parseModelConstraints,
+  setsProviders
 } from "@bastani/atomic";
 
 // dist/builtin/workflows/src/runs/shared/model-fallback-candidates.ts
@@ -51819,6 +51821,7 @@ function stripWorkflowOnlyOptions(options, defaultSessionDir, meta, pendingStage
     fallbackModels: _fallbackModels,
     fallbackThinkingLevels: _fallbackThinkingLevels,
     modelConstraints: _modelConstraints,
+    taskNeeds: _taskNeeds,
     inheritedModelConstraints: _inheritedModelConstraints,
     routerSelection: _routerSelection,
     context,
@@ -52673,7 +52676,9 @@ class StageSessionController {
             stageName: this.opts.stageName,
             constraints,
             signal: this.startupWait.signal,
-            selection: options?.routerSelection
+            selection: options?.routerSelection,
+            ...options?.taskNeeds ? { taskNeeds: options.taskNeeds } : {},
+            ...setsProviders(parseModelConstraints(options?.modelConstraints)) ? { overrideProviderSettings: true } : {}
           });
         } catch (error) {
           this.startupWait.signal.throwIfAborted();
@@ -52681,7 +52686,8 @@ class StageSessionController {
           if (!(error instanceof AutoRoutingInferenceError) || error.currentModelRoute === undefined)
             throw error;
           this.modelRoute = error.currentModelRoute;
-          this.modelCatalog?.recordWarning?.(`workflows: stage auto routing failed; running "${this.opts.stageName}" on the current chat model ${this.modelRoute.modelOverride}.`);
+          if (isModelRoutingDebugEnabled())
+            this.modelCatalog?.recordWarning?.(`workflows: stage auto routing failed; running "${this.opts.stageName}" on the current chat model ${this.modelRoute.modelOverride}.`);
         }
         this.modelRoute.assertCurrent();
         this.meta.stageOptions = { ...options, model: this.modelRoute.modelOverride };

package/dist/builtin/workflows/src/shared/authoring-contract-stage.d.ts

@@ -1,5 +1,5 @@
 /** Workflow authoring primitives, stage/session contracts, and task option types. */
-import type { ModelConstraints, ModelRoute, ModelRouterOutput } from "@bastani/atomic";
+import type { ModelConstraints, ModelRoute, ModelRouterOutput, TaskNeeds } from "@bastani/atomic";
 import type { Static, TSchema } from "typebox";
 export type { Static, TSchema };
 export type WorkflowSerializablePrimitive = string | number | boolean | null;
@@ -90,6 +90,9 @@ export interface WorkflowModelCatalogPort {
         constraints: readonly ModelConstraints[];
         signal?: AbortSignal;
         selection?: ModelRouterOutput;
+        taskNeeds?: TaskNeeds;
+        /** The stage's own constraints set a provider list, replacing the user's provider settings. */
+        overrideProviderSettings?: boolean;
     }): Promise<ModelRoute>;
     readonly currentModel?: WorkflowModelValue;
     readonly preferredProvider?: string;
@@ -130,6 +133,8 @@ export interface StageOptions<TSchemaDef extends TSchema | undefined = TSchema |
     readonly model?: WorkflowModelValue;
     /** Hard restrictions for automatic model selection and its execution fallbacks. */
     readonly modelConstraints?: ModelConstraints;
+    /** What the author already knows about the task, for `model: "auto"`; routing asks only for the rest. */
+    readonly taskNeeds?: TaskNeeds;
     readonly mcp?: StageMcpOptions;
     readonly tools?: readonly string[];
     readonly noTools?: "all" | "builtin";

package/dist/cli/auth-command.js

@@ -1,5 +1,10 @@
 import { APP_NAME } from "../config.js";
 export class AuthCommandError extends Error {
+    // Declared and assigned explicitly rather than as a constructor parameter
+    // property: `tsconfig.base.json` sets `erasableSyntaxOnly`, under which a
+    // parameter property is TS1294. Root `tsc --noEmit` does not surface it,
+    // but the shipped build does.
+    exitCode;
     constructor(message, exitCode = 1) {
         super(message);
         this.exitCode = exitCode;

package/dist/cli/auth-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-command.js","sourceRoot":"","sources":["../../src/cli/auth-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAgBxC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAO1C,YAAY,OAAe,EAAE,QAAQ,GAAG,CAAC;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAED,MAAM,kBAAkB,GAAoC;IAC3D,KAAK,EAAE,GAAG,QAAQ,+FAA+F;IACjH,OAAO,EAAE,GAAG,QAAQ,6DAA6D;IACjF,YAAY,EAAE,GAAG,QAAQ,4FAA4F;CACrH,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACvD,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACxD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC/C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxE,0EAA0E;IAC1E,sFAAsF;IACtF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,CAAC,KAAK,CAAC;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEAqCqD,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,QAAgB;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,oDAAoD,EAAE,QAAQ,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AACjC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GACT,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAClB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB;gBACjC,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACzB,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,QAAQ,0BAA0B,QAAQ,kCAAkC,QAAQ,eAAe,CACpJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAA+B,CAAC;IACpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,YAAY,GAAG,IAAI,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACV,CAAC;QACD,MAAM,eAAe,GAAG,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,IAAI,GAAG,KAAK,cAAc,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAC7D,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,gBAAgB,CAAC,sDAAsD,EAAE,QAAQ,CAAC,CAAC;YAC9F,CAAC;YACD,WAAW,GAAG,aAAa,CAAC,eAAe,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxE,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,cAAc,CAAC,EAAE,CAAC;YAC9F,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,kCAAkC,EAAE,QAAQ,CAAC,CAAC;YACrG,IAAI,GAAG,KAAK,QAAQ;gBAAE,IAAI,GAAG,IAAI,CAAC;iBAC7B,IAAI,GAAG,KAAK,eAAe;gBAAE,WAAW,GAAG,IAAI,CAAC;;gBAChD,SAAS,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;QAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,MAAM,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,8DAA8D,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["import { APP_NAME } from \"../config.js\";\nimport type { Args } from \"./args.ts\";\n\nexport type AuthCommandKind = \"check\" | \"api_key\" | \"bearer_token\";\n\nexport interface AuthCommand {\n\tkind: AuthCommandKind;\n\t/** Remaining argv for the normal parser. */\n\targs: string[];\n\tjson: boolean;\n\t/** `auth check` emits a resolved credential only with this explicit opt-in. */\n\tcredentials: boolean;\n\tnoRefresh: boolean;\n\tminExpiryMs?: number;\n}\n\nexport class AuthCommandError extends Error {\n\t// Declared and assigned explicitly rather than as a constructor parameter\n\t// property: `tsconfig.base.json` sets `erasableSyntaxOnly`, under which a\n\t// parameter property is TS1294. Root `tsc --noEmit` does not surface it,\n\t// but the shipped build does.\n\treadonly exitCode: number;\n\n\tconstructor(message: string, exitCode = 1) {\n\t\tsuper(message);\n\t\tthis.exitCode = exitCode;\n\t\tthis.name = \"AuthCommandError\";\n\t}\n}\n\nconst AUTH_COMMAND_USAGE: Record<AuthCommandKind, string> = {\n\tcheck: `${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]`,\n\tapi_key: `${APP_NAME} auth print-api-key --model <model> [--provider <provider>]`,\n\tbearer_token: `${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]`,\n};\n\nexport function getAuthCommandName(kind: AuthCommandKind): string {\n\treturn kind === \"check\" ? \"auth check\" : kind === \"api_key\" ? \"auth print-api-key\" : \"auth print-bearer-token\";\n}\n\nexport function getAuthCommandUsage(kind: AuthCommandKind): string {\n\treturn AUTH_COMMAND_USAGE[kind];\n}\n\nexport function isAuthCommandHelp(args: string[]): boolean {\n\tif (args[0] !== \"auth\") return false;\n\tif (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\") return true;\n\tconst terminator = args.indexOf(\"--\", 2);\n\tconst flags = args.slice(2, terminator === -1 ? undefined : terminator);\n\t// Checks accept direct help flags. The print commands reserve every extra\n\t// parser flag, including --help, as a usage error to keep their export stream narrow.\n\treturn args[1] === \"check\" && (flags.includes(\"--help\") || flags.includes(\"-h\"));\n}\n\nexport function printAuthCommandHelp(): void {\n\tconsole.error(`Usage:\n  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]\n  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n  ${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]\n\nCredential print commands write one configured credential alone on stdout. Everything else —\nwarnings, provider selection, refresh notices, and help — goes to stderr. --model is\nrequired for these exports, so no ambient model can emit a credential you did not name.\n\nAuth checks require at least one of --provider or --model. They print ready, not_ready,\nor invalid on stdout and refresh expired OAuth credentials by default; --no-refresh\nprevents a refresh and any auth.json mutation. --json includes the resolved provider\nwhen one is found, plus auth type and a reason when it is not ready. --credentials is\nan explicit export that needs --provider or an exact --model target; on a ready check\nit writes the credential, or includes it in JSON. A non-ready raw export leaves stdout\nempty and reports status on stderr.\n\n--min-expiry accepts ms, s, m, or h (for example 30m) and applies only to\nprint-bearer-token, where it defaults to 30m. A token with less than that\nremaining is refreshed first. It remains reserved after --, so print-api-key\nstill rejects it in either spelling.\n\nCredential-export exit codes:\n  0  credential written to stdout\n  1  usage error\n  2  no credential configured\n  3  provider ambiguous\n  4  credential kind unsupported for that provider\n  5  refresh failed (the stored credential is left untouched)\n  6  provider cannot mint a token that lives long enough\n  7  the provider's OAuth credential could not be used\n  8  the credential could not be written (nothing was emitted)\n  9  the credential was written only in part; stdout holds an unusable\n     fragment, which the caller must discard rather than use\n\nAuth-check exit codes:\n  0  provider is ready\n  1  provider is not ready\n  2  auth state or command is invalid\n  8  with --credentials, the credential could not be written\n  9  with --credentials, only part of the credential was written`);\n}\n\nfunction parseDuration(value: string | undefined, exitCode: number): number {\n\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\tif (!match) throw new AuthCommandError(\"--min-expiry must use a duration such as 30m or 1h\", exitCode);\n\tconst unit = match[2].toLowerCase();\n\tconst scale = unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000;\n\treturn Number(match[1]) * scale;\n}\n\n/** Parse the `atomic auth` command surface before normal startup. */\nexport function parseAuthCommand(args: string[]): AuthCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind: AuthCommandKind | undefined =\n\t\targs[1] === \"check\"\n\t\t\t? \"check\"\n\t\t\t: args[1] === \"print-api-key\"\n\t\t\t\t? \"api_key\"\n\t\t\t\t: args[1] === \"print-bearer-token\"\n\t\t\t\t\t? \"bearer_token\"\n\t\t\t\t\t: undefined;\n\tif (!kind) {\n\t\tthrow new AuthCommandError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\", \"${APP_NAME} auth print-bearer-token\", or \"${APP_NAME} auth check\".`,\n\t\t);\n\t}\n\n\tconst exitCode = kind === \"check\" ? 2 : 1;\n\tconst commandArgs: string[] = [];\n\tlet json = false;\n\tlet credentials = false;\n\tlet noRefresh = false;\n\tlet minExpiryMs: number | undefined;\n\tlet optionsEnded = false;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (arg === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcommandArgs.push(arg);\n\t\t\tcontinue;\n\t\t}\n\t\tconst inlineMinExpiry = arg.startsWith(\"--min-expiry=\") ? arg.slice(\"--min-expiry=\".length) : undefined;\n\t\tif (arg === \"--min-expiry\" || inlineMinExpiry !== undefined) {\n\t\t\tif (kind !== \"bearer_token\") {\n\t\t\t\tthrow new AuthCommandError(\"--min-expiry is only supported by print-bearer-token\", exitCode);\n\t\t\t}\n\t\t\tminExpiryMs = parseDuration(inlineMinExpiry ?? args[++index], exitCode);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!optionsEnded && (arg === \"--json\" || arg === \"--credentials\" || arg === \"--no-refresh\")) {\n\t\t\tif (kind !== \"check\") throw new AuthCommandError(`${arg} is only supported by auth check`, exitCode);\n\t\t\tif (arg === \"--json\") json = true;\n\t\t\telse if (arg === \"--credentials\") credentials = true;\n\t\t\telse noRefresh = true;\n\t\t\tcontinue;\n\t\t}\n\t\tcommandArgs.push(arg);\n\t}\n\n\treturn minExpiryMs === undefined\n\t\t? { kind, args: commandArgs, json, credentials, noRefresh }\n\t\t: { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };\n}\n\nexport function validateAuthCheckArgs(args: Args): { provider?: string; model?: string } {\n\tconst provider = args.provider?.trim() || undefined;\n\tconst model = args.model?.trim() || undefined;\n\tif (args.unknownFlags.size > 0) {\n\t\tconst option = args.unknownFlags.keys().next().value;\n\t\tthrow new AuthCommandError(`Unknown option --${option} for \"auth check\".`);\n\t}\n\tif (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {\n\t\tthrow new AuthCommandError(\"Auth checks only accept --provider and --model\");\n\t}\n\tif (!provider && !model) {\n\t\tthrow new AuthCommandError(\"Auth checks require --provider <provider> or --model <model>\");\n\t}\n\treturn { provider, model };\n}\n"]}
+{"version":3,"file":"auth-command.js","sourceRoot":"","sources":["../../src/cli/auth-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAgBxC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAC1C,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,8BAA8B;IACrB,QAAQ,CAAS;IAE1B,YAAY,OAAe,EAAE,QAAQ,GAAG,CAAC;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAED,MAAM,kBAAkB,GAAoC;IAC3D,KAAK,EAAE,GAAG,QAAQ,+FAA+F;IACjH,OAAO,EAAE,GAAG,QAAQ,6DAA6D;IACjF,YAAY,EAAE,GAAG,QAAQ,4FAA4F;CACrH,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACvD,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACxD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC/C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxE,0EAA0E;IAC1E,sFAAsF;IACtF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,CAAC,KAAK,CAAC;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEAqCqD,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,QAAgB;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,oDAAoD,EAAE,QAAQ,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AACjC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GACT,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAClB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB;gBACjC,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACzB,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,QAAQ,0BAA0B,QAAQ,kCAAkC,QAAQ,eAAe,CACpJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAA+B,CAAC;IACpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,YAAY,GAAG,IAAI,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACV,CAAC;QACD,MAAM,eAAe,GAAG,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,IAAI,GAAG,KAAK,cAAc,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAC7D,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,gBAAgB,CAAC,sDAAsD,EAAE,QAAQ,CAAC,CAAC;YAC9F,CAAC;YACD,WAAW,GAAG,aAAa,CAAC,eAAe,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxE,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,cAAc,CAAC,EAAE,CAAC;YAC9F,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,kCAAkC,EAAE,QAAQ,CAAC,CAAC;YACrG,IAAI,GAAG,KAAK,QAAQ;gBAAE,IAAI,GAAG,IAAI,CAAC;iBAC7B,IAAI,GAAG,KAAK,eAAe;gBAAE,WAAW,GAAG,IAAI,CAAC;;gBAChD,SAAS,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;QAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,MAAM,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,8DAA8D,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["import { APP_NAME } from \"../config.js\";\nimport type { Args } from \"./args.ts\";\n\nexport type AuthCommandKind = \"check\" | \"api_key\" | \"bearer_token\";\n\nexport interface AuthCommand {\n\tkind: AuthCommandKind;\n\t/** Remaining argv for the normal parser. */\n\targs: string[];\n\tjson: boolean;\n\t/** `auth check` emits a resolved credential only with this explicit opt-in. */\n\tcredentials: boolean;\n\tnoRefresh: boolean;\n\tminExpiryMs?: number;\n}\n\nexport class AuthCommandError extends Error {\n\t// Declared and assigned explicitly rather than as a constructor parameter\n\t// property: `tsconfig.base.json` sets `erasableSyntaxOnly`, under which a\n\t// parameter property is TS1294. Root `tsc --noEmit` does not surface it,\n\t// but the shipped build does.\n\treadonly exitCode: number;\n\n\tconstructor(message: string, exitCode = 1) {\n\t\tsuper(message);\n\t\tthis.exitCode = exitCode;\n\t\tthis.name = \"AuthCommandError\";\n\t}\n}\n\nconst AUTH_COMMAND_USAGE: Record<AuthCommandKind, string> = {\n\tcheck: `${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]`,\n\tapi_key: `${APP_NAME} auth print-api-key --model <model> [--provider <provider>]`,\n\tbearer_token: `${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]`,\n};\n\nexport function getAuthCommandName(kind: AuthCommandKind): string {\n\treturn kind === \"check\" ? \"auth check\" : kind === \"api_key\" ? \"auth print-api-key\" : \"auth print-bearer-token\";\n}\n\nexport function getAuthCommandUsage(kind: AuthCommandKind): string {\n\treturn AUTH_COMMAND_USAGE[kind];\n}\n\nexport function isAuthCommandHelp(args: string[]): boolean {\n\tif (args[0] !== \"auth\") return false;\n\tif (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\") return true;\n\tconst terminator = args.indexOf(\"--\", 2);\n\tconst flags = args.slice(2, terminator === -1 ? undefined : terminator);\n\t// Checks accept direct help flags. The print commands reserve every extra\n\t// parser flag, including --help, as a usage error to keep their export stream narrow.\n\treturn args[1] === \"check\" && (flags.includes(\"--help\") || flags.includes(\"-h\"));\n}\n\nexport function printAuthCommandHelp(): void {\n\tconsole.error(`Usage:\n  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]\n  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n  ${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]\n\nCredential print commands write one configured credential alone on stdout. Everything else —\nwarnings, provider selection, refresh notices, and help — goes to stderr. --model is\nrequired for these exports, so no ambient model can emit a credential you did not name.\n\nAuth checks require at least one of --provider or --model. They print ready, not_ready,\nor invalid on stdout and refresh expired OAuth credentials by default; --no-refresh\nprevents a refresh and any auth.json mutation. --json includes the resolved provider\nwhen one is found, plus auth type and a reason when it is not ready. --credentials is\nan explicit export that needs --provider or an exact --model target; on a ready check\nit writes the credential, or includes it in JSON. A non-ready raw export leaves stdout\nempty and reports status on stderr.\n\n--min-expiry accepts ms, s, m, or h (for example 30m) and applies only to\nprint-bearer-token, where it defaults to 30m. A token with less than that\nremaining is refreshed first. It remains reserved after --, so print-api-key\nstill rejects it in either spelling.\n\nCredential-export exit codes:\n  0  credential written to stdout\n  1  usage error\n  2  no credential configured\n  3  provider ambiguous\n  4  credential kind unsupported for that provider\n  5  refresh failed (the stored credential is left untouched)\n  6  provider cannot mint a token that lives long enough\n  7  the provider's OAuth credential could not be used\n  8  the credential could not be written (nothing was emitted)\n  9  the credential was written only in part; stdout holds an unusable\n     fragment, which the caller must discard rather than use\n\nAuth-check exit codes:\n  0  provider is ready\n  1  provider is not ready\n  2  auth state or command is invalid\n  8  with --credentials, the credential could not be written\n  9  with --credentials, only part of the credential was written`);\n}\n\nfunction parseDuration(value: string | undefined, exitCode: number): number {\n\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\tif (!match) throw new AuthCommandError(\"--min-expiry must use a duration such as 30m or 1h\", exitCode);\n\tconst unit = match[2].toLowerCase();\n\tconst scale = unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000;\n\treturn Number(match[1]) * scale;\n}\n\n/** Parse the `atomic auth` command surface before normal startup. */\nexport function parseAuthCommand(args: string[]): AuthCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind: AuthCommandKind | undefined =\n\t\targs[1] === \"check\"\n\t\t\t? \"check\"\n\t\t\t: args[1] === \"print-api-key\"\n\t\t\t\t? \"api_key\"\n\t\t\t\t: args[1] === \"print-bearer-token\"\n\t\t\t\t\t? \"bearer_token\"\n\t\t\t\t\t: undefined;\n\tif (!kind) {\n\t\tthrow new AuthCommandError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\", \"${APP_NAME} auth print-bearer-token\", or \"${APP_NAME} auth check\".`,\n\t\t);\n\t}\n\n\tconst exitCode = kind === \"check\" ? 2 : 1;\n\tconst commandArgs: string[] = [];\n\tlet json = false;\n\tlet credentials = false;\n\tlet noRefresh = false;\n\tlet minExpiryMs: number | undefined;\n\tlet optionsEnded = false;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (arg === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcommandArgs.push(arg);\n\t\t\tcontinue;\n\t\t}\n\t\tconst inlineMinExpiry = arg.startsWith(\"--min-expiry=\") ? arg.slice(\"--min-expiry=\".length) : undefined;\n\t\tif (arg === \"--min-expiry\" || inlineMinExpiry !== undefined) {\n\t\t\tif (kind !== \"bearer_token\") {\n\t\t\t\tthrow new AuthCommandError(\"--min-expiry is only supported by print-bearer-token\", exitCode);\n\t\t\t}\n\t\t\tminExpiryMs = parseDuration(inlineMinExpiry ?? args[++index], exitCode);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!optionsEnded && (arg === \"--json\" || arg === \"--credentials\" || arg === \"--no-refresh\")) {\n\t\t\tif (kind !== \"check\") throw new AuthCommandError(`${arg} is only supported by auth check`, exitCode);\n\t\t\tif (arg === \"--json\") json = true;\n\t\t\telse if (arg === \"--credentials\") credentials = true;\n\t\t\telse noRefresh = true;\n\t\t\tcontinue;\n\t\t}\n\t\tcommandArgs.push(arg);\n\t}\n\n\treturn minExpiryMs === undefined\n\t\t? { kind, args: commandArgs, json, credentials, noRefresh }\n\t\t: { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };\n}\n\nexport function validateAuthCheckArgs(args: Args): { provider?: string; model?: string } {\n\tconst provider = args.provider?.trim() || undefined;\n\tconst model = args.model?.trim() || undefined;\n\tif (args.unknownFlags.size > 0) {\n\t\tconst option = args.unknownFlags.keys().next().value;\n\t\tthrow new AuthCommandError(`Unknown option --${option} for \"auth check\".`);\n\t}\n\tif (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {\n\t\tthrow new AuthCommandError(\"Auth checks only accept --provider and --model\");\n\t}\n\tif (!provider && !model) {\n\t\tthrow new AuthCommandError(\"Auth checks require --provider <provider> or --model <model>\");\n\t}\n\treturn { provider, model };\n}\n"]}

package/dist/cli/credential-print.js

@@ -51,6 +51,8 @@ export const EXIT_CODES = {
 /** The codes whose contract is an empty stdout. See `EXIT_CODES`. */
 export const STDOUT_EMPTY_ON_EXIT = new Set(Object.keys(EXIT_CODES).filter((code) => code !== "CredentialTruncated"));
 export class CredentialPrintError extends Error {
+    code;
+    exitCode;
     constructor(code, message, options) {
         super(message, options);
         this.name = "CredentialPrintError";

package/dist/cli/credential-print.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-print.js","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlG,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,MAAM,CAAC;AAiB9D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAA6C;IACnE,KAAK,EAAE,CAAC;IACR,sBAAsB,EAAE,CAAC;IACzB,iBAAiB,EAAE,CAAC;IACpB,0BAA0B,EAAE,CAAC;IAC7B,aAAa,EAAE,CAAC;IAChB,sBAAsB,EAAE,CAAC;IACzB,gBAAgB,EAAE,CAAC;IACnB,oBAAoB,EAAE,CAAC;IACvB,mBAAmB,EAAE,CAAC;CACtB,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAA0C,IAAI,GAAG,CAChF,MAAM,CAAC,IAAI,CAAC,UAAU,CAAgC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,qBAAqB,CAAC,CACxG,CAAC;AAEF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAI9C,YAAY,IAA8B,EAAE,OAAe,EAAE,OAA6B;QACzF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,MAAM;IAClB,MAAM,CAAqB;IAE3B,YAAY,KAAa;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,qEAAqE;IACrE,IAAI;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,QAAQ;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM;QACL,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC9D,CAAC;IAED,CAAC,MAAM,CAAC,WAAW,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IAED,CAAC,OAAO,CAAC,MAAM,CAAC;QACf,OAAO,UAAU,CAAC;IACnB,CAAC;CACD;AASD;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,MAAc,EAAE,UAA4C;IACtF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;IAE1D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC;IAClD,IACC,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,EACvD,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnD,CAAC;IAED,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,UAA4C;IAChG,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC;QACJ,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,OAAO,CAAC,KAAK,CACZ,kFAAkF,KAAK,CAAC,OAAO,EAAE,CACjG,CAAC;YACF,OAAO;QACR,CAAC;QACD,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,oBAAoB,CAC7B,qBAAqB,EACrB,+FAA+F,EAC/F,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,sBAAsB,EACtB,+DAA+D,EAC/D,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,cAAc,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CACZ,uFACC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACtD,EAAE,CACF,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,oBAAoB,CAC9B,wBAAwB,EACxB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,IAAU;IACrC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAU;IACrD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAC7B,OAAO,EACP,8EAA8E,CAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,oBAAoB,CAC7B,OAAO,EACP,qEAAqE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1F,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,iBAAiB,GAAsB;IAC5C,4EAA4E;IAC5E,4BAA4B;IAC5B,kEAAkE;IAClE,qCAAqC;IACrC,4EAA4E;IAC5E,0DAA0D;CAC1D,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAC1B,oMAAoM,CAAC;AAEtM;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,4CAA4C,CAAC;AAE5E,MAAM,mBAAmB,GAAsB;IAC9C,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,qBAAqB,aAAa,sBAAsB,kBAAkB,EAAE,KAAK,CAAC;IAC5G,kEAAkE;IAClE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,UAAU,qBAAqB,+BAA+B,EAAE,KAAK,CAAC;IAC3F,kDAAkD;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,qBAAqB,qBAAqB,EAAE,KAAK,CAAC;CAC5E,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CACnB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjC,oEAAoE;QACpE,2CAA2C;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IACvF,CAAC,CAAC,EACH,IAAI,CACJ,CAAC;IACF,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,oBAAoB,CAC9B,wBAAwB,EACxB,gFAAgF,MAAM,EAAE,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,oBAAoB,CAAC,eAAe,EAAE,GAAG,MAAM,6CAA6C,EAAE;YACxG,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,IAAU,EAAE,YAA0B;IAC9D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAClE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,UAAU,IAAI,CAAC,KAAK,uFAAuF,CAC3G,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4C;IACtE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAU,EACV,YAA0B,EAC1B,IAAyB,EACzB,WAAoB;IAEpB,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAElC,yEAAyE;IACzE,8BAA8B;IAC9B,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,cAAc,GAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnD,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC9C,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,6BAA6B;IAC7B,IAAI,iBAAmD,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QAEtC,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,kEAAkE;QAClE,6DAA6D;QAC7D,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,IAAkD,CAAC;QACvD,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAChC,KAAK,EACL,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,IAAI,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,SAAS,GACd,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,iBAAiB,KAAK,SAAS,CAAC;gBAChC,SAAS;YACV,CAAC;YACD,IAAI,SAAS;gBAAE,MAAM,SAAS,CAAC;YAC/B,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC9E,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GACV,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC5G,IAAI,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEtE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,iBAAiB;YAAE,MAAM,iBAAiB,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAC7B,4BAA4B,EAC5B,aAAa,UAAU,4CAA4C,CACnE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,oBAAoB,CAC7B,4BAA4B,EAC5B,aAAa,UAAU,gDAAgD,CACvE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,aAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,gBAAgB,CAClF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,EACnB,UAAU,IAAI,CAAC,KAAK,wCAAwC,WAAW;SACrE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC;SACnC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACpC,CAAC;AACH,CAAC","sourcesContent":["/**\n * `atomic auth print-api-key` / `atomic auth print-bearer-token` and the\n * explicit `atomic auth check --credentials` export path.\n *\n * The only door in Atomic whose purpose is emitting a secret. Everything here\n * exists to keep that egress narrow:\n * - the secret leaves as a `Secret`, which cannot be interpolated, serialized,\n *   or inspected, and is consumed exactly once by the stdout writer;\n * - every export has an explicit target: the print commands require `--model`,\n *   and auth checks require `--provider` or an exact `--model` plus\n *   `--credentials`;\n * - there is no `--output <file>` and no clipboard path — stdout only;\n * - every failure is a distinct exit code, and stdout stays empty on all of\n *   them but one — `CredentialTruncated` (exit 9) exists to report the case\n *   where it cannot be, because bytes already left and cannot be recalled;\n * - a failed OAuth refresh never mutates the stored credential.\n *\n * One residual, and it is upstream: when a model infers several eligible\n * providers, each is asked for its credential before the ambiguity is known, so\n * a *successful* refresh can rotate and persist a credential this command then\n * declines to emit (exit 3). See the note on the `getAuth()` call in the\n * candidate loop.\n */\n\nimport { inspect } from \"node:util\";\nimport type { Api, AuthType, Model } from \"@bastani/pi-ai\";\nimport { ModelsError } from \"@bastani/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.js\";\nimport { flushRawStdout, RawStdoutWriteError, writeRawStdoutOnce } from \"../core/output-guard.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type CredentialPrintKind = \"api_key\" | \"bearer_token\";\n\n/** Bearer tokens are refreshed unless they still have this much life left. */\nexport const DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\n/**\n * Failure taxonomy. Each member owns one exit code, so a caller can branch on\n * the status without parsing stderr.\n */\nexport type CredentialPrintErrorCode =\n\t| \"Usage\"\n\t| \"NoCredentialConfigured\"\n\t| \"ProviderAmbiguous\"\n\t| \"KindUnsupportedForProvider\"\n\t| \"RefreshFailed\"\n\t| \"MinValidityUnreachable\"\n\t| \"OAuthUnavailable\"\n\t| \"CredentialNotEmitted\"\n\t| \"CredentialTruncated\";\n\n/**\n * Exported so a test can walk the whole taxonomy: every declared code has to\n * name an exercised path, and the record type makes a new member without an\n * exit code a compile error rather than a review miss.\n *\n * Every one of these leaves stdout empty except `CredentialTruncated`, which\n * exists to report the one case where it cannot be: bytes already went out and\n * cannot be recalled. `STDOUT_EMPTY_ON_EXIT` names that split so the taxonomy\n * test asserts it rather than assuming it.\n */\nexport const EXIT_CODES: Record<CredentialPrintErrorCode, number> = {\n\tUsage: 1,\n\tNoCredentialConfigured: 2,\n\tProviderAmbiguous: 3,\n\tKindUnsupportedForProvider: 4,\n\tRefreshFailed: 5,\n\tMinValidityUnreachable: 6,\n\tOAuthUnavailable: 7,\n\tCredentialNotEmitted: 8,\n\tCredentialTruncated: 9,\n};\n\n/** The codes whose contract is an empty stdout. See `EXIT_CODES`. */\nexport const STDOUT_EMPTY_ON_EXIT: ReadonlySet<CredentialPrintErrorCode> = new Set(\n\t(Object.keys(EXIT_CODES) as CredentialPrintErrorCode[]).filter((code) => code !== \"CredentialTruncated\"),\n);\n\nexport class CredentialPrintError extends Error {\n\treadonly code: CredentialPrintErrorCode;\n\treadonly exitCode: number;\n\n\tconstructor(code: CredentialPrintErrorCode, message: string, options?: { cause?: unknown }) {\n\t\tsuper(message, options);\n\t\tthis.name = \"CredentialPrintError\";\n\t\tthis.code = code;\n\t\tthis.exitCode = EXIT_CODES[code];\n\t}\n}\n\n/**\n * A credential in transit.\n *\n * Every path that would copy the value into a string is closed: `toString`,\n * `toJSON`, and `Symbol.toPrimitive` throw rather than return, so a template\n * literal, `JSON.stringify`, or string concatenation fails loudly instead of\n * leaking into a log line, a transcript, or an error message. `inspect` — which\n * `console.log` and Node's error formatting use — renders a placeholder.\n *\n * `take()` is the single exit, and it works once.\n */\nexport class Secret {\n\t#value: string | undefined;\n\n\tconstructor(value: string) {\n\t\tthis.#value = value;\n\t}\n\n\t/** Consume the secret. A second call is a bug, not a second read. */\n\ttake(): string {\n\t\tconst value = this.#value;\n\t\tif (value === undefined) {\n\t\t\tthrow new Error(\"Secret has already been consumed\");\n\t\t}\n\t\tthis.#value = undefined;\n\t\treturn value;\n\t}\n\n\ttoString(): never {\n\t\tthrow new Error(\"A Secret cannot be converted to a string; use take()\");\n\t}\n\n\ttoJSON(): never {\n\t\tthrow new Error(\"A Secret cannot be serialized; use take()\");\n\t}\n\n\t[Symbol.toPrimitive](): never {\n\t\tthrow new Error(\"A Secret cannot be interpolated; use take()\");\n\t}\n\n\t[inspect.custom](): string {\n\t\treturn \"[Secret]\";\n\t}\n}\n\n/** Public readiness fields emitted with a credential under `auth check --json --credentials`. */\nexport interface CredentialJsonFields {\n\tstatus: string;\n\tprovider: string;\n\tauthType?: string;\n}\n\n/**\n * The only function in `src` that opens a `Secret`.\n *\n * Its two `Secret.take()` calls are the only call sites in `src`, and the\n * source-wide credential-egress test pins that list. This function builds one\n * payload and returns it only to `emitCredential`; no caller receives a plain\n * credential string.\n */\nfunction credentialPayload(secret: Secret, jsonFields: CredentialJsonFields | undefined): string {\n\tif (jsonFields === undefined) return `${secret.take()}\\n`;\n\n\tconst { status, provider, authType } = jsonFields;\n\tif (\n\t\ttypeof status !== \"string\" ||\n\t\ttypeof provider !== \"string\" ||\n\t\t(authType !== undefined && typeof authType !== \"string\")\n\t) {\n\t\tthrow new Error(\"Invalid credential JSON fields\");\n\t}\n\n\t// Allowlist the non-secret envelope before opening the Secret. That leaves no\n\t// formatter, logger, or error path between take() and the guarded stdout write.\n\tconst fields = JSON.stringify({\n\t\tstatus,\n\t\tprovider,\n\t\t...(authType === undefined ? {} : { authType }),\n\t});\n\tif (fields === undefined || !fields.startsWith(\"{\") || !fields.endsWith(\"}\")) {\n\t\tthrow new Error(\"Invalid credential JSON envelope\");\n\t}\n\treturn `${fields.slice(0, -1)},\"credentials\":${JSON.stringify(secret.take())}}\\n`;\n}\n\n/**\n * The single credential egress in `src`.\n *\n * `credentialPayload` opens the secret only while building this one payload,\n * and this guarded write is the only path that hands it to real stdout. A\n * caller — `main.ts` included — receives a `Secret` it cannot read, print, or\n * serialize, so it cannot add a second export path without crossing this door.\n * `test/credential-print.test.ts` pins both the `take()` sites and every\n * data-bearing real-stdout write in `packages/coding-agent/src`.\n *\n * A failed payload write is answered from the stream rather than from the shape\n * of the error, because `bytesWritten` says how much of the credential actually\n * left and the right report differs for each amount.\n *\n * Nothing left — the write call threw, or the callback failed with the counter\n * unmoved — is `CredentialNotEmitted` (exit 8) with stdout provably empty,\n * which is what that exit promises. It must not fall through to the caller's\n * credential-resolution catch, which would report exit 2.\n *\n * All of it left and the failure came after: the caller holds the credential it\n * asked for, so this is reported on stderr with the exit code left at 0, for\n * the same reason the trailing drain is. A non-zero exit over a stream carrying\n * a whole credential is the thing this door never produces.\n *\n * Part of it left is neither. Those bytes cannot be recalled, so stdout is not\n * empty and cannot be made empty; but they are a fragment, not a credential,\n * and reporting success over them would hand a caller a truncated secret it\n * cannot tell from a whole one. That case gets `CredentialTruncated` (exit 9),\n * the one code in this taxonomy whose contract is *not* an empty stdout —\n * stated as such in `EXIT_CODES` and asserted through `STDOUT_EMPTY_ON_EXIT`,\n * rather than left for a caller to discover.\n */\nexport async function emitCredential(secret: Secret, jsonFields: CredentialJsonFields | undefined): Promise<void> {\n\tconst payload = credentialPayload(secret, jsonFields);\n\ttry {\n\t\tawait writeRawStdoutOnce(payload);\n\t} catch (error) {\n\t\tif (error instanceof RawStdoutWriteError && error.emitted === \"all\") {\n\t\t\t// The caller holds the whole credential. Exiting non-zero here would be\n\t\t\t// a non-zero exit over a stream carrying it, which this door never does.\n\t\t\tconsole.error(\n\t\t\t\t`Warning: the credential reached stdout but the write did not complete cleanly: ${error.message}`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\tif (error instanceof RawStdoutWriteError && error.emitted === \"partial\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"CredentialTruncated\",\n\t\t\t\t\"Only part of the credential reached stdout; discard the output, it is not a usable credential\",\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t\"CredentialNotEmitted\",\n\t\t\t\"Failed to write the credential to stdout; nothing was emitted\",\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\ttry {\n\t\tawait flushRawStdout();\n\t} catch (error) {\n\t\tconsole.error(\n\t\t\t`Warning: the credential was written to stdout but the stream did not drain cleanly: ${\n\t\t\t\terror instanceof Error ? error.message : String(error)\n\t\t\t}`,\n\t\t);\n\t}\n}\n\n/**\n * The single place a thrown value becomes an exit code for this door.\n *\n * `main.ts` routes every failure through here. Every code it can produce leaves\n * stdout empty, so an exit code from this door never contradicts the stream.\n */\nexport function toCredentialPrintError(error: unknown): CredentialPrintError {\n\tif (error instanceof CredentialPrintError) return error;\n\treturn new CredentialPrintError(\n\t\t\"NoCredentialConfigured\",\n\t\terror instanceof Error ? error.message : \"Failed to resolve credential\",\n\t\t{ cause: error },\n\t);\n}\n\n/**\n * The only two fields of `Args` this door accepts.\n *\n * Validation is an allowlist rather than a list of refusals, because the\n * refusal list only held while the dispatcher happened to ignore every other\n * flag. `--export <path>`, `--session-dir <path>`, `--print`, and `--help` are\n * all parsed by `parseArgs`; under an exclusion check they passed silently and\n * the door's \"no file sink\" guarantee rested on a downstream accident.\n */\nconst ACCEPTED_ARG_FIELDS: ReadonlySet<string> = new Set([\"model\", \"provider\"]);\n\n/** Names every field of a parsed `Args` that the caller actually set. */\nfunction populatedArgFields(args: Args): string[] {\n\tconst populated: string[] = [];\n\tfor (const [field, value] of Object.entries(args)) {\n\t\tif (ACCEPTED_ARG_FIELDS.has(field) || value === undefined) continue;\n\t\tif (Array.isArray(value)) {\n\t\t\tif (value.length > 0) populated.push(field);\n\t\t} else if (value instanceof Map) {\n\t\t\tif (value.size > 0) populated.push(field);\n\t\t} else {\n\t\t\tpopulated.push(field);\n\t\t}\n\t}\n\treturn populated;\n}\n\nexport function validateCredentialPrintArgs(args: Args): void {\n\tif (!args.model?.trim()) {\n\t\tthrow new CredentialPrintError(\"Usage\", \"Credential printing requires --model <model>\");\n\t}\n\tif (args.apiKey !== undefined) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"Usage\",\n\t\t\t\"Credential printing reads configured credentials; --api-key is not supported\",\n\t\t);\n\t}\n\tconst refused = populatedArgFields(args);\n\tif (refused.length > 0) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"Usage\",\n\t\t\t`Credential printing only accepts --provider and --model (refused: ${refused.join(\", \")})`,\n\t\t);\n\t}\n}\n\n/**\n * Provider-supplied text with anything credential-bearing masked.\n *\n * A failed refresh is reported on stderr, and the provider composes that\n * message. Most describe the failure; some quote the request they sent or the\n * body they got back, either of which can carry the very value this door exists\n * to keep off every stream except stdout. Masking keeps the diagnosis — which\n * is what makes the exit code actionable — without putting the secret in a log,\n * a terminal scrollback, or a CI transcript.\n *\n * Two passes, because either alone leaves a gap. Shape catches a value wherever\n * it appears, but only for the formats that announce themselves. Context\n * catches an opaque value — an `x-api-key`, which is just bytes — by the name it\n * is filed under, in the header, JSON, and query spellings a quoted request or\n * response body uses.\n */\nconst CREDENTIAL_SHAPES: readonly RegExp[] = [\n\t// `Authorization: Bearer <token>`, the form an echoed request header takes.\n\t/\\bBearer\\s+[\\w.~+/-]+=*/giu,\n\t// JWTs, which several providers return verbatim in an error body.\n\t/\\beyJ[\\w-]{8,}\\.[\\w-]{8,}\\.[\\w-]+/gu,\n\t// Prefixed API keys: sk-…, sk_live_…, api-key-…, and the same shapes again.\n\t/\\b(?:sk|pk|rk|api|key|tok|token|secret)[-_][\\w-]{12,}/giu,\n];\n\n/**\n * Field names whose value is the credential, however opaque that value looks.\n * `x-api-key` is the case shape-matching cannot reach: the value is just bytes.\n */\nconst CREDENTIAL_FIELD_NAME =\n\t\"(?:x-)?(?:api[-_]?key|apikey|auth(?:orization)?|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|secret[-_]?key|private[-_]?key|session[-_]?key|password|passwd|token|secret|key)\";\n\n/**\n * Auth schemes that stand between the field name and the value it introduces.\n *\n * Without them the header matcher stops at the space after `Bearer`: it redacts\n * the scheme and leaves the token, and having consumed the `Bearer` the shape\n * pass depends on, that pass can no longer reach the token either. An opaque\n * `Authorization: Bearer <token>` then survives both passes.\n */\nconst CREDENTIAL_AUTH_SCHEME = \"(?:Bearer|Basic|Digest|Token|ApiKey|OAuth)\";\n\nconst CREDENTIAL_CONTEXTS: readonly RegExp[] = [\n\t// Header or YAML-ish: `x-api-key: abc123`, to end of line, and the scheme\n\t// form `Authorization: Bearer abc123` with it.\n\tnew RegExp(String.raw`\\b${CREDENTIAL_FIELD_NAME}\\s*:\\s*(?:${CREDENTIAL_AUTH_SCHEME}\\s+)?[^\\s,;}\"']+`, \"giu\"),\n\t// JSON: `\"api_key\": \"abc123\"` / `'token':'abc123'`, quoted value.\n\tnew RegExp(String.raw`([\"']?)${CREDENTIAL_FIELD_NAME}\\1\\s*:\\s*([\"'])(?:(?!\\2).)*\\2`, \"giu\"),\n\t// Query string or form body: `?api_key=abc123&…`.\n\tnew RegExp(String.raw`\\b${CREDENTIAL_FIELD_NAME}\\s*=\\s*[^\\s&,;}\"']+`, \"giu\"),\n];\n\nexport function redactCredentialShapes(text: string): string {\n\tconst byContext = CREDENTIAL_CONTEXTS.reduce(\n\t\t(masked, context) =>\n\t\t\tmasked.replace(context, (match) => {\n\t\t\t\t// Keep the field name so the diagnosis still says which one failed;\n\t\t\t\t// replace only what follows the separator.\n\t\t\t\tconst separator = /[:=]/u.exec(match);\n\t\t\t\treturn separator ? `${match.slice(0, separator.index + 1)} [redacted]` : \"[redacted]\";\n\t\t\t}),\n\t\ttext,\n\t);\n\treturn CREDENTIAL_SHAPES.reduce((masked, shape) => masked.replace(shape, \"[redacted]\"), byContext);\n}\n\n/**\n * The literal phrase pi-ai throws when a refresh itself failed, from inside\n * `credentials.modify` and therefore before anything is persisted. This is the\n * only oauth-coded error that can claim the stored credential was left alone.\n */\nexport const OAUTH_REFRESH_FAILED_PHRASE = \"OAuth refresh failed for\";\n\n/**\n * The literal phrase pi-ai throws when a refresh succeeded but the rotated\n * token still expires inside the requested window. It is the only signal that\n * separates exit 6 from exit 5.\n */\nexport const OAUTH_EXPIRES_TOO_SOON_PHRASE = \"expires too soon\";\n\n/**\n * pi-ai raises three different `oauth`-coded failures from\n * `dist/auth/resolve.js`, and only one of them is a failed refresh.\n *\n * `OAuth auth derivation failed for <provider>` is thrown after\n * `credentials.modify` has already persisted a rotated credential, and also on\n * the branch where no refresh was attempted at all — so it gets its own code\n * and a message that makes no claim about the stored credential. Treating it as\n * `RefreshFailed` asserted a rollback the command never verified.\n *\n * Classification reads the raw message, because redaction could rewrite the\n * phrase it matches on; only the text that becomes a user-facing message is\n * redacted. The unredacted error stays reachable as `cause`, which this door\n * never logs.\n *\n * `test/credential-print.test.ts` pins both phrases against the installed\n * pi-ai build, so an upstream rewording fails the suite rather than silently\n * collapsing exit 6 into exit 5.\n */\nexport function classifyOAuthFailure(error: ModelsError): CredentialPrintError {\n\tconst detail = redactCredentialShapes(error.message);\n\tif (error.message.includes(OAUTH_EXPIRES_TOO_SOON_PHRASE)) {\n\t\treturn new CredentialPrintError(\n\t\t\t\"MinValidityUnreachable\",\n\t\t\t`The provider refreshed the token but it still expires sooner than requested: ${detail}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\tif (error.message.startsWith(OAUTH_REFRESH_FAILED_PHRASE)) {\n\t\treturn new CredentialPrintError(\"RefreshFailed\", `${detail} (the stored credential was left untouched)`, {\n\t\t\tcause: error,\n\t\t});\n\t}\n\treturn new CredentialPrintError(\"OAuthUnavailable\", detail, { cause: error });\n}\n\n/**\n * Providers whose credential the caller could have meant.\n *\n * With `--provider` the caller named one, so failing to resolve it is an error.\n * Without it, eligibility is *not* narrowed to providers holding a persisted\n * credential: a provider authenticated by an environment variable or a custom\n * resolver has nothing in `auth.json`, and filtering on that list dropped it\n * before `getAuth()` could produce its working key. Candidacy is therefore\n * \"offers the named model\", and `getAuth()` — the same call a real request\n * makes — decides which candidate actually authenticates.\n */\nfunction candidateModels(args: Args, modelRuntime: ModelRuntime): Model<Api>[] {\n\tif (args.provider) {\n\t\tconst resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"NoCredentialConfigured\",\n\t\t\t\tresolved.error ?? \"Unable to resolve the requested provider/model\",\n\t\t\t);\n\t\t}\n\t\treturn [resolved.model];\n\t}\n\n\tconst models: Model<Api>[] = [];\n\tfor (const provider of modelRuntime.getProviders()) {\n\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });\n\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\tmodels.push(resolved.model);\n\t\t}\n\t}\n\tif (models.length === 0) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"NoCredentialConfigured\",\n\t\t\t`Model \"${args.model}\" not found among the available providers. Use --list-models to see available models.`,\n\t\t);\n\t}\n\treturn models;\n}\n\nfunction bearerFromHeaders(headers: Record<string, unknown> | undefined): string | undefined {\n\tconst authorization = Object.entries(headers ?? {}).find(([name]) => name.toLowerCase() === \"authorization\")?.[1];\n\treturn typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n}\n\n/**\n * Resolve exactly one credential for a named provider/model pair.\n *\n * Goes through `ModelRuntime.getAuth()`, the same request-auth path a real\n * model call uses, so an OAuth credential is refreshed and persisted by the one\n * implementation that already handles concurrent refresh under a lock.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n): Promise<Secret> {\n\tvalidateCredentialPrintArgs(args);\n\n\t// The effective auth type per candidate provider, taken from the runtime\n\t// rather than from auth.json.\n\t//\n\t// `checkAuth` reports what a provider would actually authenticate with,\n\t// including a credential supplied by an environment variable or a custom\n\t// resolver that persists nothing, and it answers without refreshing OAuth.\n\t// `listCredentials()` sees only what was stored, which both hid working\n\t// credentials and — for a provider offering an API key *and* OAuth — could not\n\t// say which of the two a request would use. Provider capability cannot say\n\t// either: several providers send an API key as `Authorization: Bearer`, so\n\t// neither that header nor `apiKey` identifies the credential's kind on its own.\n\tconst wantedAuthType: AuthType = kind === \"api_key\" ? \"api_key\" : \"oauth\";\n\tconst resolvedAuthTypes = new Map<string, AuthType | undefined>();\n\tconst models = candidateModels(args, modelRuntime);\n\tfor (const { provider } of models) {\n\t\tif (resolvedAuthTypes.has(provider)) continue;\n\t\tresolvedAuthTypes.set(provider, (await modelRuntime.checkAuth(provider))?.type);\n\t}\n\t// A named provider, or a single candidate, is the one the caller meant, so its\n\t// authentication failure is reported with its own exit code. Among several\n\t// inferred candidates a failure only means \"not this one\" — reporting it would\n\t// let an unrelated provider that happens to offer the model decide the exit\n\t// code for a request another candidate can satisfy.\n\tconst authFailureIsFatal = args.provider !== undefined || models.length === 1;\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\t// The classified diagnosis from a candidate that could not authenticate.\n\t// Skipping a candidate must not discard why it failed: a refresh that failed,\n\t// or a token that cannot reach the requested validity, is the real answer if\n\t// nothing else produces a credential, and keeping it is what leaves exits 5\n\t// and 6 reachable instead of collapsing every inferred failure into exit 2.\n\t// It holds a `CredentialPrintError`, never a credential — the provider's text\n\t// is redacted on the way in.\n\tlet deferredDiagnosis: CredentialPrintError | undefined;\n\tfor (const model of models) {\n\t\tconst type = resolvedAuthTypes.get(model.provider);\n\t\tif (type !== wantedAuthType) continue;\n\n\t\t// Every eligible candidate is asked here, before `ProviderAmbiguous` is\n\t\t// known, so an ambiguous export can refresh and persist credentials it\n\t\t// emits nothing for. Deciding eligibility earlier is not available:\n\t\t// `checkAuth()` is the only non-mutating probe and cannot tell a candidate\n\t\t// that will authenticate from one that will fail, which is what keeps\n\t\t// exits 5 and 6 reachable. Nor does resolving without refreshing exist —\n\t\t// `resolveStoredOAuth` in `@bastani/pi-ai` refreshes whenever the\n\t\t// token falls inside `max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS,\n\t\t// minOAuthValidityMs ?? 0)`, so omitting `minOAuthValidityMs` only lowers\n\t\t// that window to five minutes and drops the post-refresh check exit 6 is\n\t\t// decided by. Bounded: the refresh rotates a valid credential, it does not\n\t\t// invalidate one. Closing it needs a non-mutating probe upstream.\n\t\tlet auth: Awaited<ReturnType<ModelRuntime[\"getAuth\"]>>;\n\t\ttry {\n\t\t\tauth = await modelRuntime.getAuth(\n\t\t\t\tmodel,\n\t\t\t\tkind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {},\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconst diagnosis =\n\t\t\t\terror instanceof ModelsError && error.code === \"oauth\" ? classifyOAuthFailure(error) : undefined;\n\t\t\tif (!authFailureIsFatal) {\n\t\t\t\tdeferredDiagnosis ??= diagnosis;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (diagnosis) throw diagnosis;\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"NoCredentialConfigured\",\n\t\t\t\tredactCredentialShapes(error instanceof Error ? error.message : String(error)),\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\n\t\tconst value =\n\t\t\tkind === \"bearer_token\" ? (auth?.auth.apiKey ?? bearerFromHeaders(auth?.auth.headers)) : auth?.auth.apiKey;\n\t\tif (value) credentials.push({ providerId: model.provider, value });\n\t}\n\n\tif (credentials.length === 1) return new Secret(credentials[0].value);\n\n\tif (credentials.length === 0) {\n\t\tif (deferredDiagnosis) throw deferredDiagnosis;\n\t\tconst providerId = models[0]?.provider;\n\t\tconst type = providerId ? resolvedAuthTypes.get(providerId) : undefined;\n\t\tif (args.provider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"KindUnsupportedForProvider\",\n\t\t\t\t`Provider \"${providerId}\" is configured with OAuth, not an API key`,\n\t\t\t);\n\t\t}\n\t\tif (args.provider && kind === \"bearer_token\" && type === \"api_key\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"KindUnsupportedForProvider\",\n\t\t\t\t`Provider \"${providerId}\" is not configured with an OAuth bearer token`,\n\t\t\t);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t\"NoCredentialConfigured\",\n\t\t\t`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`,\n\t\t);\n\t}\n\n\tthrow new CredentialPrintError(\n\t\t\"ProviderAmbiguous\",\n\t\t`Model \"${args.model}\" has multiple configured providers (${credentials\n\t\t\t.map(({ providerId }) => providerId)\n\t\t\t.join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}
+{"version":3,"file":"credential-print.js","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlG,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,MAAM,CAAC;AAiB9D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAA6C;IACnE,KAAK,EAAE,CAAC;IACR,sBAAsB,EAAE,CAAC;IACzB,iBAAiB,EAAE,CAAC;IACpB,0BAA0B,EAAE,CAAC;IAC7B,aAAa,EAAE,CAAC;IAChB,sBAAsB,EAAE,CAAC;IACzB,gBAAgB,EAAE,CAAC;IACnB,oBAAoB,EAAE,CAAC;IACvB,mBAAmB,EAAE,CAAC;CACtB,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAA0C,IAAI,GAAG,CAChF,MAAM,CAAC,IAAI,CAAC,UAAU,CAAgC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,qBAAqB,CAAC,CACxG,CAAC;AAEF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACrC,IAAI,CAA2B;IAC/B,QAAQ,CAAS;IAE1B,YAAY,IAA8B,EAAE,OAAe,EAAE,OAA6B;QACzF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACD;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,MAAM;IAClB,MAAM,CAAqB;IAE3B,YAAY,KAAa;QACxB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,qEAAqE;IACrE,IAAI;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,QAAQ;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM;QACL,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC9D,CAAC;IAED,CAAC,MAAM,CAAC,WAAW,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;IAED,CAAC,OAAO,CAAC,MAAM,CAAC;QACf,OAAO,UAAU,CAAC;IACnB,CAAC;CACD;AASD;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,MAAc,EAAE,UAA4C;IACtF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;IAE1D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC;IAClD,IACC,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,EACvD,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnD,CAAC;IAED,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,UAA4C;IAChG,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC;QACJ,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,OAAO,CAAC,KAAK,CACZ,kFAAkF,KAAK,CAAC,OAAO,EAAE,CACjG,CAAC;YACF,OAAO;QACR,CAAC;QACD,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,oBAAoB,CAC7B,qBAAqB,EACrB,+FAA+F,EAC/F,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,sBAAsB,EACtB,+DAA+D,EAC/D,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,cAAc,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CACZ,uFACC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACtD,EAAE,CACF,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,IAAI,oBAAoB,CAC9B,wBAAwB,EACxB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EACvE,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,IAAU;IACrC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAU;IACrD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAC7B,OAAO,EACP,8EAA8E,CAC9E,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,oBAAoB,CAC7B,OAAO,EACP,qEAAqE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1F,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,iBAAiB,GAAsB;IAC5C,4EAA4E;IAC5E,4BAA4B;IAC5B,kEAAkE;IAClE,qCAAqC;IACrC,4EAA4E;IAC5E,0DAA0D;CAC1D,CAAC;AAEF;;;GAGG;AACH,MAAM,qBAAqB,GAC1B,oMAAoM,CAAC;AAEtM;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,4CAA4C,CAAC;AAE5E,MAAM,mBAAmB,GAAsB;IAC9C,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,qBAAqB,aAAa,sBAAsB,kBAAkB,EAAE,KAAK,CAAC;IAC5G,kEAAkE;IAClE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,UAAU,qBAAqB,+BAA+B,EAAE,KAAK,CAAC;IAC3F,kDAAkD;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,KAAK,qBAAqB,qBAAqB,EAAE,KAAK,CAAC;CAC5E,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CACnB,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjC,oEAAoE;QACpE,2CAA2C;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IACvF,CAAC,CAAC,EACH,IAAI,CACJ,CAAC;IACF,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAkB;IACtD,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,oBAAoB,CAC9B,wBAAwB,EACxB,gFAAgF,MAAM,EAAE,EACxF,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,oBAAoB,CAAC,eAAe,EAAE,GAAG,MAAM,6CAA6C,EAAE;YACxG,KAAK,EAAE,KAAK;SACZ,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,IAAU,EAAE,YAA0B;IAC9D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAClE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACnG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC/F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,UAAU,IAAI,CAAC,KAAK,uFAAuF,CAC3G,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAA4C;IACtE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAU,EACV,YAA0B,EAC1B,IAAyB,EACzB,WAAoB;IAEpB,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAElC,yEAAyE;IACzE,8BAA8B;IAC9B,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,+EAA+E;IAC/E,2EAA2E;IAC3E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,cAAc,GAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnD,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC9C,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAE9E,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,6BAA6B;IAC7B,IAAI,iBAAmD,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,cAAc;YAAE,SAAS;QAEtC,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,kEAAkE;QAClE,6DAA6D;QAC7D,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,IAAkD,CAAC;QACvD,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAChC,KAAK,EACL,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,IAAI,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CACxG,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,SAAS,GACd,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACzB,iBAAiB,KAAK,SAAS,CAAC;gBAChC,SAAS;YACV,CAAC;YACD,IAAI,SAAS;gBAAE,MAAM,SAAS,CAAC;YAC/B,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC9E,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GACV,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC5G,IAAI,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEtE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,iBAAiB;YAAE,MAAM,iBAAiB,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAC7B,4BAA4B,EAC5B,aAAa,UAAU,4CAA4C,CACnE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,oBAAoB,CAC7B,4BAA4B,EAC5B,aAAa,UAAU,gDAAgD,CACvE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,wBAAwB,EACxB,aAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,gBAAgB,CAClF,CAAC;IACH,CAAC;IAED,MAAM,IAAI,oBAAoB,CAC7B,mBAAmB,EACnB,UAAU,IAAI,CAAC,KAAK,wCAAwC,WAAW;SACrE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC;SACnC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACpC,CAAC;AACH,CAAC","sourcesContent":["/**\n * `atomic auth print-api-key` / `atomic auth print-bearer-token` and the\n * explicit `atomic auth check --credentials` export path.\n *\n * The only door in Atomic whose purpose is emitting a secret. Everything here\n * exists to keep that egress narrow:\n * - the secret leaves as a `Secret`, which cannot be interpolated, serialized,\n *   or inspected, and is consumed exactly once by the stdout writer;\n * - every export has an explicit target: the print commands require `--model`,\n *   and auth checks require `--provider` or an exact `--model` plus\n *   `--credentials`;\n * - there is no `--output <file>` and no clipboard path — stdout only;\n * - every failure is a distinct exit code, and stdout stays empty on all of\n *   them but one — `CredentialTruncated` (exit 9) exists to report the case\n *   where it cannot be, because bytes already left and cannot be recalled;\n * - a failed OAuth refresh never mutates the stored credential.\n *\n * One residual, and it is upstream: when a model infers several eligible\n * providers, each is asked for its credential before the ambiguity is known, so\n * a *successful* refresh can rotate and persist a credential this command then\n * declines to emit (exit 3). See the note on the `getAuth()` call in the\n * candidate loop.\n */\n\nimport { inspect } from \"node:util\";\nimport type { Api, AuthType, Model } from \"@bastani/pi-ai\";\nimport { ModelsError } from \"@bastani/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.js\";\nimport { flushRawStdout, RawStdoutWriteError, writeRawStdoutOnce } from \"../core/output-guard.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type CredentialPrintKind = \"api_key\" | \"bearer_token\";\n\n/** Bearer tokens are refreshed unless they still have this much life left. */\nexport const DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\n/**\n * Failure taxonomy. Each member owns one exit code, so a caller can branch on\n * the status without parsing stderr.\n */\nexport type CredentialPrintErrorCode =\n\t| \"Usage\"\n\t| \"NoCredentialConfigured\"\n\t| \"ProviderAmbiguous\"\n\t| \"KindUnsupportedForProvider\"\n\t| \"RefreshFailed\"\n\t| \"MinValidityUnreachable\"\n\t| \"OAuthUnavailable\"\n\t| \"CredentialNotEmitted\"\n\t| \"CredentialTruncated\";\n\n/**\n * Exported so a test can walk the whole taxonomy: every declared code has to\n * name an exercised path, and the record type makes a new member without an\n * exit code a compile error rather than a review miss.\n *\n * Every one of these leaves stdout empty except `CredentialTruncated`, which\n * exists to report the one case where it cannot be: bytes already went out and\n * cannot be recalled. `STDOUT_EMPTY_ON_EXIT` names that split so the taxonomy\n * test asserts it rather than assuming it.\n */\nexport const EXIT_CODES: Record<CredentialPrintErrorCode, number> = {\n\tUsage: 1,\n\tNoCredentialConfigured: 2,\n\tProviderAmbiguous: 3,\n\tKindUnsupportedForProvider: 4,\n\tRefreshFailed: 5,\n\tMinValidityUnreachable: 6,\n\tOAuthUnavailable: 7,\n\tCredentialNotEmitted: 8,\n\tCredentialTruncated: 9,\n};\n\n/** The codes whose contract is an empty stdout. See `EXIT_CODES`. */\nexport const STDOUT_EMPTY_ON_EXIT: ReadonlySet<CredentialPrintErrorCode> = new Set(\n\t(Object.keys(EXIT_CODES) as CredentialPrintErrorCode[]).filter((code) => code !== \"CredentialTruncated\"),\n);\n\nexport class CredentialPrintError extends Error {\n\treadonly code: CredentialPrintErrorCode;\n\treadonly exitCode: number;\n\n\tconstructor(code: CredentialPrintErrorCode, message: string, options?: { cause?: unknown }) {\n\t\tsuper(message, options);\n\t\tthis.name = \"CredentialPrintError\";\n\t\tthis.code = code;\n\t\tthis.exitCode = EXIT_CODES[code];\n\t}\n}\n\n/**\n * A credential in transit.\n *\n * Every path that would copy the value into a string is closed: `toString`,\n * `toJSON`, and `Symbol.toPrimitive` throw rather than return, so a template\n * literal, `JSON.stringify`, or string concatenation fails loudly instead of\n * leaking into a log line, a transcript, or an error message. `inspect` — which\n * `console.log` and Node's error formatting use — renders a placeholder.\n *\n * `take()` is the single exit, and it works once.\n */\nexport class Secret {\n\t#value: string | undefined;\n\n\tconstructor(value: string) {\n\t\tthis.#value = value;\n\t}\n\n\t/** Consume the secret. A second call is a bug, not a second read. */\n\ttake(): string {\n\t\tconst value = this.#value;\n\t\tif (value === undefined) {\n\t\t\tthrow new Error(\"Secret has already been consumed\");\n\t\t}\n\t\tthis.#value = undefined;\n\t\treturn value;\n\t}\n\n\ttoString(): never {\n\t\tthrow new Error(\"A Secret cannot be converted to a string; use take()\");\n\t}\n\n\ttoJSON(): never {\n\t\tthrow new Error(\"A Secret cannot be serialized; use take()\");\n\t}\n\n\t[Symbol.toPrimitive](): never {\n\t\tthrow new Error(\"A Secret cannot be interpolated; use take()\");\n\t}\n\n\t[inspect.custom](): string {\n\t\treturn \"[Secret]\";\n\t}\n}\n\n/** Public readiness fields emitted with a credential under `auth check --json --credentials`. */\nexport interface CredentialJsonFields {\n\tstatus: string;\n\tprovider: string;\n\tauthType?: string;\n}\n\n/**\n * The only function in `src` that opens a `Secret`.\n *\n * Its two `Secret.take()` calls are the only call sites in `src`, and the\n * source-wide credential-egress test pins that list. This function builds one\n * payload and returns it only to `emitCredential`; no caller receives a plain\n * credential string.\n */\nfunction credentialPayload(secret: Secret, jsonFields: CredentialJsonFields | undefined): string {\n\tif (jsonFields === undefined) return `${secret.take()}\\n`;\n\n\tconst { status, provider, authType } = jsonFields;\n\tif (\n\t\ttypeof status !== \"string\" ||\n\t\ttypeof provider !== \"string\" ||\n\t\t(authType !== undefined && typeof authType !== \"string\")\n\t) {\n\t\tthrow new Error(\"Invalid credential JSON fields\");\n\t}\n\n\t// Allowlist the non-secret envelope before opening the Secret. That leaves no\n\t// formatter, logger, or error path between take() and the guarded stdout write.\n\tconst fields = JSON.stringify({\n\t\tstatus,\n\t\tprovider,\n\t\t...(authType === undefined ? {} : { authType }),\n\t});\n\tif (fields === undefined || !fields.startsWith(\"{\") || !fields.endsWith(\"}\")) {\n\t\tthrow new Error(\"Invalid credential JSON envelope\");\n\t}\n\treturn `${fields.slice(0, -1)},\"credentials\":${JSON.stringify(secret.take())}}\\n`;\n}\n\n/**\n * The single credential egress in `src`.\n *\n * `credentialPayload` opens the secret only while building this one payload,\n * and this guarded write is the only path that hands it to real stdout. A\n * caller — `main.ts` included — receives a `Secret` it cannot read, print, or\n * serialize, so it cannot add a second export path without crossing this door.\n * `test/credential-print.test.ts` pins both the `take()` sites and every\n * data-bearing real-stdout write in `packages/coding-agent/src`.\n *\n * A failed payload write is answered from the stream rather than from the shape\n * of the error, because `bytesWritten` says how much of the credential actually\n * left and the right report differs for each amount.\n *\n * Nothing left — the write call threw, or the callback failed with the counter\n * unmoved — is `CredentialNotEmitted` (exit 8) with stdout provably empty,\n * which is what that exit promises. It must not fall through to the caller's\n * credential-resolution catch, which would report exit 2.\n *\n * All of it left and the failure came after: the caller holds the credential it\n * asked for, so this is reported on stderr with the exit code left at 0, for\n * the same reason the trailing drain is. A non-zero exit over a stream carrying\n * a whole credential is the thing this door never produces.\n *\n * Part of it left is neither. Those bytes cannot be recalled, so stdout is not\n * empty and cannot be made empty; but they are a fragment, not a credential,\n * and reporting success over them would hand a caller a truncated secret it\n * cannot tell from a whole one. That case gets `CredentialTruncated` (exit 9),\n * the one code in this taxonomy whose contract is *not* an empty stdout —\n * stated as such in `EXIT_CODES` and asserted through `STDOUT_EMPTY_ON_EXIT`,\n * rather than left for a caller to discover.\n */\nexport async function emitCredential(secret: Secret, jsonFields: CredentialJsonFields | undefined): Promise<void> {\n\tconst payload = credentialPayload(secret, jsonFields);\n\ttry {\n\t\tawait writeRawStdoutOnce(payload);\n\t} catch (error) {\n\t\tif (error instanceof RawStdoutWriteError && error.emitted === \"all\") {\n\t\t\t// The caller holds the whole credential. Exiting non-zero here would be\n\t\t\t// a non-zero exit over a stream carrying it, which this door never does.\n\t\t\tconsole.error(\n\t\t\t\t`Warning: the credential reached stdout but the write did not complete cleanly: ${error.message}`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\tif (error instanceof RawStdoutWriteError && error.emitted === \"partial\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"CredentialTruncated\",\n\t\t\t\t\"Only part of the credential reached stdout; discard the output, it is not a usable credential\",\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t\"CredentialNotEmitted\",\n\t\t\t\"Failed to write the credential to stdout; nothing was emitted\",\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\ttry {\n\t\tawait flushRawStdout();\n\t} catch (error) {\n\t\tconsole.error(\n\t\t\t`Warning: the credential was written to stdout but the stream did not drain cleanly: ${\n\t\t\t\terror instanceof Error ? error.message : String(error)\n\t\t\t}`,\n\t\t);\n\t}\n}\n\n/**\n * The single place a thrown value becomes an exit code for this door.\n *\n * `main.ts` routes every failure through here. Every code it can produce leaves\n * stdout empty, so an exit code from this door never contradicts the stream.\n */\nexport function toCredentialPrintError(error: unknown): CredentialPrintError {\n\tif (error instanceof CredentialPrintError) return error;\n\treturn new CredentialPrintError(\n\t\t\"NoCredentialConfigured\",\n\t\terror instanceof Error ? error.message : \"Failed to resolve credential\",\n\t\t{ cause: error },\n\t);\n}\n\n/**\n * The only two fields of `Args` this door accepts.\n *\n * Validation is an allowlist rather than a list of refusals, because the\n * refusal list only held while the dispatcher happened to ignore every other\n * flag. `--export <path>`, `--session-dir <path>`, `--print`, and `--help` are\n * all parsed by `parseArgs`; under an exclusion check they passed silently and\n * the door's \"no file sink\" guarantee rested on a downstream accident.\n */\nconst ACCEPTED_ARG_FIELDS: ReadonlySet<string> = new Set([\"model\", \"provider\"]);\n\n/** Names every field of a parsed `Args` that the caller actually set. */\nfunction populatedArgFields(args: Args): string[] {\n\tconst populated: string[] = [];\n\tfor (const [field, value] of Object.entries(args)) {\n\t\tif (ACCEPTED_ARG_FIELDS.has(field) || value === undefined) continue;\n\t\tif (Array.isArray(value)) {\n\t\t\tif (value.length > 0) populated.push(field);\n\t\t} else if (value instanceof Map) {\n\t\t\tif (value.size > 0) populated.push(field);\n\t\t} else {\n\t\t\tpopulated.push(field);\n\t\t}\n\t}\n\treturn populated;\n}\n\nexport function validateCredentialPrintArgs(args: Args): void {\n\tif (!args.model?.trim()) {\n\t\tthrow new CredentialPrintError(\"Usage\", \"Credential printing requires --model <model>\");\n\t}\n\tif (args.apiKey !== undefined) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"Usage\",\n\t\t\t\"Credential printing reads configured credentials; --api-key is not supported\",\n\t\t);\n\t}\n\tconst refused = populatedArgFields(args);\n\tif (refused.length > 0) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"Usage\",\n\t\t\t`Credential printing only accepts --provider and --model (refused: ${refused.join(\", \")})`,\n\t\t);\n\t}\n}\n\n/**\n * Provider-supplied text with anything credential-bearing masked.\n *\n * A failed refresh is reported on stderr, and the provider composes that\n * message. Most describe the failure; some quote the request they sent or the\n * body they got back, either of which can carry the very value this door exists\n * to keep off every stream except stdout. Masking keeps the diagnosis — which\n * is what makes the exit code actionable — without putting the secret in a log,\n * a terminal scrollback, or a CI transcript.\n *\n * Two passes, because either alone leaves a gap. Shape catches a value wherever\n * it appears, but only for the formats that announce themselves. Context\n * catches an opaque value — an `x-api-key`, which is just bytes — by the name it\n * is filed under, in the header, JSON, and query spellings a quoted request or\n * response body uses.\n */\nconst CREDENTIAL_SHAPES: readonly RegExp[] = [\n\t// `Authorization: Bearer <token>`, the form an echoed request header takes.\n\t/\\bBearer\\s+[\\w.~+/-]+=*/giu,\n\t// JWTs, which several providers return verbatim in an error body.\n\t/\\beyJ[\\w-]{8,}\\.[\\w-]{8,}\\.[\\w-]+/gu,\n\t// Prefixed API keys: sk-…, sk_live_…, api-key-…, and the same shapes again.\n\t/\\b(?:sk|pk|rk|api|key|tok|token|secret)[-_][\\w-]{12,}/giu,\n];\n\n/**\n * Field names whose value is the credential, however opaque that value looks.\n * `x-api-key` is the case shape-matching cannot reach: the value is just bytes.\n */\nconst CREDENTIAL_FIELD_NAME =\n\t\"(?:x-)?(?:api[-_]?key|apikey|auth(?:orization)?|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|secret[-_]?key|private[-_]?key|session[-_]?key|password|passwd|token|secret|key)\";\n\n/**\n * Auth schemes that stand between the field name and the value it introduces.\n *\n * Without them the header matcher stops at the space after `Bearer`: it redacts\n * the scheme and leaves the token, and having consumed the `Bearer` the shape\n * pass depends on, that pass can no longer reach the token either. An opaque\n * `Authorization: Bearer <token>` then survives both passes.\n */\nconst CREDENTIAL_AUTH_SCHEME = \"(?:Bearer|Basic|Digest|Token|ApiKey|OAuth)\";\n\nconst CREDENTIAL_CONTEXTS: readonly RegExp[] = [\n\t// Header or YAML-ish: `x-api-key: abc123`, to end of line, and the scheme\n\t// form `Authorization: Bearer abc123` with it.\n\tnew RegExp(String.raw`\\b${CREDENTIAL_FIELD_NAME}\\s*:\\s*(?:${CREDENTIAL_AUTH_SCHEME}\\s+)?[^\\s,;}\"']+`, \"giu\"),\n\t// JSON: `\"api_key\": \"abc123\"` / `'token':'abc123'`, quoted value.\n\tnew RegExp(String.raw`([\"']?)${CREDENTIAL_FIELD_NAME}\\1\\s*:\\s*([\"'])(?:(?!\\2).)*\\2`, \"giu\"),\n\t// Query string or form body: `?api_key=abc123&…`.\n\tnew RegExp(String.raw`\\b${CREDENTIAL_FIELD_NAME}\\s*=\\s*[^\\s&,;}\"']+`, \"giu\"),\n];\n\nexport function redactCredentialShapes(text: string): string {\n\tconst byContext = CREDENTIAL_CONTEXTS.reduce(\n\t\t(masked, context) =>\n\t\t\tmasked.replace(context, (match) => {\n\t\t\t\t// Keep the field name so the diagnosis still says which one failed;\n\t\t\t\t// replace only what follows the separator.\n\t\t\t\tconst separator = /[:=]/u.exec(match);\n\t\t\t\treturn separator ? `${match.slice(0, separator.index + 1)} [redacted]` : \"[redacted]\";\n\t\t\t}),\n\t\ttext,\n\t);\n\treturn CREDENTIAL_SHAPES.reduce((masked, shape) => masked.replace(shape, \"[redacted]\"), byContext);\n}\n\n/**\n * The literal phrase pi-ai throws when a refresh itself failed, from inside\n * `credentials.modify` and therefore before anything is persisted. This is the\n * only oauth-coded error that can claim the stored credential was left alone.\n */\nexport const OAUTH_REFRESH_FAILED_PHRASE = \"OAuth refresh failed for\";\n\n/**\n * The literal phrase pi-ai throws when a refresh succeeded but the rotated\n * token still expires inside the requested window. It is the only signal that\n * separates exit 6 from exit 5.\n */\nexport const OAUTH_EXPIRES_TOO_SOON_PHRASE = \"expires too soon\";\n\n/**\n * pi-ai raises three different `oauth`-coded failures from\n * `dist/auth/resolve.js`, and only one of them is a failed refresh.\n *\n * `OAuth auth derivation failed for <provider>` is thrown after\n * `credentials.modify` has already persisted a rotated credential, and also on\n * the branch where no refresh was attempted at all — so it gets its own code\n * and a message that makes no claim about the stored credential. Treating it as\n * `RefreshFailed` asserted a rollback the command never verified.\n *\n * Classification reads the raw message, because redaction could rewrite the\n * phrase it matches on; only the text that becomes a user-facing message is\n * redacted. The unredacted error stays reachable as `cause`, which this door\n * never logs.\n *\n * `test/credential-print.test.ts` pins both phrases against the installed\n * pi-ai build, so an upstream rewording fails the suite rather than silently\n * collapsing exit 6 into exit 5.\n */\nexport function classifyOAuthFailure(error: ModelsError): CredentialPrintError {\n\tconst detail = redactCredentialShapes(error.message);\n\tif (error.message.includes(OAUTH_EXPIRES_TOO_SOON_PHRASE)) {\n\t\treturn new CredentialPrintError(\n\t\t\t\"MinValidityUnreachable\",\n\t\t\t`The provider refreshed the token but it still expires sooner than requested: ${detail}`,\n\t\t\t{ cause: error },\n\t\t);\n\t}\n\tif (error.message.startsWith(OAUTH_REFRESH_FAILED_PHRASE)) {\n\t\treturn new CredentialPrintError(\"RefreshFailed\", `${detail} (the stored credential was left untouched)`, {\n\t\t\tcause: error,\n\t\t});\n\t}\n\treturn new CredentialPrintError(\"OAuthUnavailable\", detail, { cause: error });\n}\n\n/**\n * Providers whose credential the caller could have meant.\n *\n * With `--provider` the caller named one, so failing to resolve it is an error.\n * Without it, eligibility is *not* narrowed to providers holding a persisted\n * credential: a provider authenticated by an environment variable or a custom\n * resolver has nothing in `auth.json`, and filtering on that list dropped it\n * before `getAuth()` could produce its working key. Candidacy is therefore\n * \"offers the named model\", and `getAuth()` — the same call a real request\n * makes — decides which candidate actually authenticates.\n */\nfunction candidateModels(args: Args, modelRuntime: ModelRuntime): Model<Api>[] {\n\tif (args.provider) {\n\t\tconst resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"NoCredentialConfigured\",\n\t\t\t\tresolved.error ?? \"Unable to resolve the requested provider/model\",\n\t\t\t);\n\t\t}\n\t\treturn [resolved.model];\n\t}\n\n\tconst models: Model<Api>[] = [];\n\tfor (const provider of modelRuntime.getProviders()) {\n\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });\n\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\tmodels.push(resolved.model);\n\t\t}\n\t}\n\tif (models.length === 0) {\n\t\tthrow new CredentialPrintError(\n\t\t\t\"NoCredentialConfigured\",\n\t\t\t`Model \"${args.model}\" not found among the available providers. Use --list-models to see available models.`,\n\t\t);\n\t}\n\treturn models;\n}\n\nfunction bearerFromHeaders(headers: Record<string, unknown> | undefined): string | undefined {\n\tconst authorization = Object.entries(headers ?? {}).find(([name]) => name.toLowerCase() === \"authorization\")?.[1];\n\treturn typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n}\n\n/**\n * Resolve exactly one credential for a named provider/model pair.\n *\n * Goes through `ModelRuntime.getAuth()`, the same request-auth path a real\n * model call uses, so an OAuth credential is refreshed and persisted by the one\n * implementation that already handles concurrent refresh under a lock.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n): Promise<Secret> {\n\tvalidateCredentialPrintArgs(args);\n\n\t// The effective auth type per candidate provider, taken from the runtime\n\t// rather than from auth.json.\n\t//\n\t// `checkAuth` reports what a provider would actually authenticate with,\n\t// including a credential supplied by an environment variable or a custom\n\t// resolver that persists nothing, and it answers without refreshing OAuth.\n\t// `listCredentials()` sees only what was stored, which both hid working\n\t// credentials and — for a provider offering an API key *and* OAuth — could not\n\t// say which of the two a request would use. Provider capability cannot say\n\t// either: several providers send an API key as `Authorization: Bearer`, so\n\t// neither that header nor `apiKey` identifies the credential's kind on its own.\n\tconst wantedAuthType: AuthType = kind === \"api_key\" ? \"api_key\" : \"oauth\";\n\tconst resolvedAuthTypes = new Map<string, AuthType | undefined>();\n\tconst models = candidateModels(args, modelRuntime);\n\tfor (const { provider } of models) {\n\t\tif (resolvedAuthTypes.has(provider)) continue;\n\t\tresolvedAuthTypes.set(provider, (await modelRuntime.checkAuth(provider))?.type);\n\t}\n\t// A named provider, or a single candidate, is the one the caller meant, so its\n\t// authentication failure is reported with its own exit code. Among several\n\t// inferred candidates a failure only means \"not this one\" — reporting it would\n\t// let an unrelated provider that happens to offer the model decide the exit\n\t// code for a request another candidate can satisfy.\n\tconst authFailureIsFatal = args.provider !== undefined || models.length === 1;\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\t// The classified diagnosis from a candidate that could not authenticate.\n\t// Skipping a candidate must not discard why it failed: a refresh that failed,\n\t// or a token that cannot reach the requested validity, is the real answer if\n\t// nothing else produces a credential, and keeping it is what leaves exits 5\n\t// and 6 reachable instead of collapsing every inferred failure into exit 2.\n\t// It holds a `CredentialPrintError`, never a credential — the provider's text\n\t// is redacted on the way in.\n\tlet deferredDiagnosis: CredentialPrintError | undefined;\n\tfor (const model of models) {\n\t\tconst type = resolvedAuthTypes.get(model.provider);\n\t\tif (type !== wantedAuthType) continue;\n\n\t\t// Every eligible candidate is asked here, before `ProviderAmbiguous` is\n\t\t// known, so an ambiguous export can refresh and persist credentials it\n\t\t// emits nothing for. Deciding eligibility earlier is not available:\n\t\t// `checkAuth()` is the only non-mutating probe and cannot tell a candidate\n\t\t// that will authenticate from one that will fail, which is what keeps\n\t\t// exits 5 and 6 reachable. Nor does resolving without refreshing exist —\n\t\t// `resolveStoredOAuth` in `@bastani/pi-ai` refreshes whenever the\n\t\t// token falls inside `max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS,\n\t\t// minOAuthValidityMs ?? 0)`, so omitting `minOAuthValidityMs` only lowers\n\t\t// that window to five minutes and drops the post-refresh check exit 6 is\n\t\t// decided by. Bounded: the refresh rotates a valid credential, it does not\n\t\t// invalidate one. Closing it needs a non-mutating probe upstream.\n\t\tlet auth: Awaited<ReturnType<ModelRuntime[\"getAuth\"]>>;\n\t\ttry {\n\t\t\tauth = await modelRuntime.getAuth(\n\t\t\t\tmodel,\n\t\t\t\tkind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {},\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tconst diagnosis =\n\t\t\t\terror instanceof ModelsError && error.code === \"oauth\" ? classifyOAuthFailure(error) : undefined;\n\t\t\tif (!authFailureIsFatal) {\n\t\t\t\tdeferredDiagnosis ??= diagnosis;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (diagnosis) throw diagnosis;\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"NoCredentialConfigured\",\n\t\t\t\tredactCredentialShapes(error instanceof Error ? error.message : String(error)),\n\t\t\t\t{ cause: error },\n\t\t\t);\n\t\t}\n\n\t\tconst value =\n\t\t\tkind === \"bearer_token\" ? (auth?.auth.apiKey ?? bearerFromHeaders(auth?.auth.headers)) : auth?.auth.apiKey;\n\t\tif (value) credentials.push({ providerId: model.provider, value });\n\t}\n\n\tif (credentials.length === 1) return new Secret(credentials[0].value);\n\n\tif (credentials.length === 0) {\n\t\tif (deferredDiagnosis) throw deferredDiagnosis;\n\t\tconst providerId = models[0]?.provider;\n\t\tconst type = providerId ? resolvedAuthTypes.get(providerId) : undefined;\n\t\tif (args.provider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"KindUnsupportedForProvider\",\n\t\t\t\t`Provider \"${providerId}\" is configured with OAuth, not an API key`,\n\t\t\t);\n\t\t}\n\t\tif (args.provider && kind === \"bearer_token\" && type === \"api_key\") {\n\t\t\tthrow new CredentialPrintError(\n\t\t\t\t\"KindUnsupportedForProvider\",\n\t\t\t\t`Provider \"${providerId}\" is not configured with an OAuth bearer token`,\n\t\t\t);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t\"NoCredentialConfigured\",\n\t\t\t`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`,\n\t\t);\n\t}\n\n\tthrow new CredentialPrintError(\n\t\t\"ProviderAmbiguous\",\n\t\t`Model \"${args.model}\" has multiple configured providers (${credentials\n\t\t\t.map(({ providerId }) => providerId)\n\t\t\t.join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}

package/dist/cli/experimental/command.js

@@ -5,9 +5,12 @@ export function stringOption(name) {
     return valueOption(name, (value) => ({ ok: true, value }));
 }
 export class Command {
+    name;
+    options = new Map();
+    subcommands = new Map();
+    builder;
+    commandAction;
     constructor(name) {
-        this.options = new Map();
-        this.subcommands = new Map();
         this.name = name;
     }
     option(option) {

package/dist/cli/experimental/command.js.map

@@ -1 +1 @@
-{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/cli/experimental/command.ts"],"names":[],"mappings":"AAqBA,MAAM,UAAU,WAAW,CAC1B,IAAmB,EACnB,KAA0D;IAE1D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAgCD,MAAM,OAAO,OAAO;IAWnB,YAAY,IAAY;QALP,YAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;QACpD,gBAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;QAKnE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,MAAM,CAAS,MAA6B;QAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,8BAA8B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAuC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAA+C;QACrD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,CAKN,OAAqF;QAErF,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,IAAI,wBAAwB,CAAC,CAAC;QACzG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAA6B,CAAC;SAChF,CAAC,CAAC;QACH,OAAO,IAIN,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAuB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAoC,CAAC;QAC9F,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAoC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAuB,EAAE,OAAiB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAiD,CAAC;QACzG,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAiC,EAAE,CAAC;IACxE,CAAC;IAEO,MAAM,CAAC,IAAuB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAEO,QAAQ,CAAC,IAAuB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAuB;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,CAAS,MAA6B,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAuB;YAC3G,MAAM,EAAE,CAAS,MAA6B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAsB;SAC9G,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,IAAuB;QAC3C,MAAM,MAAM,GAA8B;YACzC,MAAM,EAAE,IAAI,GAAG,EAAE;YACjB,aAAa,EAAE,EAAE;YACjB,MAAM,EAAE,EAAE;SACV,CAAC;QACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;YAC9B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM;YACP,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM;YACP,CAAC;YAED,IAAI,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,KAAK,GAAG,IAAI,CAAC;oBACb,KAAK,EAAE,CAAC;gBACT,CAAC;YACF,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;gBAC/C,SAAS;YACV,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;gBACzD,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjC,SAAS;YACV,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD","sourcesContent":["export interface NamedCommandInvocation {\n\treadonly command: string;\n}\n\nexport type CommandParseResult<TInvocation extends NamedCommandInvocation = NamedCommandInvocation> =\n\t| { readonly ok: true; readonly command: TInvocation }\n\t| { readonly ok: false; readonly errors: readonly string[] };\n\nexport type CommandExecutionResult<TInvocation extends NamedCommandInvocation = NamedCommandInvocation> =\n\t| { readonly ok: true; readonly command: TInvocation }\n\t| { readonly ok: false; readonly errors: readonly string[] };\n\nexport type CommandOptionParseResult<TValue> =\n\t| { readonly ok: true; readonly value: TValue }\n\t| { readonly ok: false; readonly error: string };\n\nexport interface CommandOption<TValue> {\n\treadonly name: `--${string}`;\n\tparse(value: string): CommandOptionParseResult<TValue>;\n}\n\nexport function valueOption<TValue>(\n\tname: `--${string}`,\n\tparse: (value: string) => CommandOptionParseResult<TValue>,\n): CommandOption<TValue> {\n\treturn { name, parse };\n}\n\nexport function stringOption(name: `--${string}`): CommandOption<string> {\n\treturn valueOption(name, (value) => ({ ok: true, value }));\n}\n\nexport interface ParsedCommandInput {\n\treadonly remainingArgs: readonly string[];\n\tvalue<TValue>(option: CommandOption<TValue>): TValue | undefined;\n\tvalues<TValue>(option: CommandOption<TValue>): readonly TValue[];\n}\n\nexport type CommandBuildResult<TInvocation extends NamedCommandInvocation> =\n\t| { readonly ok: true; readonly command: TInvocation }\n\t| { readonly ok: false; readonly errors: readonly string[] };\n\ninterface MutableParsedCommandInput {\n\treadonly values: Map<string, unknown[]>;\n\treadonly remainingArgs: string[];\n\treadonly errors: string[];\n}\n\ntype CommandBuilder<TInvocation extends NamedCommandInvocation> = (\n\tinput: ParsedCommandInput,\n) => CommandBuildResult<TInvocation>;\n\ntype CommandAction<TInvocation extends NamedCommandInvocation, TContext> = (\n\tcommand: TInvocation,\n\tcontext: TContext,\n) => void | Promise<void>;\n\ninterface RegisteredCommand {\n\tparse(argv: readonly string[]): CommandParseResult;\n\texecute(argv: readonly string[], context: unknown): Promise<CommandExecutionResult>;\n}\n\nexport class Command<\n\tTOwnInvocation extends NamedCommandInvocation,\n\tTContext,\n\tTInvocation extends NamedCommandInvocation = TOwnInvocation,\n> {\n\treadonly name: string;\n\tprivate readonly options = new Map<string, CommandOption<unknown>>();\n\tprivate readonly subcommands = new Map<string, RegisteredCommand>();\n\tprivate builder?: CommandBuilder<TOwnInvocation>;\n\tprivate commandAction?: CommandAction<TOwnInvocation, TContext>;\n\n\tconstructor(name: string) {\n\t\tthis.name = name;\n\t}\n\n\toption<TValue>(option: CommandOption<TValue>): this {\n\t\tif (this.options.has(option.name)) {\n\t\t\tthrow new Error(`Option ${option.name} is already registered for ${this.name}`);\n\t\t}\n\t\tthis.options.set(option.name, option);\n\t\treturn this;\n\t}\n\n\tbuild(builder: CommandBuilder<TOwnInvocation>): this {\n\t\tthis.builder = builder;\n\t\treturn this;\n\t}\n\n\taction(action: CommandAction<TOwnInvocation, TContext>): this {\n\t\tthis.commandAction = action;\n\t\treturn this;\n\t}\n\n\tcommand<\n\t\tTSubcommandOwnInvocation extends NamedCommandInvocation,\n\t\tTSubcommandContext,\n\t\tTSubcommandInvocation extends NamedCommandInvocation,\n\t>(\n\t\tcommand: Command<TSubcommandOwnInvocation, TSubcommandContext, TSubcommandInvocation>,\n\t): Command<TOwnInvocation, TContext & TSubcommandContext, TInvocation | TSubcommandInvocation> {\n\t\tif (this.subcommands.has(command.name)) throw new Error(`Command ${command.name} is already registered`);\n\t\tthis.subcommands.set(command.name, {\n\t\t\tparse: (argv) => command.parse(argv),\n\t\t\texecute: (argv, context) => command.execute(argv, context as TSubcommandContext),\n\t\t});\n\t\treturn this as unknown as Command<\n\t\t\tTOwnInvocation,\n\t\t\tTContext & TSubcommandContext,\n\t\t\tTInvocation | TSubcommandInvocation\n\t\t>;\n\t}\n\n\tparse(argv: readonly string[]): CommandParseResult<TInvocation> {\n\t\tconst selected = this.select(argv);\n\t\tif (selected) return selected.command.parse(selected.argv) as CommandParseResult<TInvocation>;\n\t\treturn this.parseOwn(argv) as CommandParseResult<TInvocation>;\n\t}\n\n\tasync execute(argv: readonly string[], context: TContext): Promise<CommandExecutionResult<TInvocation>> {\n\t\tconst selected = this.select(argv);\n\t\tif (selected) {\n\t\t\treturn selected.command.execute(selected.argv, context) as Promise<CommandExecutionResult<TInvocation>>;\n\t\t}\n\n\t\tconst parsed = this.parseOwn(argv);\n\t\tif (!parsed.ok) return parsed;\n\t\tif (!this.commandAction) throw new Error(`Command ${this.name} does not define an action`);\n\t\tawait this.commandAction(parsed.command, context);\n\t\treturn { ok: true, command: parsed.command as unknown as TInvocation };\n\t}\n\n\tprivate select(argv: readonly string[]): { command: RegisteredCommand; argv: readonly string[] } | undefined {\n\t\tconst candidate = argv[0];\n\t\tif (candidate === undefined) return undefined;\n\t\tconst command = this.subcommands.get(candidate);\n\t\treturn command ? { command, argv: argv.slice(1) } : undefined;\n\t}\n\n\tprivate parseOwn(argv: readonly string[]): CommandParseResult<TOwnInvocation> {\n\t\tif (!this.builder) throw new Error(`Command ${this.name} does not define a builder`);\n\t\tconst parsed = this.parseOptions(argv);\n\t\tconst input: ParsedCommandInput = {\n\t\t\tremainingArgs: parsed.remainingArgs,\n\t\t\tvalue: <TValue>(option: CommandOption<TValue>) => parsed.values.get(option.name)?.[0] as TValue | undefined,\n\t\t\tvalues: <TValue>(option: CommandOption<TValue>) => (parsed.values.get(option.name) ?? []) as readonly TValue[],\n\t\t};\n\t\tconst built = this.builder(input);\n\t\tconst errors = [...parsed.errors, ...(built.ok ? [] : built.errors)];\n\t\tif (errors.length > 0) return { ok: false, errors };\n\t\tif (!built.ok) throw new Error(`Command ${this.name} failed without an error`);\n\t\treturn { ok: true, command: built.command };\n\t}\n\n\tprivate parseOptions(argv: readonly string[]): MutableParsedCommandInput {\n\t\tconst parsed: MutableParsedCommandInput = {\n\t\t\tvalues: new Map(),\n\t\t\tremainingArgs: [],\n\t\t\terrors: [],\n\t\t};\n\t\tfor (let index = 0; index < argv.length; index++) {\n\t\t\tconst argument = argv[index]!;\n\t\t\tif (argument === \"--\") {\n\t\t\t\tparsed.remainingArgs.push(...argv.slice(index));\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tconst equals = argument.indexOf(\"=\");\n\t\t\tconst name = equals === -1 ? argument : argument.slice(0, equals);\n\t\t\tconst option = this.options.get(name);\n\t\t\tif (!option) {\n\t\t\t\tparsed.remainingArgs.push(...argv.slice(index));\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tlet value = equals === -1 ? undefined : argument.slice(equals + 1);\n\t\t\tif (value === undefined) {\n\t\t\t\tconst next = argv[index + 1];\n\t\t\t\tif (next !== undefined && !next.startsWith(\"-\")) {\n\t\t\t\t\tvalue = next;\n\t\t\t\t\tindex++;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (value === undefined || value === \"\") {\n\t\t\t\tparsed.errors.push(`${name} requires a value`);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst values = parsed.values.get(name) ?? [];\n\t\t\tif (values.length > 0) {\n\t\t\t\tparsed.errors.push(`${name} may only be specified once`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst result = option.parse(value);\n\t\t\tif (!result.ok) {\n\t\t\t\tparsed.errors.push(result.error);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tvalues.push(result.value);\n\t\t\tparsed.values.set(name, values);\n\t\t}\n\t\treturn parsed;\n\t}\n}\n"]}
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../../../src/cli/experimental/command.ts"],"names":[],"mappings":"AAqBA,MAAM,UAAU,WAAW,CAC1B,IAAmB,EACnB,KAA0D;IAE1D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAgCD,MAAM,OAAO,OAAO;IAKV,IAAI,CAAS;IACL,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IACpD,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC5D,OAAO,CAAkC;IACzC,aAAa,CAA2C;IAEhE,YAAY,IAAY;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,MAAM,CAAS,MAA6B;QAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,8BAA8B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAuC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAA+C;QACrD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,CAKN,OAAqF;QAErF,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,IAAI,wBAAwB,CAAC,CAAC;QACzG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAA6B,CAAC;SAChF,CAAC,CAAC;QACH,OAAO,IAIN,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAuB;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAoC,CAAC;QAC9F,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAoC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAuB,EAAE,OAAiB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAiD,CAAC;QACzG,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAiC,EAAE,CAAC;IACxE,CAAC;IAEO,MAAM,CAAC,IAAuB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAEO,QAAQ,CAAC,IAAuB;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAuB;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,KAAK,EAAE,CAAS,MAA6B,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAuB;YAC3G,MAAM,EAAE,CAAS,MAA6B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAsB;SAC9G,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,IAAuB;QAC3C,MAAM,MAAM,GAA8B;YACzC,MAAM,EAAE,IAAI,GAAG,EAAE;YACjB,aAAa,EAAE,EAAE;YACjB,MAAM,EAAE,EAAE;SACV,CAAC;QACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;YAC9B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM;YACP,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChD,MAAM;YACP,CAAC;YAED,IAAI,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,KAAK,GAAG,IAAI,CAAC;oBACb,KAAK,EAAE,CAAC;gBACT,CAAC;YACF,CAAC;YACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;gBAC/C,SAAS;YACV,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;gBACzD,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjC,SAAS;YACV,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;CACD","sourcesContent":["export interface NamedCommandInvocation {\n\treadonly command: string;\n}\n\nexport type CommandParseResult<TInvocation extends NamedCommandInvocation = NamedCommandInvocation> =\n\t| { readonly ok: true; readonly command: TInvocation }\n\t| { readonly ok: false; readonly errors: readonly string[] };\n\nexport type CommandExecutionResult<TInvocation extends NamedCommandInvocation = NamedCommandInvocation> =\n\t| { readonly ok: true; readonly command: TInvocation }\n\t| { readonly ok: false; readonly errors: readonly string[] };\n\nexport type CommandOptionParseResult<TValue> =\n\t| { readonly ok: true; readonly value: TValue }\n\t| { readonly ok: false; readonly error: string };\n\nexport interface CommandOption<TValue> {\n\treadonly name: `--${string}`;\n\tparse(value: string): CommandOptionParseResult<TValue>;\n}\n\nexport function valueOption<TValue>(\n\tname: `--${string}`,\n\tparse: (value: string) => CommandOptionParseResult<TValue>,\n): CommandOption<TValue> {\n\treturn { name, parse };\n}\n\nexport function stringOption(name: `--${string}`): CommandOption<string> {\n\treturn valueOption(name, (value) => ({ ok: true, value }));\n}\n\nexport interface ParsedCommandInput {\n\treadonly remainingArgs: readonly string[];\n\tvalue<TValue>(option: CommandOption<TValue>): TValue | undefined;\n\tvalues<TValue>(option: CommandOption<TValue>): readonly TValue[];\n}\n\nexport type CommandBuildResult<TInvocation extends NamedCommandInvocation> =\n\t| { readonly ok: true; readonly command: TInvocation }\n\t| { readonly ok: false; readonly errors: readonly string[] };\n\ninterface MutableParsedCommandInput {\n\treadonly values: Map<string, unknown[]>;\n\treadonly remainingArgs: string[];\n\treadonly errors: string[];\n}\n\ntype CommandBuilder<TInvocation extends NamedCommandInvocation> = (\n\tinput: ParsedCommandInput,\n) => CommandBuildResult<TInvocation>;\n\ntype CommandAction<TInvocation extends NamedCommandInvocation, TContext> = (\n\tcommand: TInvocation,\n\tcontext: TContext,\n) => void | Promise<void>;\n\ninterface RegisteredCommand {\n\tparse(argv: readonly string[]): CommandParseResult;\n\texecute(argv: readonly string[], context: unknown): Promise<CommandExecutionResult>;\n}\n\nexport class Command<\n\tTOwnInvocation extends NamedCommandInvocation,\n\tTContext,\n\tTInvocation extends NamedCommandInvocation = TOwnInvocation,\n> {\n\treadonly name: string;\n\tprivate readonly options = new Map<string, CommandOption<unknown>>();\n\tprivate readonly subcommands = new Map<string, RegisteredCommand>();\n\tprivate builder?: CommandBuilder<TOwnInvocation>;\n\tprivate commandAction?: CommandAction<TOwnInvocation, TContext>;\n\n\tconstructor(name: string) {\n\t\tthis.name = name;\n\t}\n\n\toption<TValue>(option: CommandOption<TValue>): this {\n\t\tif (this.options.has(option.name)) {\n\t\t\tthrow new Error(`Option ${option.name} is already registered for ${this.name}`);\n\t\t}\n\t\tthis.options.set(option.name, option);\n\t\treturn this;\n\t}\n\n\tbuild(builder: CommandBuilder<TOwnInvocation>): this {\n\t\tthis.builder = builder;\n\t\treturn this;\n\t}\n\n\taction(action: CommandAction<TOwnInvocation, TContext>): this {\n\t\tthis.commandAction = action;\n\t\treturn this;\n\t}\n\n\tcommand<\n\t\tTSubcommandOwnInvocation extends NamedCommandInvocation,\n\t\tTSubcommandContext,\n\t\tTSubcommandInvocation extends NamedCommandInvocation,\n\t>(\n\t\tcommand: Command<TSubcommandOwnInvocation, TSubcommandContext, TSubcommandInvocation>,\n\t): Command<TOwnInvocation, TContext & TSubcommandContext, TInvocation | TSubcommandInvocation> {\n\t\tif (this.subcommands.has(command.name)) throw new Error(`Command ${command.name} is already registered`);\n\t\tthis.subcommands.set(command.name, {\n\t\t\tparse: (argv) => command.parse(argv),\n\t\t\texecute: (argv, context) => command.execute(argv, context as TSubcommandContext),\n\t\t});\n\t\treturn this as unknown as Command<\n\t\t\tTOwnInvocation,\n\t\t\tTContext & TSubcommandContext,\n\t\t\tTInvocation | TSubcommandInvocation\n\t\t>;\n\t}\n\n\tparse(argv: readonly string[]): CommandParseResult<TInvocation> {\n\t\tconst selected = this.select(argv);\n\t\tif (selected) return selected.command.parse(selected.argv) as CommandParseResult<TInvocation>;\n\t\treturn this.parseOwn(argv) as CommandParseResult<TInvocation>;\n\t}\n\n\tasync execute(argv: readonly string[], context: TContext): Promise<CommandExecutionResult<TInvocation>> {\n\t\tconst selected = this.select(argv);\n\t\tif (selected) {\n\t\t\treturn selected.command.execute(selected.argv, context) as Promise<CommandExecutionResult<TInvocation>>;\n\t\t}\n\n\t\tconst parsed = this.parseOwn(argv);\n\t\tif (!parsed.ok) return parsed;\n\t\tif (!this.commandAction) throw new Error(`Command ${this.name} does not define an action`);\n\t\tawait this.commandAction(parsed.command, context);\n\t\treturn { ok: true, command: parsed.command as unknown as TInvocation };\n\t}\n\n\tprivate select(argv: readonly string[]): { command: RegisteredCommand; argv: readonly string[] } | undefined {\n\t\tconst candidate = argv[0];\n\t\tif (candidate === undefined) return undefined;\n\t\tconst command = this.subcommands.get(candidate);\n\t\treturn command ? { command, argv: argv.slice(1) } : undefined;\n\t}\n\n\tprivate parseOwn(argv: readonly string[]): CommandParseResult<TOwnInvocation> {\n\t\tif (!this.builder) throw new Error(`Command ${this.name} does not define a builder`);\n\t\tconst parsed = this.parseOptions(argv);\n\t\tconst input: ParsedCommandInput = {\n\t\t\tremainingArgs: parsed.remainingArgs,\n\t\t\tvalue: <TValue>(option: CommandOption<TValue>) => parsed.values.get(option.name)?.[0] as TValue | undefined,\n\t\t\tvalues: <TValue>(option: CommandOption<TValue>) => (parsed.values.get(option.name) ?? []) as readonly TValue[],\n\t\t};\n\t\tconst built = this.builder(input);\n\t\tconst errors = [...parsed.errors, ...(built.ok ? [] : built.errors)];\n\t\tif (errors.length > 0) return { ok: false, errors };\n\t\tif (!built.ok) throw new Error(`Command ${this.name} failed without an error`);\n\t\treturn { ok: true, command: built.command };\n\t}\n\n\tprivate parseOptions(argv: readonly string[]): MutableParsedCommandInput {\n\t\tconst parsed: MutableParsedCommandInput = {\n\t\t\tvalues: new Map(),\n\t\t\tremainingArgs: [],\n\t\t\terrors: [],\n\t\t};\n\t\tfor (let index = 0; index < argv.length; index++) {\n\t\t\tconst argument = argv[index]!;\n\t\t\tif (argument === \"--\") {\n\t\t\t\tparsed.remainingArgs.push(...argv.slice(index));\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tconst equals = argument.indexOf(\"=\");\n\t\t\tconst name = equals === -1 ? argument : argument.slice(0, equals);\n\t\t\tconst option = this.options.get(name);\n\t\t\tif (!option) {\n\t\t\t\tparsed.remainingArgs.push(...argv.slice(index));\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tlet value = equals === -1 ? undefined : argument.slice(equals + 1);\n\t\t\tif (value === undefined) {\n\t\t\t\tconst next = argv[index + 1];\n\t\t\t\tif (next !== undefined && !next.startsWith(\"-\")) {\n\t\t\t\t\tvalue = next;\n\t\t\t\t\tindex++;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (value === undefined || value === \"\") {\n\t\t\t\tparsed.errors.push(`${name} requires a value`);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst values = parsed.values.get(name) ?? [];\n\t\t\tif (values.length > 0) {\n\t\t\t\tparsed.errors.push(`${name} may only be specified once`);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst result = option.parse(value);\n\t\t\tif (!result.ok) {\n\t\t\t\tparsed.errors.push(result.error);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tvalues.push(result.value);\n\t\t\tparsed.values.set(name, values);\n\t\t}\n\t\treturn parsed;\n\t}\n}\n"]}

package/dist/cli.js

@@ -3,7 +3,7 @@
  * CLI entry point for the refactored coding agent.
  * Uses main.ts with AgentSession and new mode modules.
  *
- * Test with: npx tsx src/cli-new.ts [args...]
+ * Test with: bun src/cli.ts [args...]
  *
  * Deliberately keeps the static entry graph to config, compile-cache support,
  * attribution, and the disabled-by-default lifecycle seam. The full CLI graph

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAExE,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAErC,4BAA4B,EAAE,CAAC;AAE/B,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;AACzB,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,GAAG,MAAM,CAAC;AAC/D,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,eAAe,CAAC;AACvC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,GAAE,CAAC,CAA+B,CAAC;AAE/D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,mDAAmD;AACnD,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAChF,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;IAC3C,uBAAuB,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;AACZ,CAAC,CACD,CAAC","sourcesContent":["#!/usr/bin/env node\n/**\n * CLI entry point for the refactored coding agent.\n * Uses main.ts with AgentSession and new mode modules.\n *\n * Test with: npx tsx src/cli-new.ts [args...]\n *\n * Deliberately keeps the static entry graph to config, compile-cache support,\n * attribution, and the disabled-by-default lifecycle seam. The full CLI graph\n * loads dynamically so metadata fast paths (for example `--version`) skip it.\n */\nimport { APP_NAME, VERSION } from \"./config.js\";\nimport { markLifecycleTiming } from \"./core/lifecycle-timings.ts\";\nimport { ATOMIC_AI_AGENT } from \"./utils/agent-attribution.ts\";\nimport { enablePersistentCompileCache } from \"./utils/compile-cache.ts\";\n\nmarkLifecycleTiming(\"process-entry\");\n\nenablePersistentCompileCache();\n\nprocess.title = APP_NAME;\nprocess.env[`${APP_NAME.toUpperCase()}_CODING_AGENT`] = \"true\";\nprocess.env.AI_AGENT = ATOMIC_AI_AGENT;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\nconst args = process.argv.slice(2);\n\nif (args[0] === \"--version\" || args[0] === \"-v\") {\n\tconsole.log(VERSION);\n\tprocess.exit(0);\n}\n\n// No top-level await: the compiled binary is built with --bytecode (CJS),\n// which forbids TLA anywhere in the bundled graph.\nvoid Promise.all([import(\"./core/http-dispatcher.ts\"), import(\"./main.ts\")]).then(\n\t([{ configureHttpDispatcher }, { main }]) => {\n\t\tconfigureHttpDispatcher();\n\t\tmain(args);\n\t},\n);\n"]}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAExE,mBAAmB,CAAC,eAAe,CAAC,CAAC;AAErC,4BAA4B,EAAE,CAAC;AAE/B,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;AACzB,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,GAAG,MAAM,CAAC;AAC/D,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,eAAe,CAAC;AACvC,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,GAAE,CAAC,CAA+B,CAAC;AAE/D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,mDAAmD;AACnD,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAChF,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE;IAC3C,uBAAuB,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;AACZ,CAAC,CACD,CAAC","sourcesContent":["#!/usr/bin/env node\n/**\n * CLI entry point for the refactored coding agent.\n * Uses main.ts with AgentSession and new mode modules.\n *\n * Test with: bun src/cli.ts [args...]\n *\n * Deliberately keeps the static entry graph to config, compile-cache support,\n * attribution, and the disabled-by-default lifecycle seam. The full CLI graph\n * loads dynamically so metadata fast paths (for example `--version`) skip it.\n */\nimport { APP_NAME, VERSION } from \"./config.js\";\nimport { markLifecycleTiming } from \"./core/lifecycle-timings.ts\";\nimport { ATOMIC_AI_AGENT } from \"./utils/agent-attribution.ts\";\nimport { enablePersistentCompileCache } from \"./utils/compile-cache.ts\";\n\nmarkLifecycleTiming(\"process-entry\");\n\nenablePersistentCompileCache();\n\nprocess.title = APP_NAME;\nprocess.env[`${APP_NAME.toUpperCase()}_CODING_AGENT`] = \"true\";\nprocess.env.AI_AGENT = ATOMIC_AI_AGENT;\nprocess.emitWarning = (() => {}) as typeof process.emitWarning;\n\nconst args = process.argv.slice(2);\n\nif (args[0] === \"--version\" || args[0] === \"-v\") {\n\tconsole.log(VERSION);\n\tprocess.exit(0);\n}\n\n// No top-level await: the compiled binary is built with --bytecode (CJS),\n// which forbids TLA anywhere in the bundled graph.\nvoid Promise.all([import(\"./core/http-dispatcher.ts\"), import(\"./main.ts\")]).then(\n\t([{ configureHttpDispatcher }, { main }]) => {\n\t\tconfigureHttpDispatcher();\n\t\tmain(args);\n\t},\n);\n"]}

package/dist/config.d.ts

@@ -16,21 +16,21 @@ export declare function getUpdateInstruction(packageName: string): string;
  * Get the base directory for resolving package assets (themes, package.json, README.md, CHANGELOG.md).
  * - For Bun binary: returns the directory containing the executable
  * - For Node.js (dist/): returns __dirname (the dist/ directory)
- * - For tsx (src/): returns parent directory (the package root)
+ * - For source (src/): returns parent directory (the package root)
  */
 export declare function getPackageDir(): string;
 /**
  * Get path to built-in themes directory (shipped with package)
  * - For Bun binary: theme/ next to executable
  * - For Node.js (dist/): dist/modes/interactive/theme/
- * - For tsx (src/): src/modes/interactive/theme/
+ * - For source (src/): src/modes/interactive/theme/
  */
 export declare function getThemesDir(): string;
 /**
  * Get path to HTML export template directory (shipped with package)
  * - For Bun binary: export-html/ next to executable
  * - For Node.js (dist/): dist/core/export-html/
- * - For tsx (src/): src/core/export-html/
+ * - For source (src/): src/core/export-html/
  */
 export declare function getExportTemplateDir(): string;
 /** Get path to package.json */
@@ -47,7 +47,7 @@ export declare function getChangelogPath(): string;
  * Get path to built-in interactive assets directory.
  * - For Bun binary: assets/ next to executable
  * - For Node.js (dist/): dist/modes/interactive/assets/
- * - For tsx (src/): src/modes/interactive/assets/
+ * - For source (src/): src/modes/interactive/assets/
  */
 export declare function getInteractiveAssetsDir(): string;
 /** Get path to a bundled interactive asset */

package/dist/config.js

@@ -59,7 +59,7 @@ export function getUpdateInstruction(packageName) {
  * Get the base directory for resolving package assets (themes, package.json, README.md, CHANGELOG.md).
  * - For Bun binary: returns the directory containing the executable
  * - For Node.js (dist/): returns __dirname (the dist/ directory)
- * - For tsx (src/): returns parent directory (the package root)
+ * - For source (src/): returns parent directory (the package root)
  */
 export function getPackageDir() {
     // Allow override via environment variable (useful for Nix/Guix where store paths tokenize poorly).
@@ -95,7 +95,7 @@ function getModuleAssetRoot() {
  * Get path to built-in themes directory (shipped with package)
  * - For Bun binary: theme/ next to executable
  * - For Node.js (dist/): dist/modes/interactive/theme/
- * - For tsx (src/): src/modes/interactive/theme/
+ * - For source (src/): src/modes/interactive/theme/
  */
 export function getThemesDir() {
     if (isBunBinary) {
@@ -107,7 +107,7 @@ export function getThemesDir() {
  * Get path to HTML export template directory (shipped with package)
  * - For Bun binary: export-html/ next to executable
  * - For Node.js (dist/): dist/core/export-html/
- * - For tsx (src/): src/core/export-html/
+ * - For source (src/): src/core/export-html/
  */
 export function getExportTemplateDir() {
     if (isBunBinary) {
@@ -139,7 +139,7 @@ export function getChangelogPath() {
  * Get path to built-in interactive assets directory.
  * - For Bun binary: assets/ next to executable
  * - For Node.js (dist/): dist/modes/interactive/assets/
- * - For tsx (src/): src/modes/interactive/assets/
+ * - For source (src/): src/modes/interactive/assets/
  */
 export function getInteractiveAssetsDir() {
     if (isBunBinary) {