@bastani/atomic 0.9.9 → 0.9.10-alpha.1

package/dist/core/auth-storage.js

@@ -5,11 +5,11 @@
  * Uses file locking to prevent race conditions when multiple pi instances
  * try to refresh tokens simultaneously.
  */
-import { findEnvKeys, getEnvApiKey, } from "@earendil-works/pi-ai/compat";
-import { getOAuthApiKey, getOAuthProvider, getOAuthProviders } from "@earendil-works/pi-ai/oauth";
+import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { join } from "path";
 import { getAgentConfigPaths, getAgentDir } from "../config.js";
 import { FileAuthStorageBackend, InMemoryAuthStorageBackend } from "./auth-storage-backends.js";
+import { getOAuthProviderDescriptors, loginOAuthProvider, oauthCredentialToAuth, refreshOAuthProvider, } from "./oauth-provider-bridge.js";
 import { resolveConfigValue } from "./resolve-config-value.js";
 export { FileAuthStorageBackend, InMemoryAuthStorageBackend } from "./auth-storage-backends.js";
 /**
@@ -21,11 +21,16 @@ export class AuthStorage {
         this.runtimeOverrides = new Map();
         this.loadError = null;
         this.errors = [];
+        this.credentialMutationTail = Promise.resolve();
+        this.credentialVersions = new Map();
         this.storage = storage;
         this.reload();
     }
     static create(authPath) {
-        return new AuthStorage(new FileAuthStorageBackend(authPath ?? join(getAgentDir(), "auth.json"), authPath ? [authPath] : getAgentConfigPaths("auth.json")));
+        const paths = authPath === undefined
+            ? getAgentConfigPaths("auth.json")
+            : Array.isArray(authPath) ? authPath : [authPath];
+        return new AuthStorage(new FileAuthStorageBackend(paths[0] ?? join(getAgentDir(), "auth.json"), paths));
     }
     static fromStorage(storage) {
         return new AuthStorage(storage);
@@ -42,6 +47,10 @@ export class AuthStorage {
     setRuntimeApiKey(provider, apiKey) {
         this.runtimeOverrides.set(provider, apiKey);
     }
+    /** Read a non-persisted request override without resolving stored credentials. */
+    getRuntimeApiKey(provider) {
+        return this.runtimeOverrides.get(provider);
+    }
     /**
      * Remove a runtime API key override.
      */
@@ -100,6 +109,9 @@ export class AuthStorage {
         });
         return content;
     }
+    bumpCredentialVersion(provider) {
+        this.credentialVersions.set(provider, (this.credentialVersions.get(provider) ?? 0) + 1);
+    }
     persistProviderChange(provider, credential) {
         if (this.loadError) {
             this.reload();
@@ -119,6 +131,7 @@ export class AuthStorage {
                 return { result: merged, next: JSON.stringify(merged, null, 2) };
             });
             this.data = persistedData;
+            this.bumpCredentialVersion(provider);
             this.loadError = null;
         }
         catch (error) {
@@ -190,9 +203,7 @@ export class AuthStorage {
         }
         return { configured: false };
     }
-    /**
-     * Get all credentials (for passing to getOAuthApiKey).
-     */
+    /** Return a copy of all persisted credentials. */
     getAll() {
         return { ...this.data };
     }
@@ -219,60 +230,58 @@ export class AuthStorage {
      * Login to an OAuth provider.
      */
     async login(providerId, callbacks) {
-        const provider = getOAuthProvider(providerId);
-        if (!provider) {
-            throw new Error(`Unknown OAuth provider: ${providerId}`);
-        }
-        const credentials = await provider.login(callbacks);
-        this.set(providerId, { type: "oauth", ...credentials });
+        const credential = await loginOAuthProvider(providerId, callbacks);
+        await this.asCredentialStore().modify(providerId, async () => credential);
     }
-    /**
-     * Logout from a provider.
-     */
+    /** Logout through the preserved synchronous persistence path. */
     logout(provider) {
         this.remove(provider);
     }
+    /** Serialized logout for callers that need persistence completion. */
+    async logoutAsync(provider) {
+        await this.asCredentialStore().delete(provider);
+    }
     /**
      * Refresh OAuth token with backend locking to prevent race conditions.
      * Multiple pi instances may try to refresh simultaneously when tokens expire.
      */
     async refreshOAuthTokenWithLock(providerId) {
-        const provider = getOAuthProvider(providerId);
-        if (!provider) {
-            return null;
-        }
-        let synchronizedData;
-        const result = await this.storage.withLockAsync(async (current) => {
-            const currentData = this.parseStorageData(current);
-            synchronizedData = currentData;
-            const cred = currentData[providerId];
-            if (cred?.type !== "oauth") {
-                return { result: null };
-            }
-            if (Date.now() < cred.expires) {
-                return { result: { apiKey: provider.getApiKey(cred), newCredentials: cred } };
-            }
-            const oauthCreds = {};
-            for (const [key, value] of Object.entries(currentData)) {
-                if (value.type === "oauth") {
-                    oauthCreds[key] = value;
+        return this.runCredentialMutation(async () => {
+            let synchronizedData;
+            const credentialVersion = this.credentialVersions.get(providerId) ?? 0;
+            const result = await this.storage.withLockAsync(async (current) => {
+                const currentData = this.parseStorageData(current);
+                synchronizedData = currentData;
+                const cred = currentData[providerId];
+                if (cred?.type !== "oauth")
+                    return { result: null };
+                const oauthCredential = { ...cred, type: "oauth" };
+                if (Date.now() < cred.expires) {
+                    const auth = await oauthCredentialToAuth(providerId, oauthCredential);
+                    return { result: auth ? { auth, newCredentials: cred } : null };
                 }
-            }
-            const refreshed = await getOAuthApiKey(providerId, oauthCreds);
-            if (!refreshed) {
-                return { result: null };
-            }
-            const merged = {
-                ...currentData,
-                [providerId]: { type: "oauth", ...refreshed.newCredentials },
-            };
-            synchronizedData = merged;
-            return { result: refreshed, next: JSON.stringify(merged, null, 2) };
+                const refreshed = await refreshOAuthProvider(providerId, oauthCredential);
+                if (!refreshed)
+                    return { result: null };
+                if ((this.credentialVersions.get(providerId) ?? 0) !== credentialVersion) {
+                    synchronizedData = undefined;
+                    return { result: null };
+                }
+                const merged = {
+                    ...currentData,
+                    [providerId]: refreshed.credential,
+                };
+                synchronizedData = merged;
+                return {
+                    result: { auth: refreshed.auth, newCredentials: refreshed.credential },
+                    next: JSON.stringify(merged, null, 2),
+                };
+            });
+            if (synchronizedData)
+                this.data = synchronizedData;
+            this.loadError = null;
+            return result;
         });
-        if (synchronizedData)
-            this.data = synchronizedData;
-        this.loadError = null;
-        return result;
     }
     /**
      * Get API key for a provider.
@@ -283,66 +292,116 @@ export class AuthStorage {
      * 4. Environment variable
      * 5. Fallback resolver (models.json custom providers)
      */
-    async getApiKey(providerId, options) {
-        // Runtime override takes highest priority
+    async getModelAuth(providerId, options) {
         const runtimeKey = this.runtimeOverrides.get(providerId);
-        if (runtimeKey) {
-            return runtimeKey;
-        }
+        if (runtimeKey)
+            return { apiKey: runtimeKey };
         const cred = this.data[providerId];
-        if (cred?.type === "api_key") {
-            return resolveConfigValue(cred.key);
-        }
+        if (cred?.type === "api_key")
+            return { apiKey: resolveConfigValue(cred.key) };
         if (cred?.type === "oauth") {
-            const provider = getOAuthProvider(providerId);
-            if (!provider) {
-                // Unknown OAuth provider, can't get API key
-                return undefined;
-            }
-            // Check if token needs refresh
-            const needsRefresh = Date.now() >= cred.expires;
-            if (needsRefresh) {
-                // Use locked refresh to prevent race conditions
-                try {
-                    const result = await this.refreshOAuthTokenWithLock(providerId);
-                    if (result) {
-                        return result.apiKey;
-                    }
-                }
-                catch (error) {
-                    this.recordError(error);
-                    // Refresh failed - re-read file to check if another instance succeeded
-                    this.reload();
-                    const updatedCred = this.data[providerId];
-                    if (updatedCred?.type === "oauth" && Date.now() < updatedCred.expires) {
-                        // Another instance refreshed successfully, use those credentials
-                        return provider.getApiKey(updatedCred);
-                    }
-                    // Refresh truly failed - return undefined so model discovery skips this provider
-                    // User can /login to re-authenticate (credentials preserved for retry)
-                    return undefined;
+            try {
+                if (Date.now() >= cred.expires) {
+                    return (await this.refreshOAuthTokenWithLock(providerId))?.auth;
                 }
+                return await oauthCredentialToAuth(providerId, { ...cred, type: "oauth" });
             }
-            else {
-                // Token not expired, use current access token
-                return provider.getApiKey(cred);
+            catch (error) {
+                this.recordError(error);
+                this.reload();
+                const updated = this.data[providerId];
+                if (updated?.type === "oauth" && Date.now() < updated.expires) {
+                    return oauthCredentialToAuth(providerId, { ...updated, type: "oauth" });
+                }
+                return undefined;
             }
         }
-        // Fall back to environment variable
         const envKey = getEnvApiKey(providerId);
         if (envKey)
-            return envKey;
-        // Fall back to custom resolver (e.g., models.json custom providers)
+            return { apiKey: envKey };
         if (options?.includeFallback !== false) {
-            return this.fallbackResolver?.(providerId) ?? undefined;
+            const fallback = this.fallbackResolver?.(providerId);
+            if (fallback)
+                return { apiKey: fallback };
         }
         return undefined;
     }
+    async getApiKey(providerId, options) {
+        return (await this.getModelAuth(providerId, options))?.apiKey;
+    }
     /**
      * Get all registered OAuth providers
      */
     getOAuthProviders() {
-        return getOAuthProviders();
+        return getOAuthProviderDescriptors();
+    }
+    runCredentialMutation(operation) {
+        const result = this.credentialMutationTail.then(operation, operation);
+        this.credentialMutationTail = result.then(() => undefined, () => undefined);
+        return result;
+    }
+    /** Private async adapter for pi-ai's provider-owned Models runtime. */
+    asCredentialStore() {
+        const runtimeCredential = (providerId) => {
+            const key = this.runtimeOverrides.get(providerId);
+            return key === undefined ? undefined : { type: "api_key", key };
+        };
+        return {
+            read: async (providerId) => runtimeCredential(providerId) ?? this.get(providerId),
+            list: async () => {
+                const providers = new Set([...this.list(), ...this.runtimeOverrides.keys()]);
+                return [...providers].map((providerId) => ({
+                    providerId,
+                    type: runtimeCredential(providerId)?.type ?? this.data[providerId].type,
+                }));
+            },
+            modify: (providerId, fn) => this.runCredentialMutation(async () => {
+                let synchronizedData;
+                try {
+                    const result = await this.storage.withLockAsync(async (current) => {
+                        const data = this.parseStorageData(current);
+                        const next = await fn(data[providerId]);
+                        if (next === undefined) {
+                            synchronizedData = data;
+                            return { result: data[providerId] };
+                        }
+                        const merged = { ...data, [providerId]: next };
+                        synchronizedData = merged;
+                        return { result: next, next: JSON.stringify(merged, null, 2) };
+                    });
+                    if (synchronizedData) {
+                        this.data = synchronizedData;
+                        this.bumpCredentialVersion(providerId);
+                    }
+                    this.loadError = null;
+                    return result;
+                }
+                catch (error) {
+                    this.recordError(error);
+                    throw error;
+                }
+            }),
+            delete: (providerId) => this.runCredentialMutation(async () => {
+                let synchronizedData;
+                try {
+                    await this.storage.withLockAsync(async (current) => {
+                        const data = this.parseStorageData(current);
+                        delete data[providerId];
+                        synchronizedData = data;
+                        return { result: undefined, next: JSON.stringify(data, null, 2) };
+                    });
+                    if (synchronizedData) {
+                        this.data = synchronizedData;
+                        this.bumpCredentialVersion(providerId);
+                    }
+                    this.loadError = null;
+                }
+                catch (error) {
+                    this.recordError(error);
+                    throw error;
+                }
+            }),
+        };
     }
 }
 //# sourceMappingURL=auth-storage.js.map

package/dist/core/auth-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,WAAW,EACX,YAAY,GAIZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAClG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAqB/D,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AAEzH;;GAEG;AACH,MAAM,OAAO,WAAW;IASvB,YAAoB,OAA2B;QARvC,SAAI,GAAoB,EAAE,CAAC;QAC3B,qBAAgB,GAAwB,IAAI,GAAG,EAAE,CAAC;QAElD,cAAS,GAAiB,IAAI,CAAC;QAC/B,WAAM,GAAY,EAAE,CAAC;QAK5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAAiB;QAC9B,OAAO,IAAI,WAAW,CACrB,IAAI,sBAAsB,CACzB,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,EAC5C,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC,CACxD,CACD,CAAC;IACH,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,QAAgB,EAAE,MAAc;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,QAAgB;QACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAkD;QACrE,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IAClC,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,MAAM,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,CAAC;YACJ,kEAAkE;YAClE,mEAAmE;YACnE,yEAAyE;YACzE,wEAAwE;YACxE,4BAA4B;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,GAAG,KAAc,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IAED;;;;OAIG;IACK,YAAY;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,OAAO,GAAG,OAAO,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAAC,QAAgB,EAAE,UAAsC;QACrF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACvD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC;gBACnD,IAAI,UAAU,EAAE,CAAC;oBAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACP,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;YAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB,EAAE,UAA0B;QAC/C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,IAAI;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB;QACnB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB;QACvB,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,KAAK,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QACnF,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,MAAM;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,WAAW;QACV,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACH,YAAY;QACX,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,UAA2B,EAAE,SAA8B;QACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,yBAAyB,CACtC,UAA2B;QAE3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,gBAA6C,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,gBAAgB,GAAG,WAAW,CAAC;YAE/B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;YAC/E,CAAC;YAED,MAAM,UAAU,GAAqC,EAAE,CAAC;YACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC5B,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACzB,CAAC;YACF,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,MAAM,MAAM,GAAoB;gBAC/B,GAAG,WAAW;gBACd,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,cAAc,EAAE;aAC5D,CAAC;YACF,gBAAgB,GAAG,MAAM,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAuC;QAC1E,0CAA0C;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnC,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,4CAA4C;gBAC5C,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,+BAA+B;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;YAEhD,IAAI,YAAY,EAAE,CAAC;gBAClB,gDAAgD;gBAChD,IAAI,CAAC;oBACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;oBAChE,IAAI,MAAM,EAAE,CAAC;wBACZ,OAAO,MAAM,CAAC,MAAM,CAAC;oBACtB,CAAC;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBACxB,uEAAuE;oBACvE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACd,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAE1C,IAAI,WAAW,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;wBACvE,iEAAiE;wBACjE,OAAO,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;oBACxC,CAAC;oBAED,iFAAiF;oBACjF,uEAAuE;oBACvE,OAAO,SAAS,CAAC;gBAClB,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,8CAA8C;gBAC9C,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACF,CAAC;QAED,oCAAoC;QACpC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,oEAAoE;QACpE,IAAI,OAAO,EAAE,eAAe,KAAK,KAAK,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QACzD,CAAC;QAED,OAAO,SAAS,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,iBAAiB;QAChB,OAAO,iBAAiB,EAAE,CAAC;IAC5B,CAAC;CACD","sourcesContent":["/**\n * Credential storage for API keys and OAuth tokens.\n * Handles loading, saving, and refreshing credentials from auth.json.\n *\n * Uses file locking to prevent race conditions when multiple pi instances\n * try to refresh tokens simultaneously.\n */\n\nimport {\n\tfindEnvKeys,\n\tgetEnvApiKey,\n\ttype OAuthCredentials,\n\ttype OAuthLoginCallbacks,\n\ttype OAuthProviderId,\n} from \"@earendil-works/pi-ai/compat\";\nimport { getOAuthApiKey, getOAuthProvider, getOAuthProviders } from \"@earendil-works/pi-ai/oauth\";\nimport { join } from \"path\";\nimport { getAgentConfigPaths, getAgentDir } from \"../config.ts\";\nimport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\nimport { resolveConfigValue } from \"./resolve-config-value.ts\";\n\nexport type ApiKeyCredential = {\n\ttype: \"api_key\";\n\tkey: string;\n};\n\nexport type OAuthCredential = {\n\ttype: \"oauth\";\n} & OAuthCredentials;\n\nexport type AuthCredential = ApiKeyCredential | OAuthCredential;\n\nexport type AuthStorageData = Record<string, AuthCredential>;\n\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage {\n\tprivate data: AuthStorageData = {};\n\tprivate runtimeOverrides: Map<string, string> = new Map();\n\tprivate fallbackResolver?: (provider: string) => string | undefined;\n\tprivate loadError: Error | null = null;\n\tprivate errors: Error[] = [];\n\n\tdeclare private storage: AuthStorageBackend;\n\n\tprivate constructor(storage: AuthStorageBackend) {\n\t\tthis.storage = storage;\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath?: string): AuthStorage {\n\t\treturn new AuthStorage(\n\t\t\tnew FileAuthStorageBackend(\n\t\t\t\tauthPath ?? join(getAgentDir(), \"auth.json\"),\n\t\t\t\tauthPath ? [authPath] : getAgentConfigPaths(\"auth.json\"),\n\t\t\t),\n\t\t);\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\t/**\n\t * Set a runtime API key override (not persisted to disk).\n\t * Used for CLI --api-key flag.\n\t */\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\n\t\tthis.runtimeOverrides.set(provider, apiKey);\n\t}\n\n\t/**\n\t * Remove a runtime API key override.\n\t */\n\tremoveRuntimeApiKey(provider: string): void {\n\t\tthis.runtimeOverrides.delete(provider);\n\t}\n\n\t/**\n\t * Set a fallback resolver for API keys not found in auth.json or env vars.\n\t * Used for custom provider keys from models.json.\n\t */\n\tsetFallbackResolver(resolver: (provider: string) => string | undefined): void {\n\t\tthis.fallbackResolver = resolver;\n\t}\n\n\tprivate recordError(error: unknown): void {\n\t\tconst normalizedError = error instanceof Error ? error : new Error(String(error));\n\t\tthis.errors.push(normalizedError);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as AuthStorageData;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\ttry {\n\t\t\t// Pure read: never take the exclusive write lock. Writers replace\n\t\t\t// auth.json atomically, so a lock-free read always sees a complete\n\t\t\t// snapshot. This keeps many concurrent sessions from starving each other\n\t\t\t// on the lock and misreporting configured providers as unreadable under\n\t\t\t// contention (issue #1431).\n\t\t\tconst content = this.readSnapshot();\n\t\t\tthis.data = this.parseStorageData(content);\n\t\t\tthis.loadError = null;\n\t\t} catch (error) {\n\t\t\tthis.loadError = error as Error;\n\t\t\tthis.recordError(error);\n\t\t}\n\t}\n\n\t/**\n\t * Read the credential snapshot, preferring the backend's lock-free `read()`.\n\t * Falls back to a `withLock`-based read for custom backends that predate\n\t * `read()` so the released `AuthStorageBackend` interface stays compatible.\n\t */\n\tprivate readSnapshot(): string | undefined {\n\t\tif (this.storage.read) {\n\t\t\treturn this.storage.read();\n\t\t}\n\t\tlet content: string | undefined;\n\t\tthis.storage.withLock((current) => {\n\t\t\tcontent = current;\n\t\t\treturn { result: undefined };\n\t\t});\n\t\treturn content;\n\t}\n\n\tprivate persistProviderChange(provider: string, credential: AuthCredential | undefined): void {\n\t\tif (this.loadError) {\n\t\t\tthis.reload();\n\t\t\tif (this.loadError) throw this.loadError;\n\t\t}\n\n\t\ttry {\n\t\t\tconst persistedData = this.storage.withLock((current) => {\n\t\t\t\tconst currentData = this.parseStorageData(current);\n\t\t\t\tconst merged: AuthStorageData = { ...currentData };\n\t\t\t\tif (credential) {\n\t\t\t\t\tmerged[provider] = credential;\n\t\t\t\t} else {\n\t\t\t\t\tdelete merged[provider];\n\t\t\t\t}\n\t\t\t\treturn { result: merged, next: JSON.stringify(merged, null, 2) };\n\t\t\t});\n\t\t\tthis.data = persistedData;\n\t\t\tthis.loadError = null;\n\t\t} catch (error) {\n\t\t\tthis.recordError(error);\n\t\t\tthrow error instanceof Error ? error : new Error(String(error));\n\t\t}\n\t}\n\n\t/**\n\t * Get credential for a provider.\n\t */\n\tget(provider: string): AuthCredential | undefined {\n\t\treturn this.data[provider] ?? undefined;\n\t}\n\n\t/**\n\t * Set credential for a provider.\n\t */\n\tset(provider: string, credential: AuthCredential): void {\n\t\tthis.persistProviderChange(provider, credential);\n\t}\n\n\t/**\n\t * Remove credential for a provider.\n\t */\n\tremove(provider: string): void {\n\t\tthis.persistProviderChange(provider, undefined);\n\t}\n\n\t/**\n\t * List all providers with credentials.\n\t */\n\tlist(): string[] {\n\t\treturn Object.keys(this.data);\n\t}\n\n\t/**\n\t * Check if credentials exist for a provider in auth.json.\n\t */\n\thas(provider: string): boolean {\n\t\treturn provider in this.data;\n\t}\n\n\t/**\n\t * Check if any form of auth is configured for a provider.\n\t * Unlike getApiKey(), this doesn't refresh OAuth tokens.\n\t */\n\thasAuth(provider: string): boolean {\n\t\tif (this.runtimeOverrides.has(provider)) return true;\n\t\tif (this.data[provider]) return true;\n\t\tif (getEnvApiKey(provider)) return true;\n\t\tif (this.fallbackResolver?.(provider)) return true;\n\t\treturn false;\n\t}\n\n\t/**\n\t * Return auth status without exposing credential values or refreshing tokens.\n\t */\n\tgetAuthStatus(provider: string): AuthStatus {\n\t\tif (this.data[provider]) {\n\t\t\treturn { configured: true, source: \"stored\" };\n\t\t}\n\n\t\tif (this.runtimeOverrides.has(provider)) {\n\t\t\treturn { configured: false, source: \"runtime\", label: \"--api-key\" };\n\t\t}\n\n\t\tconst envKeys = findEnvKeys(provider);\n\t\tif (envKeys?.[0]) {\n\t\t\treturn { configured: false, source: \"environment\", label: envKeys[0] };\n\t\t}\n\n\t\tif (this.fallbackResolver?.(provider)) {\n\t\t\treturn { configured: false, source: \"fallback\", label: \"custom provider config\" };\n\t\t}\n\n\t\treturn { configured: false };\n\t}\n\n\t/**\n\t * Get all credentials (for passing to getOAuthApiKey).\n\t */\n\tgetAll(): AuthStorageData {\n\t\treturn { ...this.data };\n\t}\n\n\tdrainErrors(): Error[] {\n\t\tconst drained = [...this.errors];\n\t\tthis.errors = [];\n\t\treturn drained;\n\t}\n\n\t/**\n\t * Returns the error from the most recent failed credential load, or null when\n\t * the last reload succeeded.\n\t *\n\t * A non-null value means stored credentials could NOT be read — e.g. the auth\n\t * file was temporarily locked by another process (ELOCKED) or contained\n\t * invalid JSON — so an empty/absent credential set is NOT authoritative.\n\t * Callers that would otherwise report \"No API key found\" should surface this\n\t * load failure instead of treating the provider as unauthenticated\n\t * (issue #1431).\n\t */\n\tgetLoadError(): Error | null {\n\t\treturn this.loadError;\n\t}\n\n\t/**\n\t * Login to an OAuth provider.\n\t */\n\tasync login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks): Promise<void> {\n\t\tconst provider = getOAuthProvider(providerId);\n\t\tif (!provider) {\n\t\t\tthrow new Error(`Unknown OAuth provider: ${providerId}`);\n\t\t}\n\n\t\tconst credentials = await provider.login(callbacks);\n\t\tthis.set(providerId, { type: \"oauth\", ...credentials });\n\t}\n\n\t/**\n\t * Logout from a provider.\n\t */\n\tlogout(provider: string): void {\n\t\tthis.remove(provider);\n\t}\n\n\t/**\n\t * Refresh OAuth token with backend locking to prevent race conditions.\n\t * Multiple pi instances may try to refresh simultaneously when tokens expire.\n\t */\n\tprivate async refreshOAuthTokenWithLock(\n\t\tproviderId: OAuthProviderId,\n\t): Promise<{ apiKey: string; newCredentials: OAuthCredentials } | null> {\n\t\tconst provider = getOAuthProvider(providerId);\n\t\tif (!provider) {\n\t\t\treturn null;\n\t\t}\n\n\t\tlet synchronizedData: AuthStorageData | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (current) => {\n\t\t\tconst currentData = this.parseStorageData(current);\n\t\t\tsynchronizedData = currentData;\n\n\t\t\tconst cred = currentData[providerId];\n\t\t\tif (cred?.type !== \"oauth\") {\n\t\t\t\treturn { result: null };\n\t\t\t}\n\n\t\t\tif (Date.now() < cred.expires) {\n\t\t\t\treturn { result: { apiKey: provider.getApiKey(cred), newCredentials: cred } };\n\t\t\t}\n\n\t\t\tconst oauthCreds: Record<string, OAuthCredentials> = {};\n\t\t\tfor (const [key, value] of Object.entries(currentData)) {\n\t\t\t\tif (value.type === \"oauth\") {\n\t\t\t\t\toauthCreds[key] = value;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst refreshed = await getOAuthApiKey(providerId, oauthCreds);\n\t\t\tif (!refreshed) {\n\t\t\t\treturn { result: null };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = {\n\t\t\t\t...currentData,\n\t\t\t\t[providerId]: { type: \"oauth\", ...refreshed.newCredentials },\n\t\t\t};\n\t\t\tsynchronizedData = merged;\n\t\t\treturn { result: refreshed, next: JSON.stringify(merged, null, 2) };\n\t\t});\n\n\t\tif (synchronizedData) this.data = synchronizedData;\n\t\tthis.loadError = null;\n\t\treturn result;\n\t}\n\n\t/**\n\t * Get API key for a provider.\n\t * Priority:\n\t * 1. Runtime override (CLI --api-key)\n\t * 2. API key from auth.json\n\t * 3. OAuth token from auth.json (auto-refreshed with locking)\n\t * 4. Environment variable\n\t * 5. Fallback resolver (models.json custom providers)\n\t */\n\tasync getApiKey(providerId: string, options?: { includeFallback?: boolean }): Promise<string | undefined> {\n\t\t// Runtime override takes highest priority\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\n\t\tif (runtimeKey) {\n\t\t\treturn runtimeKey;\n\t\t}\n\n\t\tconst cred = this.data[providerId];\n\n\t\tif (cred?.type === \"api_key\") {\n\t\t\treturn resolveConfigValue(cred.key);\n\t\t}\n\n\t\tif (cred?.type === \"oauth\") {\n\t\t\tconst provider = getOAuthProvider(providerId);\n\t\t\tif (!provider) {\n\t\t\t\t// Unknown OAuth provider, can't get API key\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\t// Check if token needs refresh\n\t\t\tconst needsRefresh = Date.now() >= cred.expires;\n\n\t\t\tif (needsRefresh) {\n\t\t\t\t// Use locked refresh to prevent race conditions\n\t\t\t\ttry {\n\t\t\t\t\tconst result = await this.refreshOAuthTokenWithLock(providerId);\n\t\t\t\t\tif (result) {\n\t\t\t\t\t\treturn result.apiKey;\n\t\t\t\t\t}\n\t\t\t\t} catch (error) {\n\t\t\t\t\tthis.recordError(error);\n\t\t\t\t\t// Refresh failed - re-read file to check if another instance succeeded\n\t\t\t\t\tthis.reload();\n\t\t\t\t\tconst updatedCred = this.data[providerId];\n\n\t\t\t\t\tif (updatedCred?.type === \"oauth\" && Date.now() < updatedCred.expires) {\n\t\t\t\t\t\t// Another instance refreshed successfully, use those credentials\n\t\t\t\t\t\treturn provider.getApiKey(updatedCred);\n\t\t\t\t\t}\n\n\t\t\t\t\t// Refresh truly failed - return undefined so model discovery skips this provider\n\t\t\t\t\t// User can /login to re-authenticate (credentials preserved for retry)\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Token not expired, use current access token\n\t\t\t\treturn provider.getApiKey(cred);\n\t\t\t}\n\t\t}\n\n\t\t// Fall back to environment variable\n\t\tconst envKey = getEnvApiKey(providerId);\n\t\tif (envKey) return envKey;\n\n\t\t// Fall back to custom resolver (e.g., models.json custom providers)\n\t\tif (options?.includeFallback !== false) {\n\t\t\treturn this.fallbackResolver?.(providerId) ?? undefined;\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t/**\n\t * Get all registered OAuth providers\n\t */\n\tgetOAuthProviders() {\n\t\treturn getOAuthProviders();\n\t}\n}\n"]}
+{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AACzH,OAAO,EAEN,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAqB/D,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AAEzH;;GAEG;AACH,MAAM,OAAO,WAAW;IAWvB,YAAoB,OAA2B;QAVvC,SAAI,GAAoB,EAAE,CAAC;QAC3B,qBAAgB,GAAwB,IAAI,GAAG,EAAE,CAAC;QAElD,cAAS,GAAiB,IAAI,CAAC;QAC/B,WAAM,GAAY,EAAE,CAAC;QACrB,2BAAsB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1D,uBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAKtD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAA4B;QACzC,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS;YACnC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,QAAgB,EAAE,MAAc;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,kFAAkF;IAClF,gBAAgB,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAGD;;OAEG;IACH,mBAAmB,CAAC,QAAgB;QACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAkD;QACrE,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IAClC,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,MAAM,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,CAAC;YACJ,kEAAkE;YAClE,mEAAmE;YACnE,yEAAyE;YACzE,wEAAwE;YACxE,4BAA4B;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,GAAG,KAAc,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IAED;;;;OAIG;IACK,YAAY;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,OAAO,GAAG,OAAO,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAAC,QAAgB;QAC7C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,CAAC;IAEO,qBAAqB,CAAC,QAAgB,EAAE,UAAsC;QACrF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACvD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC;gBACnD,IAAI,UAAU,EAAE,CAAC;oBAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACP,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB,EAAE,UAA0B;QAC/C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,IAAI;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB;QACnB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB;QACvB,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,YAAY,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,KAAK,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QACnF,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,kDAAkD;IAClD,MAAM;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,WAAW;QACV,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACH,YAAY;QACX,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,SAAoC;QACnE,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;IAC3E,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,WAAW,CAAC,QAAgB;QACjC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,yBAAyB,CACtC,UAAkB;QAElB,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YAC5C,IAAI,gBAA6C,CAAC;YAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACnD,gBAAgB,GAAG,WAAW,CAAC;gBAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;gBACrC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAEpD,MAAM,eAAe,GAAsB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBACtE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC/B,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;oBACtE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjE,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;gBAC1E,IAAI,CAAC,SAAS;oBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,iBAAiB,EAAE,CAAC;oBAC1E,gBAAgB,GAAG,SAAS,CAAC;oBAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACzB,CAAC;gBACD,MAAM,MAAM,GAAoB;oBAC/B,GAAG,WAAW;oBACd,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,UAAU;iBAClC,CAAC;gBACF,gBAAgB,GAAG,MAAM,CAAC;gBAC1B,OAAO;oBACN,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,UAAU,EAAE;oBACtE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACrC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,gBAAgB;gBAAE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;YACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,OAAuC;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAE9E,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChC,OAAO,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC;gBACjE,CAAC;gBACD,OAAO,MAAM,qBAAqB,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC/D,OAAO,qBAAqB,CAAC,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,IAAI,OAAO,EAAE,eAAe,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAuC;QAC1E,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,iBAAiB;QAChB,OAAO,2BAA2B,EAAE,CAAC;IACtC,CAAC;IAEO,qBAAqB,CAAI,SAA2B;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,sBAAsB,GAAG,MAAM,CAAC,IAAI,CACxC,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QACF,OAAO,MAAM,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,iBAAiB;QAChB,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAA0B,EAAE;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACjE,CAAC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAA4B;YAC7G,IAAI,EAAE,KAAK,IAAwC,EAAE;gBACpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7E,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;oBAC1C,UAAU;oBACV,IAAI,EAAE,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI;iBACvE,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAC1B,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;gBACrC,IAAI,gBAA6C,CAAC;gBAClD,IAAI,CAAC;oBACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;wBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAA2B,CAAC,CAAC;wBAClE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;4BACxB,gBAAgB,GAAG,IAAI,CAAC;4BACxB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAA2B,EAAE,CAAC;wBAC/D,CAAC;wBACD,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,IAAsB,EAAE,CAAC;wBACjE,gBAAgB,GAAG,MAAM,CAAC;wBAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBAChE,CAAC,CAAC,CAAC;oBACH,IAAI,gBAAgB,EAAE,CAAC;wBACtB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;wBAC7B,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;oBACxC,CAAC;oBACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;oBACtB,OAAO,MAAM,CAAC;gBACf,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBACxB,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CACtB,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;gBACrC,IAAI,gBAA6C,CAAC;gBAClD,IAAI,CAAC;oBACJ,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;wBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;wBACxB,gBAAgB,GAAG,IAAI,CAAC;wBACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBACnE,CAAC,CAAC,CAAC;oBACH,IAAI,gBAAgB,EAAE,CAAC;wBACtB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;wBAC7B,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;oBACxC,CAAC;oBACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBACxB,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC,CAAC;SACH,CAAC;IACH,CAAC;CACD","sourcesContent":["/**\n * Credential storage for API keys and OAuth tokens.\n * Handles loading, saving, and refreshing credentials from auth.json.\n *\n * Uses file locking to prevent race conditions when multiple pi instances\n * try to refresh tokens simultaneously.\n */\n\nimport {\n\ttype Credential,\n\ttype CredentialInfo,\n\ttype CredentialStore,\n\ttype ModelAuth,\n\ttype OAuthCredential as PiOAuthCredential,\n\ttype OAuthCredentials,\n} from \"@earendil-works/pi-ai\";\nimport { findEnvKeys, getEnvApiKey } from \"@earendil-works/pi-ai/compat\";\nimport { join } from \"path\";\nimport { getAgentConfigPaths, getAgentDir } from \"../config.ts\";\nimport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\nimport {\n\ttype AtomicOAuthLoginCallbacks,\n\tgetOAuthProviderDescriptors,\n\tloginOAuthProvider,\n\toauthCredentialToAuth,\n\trefreshOAuthProvider,\n} from \"./oauth-provider-bridge.ts\";\nimport { resolveConfigValue } from \"./resolve-config-value.ts\";\n\nexport type ApiKeyCredential = {\n\ttype: \"api_key\";\n\tkey: string;\n};\n\nexport type OAuthCredential = {\n\ttype: \"oauth\";\n} & OAuthCredentials;\n\nexport type AuthCredential = ApiKeyCredential | OAuthCredential;\n\nexport type AuthStorageData = Record<string, AuthCredential>;\n\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage {\n\tprivate data: AuthStorageData = {};\n\tprivate runtimeOverrides: Map<string, string> = new Map();\n\tprivate fallbackResolver?: (provider: string) => string | undefined;\n\tprivate loadError: Error | null = null;\n\tprivate errors: Error[] = [];\n\tprivate credentialMutationTail: Promise<void> = Promise.resolve();\n\tprivate credentialVersions = new Map<string, number>();\n\n\tdeclare private storage: AuthStorageBackend;\n\n\tprivate constructor(storage: AuthStorageBackend) {\n\t\tthis.storage = storage;\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath?: string | string[]): AuthStorage {\n\t\tconst paths = authPath === undefined\n\t\t\t? getAgentConfigPaths(\"auth.json\")\n\t\t\t: Array.isArray(authPath) ? authPath : [authPath];\n\t\treturn new AuthStorage(new FileAuthStorageBackend(paths[0] ?? join(getAgentDir(), \"auth.json\"), paths));\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\t/**\n\t * Set a runtime API key override (not persisted to disk).\n\t * Used for CLI --api-key flag.\n\t */\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\n\t\tthis.runtimeOverrides.set(provider, apiKey);\n\t}\n\t/** Read a non-persisted request override without resolving stored credentials. */\n\tgetRuntimeApiKey(provider: string): string | undefined {\n\t\treturn this.runtimeOverrides.get(provider);\n\t}\n\n\n\t/**\n\t * Remove a runtime API key override.\n\t */\n\tremoveRuntimeApiKey(provider: string): void {\n\t\tthis.runtimeOverrides.delete(provider);\n\t}\n\n\t/**\n\t * Set a fallback resolver for API keys not found in auth.json or env vars.\n\t * Used for custom provider keys from models.json.\n\t */\n\tsetFallbackResolver(resolver: (provider: string) => string | undefined): void {\n\t\tthis.fallbackResolver = resolver;\n\t}\n\n\tprivate recordError(error: unknown): void {\n\t\tconst normalizedError = error instanceof Error ? error : new Error(String(error));\n\t\tthis.errors.push(normalizedError);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as AuthStorageData;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\ttry {\n\t\t\t// Pure read: never take the exclusive write lock. Writers replace\n\t\t\t// auth.json atomically, so a lock-free read always sees a complete\n\t\t\t// snapshot. This keeps many concurrent sessions from starving each other\n\t\t\t// on the lock and misreporting configured providers as unreadable under\n\t\t\t// contention (issue #1431).\n\t\t\tconst content = this.readSnapshot();\n\t\t\tthis.data = this.parseStorageData(content);\n\t\t\tthis.loadError = null;\n\t\t} catch (error) {\n\t\t\tthis.loadError = error as Error;\n\t\t\tthis.recordError(error);\n\t\t}\n\t}\n\n\t/**\n\t * Read the credential snapshot, preferring the backend's lock-free `read()`.\n\t * Falls back to a `withLock`-based read for custom backends that predate\n\t * `read()` so the released `AuthStorageBackend` interface stays compatible.\n\t */\n\tprivate readSnapshot(): string | undefined {\n\t\tif (this.storage.read) {\n\t\t\treturn this.storage.read();\n\t\t}\n\t\tlet content: string | undefined;\n\t\tthis.storage.withLock((current) => {\n\t\t\tcontent = current;\n\t\t\treturn { result: undefined };\n\t\t});\n\t\treturn content;\n\t}\n\n\tprivate bumpCredentialVersion(provider: string): void {\n\t\tthis.credentialVersions.set(provider, (this.credentialVersions.get(provider) ?? 0) + 1);\n\t}\n\n\tprivate persistProviderChange(provider: string, credential: AuthCredential | undefined): void {\n\t\tif (this.loadError) {\n\t\t\tthis.reload();\n\t\t\tif (this.loadError) throw this.loadError;\n\t\t}\n\n\t\ttry {\n\t\t\tconst persistedData = this.storage.withLock((current) => {\n\t\t\t\tconst currentData = this.parseStorageData(current);\n\t\t\t\tconst merged: AuthStorageData = { ...currentData };\n\t\t\t\tif (credential) {\n\t\t\t\t\tmerged[provider] = credential;\n\t\t\t\t} else {\n\t\t\t\t\tdelete merged[provider];\n\t\t\t\t}\n\t\t\t\treturn { result: merged, next: JSON.stringify(merged, null, 2) };\n\t\t\t});\n\t\t\tthis.data = persistedData;\n\t\t\tthis.bumpCredentialVersion(provider);\n\t\t\tthis.loadError = null;\n\t\t} catch (error) {\n\t\t\tthis.recordError(error);\n\t\t\tthrow error instanceof Error ? error : new Error(String(error));\n\t\t}\n\t}\n\n\t/**\n\t * Get credential for a provider.\n\t */\n\tget(provider: string): AuthCredential | undefined {\n\t\treturn this.data[provider] ?? undefined;\n\t}\n\n\t/**\n\t * Set credential for a provider.\n\t */\n\tset(provider: string, credential: AuthCredential): void {\n\t\tthis.persistProviderChange(provider, credential);\n\t}\n\n\t/**\n\t * Remove credential for a provider.\n\t */\n\tremove(provider: string): void {\n\t\tthis.persistProviderChange(provider, undefined);\n\t}\n\n\t/**\n\t * List all providers with credentials.\n\t */\n\tlist(): string[] {\n\t\treturn Object.keys(this.data);\n\t}\n\n\t/**\n\t * Check if credentials exist for a provider in auth.json.\n\t */\n\thas(provider: string): boolean {\n\t\treturn provider in this.data;\n\t}\n\n\t/**\n\t * Check if any form of auth is configured for a provider.\n\t * Unlike getApiKey(), this doesn't refresh OAuth tokens.\n\t */\n\thasAuth(provider: string): boolean {\n\t\tif (this.runtimeOverrides.has(provider)) return true;\n\t\tif (this.data[provider]) return true;\n\t\tif (getEnvApiKey(provider)) return true;\n\t\tif (this.fallbackResolver?.(provider)) return true;\n\t\treturn false;\n\t}\n\n\t/**\n\t * Return auth status without exposing credential values or refreshing tokens.\n\t */\n\tgetAuthStatus(provider: string): AuthStatus {\n\t\tif (this.data[provider]) {\n\t\t\treturn { configured: true, source: \"stored\" };\n\t\t}\n\n\t\tif (this.runtimeOverrides.has(provider)) {\n\t\t\treturn { configured: false, source: \"runtime\", label: \"--api-key\" };\n\t\t}\n\n\t\tconst envKeys = findEnvKeys(provider);\n\t\tif (envKeys?.[0]) {\n\t\t\treturn { configured: false, source: \"environment\", label: envKeys[0] };\n\t\t}\n\n\t\tif (this.fallbackResolver?.(provider)) {\n\t\t\treturn { configured: false, source: \"fallback\", label: \"custom provider config\" };\n\t\t}\n\n\t\treturn { configured: false };\n\t}\n\n\t/** Return a copy of all persisted credentials. */\n\tgetAll(): AuthStorageData {\n\t\treturn { ...this.data };\n\t}\n\n\tdrainErrors(): Error[] {\n\t\tconst drained = [...this.errors];\n\t\tthis.errors = [];\n\t\treturn drained;\n\t}\n\n\t/**\n\t * Returns the error from the most recent failed credential load, or null when\n\t * the last reload succeeded.\n\t *\n\t * A non-null value means stored credentials could NOT be read — e.g. the auth\n\t * file was temporarily locked by another process (ELOCKED) or contained\n\t * invalid JSON — so an empty/absent credential set is NOT authoritative.\n\t * Callers that would otherwise report \"No API key found\" should surface this\n\t * load failure instead of treating the provider as unauthenticated\n\t * (issue #1431).\n\t */\n\tgetLoadError(): Error | null {\n\t\treturn this.loadError;\n\t}\n\n\t/**\n\t * Login to an OAuth provider.\n\t */\n\tasync login(providerId: string, callbacks: AtomicOAuthLoginCallbacks): Promise<void> {\n\t\tconst credential = await loginOAuthProvider(providerId, callbacks);\n\t\tawait this.asCredentialStore().modify(providerId, async () => credential);\n\t}\n\n\t/** Logout through the preserved synchronous persistence path. */\n\tlogout(provider: string): void {\n\t\tthis.remove(provider);\n\t}\n\n\t/** Serialized logout for callers that need persistence completion. */\n\tasync logoutAsync(provider: string): Promise<void> {\n\t\tawait this.asCredentialStore().delete(provider);\n\t}\n\n\t/**\n\t * Refresh OAuth token with backend locking to prevent race conditions.\n\t * Multiple pi instances may try to refresh simultaneously when tokens expire.\n\t */\n\tprivate async refreshOAuthTokenWithLock(\n\t\tproviderId: string,\n\t): Promise<{ auth: ModelAuth; newCredentials: OAuthCredentials } | null> {\n\t\treturn this.runCredentialMutation(async () => {\n\t\t\tlet synchronizedData: AuthStorageData | undefined;\n\t\t\tconst credentialVersion = this.credentialVersions.get(providerId) ?? 0;\n\t\t\tconst result = await this.storage.withLockAsync(async (current) => {\n\t\t\t\tconst currentData = this.parseStorageData(current);\n\t\t\t\tsynchronizedData = currentData;\n\t\t\t\tconst cred = currentData[providerId];\n\t\t\t\tif (cred?.type !== \"oauth\") return { result: null };\n\n\t\t\t\tconst oauthCredential: PiOAuthCredential = { ...cred, type: \"oauth\" };\n\t\t\t\tif (Date.now() < cred.expires) {\n\t\t\t\t\tconst auth = await oauthCredentialToAuth(providerId, oauthCredential);\n\t\t\t\t\treturn { result: auth ? { auth, newCredentials: cred } : null };\n\t\t\t\t}\n\n\t\t\t\tconst refreshed = await refreshOAuthProvider(providerId, oauthCredential);\n\t\t\t\tif (!refreshed) return { result: null };\n\t\t\t\tif ((this.credentialVersions.get(providerId) ?? 0) !== credentialVersion) {\n\t\t\t\t\tsynchronizedData = undefined;\n\t\t\t\t\treturn { result: null };\n\t\t\t\t}\n\t\t\t\tconst merged: AuthStorageData = {\n\t\t\t\t\t...currentData,\n\t\t\t\t\t[providerId]: refreshed.credential,\n\t\t\t\t};\n\t\t\t\tsynchronizedData = merged;\n\t\t\t\treturn {\n\t\t\t\t\tresult: { auth: refreshed.auth, newCredentials: refreshed.credential },\n\t\t\t\t\tnext: JSON.stringify(merged, null, 2),\n\t\t\t\t};\n\t\t\t});\n\n\t\t\tif (synchronizedData) this.data = synchronizedData;\n\t\t\tthis.loadError = null;\n\t\t\treturn result;\n\t\t});\n\t}\n\n\t/**\n\t * Get API key for a provider.\n\t * Priority:\n\t * 1. Runtime override (CLI --api-key)\n\t * 2. API key from auth.json\n\t * 3. OAuth token from auth.json (auto-refreshed with locking)\n\t * 4. Environment variable\n\t * 5. Fallback resolver (models.json custom providers)\n\t */\n\tasync getModelAuth(providerId: string, options?: { includeFallback?: boolean }): Promise<ModelAuth | undefined> {\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\n\t\tif (runtimeKey) return { apiKey: runtimeKey };\n\n\t\tconst cred = this.data[providerId];\n\t\tif (cred?.type === \"api_key\") return { apiKey: resolveConfigValue(cred.key) };\n\n\t\tif (cred?.type === \"oauth\") {\n\t\t\ttry {\n\t\t\t\tif (Date.now() >= cred.expires) {\n\t\t\t\t\treturn (await this.refreshOAuthTokenWithLock(providerId))?.auth;\n\t\t\t\t}\n\t\t\t\treturn await oauthCredentialToAuth(providerId, { ...cred, type: \"oauth\" });\n\t\t\t} catch (error) {\n\t\t\t\tthis.recordError(error);\n\t\t\t\tthis.reload();\n\t\t\t\tconst updated = this.data[providerId];\n\t\t\t\tif (updated?.type === \"oauth\" && Date.now() < updated.expires) {\n\t\t\t\t\treturn oauthCredentialToAuth(providerId, { ...updated, type: \"oauth\" });\n\t\t\t\t}\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tconst envKey = getEnvApiKey(providerId);\n\t\tif (envKey) return { apiKey: envKey };\n\t\tif (options?.includeFallback !== false) {\n\t\t\tconst fallback = this.fallbackResolver?.(providerId);\n\t\t\tif (fallback) return { apiKey: fallback };\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tasync getApiKey(providerId: string, options?: { includeFallback?: boolean }): Promise<string | undefined> {\n\t\treturn (await this.getModelAuth(providerId, options))?.apiKey;\n\t}\n\n\t/**\n\t * Get all registered OAuth providers\n\t */\n\tgetOAuthProviders() {\n\t\treturn getOAuthProviderDescriptors();\n\t}\n\n\tprivate runCredentialMutation<T>(operation: () => Promise<T>): Promise<T> {\n\t\tconst result = this.credentialMutationTail.then(operation, operation);\n\t\tthis.credentialMutationTail = result.then(\n\t\t\t() => undefined,\n\t\t\t() => undefined,\n\t\t);\n\t\treturn result;\n\t}\n\n\t/** Private async adapter for pi-ai's provider-owned Models runtime. */\n\tasCredentialStore(): CredentialStore {\n\t\tconst runtimeCredential = (providerId: string): Credential | undefined => {\n\t\t\tconst key = this.runtimeOverrides.get(providerId);\n\t\t\treturn key === undefined ? undefined : { type: \"api_key\", key };\n\t\t};\n\t\treturn {\n\t\t\tread: async (providerId) => runtimeCredential(providerId) ?? (this.get(providerId) as Credential | undefined),\n\t\t\tlist: async (): Promise<readonly CredentialInfo[]> => {\n\t\t\t\tconst providers = new Set([...this.list(), ...this.runtimeOverrides.keys()]);\n\t\t\t\treturn [...providers].map((providerId) => ({\n\t\t\t\t\tproviderId,\n\t\t\t\t\ttype: runtimeCredential(providerId)?.type ?? this.data[providerId].type,\n\t\t\t\t}));\n\t\t\t},\n\t\t\tmodify: (providerId, fn) =>\n\t\t\t\tthis.runCredentialMutation(async () => {\n\t\t\t\t\tlet synchronizedData: AuthStorageData | undefined;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst result = await this.storage.withLockAsync(async (current) => {\n\t\t\t\t\t\t\tconst data = this.parseStorageData(current);\n\t\t\t\t\t\t\tconst next = await fn(data[providerId] as Credential | undefined);\n\t\t\t\t\t\t\tif (next === undefined) {\n\t\t\t\t\t\t\t\tsynchronizedData = data;\n\t\t\t\t\t\t\t\treturn { result: data[providerId] as Credential | undefined };\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tconst merged = { ...data, [providerId]: next as AuthCredential };\n\t\t\t\t\t\t\tsynchronizedData = merged;\n\t\t\t\t\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t\t\t\t\t});\n\t\t\t\t\t\tif (synchronizedData) {\n\t\t\t\t\t\t\tthis.data = synchronizedData;\n\t\t\t\t\t\t\tthis.bumpCredentialVersion(providerId);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthis.loadError = null;\n\t\t\t\t\t\treturn result;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tthis.recordError(error);\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\tdelete: (providerId) =>\n\t\t\t\tthis.runCredentialMutation(async () => {\n\t\t\t\t\tlet synchronizedData: AuthStorageData | undefined;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait this.storage.withLockAsync(async (current) => {\n\t\t\t\t\t\t\tconst data = this.parseStorageData(current);\n\t\t\t\t\t\t\tdelete data[providerId];\n\t\t\t\t\t\t\tsynchronizedData = data;\n\t\t\t\t\t\t\treturn { result: undefined, next: JSON.stringify(data, null, 2) };\n\t\t\t\t\t\t});\n\t\t\t\t\t\tif (synchronizedData) {\n\t\t\t\t\t\t\tthis.data = synchronizedData;\n\t\t\t\t\t\t\tthis.bumpCredentialVersion(providerId);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthis.loadError = null;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tthis.recordError(error);\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t};\n\t}\n}\n"]}

package/dist/core/callback-activity.d.ts

@@ -0,0 +1,27 @@
+export type CallbackActivityKind = "extension.hook" | "renderer" | "tool.execute" | "tool.prepare" | "workflow.ctx_tool" | "workflow.run" | "workflow.stage_adapter";
+export interface CallbackActivity {
+    id: string;
+    kind: CallbackActivityKind;
+    name: string;
+    startedAt: number;
+    sourcePath?: string;
+    toolCallId?: string;
+    runId?: string;
+    stageId?: string;
+}
+export interface CallbackActivityReporter {
+    started(activity: CallbackActivity): void;
+    finished(activityId: string): void;
+}
+export interface CallbackActivityDescriptor {
+    kind: CallbackActivityKind;
+    name: string;
+    sourcePath?: string;
+    toolCallId?: string;
+    runId?: string;
+    stageId?: string;
+}
+export declare function setCallbackActivityReporter(next: CallbackActivityReporter | undefined): void;
+export declare function runSynchronousCallback<T>(descriptor: CallbackActivityDescriptor, callback: () => T): T;
+export declare function runCallback<T>(descriptor: CallbackActivityDescriptor, callback: () => T | Promise<T>): Promise<T>;
+//# sourceMappingURL=callback-activity.d.ts.map

package/dist/core/callback-activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-activity.d.ts","sourceRoot":"","sources":["../../src/core/callback-activity.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,oBAAoB,GAC7B,gBAAgB,GAChB,UAAU,GACV,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,cAAc,GACd,wBAAwB,CAAC;AAE5B,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACxC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,oBAAoB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAKD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,GAAG,IAAI,CAE5F;AAiBD,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAQtG;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAWvH"}

package/dist/core/callback-activity.js

@@ -0,0 +1,44 @@
+import { yieldToEventLoop } from "../utils/event-loop.js";
+let reporter;
+let nextActivityId = 0;
+export function setCallbackActivityReporter(next) {
+    reporter = next;
+}
+function beginActivity(descriptor) {
+    const activeReporter = reporter;
+    if (!activeReporter)
+        return undefined;
+    const activity = {
+        ...descriptor,
+        id: `callback_${++nextActivityId}`,
+        startedAt: performance.now(),
+    };
+    activeReporter.started(activity);
+    return { activity, reporter: activeReporter };
+}
+export function runSynchronousCallback(descriptor, callback) {
+    const active = beginActivity(descriptor);
+    if (!active)
+        return callback();
+    try {
+        return callback();
+    }
+    finally {
+        active.reporter.finished(active.activity.id);
+    }
+}
+export async function runCallback(descriptor, callback) {
+    const active = beginActivity(descriptor);
+    if (!active)
+        return callback();
+    try {
+        // Give the activity frame and the last healthy heartbeat a chance to leave
+        // the engine before arbitrary callback code begins.
+        await yieldToEventLoop();
+        return await callback();
+    }
+    finally {
+        active.reporter.finished(active.activity.id);
+    }
+}
+//# sourceMappingURL=callback-activity.js.map

package/dist/core/callback-activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-activity.js","sourceRoot":"","sources":["../../src/core/callback-activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAoC1D,IAAI,QAA8C,CAAC;AACnD,IAAI,cAAc,GAAG,CAAC,CAAC;AAEvB,MAAM,UAAU,2BAA2B,CAAC,IAA0C;IACrF,QAAQ,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,UAAsC;IAI5D,MAAM,cAAc,GAAG,QAAQ,CAAC;IAChC,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAqB;QAClC,GAAG,UAAU;QACb,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE;QAClC,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE;KAC5B,CAAC;IACF,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAI,UAAsC,EAAE,QAAiB;IAClG,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,EAAE,CAAC;IAC/B,IAAI,CAAC;QACJ,OAAO,QAAQ,EAAE,CAAC;IACnB,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,UAAsC,EAAE,QAA8B;IAC1G,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,EAAE,CAAC;IAC/B,IAAI,CAAC;QACJ,2EAA2E;QAC3E,oDAAoD;QACpD,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,MAAM,QAAQ,EAAE,CAAC;IACzB,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACF,CAAC","sourcesContent":["import { yieldToEventLoop } from \"../utils/event-loop.ts\";\n\nexport type CallbackActivityKind =\n\t| \"extension.hook\"\n\t| \"renderer\"\n\t| \"tool.execute\"\n\t| \"tool.prepare\"\n\t| \"workflow.ctx_tool\"\n\t| \"workflow.run\"\n\t| \"workflow.stage_adapter\";\n\nexport interface CallbackActivity {\n\tid: string;\n\tkind: CallbackActivityKind;\n\tname: string;\n\tstartedAt: number;\n\tsourcePath?: string;\n\ttoolCallId?: string;\n\trunId?: string;\n\tstageId?: string;\n}\n\nexport interface CallbackActivityReporter {\n\tstarted(activity: CallbackActivity): void;\n\tfinished(activityId: string): void;\n}\n\nexport interface CallbackActivityDescriptor {\n\tkind: CallbackActivityKind;\n\tname: string;\n\tsourcePath?: string;\n\ttoolCallId?: string;\n\trunId?: string;\n\tstageId?: string;\n}\n\nlet reporter: CallbackActivityReporter | undefined;\nlet nextActivityId = 0;\n\nexport function setCallbackActivityReporter(next: CallbackActivityReporter | undefined): void {\n\treporter = next;\n}\n\nfunction beginActivity(descriptor: CallbackActivityDescriptor): {\n\tactivity: CallbackActivity;\n\treporter: CallbackActivityReporter;\n} | undefined {\n\tconst activeReporter = reporter;\n\tif (!activeReporter) return undefined;\n\tconst activity: CallbackActivity = {\n\t\t...descriptor,\n\t\tid: `callback_${++nextActivityId}`,\n\t\tstartedAt: performance.now(),\n\t};\n\tactiveReporter.started(activity);\n\treturn { activity, reporter: activeReporter };\n}\n\nexport function runSynchronousCallback<T>(descriptor: CallbackActivityDescriptor, callback: () => T): T {\n\tconst active = beginActivity(descriptor);\n\tif (!active) return callback();\n\ttry {\n\t\treturn callback();\n\t} finally {\n\t\tactive.reporter.finished(active.activity.id);\n\t}\n}\n\nexport async function runCallback<T>(descriptor: CallbackActivityDescriptor, callback: () => T | Promise<T>): Promise<T> {\n\tconst active = beginActivity(descriptor);\n\tif (!active) return callback();\n\ttry {\n\t\t// Give the activity frame and the last healthy heartbeat a chance to leave\n\t\t// the engine before arbitrary callback code begins.\n\t\tawait yieldToEventLoop();\n\t\treturn await callback();\n\t} finally {\n\t\tactive.reporter.finished(active.activity.id);\n\t}\n}\n"]}

package/dist/core/compaction/branch-summarization.d.ts

@@ -5,6 +5,7 @@
  * a summary of the branch being left so context isn't lost.
  */
 import type { AgentMessage, StreamFn } from "@earendil-works/pi-agent-core";
+import type { ProviderHeaders } from "@earendil-works/pi-ai";
 import type { Api, Model } from "@earendil-works/pi-ai/compat";
 import type { ReadonlySessionManager, SessionEntry } from "../session-manager.ts";
 import { type FileOperations } from "./utils.ts";
@@ -41,7 +42,9 @@ export interface GenerateBranchSummaryOptions {
     /** API key for the model */
     apiKey: string;
     /** Request headers for the model */
-    headers?: Record<string, string>;
+    headers?: ProviderHeaders;
+    /** Credential-specific request endpoint for the model */
+    baseUrl?: string;
     /** Abort signal for cancellation */
     signal: AbortSignal;
     /** Optional custom instructions for summarization */

package/dist/core/compaction/branch-summarization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch-summarization.d.ts","sourceRoot":"","sources":["../../../src/core/compaction/branch-summarization.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAuB,MAAM,8BAA8B,CAAC;AAIpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAIN,KAAK,cAAc,EAInB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,mBAAmB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IACjC,mEAAmE;IACnE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,gDAAgD;IAChD,OAAO,EAAE,cAAc,CAAC;IACxB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC5C,qCAAqC;IACrC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oCAAoC;IACpC,MAAM,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACpB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE,MAAM,GACd,oBAAoB,CAkCtB;AA6CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,WAAW,GAAE,MAAU,GAAG,iBAAiB,CAqDxG;AAwCD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA4F9B"}
+{"version":3,"file":"branch-summarization.d.ts","sourceRoot":"","sources":["../../../src/core/compaction/branch-summarization.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAuB,MAAM,8BAA8B,CAAC;AAIpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAIN,KAAK,cAAc,EAInB,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,mBAAmB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IACjC,mEAAmE;IACnE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,gDAAgD;IAChD,OAAO,EAAE,cAAc,CAAC;IACxB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC5C,qCAAqC;IACrC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,MAAM,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACpB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,sBAAsB,EAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE,MAAM,GACd,oBAAoB,CAkCtB;AA6CD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,WAAW,GAAE,MAAU,GAAG,iBAAiB,CAqDxG;AAwCD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA8F9B"}

package/dist/core/compaction/branch-summarization.js

@@ -189,7 +189,7 @@ Keep each section concise. Preserve exact file paths, function names, and error
  * @param options - Generation options
  */
 export async function generateBranchSummary(entries, options) {
-    const { model, apiKey, headers, signal, customInstructions, replaceInstructions, reserveTokens = 16384, streamFn, } = options;
+    const { model, apiKey, headers, baseUrl, signal, customInstructions, replaceInstructions, reserveTokens = 16384, streamFn, } = options;
     // Token budget = context window minus reserved space for prompt + response
     const contextWindow = model.contextWindow || 128000;
     const tokenBudget = contextWindow - reserveTokens;
@@ -225,11 +225,12 @@ export async function generateBranchSummary(entries, options) {
     // without running through agent state/events.
     const context = { systemPrompt: SUMMARIZATION_SYSTEM_PROMPT, messages: summarizationMessages };
     const requestOptions = { apiKey, headers, signal, maxTokens: 2048 };
+    const requestModel = baseUrl === undefined || baseUrl === model.baseUrl ? model : { ...model, baseUrl };
     const response = await (async () => {
         try {
             return streamFn
-                ? await (await streamFn(model, context, requestOptions)).result()
-                : await completeSimple(model, context, requestOptions);
+                ? await (await streamFn(requestModel, context, requestOptions)).result()
+                : await completeSimple(requestModel, context, requestOptions);
         }
         catch (error) {
             if (signal.aborted) {