@cereworker/cerebrum 0.7.0 → 26.313.2

package/dist/index.d.ts

@@ -4,4 +4,5 @@ export { createBuiltinTools, type BuiltinTools, type BuiltinToolName } from './t
 export { withRetry, type RetryOptions } from './retry.js';
 export { buildCompactionPrompt } from './context.js';
 export { evaluateCommand, extractBinary, isSafeBinary, type ExecDecision } from './tools/exec-policy.js';
+export { OAUTH_PROVIDERS, TokenStore, refreshAccessToken, runOAuthFlow, runDeviceCodeFlow, isRemoteEnvironment, loginOpenAI, loginGoogle, refreshOpenAIToken, refreshGoogleToken, generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, type OAuthProviderConfig, type OAuthTokens, type OAuthFlowOptions, type DeviceCodeFlowOptions, type PiAuthCallbacks, } from './oauth/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACzG,OAAO,EACL,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -3,4 +3,5 @@ export { createBuiltinTools } from './tools/index.js';
 export { withRetry } from './retry.js';
 export { buildCompactionPrompt } from './context.js';
 export { evaluateCommand, extractBinary, isSafeBinary } from './tools/exec-policy.js';
+export { OAUTH_PROVIDERS, TokenStore, refreshAccessToken, runOAuthFlow, runDeviceCodeFlow, isRemoteEnvironment, loginOpenAI, loginGoogle, refreshOpenAIToken, refreshGoogleToken, generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl, } from './oauth/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAA2C,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAqB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAA2C,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAqB,MAAM,wBAAwB,CAAC;AACzG,OAAO,EACL,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GAMtB,MAAM,kBAAkB,CAAC"}

package/dist/oauth/flow.d.ts

@@ -0,0 +1,26 @@
+import { type OAuthTokens } from './types.js';
+export interface OAuthFlowOptions {
+    clientId?: string;
+    clientSecret?: string;
+    onReady?: (authUrl: string) => void;
+}
+export declare function isRemoteEnvironment(): boolean;
+/**
+ * Run the full OAuth Authorization Code + PKCE flow.
+ *
+ * In remote/WSL environments, falls back to manual paste of the redirect URL.
+ * Uses the PKCE code verifier as the OAuth state parameter.
+ */
+export declare function runOAuthFlow(provider: string, options?: OAuthFlowOptions): Promise<OAuthTokens>;
+export interface DeviceCodeFlowOptions {
+    clientId?: string;
+    clientSecret?: string;
+    onUserCode?: (userCode: string, verificationUri: string) => void;
+}
+/**
+ * Run the OAuth Device Authorization Grant flow.
+ * Used for headless environments where browser-based redirect isn't possible.
+ * Provider must have `deviceCodeUrl` configured.
+ */
+export declare function runDeviceCodeFlow(provider: string, options?: DeviceCodeFlowOptions): Promise<OAuthTokens>;
+//# sourceMappingURL=flow.d.ts.map

package/dist/oauth/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/oauth/flow.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAO7C;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC;CAClE;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAmFtB"}

package/dist/oauth/flow.js

@@ -0,0 +1,225 @@
+import { createServer } from 'node:http';
+import { createInterface } from 'node:readline';
+import { OAUTH_PROVIDERS } from './types.js';
+import { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl } from './pkce.js';
+export function isRemoteEnvironment() {
+    return !!(process.env.SSH_CONNECTION ||
+        process.env.SSH_CLIENT ||
+        process.env.WSL_DISTRO_NAME ||
+        process.env.REMOTE_CONTAINERS);
+}
+/**
+ * Run the full OAuth Authorization Code + PKCE flow.
+ *
+ * In remote/WSL environments, falls back to manual paste of the redirect URL.
+ * Uses the PKCE code verifier as the OAuth state parameter.
+ */
+export async function runOAuthFlow(provider, options) {
+    const config = OAUTH_PROVIDERS[provider];
+    if (!config)
+        throw new Error(`No OAuth config for provider: ${provider}`);
+    const clientId = options?.clientId ?? config.clientId;
+    if (!clientId) {
+        throw new Error(`OAuth clientId required for ${provider}. Set cerebrum.providers.${provider}.oauth.clientId in config.`);
+    }
+    const clientSecret = options?.clientSecret ?? config.clientSecret;
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = generateCodeChallenge(codeVerifier);
+    // Use verifier as state (same pattern as OpenClaw)
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, codeVerifier, clientId);
+    let code;
+    if (isRemoteEnvironment()) {
+        options?.onReady?.(authUrl);
+        code = await manualCodeEntry(codeVerifier);
+    }
+    else {
+        code = await startCallbackServer(config, codeVerifier, () => {
+            options?.onReady?.(authUrl);
+        });
+    }
+    const tokens = await exchangeCode(config, code, codeVerifier, clientId, clientSecret);
+    tokens.clientId = clientId;
+    return tokens;
+}
+/**
+ * Run the OAuth Device Authorization Grant flow.
+ * Used for headless environments where browser-based redirect isn't possible.
+ * Provider must have `deviceCodeUrl` configured.
+ */
+export async function runDeviceCodeFlow(provider, options) {
+    const config = OAUTH_PROVIDERS[provider];
+    if (!config)
+        throw new Error(`No OAuth config for provider: ${provider}`);
+    if (!config.deviceCodeUrl) {
+        throw new Error(`Provider ${provider} does not support device code flow`);
+    }
+    const clientId = options?.clientId ?? config.clientId;
+    if (!clientId) {
+        throw new Error(`OAuth clientId required for ${provider}. Set cerebrum.providers.${provider}.oauth.clientId in config.`);
+    }
+    const clientSecret = options?.clientSecret ?? config.clientSecret;
+    // Step 1: Request device code
+    const deviceRes = await fetch(config.deviceCodeUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: clientId,
+            scope: config.scopes.join(' '),
+        }),
+    });
+    if (!deviceRes.ok) {
+        const body = await deviceRes.text();
+        throw new Error(`Device code request failed: ${deviceRes.status} ${body}`);
+    }
+    const deviceData = (await deviceRes.json());
+    const deviceCode = deviceData.device_code;
+    const userCode = deviceData.user_code;
+    const verificationUri = deviceData.verification_uri;
+    const expiresIn = deviceData.expires_in ?? 300;
+    let interval = (deviceData.interval ?? 5) * 1000;
+    options?.onUserCode?.(userCode, verificationUri);
+    // Step 2: Poll for token
+    const deadline = Date.now() + expiresIn * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, interval));
+        const params = {
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: deviceCode,
+            client_id: clientId,
+        };
+        if (clientSecret)
+            params.client_secret = clientSecret;
+        const tokenRes = await fetch(config.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams(params),
+        });
+        const tokenData = (await tokenRes.json());
+        if (tokenRes.ok) {
+            return {
+                accessToken: tokenData.access_token,
+                refreshToken: tokenData.refresh_token,
+                expiresAt: Date.now() + (tokenData.expires_in ?? 3600) * 1000,
+                tokenType: tokenData.token_type ?? 'bearer',
+                scope: tokenData.scope,
+                clientId,
+            };
+        }
+        const error = tokenData.error;
+        if (error === 'authorization_pending')
+            continue;
+        if (error === 'slow_down') {
+            interval += 5000;
+            continue;
+        }
+        throw new Error(`Device code flow failed: ${error}`);
+    }
+    throw new Error('Device code flow timed out');
+}
+function manualCodeEntry(expectedState) {
+    return new Promise((resolve, reject) => {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        rl.question('\nPaste the redirect URL from your browser: ', (input) => {
+            rl.close();
+            try {
+                const url = new URL(input.trim());
+                const code = url.searchParams.get('code');
+                const state = url.searchParams.get('state');
+                const error = url.searchParams.get('error');
+                if (error) {
+                    reject(new Error(`OAuth error: ${error}`));
+                    return;
+                }
+                if (state !== expectedState) {
+                    reject(new Error('OAuth state mismatch — possible CSRF attack'));
+                    return;
+                }
+                if (!code) {
+                    reject(new Error('No authorization code in URL'));
+                    return;
+                }
+                resolve(code);
+            }
+            catch {
+                reject(new Error(`Invalid URL: ${input}`));
+            }
+        });
+    });
+}
+function startCallbackServer(config, expectedState, onListening) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (fn) => {
+            if (!settled) {
+                settled = true;
+                fn();
+            }
+        };
+        const server = createServer((req, res) => {
+            const url = new URL(req.url, `http://localhost:${config.callbackPort}`);
+            if (url.pathname !== config.callbackPath) {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            if (error) {
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end('<h2>Authorization failed</h2><p>You can close this tab.</p>');
+                server.close();
+                settle(() => reject(new Error(`OAuth error: ${error}`)));
+                return;
+            }
+            if (state !== expectedState) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end('<h2>Invalid state</h2>');
+                server.close();
+                settle(() => reject(new Error('OAuth state mismatch')));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end('<h2>Authorized!</h2><p>You can close this tab and return to CereWorker.</p>');
+            server.close();
+            settle(() => resolve(code));
+        });
+        server.listen(config.callbackPort, () => {
+            onListening();
+        });
+        const timeout = setTimeout(() => {
+            server.close();
+            settle(() => reject(new Error('OAuth callback timed out (5 minutes)')));
+        }, 300_000);
+        server.on('close', () => clearTimeout(timeout));
+    });
+}
+async function exchangeCode(config, code, codeVerifier, clientId, clientSecret) {
+    const params = {
+        grant_type: 'authorization_code',
+        code,
+        redirect_uri: `http://localhost:${config.callbackPort}${config.callbackPath}`,
+        client_id: clientId,
+        code_verifier: codeVerifier,
+    };
+    if (clientSecret)
+        params.client_secret = clientSecret;
+    const res = await fetch(config.tokenUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(params),
+    });
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`Token exchange failed: ${res.status} ${body}`);
+    }
+    const data = (await res.json());
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt: Date.now() + (data.expires_in ?? 3600) * 1000,
+        tokenType: data.token_type ?? 'bearer',
+        scope: data.scope,
+    };
+}
+//# sourceMappingURL=flow.js.map

package/dist/oauth/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/oauth/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAQ/F,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,CAAC,CACP,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1B,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,OAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,4BAA4B,QAAQ,4BAA4B,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAElE,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAE1D,mDAAmD;IACnD,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAErF,IAAI,IAAY,CAAC;IACjB,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE;YAC1D,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtF,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,OAA+B;IAE/B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,4BAA4B,QAAQ,4BAA4B,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAElE,8BAA8B;IAC9B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SAC/B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAC;IACvE,MAAM,UAAU,GAAG,UAAU,CAAC,WAAqB,CAAC;IACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAmB,CAAC;IAChD,MAAM,eAAe,GAAG,UAAU,CAAC,gBAA0B,CAAC;IAC9D,MAAM,SAAS,GAAI,UAAU,CAAC,UAAqB,IAAI,GAAG,CAAC;IAC3D,IAAI,QAAQ,GAAG,CAAE,UAAU,CAAC,QAAmB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAE7D,OAAO,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEjD,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAE/C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAElD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,QAAQ;SACpB,CAAC;QACF,IAAI,YAAY;YAAE,MAAM,CAAC,aAAa,GAAG,YAAY,CAAC;QAEtD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAErE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,WAAW,EAAE,SAAS,CAAC,YAAsB;gBAC7C,YAAY,EAAE,SAAS,CAAC,aAAmC;gBAC3D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAE,SAAS,CAAC,UAAqB,IAAI,IAAI,CAAC,GAAG,IAAI;gBACzE,SAAS,EAAG,SAAS,CAAC,UAAqB,IAAI,QAAQ;gBACvD,KAAK,EAAE,SAAS,CAAC,KAA2B;gBAC5C,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAe,CAAC;QACxC,IAAI,KAAK,KAAK,uBAAuB;YAAE,SAAS;QAChD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,QAAQ,IAAI,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,aAAqB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAE7E,EAAE,CAAC,QAAQ,CACT,8CAA8C,EAC9C,CAAC,KAAK,EAAE,EAAE;YACR,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC3C,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBAClD,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAA2B,EAC3B,aAAqB,EACrB,WAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,EAAE,EAAE,CAAC;YACP,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,oBAAoB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAE5C,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;gBACvE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;gBAClC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;YACvF,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;YACtC,WAAW,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAA2B,EAC3B,IAAY,EACZ,YAAoB,EACpB,QAAgB,EAChB,YAAqB;IAErB,MAAM,MAAM,GAA2B;QACrC,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE;QAC7E,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,IAAI,YAAY;QAAE,MAAM,CAAC,aAAa,GAAG,YAAY,CAAC;IAEtD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAsB;QACxC,YAAY,EAAE,IAAI,CAAC,aAAmC;QACtD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAE,IAAI,CAAC,UAAiC,IAAI,IAAI,CAAC,GAAG,IAAI;QAChF,SAAS,EAAG,IAAI,CAAC,UAAiC,IAAI,QAAQ;QAC9D,KAAK,EAAE,IAAI,CAAC,KAA2B;KACxC,CAAC;AACJ,CAAC"}

package/dist/oauth/index.d.ts

@@ -0,0 +1,6 @@
+export { OAUTH_PROVIDERS, type OAuthProviderConfig, type OAuthTokens } from './types.js';
+export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl } from './pkce.js';
+export { TokenStore, refreshAccessToken } from './token-store.js';
+export { runOAuthFlow, runDeviceCodeFlow, isRemoteEnvironment, type OAuthFlowOptions, type DeviceCodeFlowOptions, } from './flow.js';
+export { loginOpenAI, loginGoogle, refreshOpenAIToken, refreshGoogleToken, type PiAuthCallbacks, } from './pi-auth.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC"}

package/dist/oauth/index.js

@@ -0,0 +1,6 @@
+export { OAUTH_PROVIDERS } from './types.js';
+export { generateCodeVerifier, generateCodeChallenge, buildAuthorizationUrl } from './pkce.js';
+export { TokenStore, refreshAccessToken } from './token-store.js';
+export { runOAuthFlow, runDeviceCodeFlow, isRemoteEnvironment, } from './flow.js';
+export { loginOpenAI, loginGoogle, refreshOpenAIToken, refreshGoogleToken, } from './pi-auth.js';
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA8C,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/F,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GAGpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,cAAc,CAAC"}

package/dist/oauth/pi-auth.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Thin wrappers around @mariozechner/pi-ai OAuth login & refresh functions.
+ * Converts pi-ai credential format to CereWorker OAuthTokens.
+ */
+import type { OAuthTokens } from './types.js';
+export interface PiAuthCallbacks {
+    onAuth: (url: string, instructions?: string) => void;
+    onPrompt?: (message: string) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+}
+export declare function loginOpenAI(callbacks: PiAuthCallbacks): Promise<OAuthTokens>;
+export declare function loginGoogle(callbacks: PiAuthCallbacks): Promise<OAuthTokens>;
+export declare function refreshOpenAIToken(refreshToken: string): Promise<OAuthTokens>;
+export declare function refreshGoogleToken(refreshToken: string, projectId: string): Promise<OAuthTokens>;
+//# sourceMappingURL=pi-auth.d.ts.map

package/dist/oauth/pi-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-auth.d.ts","sourceRoot":"","sources":["../../src/oauth/pi-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAe9C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAYlF;AAED,wBAAsB,WAAW,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAQlF;AAED,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAGnF;AAED,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,CAAC,CAGtB"}

package/dist/oauth/pi-auth.js

@@ -0,0 +1,38 @@
+function toTokens(creds) {
+    return {
+        accessToken: creds.access,
+        refreshToken: creds.refresh,
+        expiresAt: creds.expires,
+        tokenType: 'bearer',
+        email: creds.email,
+        projectId: creds.projectId,
+    };
+}
+export async function loginOpenAI(callbacks) {
+    const { loginOpenAICodex } = await import('@mariozechner/pi-ai/oauth');
+    const creds = await loginOpenAICodex({
+        onAuth: (info) => callbacks.onAuth(info.url, info.instructions),
+        onPrompt: async (prompt) => {
+            if (!callbacks.onPrompt)
+                throw new Error('Manual input required but no prompt handler');
+            return callbacks.onPrompt(prompt.message);
+        },
+        onProgress: callbacks.onProgress,
+        onManualCodeInput: callbacks.onManualCodeInput,
+    });
+    return toTokens(creds);
+}
+export async function loginGoogle(callbacks) {
+    const { loginGeminiCli } = await import('@mariozechner/pi-ai/oauth');
+    const creds = await loginGeminiCli((info) => callbacks.onAuth(info.url, info.instructions), callbacks.onProgress, callbacks.onManualCodeInput);
+    return toTokens(creds);
+}
+export async function refreshOpenAIToken(refreshToken) {
+    const { refreshOpenAICodexToken } = await import('@mariozechner/pi-ai/oauth');
+    return toTokens(await refreshOpenAICodexToken(refreshToken));
+}
+export async function refreshGoogleToken(refreshToken, projectId) {
+    const { refreshGoogleCloudToken } = await import('@mariozechner/pi-ai/oauth');
+    return toTokens(await refreshGoogleCloudToken(refreshToken, projectId));
+}
+//# sourceMappingURL=pi-auth.js.map

package/dist/oauth/pi-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-auth.js","sourceRoot":"","sources":["../../src/oauth/pi-auth.ts"],"names":[],"mappings":"AAQA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,SAAS,EAAE,KAAK,CAAC,OAAO;QACxB,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,KAAK,CAAC,KAA2B;QACxC,SAAS,EAAE,KAAK,CAAC,SAA+B;KACjD,CAAC;AACJ,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAA0B;IAC1D,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC;QACnC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;QAC/D,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzB,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACxF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;KAC/C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAA0B;IAC1D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,cAAc,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvD,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,iBAAiB,CAC5B,CAAC;IACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IAC3D,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,SAAiB;IAEjB,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,MAAM,uBAAuB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/oauth/pkce.d.ts

@@ -0,0 +1,5 @@
+import type { OAuthProviderConfig } from './types.js';
+export declare function generateCodeVerifier(): string;
+export declare function generateCodeChallenge(verifier: string): string;
+export declare function buildAuthorizationUrl(config: OAuthProviderConfig, codeChallenge: string, state: string, clientIdOverride?: string): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,mBAAmB,EAC3B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,gBAAgB,CAAC,EAAE,MAAM,GACxB,MAAM,CAWR"}

package/dist/oauth/pkce.js

@@ -0,0 +1,20 @@
+import { randomBytes, createHash } from 'node:crypto';
+export function generateCodeVerifier() {
+    return randomBytes(32).toString('base64url');
+}
+export function generateCodeChallenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+export function buildAuthorizationUrl(config, codeChallenge, state, clientIdOverride) {
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: clientIdOverride ?? config.clientId,
+        redirect_uri: `http://localhost:${config.callbackPort}${config.callbackPath}`,
+        code_challenge: codeChallenge,
+        code_challenge_method: 'S256',
+        scope: config.scopes.join(' '),
+        state,
+    });
+    return `${config.authorizationUrl}?${params}`;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGtD,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAA2B,EAC3B,aAAqB,EACrB,KAAa,EACb,gBAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,gBAAgB,IAAI,MAAM,CAAC,QAAQ;QAC9C,YAAY,EAAE,oBAAoB,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE;QAC7E,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;QAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,KAAK;KACN,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/dist/oauth/token-store.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthProviderConfig, OAuthTokens } from './types.js';
+export declare class TokenStore {
+    private dir;
+    constructor(dir?: string);
+    save(provider: string, tokens: OAuthTokens): void;
+    load(provider: string): OAuthTokens | null;
+    delete(provider: string): void;
+    isExpired(tokens: OAuthTokens, bufferMs?: number): boolean;
+}
+export declare function refreshAccessToken(providerConfig: OAuthProviderConfig, refreshToken: string, clientId?: string, clientSecret?: string): Promise<OAuthTokens>;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/oauth/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/oauth/token-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAInE,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAS;gBAER,GAAG,CAAC,EAAE,MAAM;IAIxB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI;IASjD,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAM1C,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAK9B,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,SAAU,GAAG,OAAO;CAG5D;AAED,wBAAsB,kBAAkB,CACtC,cAAc,EAAE,mBAAmB,EACnC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CA4BtB"}

package/dist/oauth/token-store.js

@@ -0,0 +1,56 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from 'node:fs';
+const DEFAULT_OAUTH_DIR = join(homedir(), '.cereworker', 'oauth');
+export class TokenStore {
+    dir;
+    constructor(dir) {
+        this.dir = dir ?? DEFAULT_OAUTH_DIR;
+    }
+    save(provider, tokens) {
+        mkdirSync(this.dir, { recursive: true });
+        writeFileSync(join(this.dir, `${provider}.json`), JSON.stringify(tokens, null, 2), { mode: 0o600 });
+    }
+    load(provider) {
+        const path = join(this.dir, `${provider}.json`);
+        if (!existsSync(path))
+            return null;
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    delete(provider) {
+        const path = join(this.dir, `${provider}.json`);
+        if (existsSync(path))
+            unlinkSync(path);
+    }
+    isExpired(tokens, bufferMs = 300_000) {
+        return Date.now() >= tokens.expiresAt - bufferMs;
+    }
+}
+export async function refreshAccessToken(providerConfig, refreshToken, clientId, clientSecret) {
+    const params = {
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: clientId ?? providerConfig.clientId,
+    };
+    const secret = clientSecret ?? providerConfig.clientSecret;
+    if (secret)
+        params.client_secret = secret;
+    const res = await fetch(providerConfig.tokenUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(params),
+    });
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`Token refresh failed: ${res.status} ${body}`);
+    }
+    const data = (await res.json());
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token ?? refreshToken,
+        expiresAt: Date.now() + (data.expires_in ?? 3600) * 1000,
+        tokenType: data.token_type ?? 'bearer',
+        scope: data.scope,
+    };
+}
+//# sourceMappingURL=token-store.js.map

package/dist/oauth/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/oauth/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGzF,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAElE,MAAM,OAAO,UAAU;IACb,GAAG,CAAS;IAEpB,YAAY,GAAY;QACtB,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,iBAAiB,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,QAAgB,EAAE,MAAmB;QACxC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,OAAO,CAAC,EAClC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAC/B,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAgB;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,CAAC,MAAmB,EAAE,QAAQ,GAAG,OAAO;QAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;IACnD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,cAAmC,EACnC,YAAoB,EACpB,QAAiB,EACjB,YAAqB;IAErB,MAAM,MAAM,GAA2B;QACrC,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;QAC3B,SAAS,EAAE,QAAQ,IAAI,cAAc,CAAC,QAAQ;KAC/C,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,IAAI,cAAc,CAAC,YAAY,CAAC;IAC3D,IAAI,MAAM;QAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;IAE1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE;QAC/C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAsB;QACxC,YAAY,EAAG,IAAI,CAAC,aAAoC,IAAI,YAAY;QACxE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAE,IAAI,CAAC,UAAiC,IAAI,IAAI,CAAC,GAAG,IAAI;QAChF,SAAS,EAAG,IAAI,CAAC,UAAiC,IAAI,QAAQ;QAC9D,KAAK,EAAE,IAAI,CAAC,KAA2B;KACxC,CAAC;AACJ,CAAC"}

package/dist/oauth/types.d.ts

@@ -0,0 +1,26 @@
+export interface OAuthProviderConfig {
+    authorizationUrl: string;
+    tokenUrl: string;
+    clientId: string;
+    clientSecret?: string;
+    deviceCodeUrl?: string;
+    scopes: string[];
+    callbackPort: number;
+    callbackPath: string;
+}
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt: number;
+    tokenType: string;
+    scope?: string;
+    clientId?: string;
+    email?: string;
+    projectId?: string;
+}
+/**
+ * Provider-specific OAuth endpoints.
+ * Users override clientId in their config (register their own OAuth app).
+ */
+export declare const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig>;
+//# sourceMappingURL=types.d.ts.map

package/dist/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAsB/D,CAAC"}

package/dist/oauth/types.js

@@ -0,0 +1,28 @@
+/**
+ * Provider-specific OAuth endpoints.
+ * Users override clientId in their config (register their own OAuth app).
+ */
+export const OAUTH_PROVIDERS = {
+    openai: {
+        authorizationUrl: 'https://auth0.openai.com/authorize',
+        tokenUrl: 'https://auth0.openai.com/oauth/token',
+        clientId: '', // Must be provided by user in config
+        scopes: ['openai.organization.read', 'openai.api'],
+        callbackPort: 18888,
+        callbackPath: '/callback',
+    },
+    google: {
+        authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+        tokenUrl: 'https://oauth2.googleapis.com/token',
+        clientId: '',
+        deviceCodeUrl: 'https://oauth2.googleapis.com/device/code',
+        scopes: [
+            'https://www.googleapis.com/auth/cloud-platform',
+            'https://www.googleapis.com/auth/userinfo.email',
+            'https://www.googleapis.com/auth/userinfo.profile',
+        ],
+        callbackPort: 18888,
+        callbackPath: '/callback',
+    },
+};
+//# sourceMappingURL=types.js.map

package/dist/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/oauth/types.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAwC;IAClE,MAAM,EAAE;QACN,gBAAgB,EAAE,oCAAoC;QACtD,QAAQ,EAAE,sCAAsC;QAChD,QAAQ,EAAE,EAAE,EAAE,qCAAqC;QACnD,MAAM,EAAE,CAAC,0BAA0B,EAAE,YAAY,CAAC;QAClD,YAAY,EAAE,KAAK;QACnB,YAAY,EAAE,WAAW;KAC1B;IACD,MAAM,EAAE;QACN,gBAAgB,EAAE,8CAA8C;QAChE,QAAQ,EAAE,qCAAqC;QAC/C,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,2CAA2C;QAC1D,MAAM,EAAE;YACN,gDAAgD;YAChD,gDAAgD;YAChD,kDAAkD;SACnD;QACD,YAAY,EAAE,KAAK;QACnB,YAAY,EAAE,WAAW;KAC1B;CACF,CAAC"}

package/dist/provider.d.ts

@@ -5,7 +5,9 @@ export declare class CerebrumProvider {
     private config;
     private builtinTools;
     private retryOptions;
+    private tokenStore;
     constructor(config: CerebrumConfig, shellConfig?: Partial<import('./tools/shell.js').ShellToolConfig>, retryOptions?: RetryOptions);
+    private resolveApiKey;
     private getModel;
     private convertMessages;
     stream(messages: Message[], callbacks: StreamCallbacks, options?: {

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAkB,eAAe,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAG1D,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,YAAY,CAAe;gBAGjC,MAAM,EAAE,cAAc,EACtB,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,eAAe,CAAC,EACjE,YAAY,CAAC,EAAE,YAAY;IAO7B,OAAO,CAAC,QAAQ;IAwChB,OAAO,CAAC,eAAe;IA2BjB,MAAM,CACV,QAAQ,EAAE,OAAO,EAAE,EACnB,SAAS,EAAE,eAAe,EAC1B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACxF,OAAO,CAAC,IAAI,CAAC;IA0DhB,kBAAkB,IAAI,MAAM;IAI5B,eAAe,IAAI,MAAM;IAIzB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAInC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI7B;;;OAGG;IACG,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBrD,qDAAqD;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYhD"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAkB,eAAe,EAAE,MAAM,YAAY,CAAC;AAElF,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAK1D,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAAoB;gBAGpC,MAAM,EAAE,cAAc,EACtB,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,eAAe,CAAC,EACjE,YAAY,CAAC,EAAE,YAAY;YAOf,aAAa;YA6Cb,QAAQ;IAwCtB,OAAO,CAAC,eAAe;IA2BjB,MAAM,CACV,QAAQ,EAAE,OAAO,EAAE,EACnB,SAAS,EAAE,eAAe,EAC1B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACxF,OAAO,CAAC,IAAI,CAAC;IAwDhB,kBAAkB,IAAI,MAAM;IAI5B,eAAe,IAAI,MAAM;IAIzB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAInC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI7B;;;OAGG;IACG,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBrD,qDAAqD;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYhD"}

package/dist/provider.js

@@ -5,45 +5,78 @@ import { createGoogleGenerativeAI } from '@ai-sdk/google';
 import { createBuiltinTools } from './tools/index.js';
 import { withRetry } from './retry.js';
 import { buildCompactionPrompt } from './context.js';
+import { TokenStore, refreshAccessToken, OAUTH_PROVIDERS } from './oauth/index.js';
+import { refreshOpenAIToken, refreshGoogleToken } from './oauth/pi-auth.js';
 export class CerebrumProvider {
     config;
     builtinTools;
     retryOptions;
+    tokenStore = new TokenStore();
     constructor(config, shellConfig, retryOptions) {
         this.config = config;
         this.builtinTools = createBuiltinTools(shellConfig);
         this.retryOptions = retryOptions ?? {};
     }
-    getModel(provider, model) {
+    async resolveApiKey(providerName, providerConfig) {
+        if (providerConfig?.auth !== 'oauth') {
+            return providerConfig?.apiKey;
+        }
+        const tokens = this.tokenStore.load(providerName);
+        if (!tokens) {
+            throw new Error(`No OAuth tokens found for ${providerName}. Run: cereworker auth ${providerName}`);
+        }
+        if (this.tokenStore.isExpired(tokens)) {
+            if (!tokens.refreshToken) {
+                throw new Error(`OAuth token expired and no refresh token. Run: cereworker auth ${providerName}`);
+            }
+            let refreshed;
+            if (providerName === 'openai') {
+                refreshed = await refreshOpenAIToken(tokens.refreshToken);
+            }
+            else if (providerName === 'google') {
+                refreshed = await refreshGoogleToken(tokens.refreshToken, tokens.projectId ?? '');
+            }
+            else {
+                const oauthConfig = OAUTH_PROVIDERS[providerName];
+                if (!oauthConfig)
+                    throw new Error(`No OAuth config for ${providerName}`);
+                refreshed = await refreshAccessToken(oauthConfig, tokens.refreshToken, tokens.clientId ?? providerConfig.oauth?.clientId, providerConfig.oauth?.clientSecret);
+            }
+            this.tokenStore.save(providerName, refreshed);
+            return refreshed.accessToken;
+        }
+        return tokens.accessToken;
+    }
+    async getModel(provider, model) {
         const providerName = provider ?? this.config.defaultProvider;
         const modelName = model ?? this.config.defaultModel;
         const providerConfig = this.config.providers[providerName];
+        const apiKey = await this.resolveApiKey(providerName, providerConfig);
         switch (providerName) {
             case 'anthropic': {
                 const anthropic = createAnthropic({
-                    apiKey: providerConfig?.apiKey,
+                    apiKey,
                     ...(providerConfig?.baseUrl ? { baseURL: providerConfig.baseUrl } : {}),
                 });
                 return anthropic(modelName);
             }
             case 'openai': {
                 const openai = createOpenAI({
-                    apiKey: providerConfig?.apiKey,
+                    apiKey,
                     ...(providerConfig?.baseUrl ? { baseURL: providerConfig.baseUrl } : {}),
                 });
                 return openai(modelName);
             }
             case 'google': {
                 const google = createGoogleGenerativeAI({
-                    apiKey: providerConfig?.apiKey,
+                    apiKey,
                     ...(providerConfig?.baseUrl ? { baseURL: providerConfig.baseUrl } : {}),
                 });
                 return google(modelName);
             }
             case 'local': {
-                // Local models via OpenAI-compatible API (e.g., Ollama, vLLM)
                 const local = createOpenAI({
-                    apiKey: providerConfig?.apiKey ?? 'not-needed',
+                    apiKey: apiKey ?? 'not-needed',
                     baseURL: providerConfig?.baseUrl ?? 'http://localhost:11434/v1',
                 });
                 return local(providerConfig?.model ?? modelName);
@@ -79,12 +112,10 @@ export class CerebrumProvider {
         });
     }
     async stream(messages, callbacks, options) {
-        // Extract system messages from the messages array for system prompt
         const systemMessages = messages.filter((m) => m.role === 'system');
         const nonSystemMessages = messages.filter((m) => m.role !== 'system');
-        const model = this.getModel(options?.provider, options?.model);
+        const model = await this.getModel(options?.provider, options?.model);
         const coreMessages = this.convertMessages(nonSystemMessages);
-        // Build system prompt from explicit option + system messages
         const systemParts = [];
         if (options?.systemPrompt)
             systemParts.push(options.systemPrompt);
@@ -125,7 +156,7 @@ export class CerebrumProvider {
             }
             catch (error) {
                 callbacks.onError(error instanceof Error ? error : new Error(String(error)));
-                throw error; // Re-throw so withRetry can catch it
+                throw error;
             }
         }, this.retryOptions);
     }
@@ -146,13 +177,13 @@ export class CerebrumProvider {
      * Used for context window compaction.
      */
     async summarize(messages) {
-        const model = this.getModel();
+        const model = await this.getModel();
         const prompt = buildCompactionPrompt(messages);
         const result = await withRetry(async () => {
             const { text } = await generateText({
                 model,
                 prompt,
-                temperature: 0.3, // Lower temperature for factual summarization
+                temperature: 0.3,
             });
             return text;
         }, this.retryOptions);
@@ -160,7 +191,7 @@ export class CerebrumProvider {
     }
     /** Single-shot text generation from a raw prompt. */
     async generate(prompt) {
-        const model = this.getModel();
+        const model = await this.getModel();
         const result = await withRetry(async () => {
             const { text } = await generateText({
                 model,

package/dist/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAwC,MAAM,IAAI,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAiB;IACvB,YAAY,CAAe;IAC3B,YAAY,CAAe;IAEnC,YACE,MAAsB,EACtB,WAAiE,EACjE,YAA2B;QAE3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,EAAE,CAAC;IACzC,CAAC;IAEO,QAAQ,CAAC,QAAiB,EAAE,KAAc;QAChD,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAC7D,MAAM,SAAS,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE3D,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,SAAS,GAAG,eAAe,CAAC;oBAChC,MAAM,EAAE,cAAc,EAAE,MAAM;oBAC9B,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,YAAY,CAAC;oBAC1B,MAAM,EAAE,cAAc,EAAE,MAAM;oBAC9B,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,wBAAwB,CAAC;oBACtC,MAAM,EAAE,cAAc,EAAE,MAAM;oBAC9B,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,8DAA8D;gBAC9D,MAAM,KAAK,GAAG,YAAY,CAAC;oBACzB,MAAM,EAAE,cAAc,EAAE,MAAM,IAAI,YAAY;oBAC9C,OAAO,EAAE,cAAc,EAAE,OAAO,IAAI,2BAA2B;iBAChE,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,cAAc,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;YACnD,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,qBAAqB,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,QAAmB;QACzC,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;aAC7D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACvD,KAAK,UAAU;oBACb,OAAO,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5D,KAAK,MAAM;oBACT,OAAO;wBACL,IAAI,EAAE,MAAe;wBACrB,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,aAAsB;gCAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE;gCACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAkB,IAAI,SAAS;gCACrD,MAAM,EAAE,CAAC,CAAC,OAAO;6BAClB;yBACF;qBACF,CAAC;gBACJ;oBACE,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CACV,QAAmB,EACnB,SAA0B,EAC1B,OAAyF;QAEzF,oEAAoE;QACpE,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACnE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAEtE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;QAE7D,6DAA6D;QAC7D,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,IAAI,OAAO,EAAE,YAAY;YAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClE,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC;oBACxB,KAAK;oBACL,QAAQ,EAAE,YAAY;oBACtB,KAAK,EAAE,IAAI,CAAC,YAAY;oBACxB,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;oBACnD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;oBACpC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC,CAAC;gBAEH,IAAI,WAAW,GAAG,EAAE,CAAC;gBAErB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBAC3C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAClB,KAAK,YAAY;4BACf,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC;4BAC9B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;4BAClC,MAAM;wBACR,KAAK,WAAW;4BACd,MAAM,SAAS,CAAC,UAAU,CAAC;gCACzB,EAAE,EAAE,IAAI,CAAC,UAAU;gCACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;gCACnB,IAAI,EAAE,IAAI,CAAC,IAA+B;6BAC3C,CAAC,CAAC;4BACH,MAAM;wBACR,KAAK,OAAO;4BACV,SAAS,CAAC,OAAO,CACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACzE,CAAC;4BACF,MAAM;oBACV,CAAC;gBACH,CAAC;gBAED,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7E,MAAM,KAAK,CAAC,CAAC,qCAAqC;YACpD,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;IACrC,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;IAClC,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,QAAmB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;gBAClC,KAAK;gBACL,MAAM;gBACN,WAAW,EAAE,GAAG,EAAE,8CAA8C;aACjE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAEtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;gBAClC,KAAK;gBACL,MAAM;gBACN,WAAW,EAAE,GAAG;aACjB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAwC,MAAM,IAAI,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAG1D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAqB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,MAAM,OAAO,gBAAgB;IACnB,MAAM,CAAiB;IACvB,YAAY,CAAe;IAC3B,YAAY,CAAe;IAC3B,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IAEtC,YACE,MAAsB,EACtB,WAAiE,EACjE,YAA2B;QAE3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,YAAoB,EACpB,cAA+B;QAE/B,IAAI,cAAc,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACrC,OAAO,cAAc,EAAE,MAAM,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,6BAA6B,YAAY,0BAA0B,YAAY,EAAE,CAClF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,kEAAkE,YAAY,EAAE,CACjF,CAAC;YACJ,CAAC;YAED,IAAI,SAAS,CAAC;YACd,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC9B,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;iBAAM,IAAI,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACrC,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;gBAClD,IAAI,CAAC,WAAW;oBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,EAAE,CAAC,CAAC;gBACzE,SAAS,GAAG,MAAM,kBAAkB,CAClC,WAAW,EACX,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,QAAQ,IAAI,cAAc,CAAC,KAAK,EAAE,QAAQ,EACjD,cAAc,CAAC,KAAK,EAAE,YAAY,CACnC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,QAAiB,EAAE,KAAc;QACtD,MAAM,YAAY,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAC7D,MAAM,SAAS,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAEtE,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,SAAS,GAAG,eAAe,CAAC;oBAChC,MAAM;oBACN,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,YAAY,CAAC;oBAC1B,MAAM;oBACN,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,wBAAwB,CAAC;oBACtC,MAAM;oBACN,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,KAAK,GAAG,YAAY,CAAC;oBACzB,MAAM,EAAE,MAAM,IAAI,YAAY;oBAC9B,OAAO,EAAE,cAAc,EAAE,OAAO,IAAI,2BAA2B;iBAChE,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,cAAc,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;YACnD,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,qBAAqB,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,QAAmB;QACzC,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;aAC7D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,MAAM;oBACT,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACvD,KAAK,UAAU;oBACb,OAAO,EAAE,IAAI,EAAE,WAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5D,KAAK,MAAM;oBACT,OAAO;wBACL,IAAI,EAAE,MAAe;wBACrB,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,aAAsB;gCAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE;gCACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAkB,IAAI,SAAS;gCACrD,MAAM,EAAE,CAAC,CAAC,OAAO;6BAClB;yBACF;qBACF,CAAC;gBACJ;oBACE,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CACV,QAAmB,EACnB,SAA0B,EAC1B,OAAyF;QAEzF,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACnE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAEtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,IAAI,OAAO,EAAE,YAAY;YAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClE,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC;oBACxB,KAAK;oBACL,QAAQ,EAAE,YAAY;oBACtB,KAAK,EAAE,IAAI,CAAC,YAAY;oBACxB,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;oBACnD,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;oBACpC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC,CAAC;gBAEH,IAAI,WAAW,GAAG,EAAE,CAAC;gBAErB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBAC3C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;wBAClB,KAAK,YAAY;4BACf,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC;4BAC9B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;4BAClC,MAAM;wBACR,KAAK,WAAW;4BACd,MAAM,SAAS,CAAC,UAAU,CAAC;gCACzB,EAAE,EAAE,IAAI,CAAC,UAAU;gCACnB,IAAI,EAAE,IAAI,CAAC,QAAQ;gCACnB,IAAI,EAAE,IAAI,CAAC,IAA+B;6BAC3C,CAAC,CAAC;4BACH,MAAM;wBACR,KAAK,OAAO;4BACV,SAAS,CAAC,OAAO,CACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACzE,CAAC;4BACF,MAAM;oBACV,CAAC;gBACH,CAAC;gBAED,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7E,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;IACrC,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;IAClC,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,QAAmB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;gBAClC,KAAK;gBACL,MAAM;gBACN,WAAW,EAAE,GAAG;aACjB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAEtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC;gBAClC,KAAK;gBACL,MAAM;gBACN,WAAW,EAAE,GAAG;aACjB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/types.d.ts

@@ -11,6 +11,12 @@ export interface ProviderConfig {
     baseUrl?: string;
     models?: string[];
     model?: string;
+    auth?: 'apikey' | 'oauth';
+    oauth?: {
+        clientId?: string;
+        clientSecret?: string;
+        callbackPort?: number;
+    };
 }
 export interface CerebrumRequest {
     messages: Message[];

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEtE,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEtE,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cereworker/cerebrum",
-  "version": "0.7.0",
+  "version": "26.313.2",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -16,13 +16,14 @@
     "directory": "packages/cerebrum"
   },
   "dependencies": {
-    "ai": "^4.1.0",
     "@ai-sdk/anthropic": "^1.2.0",
-    "@ai-sdk/openai": "^1.2.0",
     "@ai-sdk/google": "^1.2.0",
+    "@ai-sdk/openai": "^1.2.0",
+    "@mariozechner/pi-ai": "^0.57.1",
+    "ai": "^4.1.0",
     "zod": "^3.24.0",
-    "@cereworker/core": "0.7.0",
-    "@cereworker/config": "0.7.0"
+    "@cereworker/config": "26.313.2",
+    "@cereworker/core": "26.313.2"
   },
   "devDependencies": {
     "typescript": "^5.7.3"