@cleocode/core 2026.6.12 → 2026.6.14

package/dist/llm/onboarding/login-engine.d.ts

@@ -0,0 +1,175 @@
+/**
+ * `runOnboardingLogin` — the 3-step onboarding login engine (T11724 · M3).
+ *
+ * The imperative front-door flow that takes a provider from a cold start to a
+ * usable, validated profile binding. It ORCHESTRATES the already-merged
+ * credential / catalog / config / resolver accessors — it does NOT reimplement
+ * OAuth, construct a transport, or open an LLM client (Gate-13: chokepoint only).
+ *
+ * ## The four steps
+ *
+ *   1. **connect**  — resolve the provider (alias → canonical via
+ *      {@link getProviderProfile}) and land a credential (Account) in the
+ *      multi-credential pool via {@link addCredential}. The OAuth token / API
+ *      key is supplied by the caller (`opts.token`): the owner-driven browser
+ *      step (PKCE / device-code) runs in `cleo llm login` BEFORE this engine,
+ *      so the engine itself is non-interactive and testable. OAuth-less
+ *      providers pass the same `opts.token` as an API key (AC4).
+ *   2. **select**   — choose a model from the catalog: `opts.model` when given
+ *      (validated against the catalog), else the latest by `release_date` via
+ *      {@link resolveProviderDefaultModel}.
+ *   3. **bind**     — write the `llm.default` (or `llm.roles[role]`) config
+ *      binding tying the account + model together via {@link setConfigValue}.
+ *   4. **validate** — round-trip the binding through {@link resolveLLMForSystem}
+ *      and confirm the resolved provider/model are consistent. NOT a live LLM
+ *      call: no token is materialized; only resolution metadata is asserted,
+ *      and the secret stays behind the sealed handle.
+ *
+ * ## Security (AC2)
+ *
+ * The {@link OnboardingResult} envelope carries NO secret fields — never an
+ * access token, API key, or refresh token. The plaintext is materialized only
+ * at the wire via the sealed handle, never on this envelope.
+ *
+ * ## Testability (AC3)
+ *
+ * Every step depends only on the injectable {@link OnboardingDeps} seam, which
+ * defaults to the real core accessors. Tests pass a {@link StubOnboardingDeps}
+ * (stub catalog + in-memory pool/config + stub resolver) to exercise each step
+ * in isolation without a live browser, network, or disk.
+ *
+ * @module llm/onboarding/login-engine
+ * @task T11724
+ * @epic T11671 (E6-ONBOARDING-FRONT-DOOR)
+ */
+import type { ModelTransport, OnboardingAuthMode, OnboardingResult, ProviderProfile, RoleName } from '@cleocode/contracts';
+import { type StoredAuthType } from '../credentials-store.js';
+/**
+ * Options for {@link runOnboardingLogin}.
+ *
+ * @task T11724
+ */
+export interface OnboardingLoginOptions {
+    /**
+     * The credential secret to store — an OAuth access token (when
+     * `authMode: 'oauth'`) or a raw API key (when `authMode: 'api_key'`).
+     *
+     * The interactive OAuth browser/device-code exchange runs in
+     * `cleo llm login` BEFORE this engine; the resulting token is passed here so
+     * the engine is non-interactive and testable. When omitted, the connect step
+     * fails cleanly with `E_ONBOARDING_NO_CREDENTIAL` (no throw).
+     */
+    token?: string;
+    /**
+     * Auth scheme for the supplied `token`. Defaults to `'oauth'` when the
+     * resolved provider profile exposes an OAuth config, else `'api_key'` (AC4).
+     */
+    authMode?: OnboardingAuthMode;
+    /** Human-readable label stored alongside the credential. Defaults to `'oauth-login'`. */
+    label?: string;
+    /**
+     * Explicit model id to bind. When omitted, the latest catalog model for the
+     * provider (by `release_date`) is selected. When given, it is validated
+     * against the catalog and rejected with `E_MODEL_NOT_IN_CATALOG` on a miss.
+     */
+    model?: string;
+    /**
+     * Bind the model to a specific role (`llm.roles[role]`) instead of the
+     * global default (`llm.default`). The bound name surfaces as
+     * {@link OnboardingResult.profileName}.
+     */
+    role?: RoleName;
+    /** Project root passed through to the resolver during the validate step. */
+    projectRoot?: string;
+    /**
+     * Skip the connect-step credential write because an interactive OAuth flow
+     * (e.g. `cleo llm login`'s PKCE / device-code dance) has ALREADY landed the
+     * credential in the pool. The connect step still resolves the provider and
+     * records an `ok` trace, but does NOT call {@link addCredential} a second
+     * time. Used by the shared front-door orchestrator (T11725) so the OAuth
+     * token is stored exactly once.
+     *
+     * When `true`, {@link OnboardingLoginOptions.token} is NOT required.
+     */
+    credentialAlreadyStored?: boolean;
+}
+/**
+ * Minimal resolver result the validate step asserts against — a structural
+ * subset of `ResolvedLLMForSystem` so a stub resolver need not construct a full
+ * client/credential graph.
+ *
+ * @task T11724
+ */
+export interface OnboardingResolution {
+    /** Provider the binding resolved to. */
+    provider: ModelTransport;
+    /** Model the binding resolved to. */
+    model: string;
+    /**
+     * Sealed credential handle (or `null`). The validate step reads only its
+     * presence + `tokenPreview` — it NEVER calls `fetch()`, so no secret is
+     * materialized during onboarding.
+     */
+    sealedCredential: {
+        tokenPreview: string;
+    } | null;
+}
+/**
+ * Injectable accessor seam. Defaults to the real `@cleocode/core` accessors;
+ * tests override individual members to exercise each step in isolation.
+ *
+ * @task T11724
+ */
+export interface OnboardingDeps {
+    /** Resolve a provider profile by name/alias (alias → canonical). */
+    getProviderProfile: (name: string) => Promise<ProviderProfile | undefined>;
+    /** Persist a credential (Account) into the multi-credential pool. */
+    addCredential: (input: {
+        provider: ModelTransport;
+        label: string;
+        authType: StoredAuthType;
+        accessToken: string;
+        source: string;
+    }) => Promise<unknown>;
+    /** Map a CLEO provider name to its models.dev catalog key. */
+    catalogKeyForProvider: (providerName: string) => string;
+    /** Resolve the latest catalog model for a provider, or `null`. */
+    resolveProviderDefaultModel: (catalogKey: string) => string | null;
+    /** Validate a model id against the catalog for a provider. */
+    validateModelForProvider: (model: string, catalogKey: string) => {
+        valid: boolean;
+        reason: string;
+    };
+    /** Write a global config value (the `llm.default` / `llm.roles[role]` binding). */
+    setConfigValue: (key: string, value: unknown) => Promise<unknown>;
+    /**
+     * Round-trip resolve the binding for the validate step.
+     *
+     * `role` is the role the bind step just wrote (`llm.roles[role]`), so the
+     * validate resolution MUST target that role — resolving a different role
+     * would validate an unrelated binding (T11725 takeover review).
+     */
+    resolve: (provider: ModelTransport, projectRoot?: string, role?: RoleName) => Promise<OnboardingResolution>;
+}
+/**
+ * Run the 3-step onboarding login flow for a provider (T11724 · M3).
+ *
+ * Walks **connect → select → bind → validate**, reusing the merged credential /
+ * catalog / config / resolver accessors. Returns a typed {@link OnboardingResult}
+ * envelope with the per-step trace and the non-secret binding identifiers.
+ *
+ * Like the resolver chokepoint, this engine **never throws** for an expected
+ * failure (missing credential, unknown model, config write error): it returns
+ * an envelope whose failing step carries `status: 'failed'` and a stable `E_*`
+ * `code`, with `validated: false`. Unexpected accessor errors are caught and
+ * mapped to a failed step trace as well.
+ *
+ * @param provider - Provider name or alias (e.g. `'anthropic'`, `'codex'`).
+ * @param opts     - {@link OnboardingLoginOptions} (token, model, role, …).
+ * @param deps     - Injectable accessor seam (AC3); defaults to real core accessors.
+ * @returns The typed onboarding result envelope; never throws on expected failure.
+ *
+ * @task T11724
+ */
+export declare function runOnboardingLogin(provider: string, opts?: OnboardingLoginOptions, deps?: OnboardingDeps): Promise<OnboardingResult>;
+//# sourceMappingURL=login-engine.d.ts.map

package/dist/llm/onboarding/login-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-engine.d.ts","sourceRoot":"","sources":["../../../src/llm/onboarding/login-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAGhB,eAAe,EACf,QAAQ,EACT,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAU7E;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;OASG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,gBAAgB,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC3E,qEAAqE;IACrE,aAAa,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,EAAE,cAAc,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,cAAc,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACxD,kEAAkE;IAClE,2BAA2B,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACnE,8DAA8D;IAC9D,wBAAwB,EAAE,CACxB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,KACf;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,mFAAmF;IACnF,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE;;;;;;OAMG;IACH,OAAO,EAAE,CACP,QAAQ,EAAE,cAAc,EACxB,WAAW,CAAC,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,QAAQ,KACZ,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpC;AA6ED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,sBAA2B,EACjC,IAAI,GAAE,cAA8B,GACnC,OAAO,CAAC,gBAAgB,CAAC,CAqM3B"}

package/dist/llm/onboarding/login-engine.js

@@ -0,0 +1,286 @@
+/**
+ * `runOnboardingLogin` — the 3-step onboarding login engine (T11724 · M3).
+ *
+ * The imperative front-door flow that takes a provider from a cold start to a
+ * usable, validated profile binding. It ORCHESTRATES the already-merged
+ * credential / catalog / config / resolver accessors — it does NOT reimplement
+ * OAuth, construct a transport, or open an LLM client (Gate-13: chokepoint only).
+ *
+ * ## The four steps
+ *
+ *   1. **connect**  — resolve the provider (alias → canonical via
+ *      {@link getProviderProfile}) and land a credential (Account) in the
+ *      multi-credential pool via {@link addCredential}. The OAuth token / API
+ *      key is supplied by the caller (`opts.token`): the owner-driven browser
+ *      step (PKCE / device-code) runs in `cleo llm login` BEFORE this engine,
+ *      so the engine itself is non-interactive and testable. OAuth-less
+ *      providers pass the same `opts.token` as an API key (AC4).
+ *   2. **select**   — choose a model from the catalog: `opts.model` when given
+ *      (validated against the catalog), else the latest by `release_date` via
+ *      {@link resolveProviderDefaultModel}.
+ *   3. **bind**     — write the `llm.default` (or `llm.roles[role]`) config
+ *      binding tying the account + model together via {@link setConfigValue}.
+ *   4. **validate** — round-trip the binding through {@link resolveLLMForSystem}
+ *      and confirm the resolved provider/model are consistent. NOT a live LLM
+ *      call: no token is materialized; only resolution metadata is asserted,
+ *      and the secret stays behind the sealed handle.
+ *
+ * ## Security (AC2)
+ *
+ * The {@link OnboardingResult} envelope carries NO secret fields — never an
+ * access token, API key, or refresh token. The plaintext is materialized only
+ * at the wire via the sealed handle, never on this envelope.
+ *
+ * ## Testability (AC3)
+ *
+ * Every step depends only on the injectable {@link OnboardingDeps} seam, which
+ * defaults to the real core accessors. Tests pass a {@link StubOnboardingDeps}
+ * (stub catalog + in-memory pool/config + stub resolver) to exercise each step
+ * in isolation without a live browser, network, or disk.
+ *
+ * @module llm/onboarding/login-engine
+ * @task T11724
+ * @epic T11671 (E6-ONBOARDING-FRONT-DOOR)
+ */
+import { WHOAMI_ROLE_IDS } from '@cleocode/contracts';
+import { setConfigValue } from '../../config.js';
+import { getLogger } from '../../logger.js';
+import { catalogKeyForProvider, resolveProviderDefaultModel, validateModelForProvider, } from '../catalog-model-resolver.js';
+import { addCredential } from '../credentials-store.js';
+import { getProviderProfile } from '../provider-registry/index.js';
+import { resolveLLMForSystem } from '../system-resolver.js';
+const logger = getLogger('llm-onboarding');
+/**
+ * The default dependency set — the real, merged core accessors.
+ *
+ * @task T11724
+ */
+function defaultDeps() {
+    return {
+        getProviderProfile,
+        addCredential: (input) => addCredential(input),
+        catalogKeyForProvider,
+        resolveProviderDefaultModel: (catalogKey) => resolveProviderDefaultModel(catalogKey),
+        validateModelForProvider: (model, catalogKey) => validateModelForProvider(model, catalogKey),
+        setConfigValue: (key, value) => setConfigValue(key, value, undefined, { global: true }),
+        resolve: async (_provider, projectRoot, role) => {
+            const resolved = await resolveLLMForSystem({ kind: 'role', id: role ?? 'consolidation' }, projectRoot !== undefined ? { projectRoot } : undefined);
+            // Map the full resolver envelope down to the structural subset the
+            // validate step needs. NOTE: we never read or materialize the secret.
+            return {
+                provider: resolved.provider,
+                model: resolved.model,
+                sealedCredential: resolved.sealedCredential
+                    ? { tokenPreview: resolved.sealedCredential.tokenPreview }
+                    : null,
+            };
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Internal step-trace helpers
+// ---------------------------------------------------------------------------
+/** Build an `ok` step trace. @internal */
+function ok(step, detail) {
+    return { step, status: 'ok', detail };
+}
+/** Build a `failed` step trace carrying a stable `E_*` code. @internal */
+function fail(step, code, detail) {
+    return { step, status: 'failed', detail, code };
+}
+/** Build a `skipped` step trace (downstream of a failure). @internal */
+function skipped(step, detail) {
+    return { step, status: 'skipped', detail };
+}
+/**
+ * Compose the partial envelope returned when a step fails: the failed step's
+ * trace plus a `skipped` trace for every remaining step, so the 4-row shape is
+ * always stable.
+ *
+ * @internal
+ */
+function withSkips(done, failedAt) {
+    const order = ['connect', 'select', 'bind', 'validate'];
+    const steps = [...done, failedAt];
+    const seen = new Set(steps.map((s) => s.step));
+    for (const name of order) {
+        if (!seen.has(name))
+            steps.push(skipped(name, 'skipped — earlier step failed'));
+    }
+    // Re-sort into canonical execution order.
+    return order.map((name) => steps.find((s) => s.step === name));
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Run the 3-step onboarding login flow for a provider (T11724 · M3).
+ *
+ * Walks **connect → select → bind → validate**, reusing the merged credential /
+ * catalog / config / resolver accessors. Returns a typed {@link OnboardingResult}
+ * envelope with the per-step trace and the non-secret binding identifiers.
+ *
+ * Like the resolver chokepoint, this engine **never throws** for an expected
+ * failure (missing credential, unknown model, config write error): it returns
+ * an envelope whose failing step carries `status: 'failed'` and a stable `E_*`
+ * `code`, with `validated: false`. Unexpected accessor errors are caught and
+ * mapped to a failed step trace as well.
+ *
+ * @param provider - Provider name or alias (e.g. `'anthropic'`, `'codex'`).
+ * @param opts     - {@link OnboardingLoginOptions} (token, model, role, …).
+ * @param deps     - Injectable accessor seam (AC3); defaults to real core accessors.
+ * @returns The typed onboarding result envelope; never throws on expected failure.
+ *
+ * @task T11724
+ */
+export async function runOnboardingLogin(provider, opts = {}, deps = defaultDeps()) {
+    const label = opts.label?.trim() ? opts.label.trim() : 'oauth-login';
+    const done = [];
+    // --- Step 1: connect ----------------------------------------------------
+    let canonicalProvider;
+    let authMode;
+    try {
+        const profile = await deps.getProviderProfile(provider);
+        if (!profile) {
+            const step = fail('connect', 'E_UNKNOWN_PROVIDER', `Unknown provider '${provider}'. Run \`cleo llm list-providers\` to see supported providers.`);
+            return envelope(withSkips(done, step), provider, label, null, null, null, false);
+        }
+        canonicalProvider = profile.name;
+        // OAuth when the provider profile advertises an OAuth config; else API key (AC4).
+        authMode = opts.authMode ?? (profile.oauth ? 'oauth' : 'api_key');
+        if (opts.credentialAlreadyStored) {
+            // An interactive OAuth flow already landed the credential in the pool
+            // (front-door orchestrator path — T11725). Resolve + record connect as
+            // ok WITHOUT a second write so the token is stored exactly once.
+            done.push(ok('connect', `account '${label}' connected (${authMode}, pre-stored)`));
+        }
+        else {
+            if (!opts.token) {
+                const step = fail('connect', 'E_ONBOARDING_NO_CREDENTIAL', `No credential supplied for '${canonicalProvider}'. ` +
+                    `Complete \`cleo llm login ${canonicalProvider}\` (OAuth) or pass an API key.`);
+                return envelope(withSkips(done, step), canonicalProvider, label, null, null, null, false);
+            }
+            const storedAuthType = authMode === 'oauth' ? 'oauth' : 'api_key';
+            await deps.addCredential({
+                provider: canonicalProvider,
+                label,
+                authType: storedAuthType,
+                accessToken: opts.token,
+                source: 'onboarding-login',
+            });
+            done.push(ok('connect', `account '${label}' connected (${authMode})`));
+        }
+    }
+    catch (err) {
+        const step = fail('connect', 'E_ONBOARDING_CONNECT_FAILED', errMsg(err));
+        return envelope(withSkips(done, step), provider, label, null, null, null, false);
+    }
+    // --- Step 2: select -----------------------------------------------------
+    let modelId;
+    try {
+        const catalogKey = deps.catalogKeyForProvider(canonicalProvider);
+        if (opts.model) {
+            const validation = deps.validateModelForProvider(opts.model, catalogKey);
+            if (!validation.valid && validation.reason === 'not-found') {
+                const step = fail('select', 'E_MODEL_NOT_IN_CATALOG', `Model '${opts.model}' is not in the catalog for provider '${canonicalProvider}'. ` +
+                    `Run \`cleo llm refresh-catalog\` to update the catalog.`);
+                return envelope(withSkips(done, step), canonicalProvider, label, authMode, null, null, false);
+            }
+            modelId = opts.model;
+            done.push(ok('select', `model '${modelId}' selected (explicit, validated)`));
+        }
+        else {
+            const latest = deps.resolveProviderDefaultModel(catalogKey);
+            if (!latest) {
+                const step = fail('select', 'E_NO_CATALOG_MODEL', `No catalog model available for '${canonicalProvider}'. ` +
+                    `Run \`cleo llm refresh-catalog\`, or pass an explicit \`--model\`.`);
+                return envelope(withSkips(done, step), canonicalProvider, label, authMode, null, null, false);
+            }
+            modelId = latest;
+            done.push(ok('select', `model '${modelId}' selected (catalog default, latest release_date)`));
+        }
+    }
+    catch (err) {
+        const step = fail('select', 'E_ONBOARDING_SELECT_FAILED', errMsg(err));
+        return envelope(withSkips(done, step), canonicalProvider, label, authMode, null, null, false);
+    }
+    // --- Step 3: bind -------------------------------------------------------
+    let profileName;
+    try {
+        if (opts.role) {
+            if (!WHOAMI_ROLE_IDS.includes(opts.role)) {
+                const step = fail('bind', 'E_INVALID_ROLE', `Invalid role '${opts.role}'. Valid roles: ${WHOAMI_ROLE_IDS.join(', ')}.`);
+                return envelope(withSkips(done, step), canonicalProvider, label, authMode, modelId, null, false);
+            }
+            await deps.setConfigValue(`llm.roles.${opts.role}.provider`, canonicalProvider);
+            await deps.setConfigValue(`llm.roles.${opts.role}.model`, modelId);
+            await deps.setConfigValue(`llm.roles.${opts.role}.credentialLabel`, label);
+            profileName = opts.role;
+            done.push(ok('bind', `profile '${profileName}' bound → ${canonicalProvider}/${modelId}`));
+        }
+        else {
+            await deps.setConfigValue('llm.default.provider', canonicalProvider);
+            await deps.setConfigValue('llm.default.model', modelId);
+            profileName = 'default';
+            done.push(ok('bind', `default binding → ${canonicalProvider}/${modelId}`));
+        }
+    }
+    catch (err) {
+        const step = fail('bind', 'E_ONBOARDING_BIND_FAILED', errMsg(err));
+        return envelope(withSkips(done, step), canonicalProvider, label, authMode, modelId, null, false);
+    }
+    // --- Step 4: validate ---------------------------------------------------
+    try {
+        const resolved = await deps.resolve(canonicalProvider, opts.projectRoot, opts.role);
+        const providerMatch = resolved.provider === canonicalProvider;
+        const modelMatch = resolved.model === modelId;
+        const hasHandle = resolved.sealedCredential !== null;
+        if (providerMatch && modelMatch && hasHandle) {
+            done.push(ok('validate', `round-trip ok — resolves to ${resolved.provider}/${resolved.model} ` +
+                `(sealed handle ${resolved.sealedCredential?.tokenPreview ?? '…'})`));
+            return envelope(done, canonicalProvider, label, authMode, modelId, profileName, true);
+        }
+        const reason = !hasHandle
+            ? 'no credential handle resolved'
+            : `resolved ${resolved.provider}/${resolved.model}, expected ${canonicalProvider}/${modelId}`;
+        const step = fail('validate', 'E_ONBOARDING_VALIDATION_FAILED', `binding inconsistent — ${reason}`);
+        return envelope([...done, step], canonicalProvider, label, authMode, modelId, profileName, false);
+    }
+    catch (err) {
+        const step = fail('validate', 'E_ONBOARDING_VALIDATION_FAILED', errMsg(err));
+        return envelope([...done, step], canonicalProvider, label, authMode, modelId, profileName, false);
+    }
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/**
+ * Assemble the {@link OnboardingResult} envelope. Centralised so every return
+ * path produces an identically-shaped, secret-free result.
+ *
+ * @internal
+ */
+function envelope(steps, provider, accountLabel, authMode, modelId, profileName, validated) {
+    return {
+        steps,
+        provider,
+        accountLabel,
+        authMode,
+        modelId,
+        profileName,
+        validated,
+    };
+}
+/**
+ * Extract a short, secret-free message from an unknown thrown value. The
+ * onboarding accessors already redact their own error strings; this is a final
+ * defensive narrow so the envelope never carries a raw stack.
+ *
+ * @internal
+ */
+function errMsg(err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    logger.debug({ err: raw }, 'onboarding: step accessor error');
+    return raw;
+}
+//# sourceMappingURL=login-engine.js.map

package/dist/llm/onboarding/login-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-engine.js","sourceRoot":"","sources":["../../../src/llm/onboarding/login-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAWH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAuB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC;AA0H3C;;;;GAIG;AACH,SAAS,WAAW;IAClB,OAAO;QACL,kBAAkB;QAClB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;QAC9C,qBAAqB;QACrB,2BAA2B,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,2BAA2B,CAAC,UAAU,CAAC;QACpF,wBAAwB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC;QAC5F,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACvF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,eAAe,EAAE,EAC7C,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC;YACF,mEAAmE;YACnE,sEAAsE;YACtE,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;oBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,gBAAgB,CAAC,YAAY,EAAE;oBAC1D,CAAC,CAAC,IAAI;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,0CAA0C;AAC1C,SAAS,EAAE,CAAC,IAAwB,EAAE,MAAc;IAClD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,SAAS,IAAI,CAAC,IAAwB,EAAE,IAAY,EAAE,MAAc;IAClE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,wEAAwE;AACxE,SAAS,OAAO,CAAC,IAAwB,EAAE,MAAc;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAChB,IAA4B,EAC5B,QAA8B;IAE9B,MAAM,KAAK,GAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,0CAA0C;IAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAE,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,OAA+B,EAAE,EACjC,OAAuB,WAAW,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;IACrE,MAAM,IAAI,GAA2B,EAAE,CAAC;IAExC,2EAA2E;IAC3E,IAAI,iBAAiC,CAAC;IACtC,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,IAAI,CACf,SAAS,EACT,oBAAoB,EACpB,qBAAqB,QAAQ,gEAAgE,CAC9F,CAAC;YACF,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,iBAAiB,GAAG,OAAO,CAAC,IAAsB,CAAC;QAEnD,kFAAkF;QAClF,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACjC,sEAAsE;YACtE,uEAAuE;YACvE,iEAAiE;YACjE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,KAAK,gBAAgB,QAAQ,eAAe,CAAC,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,IAAI,CACf,SAAS,EACT,4BAA4B,EAC5B,+BAA+B,iBAAiB,KAAK;oBACnD,6BAA6B,iBAAiB,gCAAgC,CACjF,CAAC;gBACF,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5F,CAAC;YAED,MAAM,cAAc,GAAmB,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAElF,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,QAAQ,EAAE,iBAAiB;gBAC3B,KAAK;gBACL,QAAQ,EAAE,cAAc;gBACxB,WAAW,EAAE,IAAI,CAAC,KAAK;gBACvB,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,KAAK,gBAAgB,QAAQ,GAAG,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,6BAA6B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,IAAI,CACf,QAAQ,EACR,wBAAwB,EACxB,UAAU,IAAI,CAAC,KAAK,yCAAyC,iBAAiB,KAAK;oBACjF,yDAAyD,CAC5D,CAAC;gBACF,OAAO,QAAQ,CACb,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EACrB,iBAAiB,EACjB,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,KAAK,CACN,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,OAAO,kCAAkC,CAAC,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,IAAI,CACf,QAAQ,EACR,oBAAoB,EACpB,mCAAmC,iBAAiB,KAAK;oBACvD,oEAAoE,CACvE,CAAC;gBACF,OAAO,QAAQ,CACb,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EACrB,iBAAiB,EACjB,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,KAAK,CACN,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,MAAM,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,OAAO,mDAAmD,CAAC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,4BAA4B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAED,2EAA2E;IAC3E,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,GAAG,IAAI,CACf,MAAM,EACN,gBAAgB,EAChB,iBAAiB,IAAI,CAAC,IAAI,mBAAmB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;gBACF,OAAO,QAAQ,CACb,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EACrB,iBAAiB,EACjB,KAAK,EACL,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,KAAK,CACN,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,IAAI,CAAC,IAAI,WAAW,EAAE,iBAAiB,CAAC,CAAC;YAChF,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,IAAI,CAAC,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,IAAI,CAAC,IAAI,kBAAkB,EAAE,KAAK,CAAC,CAAC;YAC3E,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,WAAW,aAAa,iBAAiB,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACxD,WAAW,GAAG,SAAS,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,iBAAiB,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,OAAO,QAAQ,CACb,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EACrB,iBAAiB,EACjB,KAAK,EACL,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,KAAK,CACN,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,CAAC;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,KAAK,IAAI,CAAC;QAErD,IAAI,aAAa,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CACP,EAAE,CACA,UAAU,EACV,+BAA+B,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG;gBACnE,kBAAkB,QAAQ,CAAC,gBAAgB,EAAE,YAAY,IAAI,GAAG,GAAG,CACtE,CACF,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,SAAS;YACvB,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,YAAY,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,cAAc,iBAAiB,IAAI,OAAO,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CACf,UAAU,EACV,gCAAgC,EAChC,0BAA0B,MAAM,EAAE,CACnC,CAAC;QACF,OAAO,QAAQ,CACb,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,EACf,iBAAiB,EACjB,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,gCAAgC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAQ,CACb,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,EACf,iBAAiB,EACjB,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EACX,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,QAAQ,CACf,KAA6B,EAC7B,QAAgB,EAChB,YAAoB,EACpB,QAAmC,EACnC,OAAsB,EACtB,WAA0B,EAC1B,SAAkB;IAElB,OAAO;QACL,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,WAAW;QACX,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC"}