@code-yeongyu/senpi-ai 2026.7.25-2

package/dist/auth/types.d.ts

@@ -0,0 +1,219 @@
+import type { ProviderEnv, ProviderHeaders } from "../types.ts";
+/**
+ * Request auth for a single model request. If a value cannot be expressed as
+ * `apiKey`, `headers`, or `baseUrl`, it is provider config, not auth.
+ */
+export interface ModelAuth {
+    apiKey?: string;
+    headers?: ProviderHeaders;
+    baseUrl?: string;
+}
+/**
+ * Stored api-key credential. `env` holds provider-scoped environment/config
+ * values such as Cloudflare account/gateway ids.
+ */
+export interface ApiKeyCredential {
+    type: "api_key";
+    key?: string;
+    env?: ProviderEnv;
+}
+/** OAuth token data returned by extension compatibility flows. */
+export interface OAuthCredentials {
+    refresh: string;
+    access: string;
+    expires: number;
+    [key: string]: unknown;
+}
+/** Stored canonical OAuth credential. */
+export interface OAuthCredential extends OAuthCredentials {
+    type: "oauth";
+}
+/** One type-tagged credential per provider — the shape of today's auth.json. */
+export type Credential = ApiKeyCredential | OAuthCredential;
+/** Non-secret credential metadata for account/status enumeration. */
+export interface CredentialInfo {
+    providerId: string;
+    type: Credential["type"];
+}
+/**
+ * App-owned credential storage, keyed by `Provider.id`, one credential per
+ * provider. `modify` is the only write path, so every mutation is a
+ * serialized read-modify-write; `Models.getAuth()` runs OAuth refresh inside
+ * `modify` so concurrent requests cannot double-refresh a rotated token. The
+ * app persists a credential after login via
+ * `modify(provider.id, async () => credential)`. Login/logout orchestration
+ * is app-owned.
+ *
+ * Error semantics: `read` resolves `undefined` for missing entries. Methods
+ * reject only on storage failure; `Models` wraps such rejections in
+ * `ModelsError` with code "auth". Best-effort stores that serve an in-memory
+ * view and record persistence errors internally (like coding-agent's
+ * AuthStorage) are valid implementations.
+ */
+export interface CredentialStore {
+    /**
+     * Read the stored credential, possibly expired. Display/status use;
+     * resolved request auth comes from `Models.getAuth()`.
+     */
+    read(providerId: string): Promise<Credential | undefined>;
+    /**
+     * List stored credential metadata without resolving or exposing secrets.
+     * Implementations must not execute configured API-key commands while listing.
+     */
+    list(): Promise<readonly CredentialInfo[]>;
+    /**
+     * Serialized write — the only write path. `fn` sees the current credential
+     * because correct writes (refresh, login-during-refresh) depend on it;
+     * return the new credential, or undefined to leave the entry unchanged.
+     * Mutual exclusion per provider id, cross-process too where the backing
+     * store supports it (e.g. a file lock). Resolves with the post-write
+     * credential. Rejections from `fn` propagate.
+     */
+    modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
+    /** Remove a credential (logout). Implementations serialize this against `modify`. */
+    delete(providerId: string): Promise<void>;
+}
+/** Environment access for auth resolution. Injectable for tests and browsers. */
+export interface AuthContext {
+    env(name: string): Promise<string | undefined>;
+    /** Check whether a file exists. Supports a leading `~`. Always false in browsers. */
+    fileExists(path: string): Promise<boolean>;
+}
+/** Result of resolving auth for a model. */
+export interface AuthResult {
+    auth: ModelAuth;
+    /** Provider-scoped environment/config values resolved from credentials and ambient context. */
+    env?: ProviderEnv;
+    /** Human-readable label for status UI: "ANTHROPIC_API_KEY", "OAuth", "~/.aws/credentials". */
+    source?: string;
+}
+export interface AuthCheck {
+    source?: string;
+    type: "api_key" | "oauth";
+}
+export type AuthType = "api_key" | "oauth";
+/**
+ * Prompt shown to the user during login. `signal` lets the flow cancel a
+ * pending prompt when an out-of-band event resolves the step, e.g. a
+ * `manual_code` prompt raced against a callback server, aborted when the
+ * callback wins.
+ */
+export type AuthPrompt = {
+    signal?: AbortSignal;
+} & ({
+    type: "text";
+    message: string;
+    placeholder?: string;
+} | {
+    type: "secret";
+    message: string;
+    placeholder?: string;
+} | {
+    type: "select";
+    message: string;
+    options: readonly {
+        id: string;
+        label: string;
+        description?: string;
+    }[];
+} | {
+    type: "manual_code";
+    message: string;
+    placeholder?: string;
+});
+export interface AuthInfoLink {
+    url: string;
+    label?: string;
+}
+export type AuthEvent = {
+    type: "info";
+    message: string;
+    links?: readonly AuthInfoLink[];
+} | {
+    type: "auth_url";
+    url: string;
+    instructions?: string;
+} | {
+    type: "device_code";
+    userCode: string;
+    verificationUri: string;
+    intervalSeconds?: number;
+    expiresInSeconds?: number;
+} | {
+    type: "progress";
+    message: string;
+};
+/**
+ * Login interaction callbacks serving both api-key and OAuth flows.
+ *
+ * `prompt()` returns the entered/selected string (`select` returns the option
+ * id). Rejects on cancel/abort. `signal` aborts the whole login flow;
+ * per-prompt cancellation uses `AuthPrompt.signal`.
+ */
+export interface AuthInteraction {
+    signal?: AbortSignal;
+    prompt(prompt: AuthPrompt): Promise<string>;
+    notify(event: AuthEvent): void;
+}
+/**
+ * Api-key auth: stored key/provider env plus ambient sources (env vars, AWS
+ * profiles, ADC files). Ambient-only providers omit `login`.
+ */
+export interface ApiKeyAuth {
+    /** Display name, e.g. "Anthropic API key". */
+    name: string;
+    /** Interactive setup (prompt for key/provider env). Absent = ambient-only. */
+    login?(interaction: AuthInteraction): Promise<ApiKeyCredential>;
+    /**
+     * Optional side-effect-free availability check. Use this when `resolve()` may
+     * execute commands or perform other request-time work. Missing means Models
+     * checks availability by resolving auth.
+     */
+    check?(input: {
+        ctx: AuthContext;
+        credential?: ApiKeyCredential;
+    }): Promise<AuthCheck | undefined>;
+    /**
+     * Resolve auth from the stored credential and/or ambient sources, merging
+     * per field (`credential.key ?? env("...")`, `credential.env?.NAME ?? env("...")`).
+     * undefined = not configured. Resolution is provider-scoped; model-specific
+     * endpoint preparation happens after auth has been resolved.
+     */
+    resolve(input: {
+        ctx: AuthContext;
+        credential?: ApiKeyCredential;
+    }): Promise<AuthResult | undefined>;
+}
+/**
+ * OAuth auth. The `refresh`/`toAuth` split lets `Models` own the locked
+ * refresh pattern: `refresh` produces a credential, `toAuth` derives request
+ * auth from whatever credential ends up stored.
+ */
+export interface OAuthAuth {
+    /** Display name, e.g. "Anthropic (Claude Pro/Max)". */
+    name: string;
+    /** Selector label for the subscription login option, e.g. "Sign in with SuperGrok or X Premium". */
+    loginLabel?: string;
+    login(interaction: AuthInteraction): Promise<OAuthCredential>;
+    /**
+     * Exchange the refresh token. Network call; throws on failure
+     * (invalid_grant etc.). `Models` runs this under the store lock.
+     */
+    refresh(credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredential>;
+    /**
+     * Side-effect-free derivation of request auth from a valid credential.
+     * Covers per-credential baseUrl (GitHub Copilot). Async so lazy wrappers
+     * can load the implementation on first use.
+     */
+    toAuth(credential: OAuthCredential): Promise<ModelAuth>;
+}
+/**
+ * Provider auth. At least one of `apiKey`/`oauth` must be present: even
+ * ambient-credential providers and keyless local servers provide `apiKey`
+ * auth whose `resolve()` reports whether the provider is configured.
+ */
+export interface ProviderAuth {
+    apiKey?: ApiKeyAuth;
+    oauth?: OAuthAuth;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACxD,IAAI,EAAE,OAAO,CAAC;CACd;AAED,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE5D,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAE1D;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAE3C;;;;;;;OAOG;IACH,MAAM,CACL,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GACtE,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEnC,qFAAqF;IACrF,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,qFAAqF;IACrF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,CACjD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GAC5G;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAChE,CAAC;AAEF,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,SAAS,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IACA,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IAErB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IAEb,8EAA8E;IAC9E,KAAK,CAAC,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEhE;;;;OAIG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,WAAW,CAAC;QAAC,UAAU,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAEnG;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,WAAW,CAAC;QAAC,UAAU,CAAC,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACrG;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IAEb,oGAAoG;IACpG,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,KAAK,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9D;;;OAGG;IACH,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAErF;;;;OAIG;IACH,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB"}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ProviderEnv, ProviderHeaders } from \"../types.ts\";\n\n/**\n * Request auth for a single model request. If a value cannot be expressed as\n * `apiKey`, `headers`, or `baseUrl`, it is provider config, not auth.\n */\nexport interface ModelAuth {\n\tapiKey?: string;\n\theaders?: ProviderHeaders;\n\tbaseUrl?: string;\n}\n\n/**\n * Stored api-key credential. `env` holds provider-scoped environment/config\n * values such as Cloudflare account/gateway ids.\n */\nexport interface ApiKeyCredential {\n\ttype: \"api_key\";\n\tkey?: string;\n\tenv?: ProviderEnv;\n}\n\n/** OAuth token data returned by extension compatibility flows. */\nexport interface OAuthCredentials {\n\trefresh: string;\n\taccess: string;\n\texpires: number;\n\t[key: string]: unknown;\n}\n\n/** Stored canonical OAuth credential. */\nexport interface OAuthCredential extends OAuthCredentials {\n\ttype: \"oauth\";\n}\n\n/** One type-tagged credential per provider — the shape of today's auth.json. */\nexport type Credential = ApiKeyCredential | OAuthCredential;\n\n/** Non-secret credential metadata for account/status enumeration. */\nexport interface CredentialInfo {\n\tproviderId: string;\n\ttype: Credential[\"type\"];\n}\n\n/**\n * App-owned credential storage, keyed by `Provider.id`, one credential per\n * provider. `modify` is the only write path, so every mutation is a\n * serialized read-modify-write; `Models.getAuth()` runs OAuth refresh inside\n * `modify` so concurrent requests cannot double-refresh a rotated token. The\n * app persists a credential after login via\n * `modify(provider.id, async () => credential)`. Login/logout orchestration\n * is app-owned.\n *\n * Error semantics: `read` resolves `undefined` for missing entries. Methods\n * reject only on storage failure; `Models` wraps such rejections in\n * `ModelsError` with code \"auth\". Best-effort stores that serve an in-memory\n * view and record persistence errors internally (like coding-agent's\n * AuthStorage) are valid implementations.\n */\nexport interface CredentialStore {\n\t/**\n\t * Read the stored credential, possibly expired. Display/status use;\n\t * resolved request auth comes from `Models.getAuth()`.\n\t */\n\tread(providerId: string): Promise<Credential | undefined>;\n\n\t/**\n\t * List stored credential metadata without resolving or exposing secrets.\n\t * Implementations must not execute configured API-key commands while listing.\n\t */\n\tlist(): Promise<readonly CredentialInfo[]>;\n\n\t/**\n\t * Serialized write — the only write path. `fn` sees the current credential\n\t * because correct writes (refresh, login-during-refresh) depend on it;\n\t * return the new credential, or undefined to leave the entry unchanged.\n\t * Mutual exclusion per provider id, cross-process too where the backing\n\t * store supports it (e.g. a file lock). Resolves with the post-write\n\t * credential. Rejections from `fn` propagate.\n\t */\n\tmodify(\n\t\tproviderId: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t): Promise<Credential | undefined>;\n\n\t/** Remove a credential (logout). Implementations serialize this against `modify`. */\n\tdelete(providerId: string): Promise<void>;\n}\n\n/** Environment access for auth resolution. Injectable for tests and browsers. */\nexport interface AuthContext {\n\tenv(name: string): Promise<string | undefined>;\n\t/** Check whether a file exists. Supports a leading `~`. Always false in browsers. */\n\tfileExists(path: string): Promise<boolean>;\n}\n\n/** Result of resolving auth for a model. */\nexport interface AuthResult {\n\tauth: ModelAuth;\n\t/** Provider-scoped environment/config values resolved from credentials and ambient context. */\n\tenv?: ProviderEnv;\n\t/** Human-readable label for status UI: \"ANTHROPIC_API_KEY\", \"OAuth\", \"~/.aws/credentials\". */\n\tsource?: string;\n}\n\nexport interface AuthCheck {\n\tsource?: string;\n\ttype: \"api_key\" | \"oauth\";\n}\n\nexport type AuthType = \"api_key\" | \"oauth\";\n\n/**\n * Prompt shown to the user during login. `signal` lets the flow cancel a\n * pending prompt when an out-of-band event resolves the step, e.g. a\n * `manual_code` prompt raced against a callback server, aborted when the\n * callback wins.\n */\nexport type AuthPrompt = { signal?: AbortSignal } & (\n\t| { type: \"text\"; message: string; placeholder?: string }\n\t| { type: \"secret\"; message: string; placeholder?: string }\n\t| { type: \"select\"; message: string; options: readonly { id: string; label: string; description?: string }[] }\n\t| { type: \"manual_code\"; message: string; placeholder?: string }\n);\n\nexport interface AuthInfoLink {\n\turl: string;\n\tlabel?: string;\n}\n\nexport type AuthEvent =\n\t| { type: \"info\"; message: string; links?: readonly AuthInfoLink[] }\n\t| { type: \"auth_url\"; url: string; instructions?: string }\n\t| {\n\t\t\ttype: \"device_code\";\n\t\t\tuserCode: string;\n\t\t\tverificationUri: string;\n\t\t\tintervalSeconds?: number;\n\t\t\texpiresInSeconds?: number;\n\t  }\n\t| { type: \"progress\"; message: string };\n\n/**\n * Login interaction callbacks serving both api-key and OAuth flows.\n *\n * `prompt()` returns the entered/selected string (`select` returns the option\n * id). Rejects on cancel/abort. `signal` aborts the whole login flow;\n * per-prompt cancellation uses `AuthPrompt.signal`.\n */\nexport interface AuthInteraction {\n\tsignal?: AbortSignal;\n\n\tprompt(prompt: AuthPrompt): Promise<string>;\n\tnotify(event: AuthEvent): void;\n}\n\n/**\n * Api-key auth: stored key/provider env plus ambient sources (env vars, AWS\n * profiles, ADC files). Ambient-only providers omit `login`.\n */\nexport interface ApiKeyAuth {\n\t/** Display name, e.g. \"Anthropic API key\". */\n\tname: string;\n\n\t/** Interactive setup (prompt for key/provider env). Absent = ambient-only. */\n\tlogin?(interaction: AuthInteraction): Promise<ApiKeyCredential>;\n\n\t/**\n\t * Optional side-effect-free availability check. Use this when `resolve()` may\n\t * execute commands or perform other request-time work. Missing means Models\n\t * checks availability by resolving auth.\n\t */\n\tcheck?(input: { ctx: AuthContext; credential?: ApiKeyCredential }): Promise<AuthCheck | undefined>;\n\n\t/**\n\t * Resolve auth from the stored credential and/or ambient sources, merging\n\t * per field (`credential.key ?? env(\"...\")`, `credential.env?.NAME ?? env(\"...\")`).\n\t * undefined = not configured. Resolution is provider-scoped; model-specific\n\t * endpoint preparation happens after auth has been resolved.\n\t */\n\tresolve(input: { ctx: AuthContext; credential?: ApiKeyCredential }): Promise<AuthResult | undefined>;\n}\n\n/**\n * OAuth auth. The `refresh`/`toAuth` split lets `Models` own the locked\n * refresh pattern: `refresh` produces a credential, `toAuth` derives request\n * auth from whatever credential ends up stored.\n */\nexport interface OAuthAuth {\n\t/** Display name, e.g. \"Anthropic (Claude Pro/Max)\". */\n\tname: string;\n\n\t/** Selector label for the subscription login option, e.g. \"Sign in with SuperGrok or X Premium\". */\n\tloginLabel?: string;\n\n\tlogin(interaction: AuthInteraction): Promise<OAuthCredential>;\n\n\t/**\n\t * Exchange the refresh token. Network call; throws on failure\n\t * (invalid_grant etc.). `Models` runs this under the store lock.\n\t */\n\trefresh(credential: OAuthCredential, signal?: AbortSignal): Promise<OAuthCredential>;\n\n\t/**\n\t * Side-effect-free derivation of request auth from a valid credential.\n\t * Covers per-credential baseUrl (GitHub Copilot). Async so lazy wrappers\n\t * can load the implementation on first use.\n\t */\n\ttoAuth(credential: OAuthCredential): Promise<ModelAuth>;\n}\n\n/**\n * Provider auth. At least one of `apiKey`/`oauth` must be present: even\n * ambient-credential providers and keyless local servers provide `apiKey`\n * auth whose `resolve()` reports whether the provider is configured.\n */\nexport interface ProviderAuth {\n\tapiKey?: ApiKeyAuth;\n\toauth?: OAuthAuth;\n}\n"]}

package/dist/bedrock-provider.d.ts

@@ -0,0 +1,5 @@
+export declare const bedrockProviderModule: {
+    stream: import("./types.ts").StreamFunction<"bedrock-converse-stream", import("./api/bedrock-converse-stream.ts").BedrockOptions>;
+    streamSimple: import("./types.ts").StreamFunction<"bedrock-converse-stream", import("./types.ts").SimpleStreamOptions>;
+};
+//# sourceMappingURL=bedrock-provider.d.ts.map

package/dist/bedrock-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bedrock-provider.d.ts","sourceRoot":"","sources":["../src/bedrock-provider.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB;;;CAGjC,CAAC"}

package/dist/bedrock-provider.js

@@ -0,0 +1,6 @@
+import { stream, streamSimple } from "./api/bedrock-converse-stream.js";
+export const bedrockProviderModule = {
+    stream,
+    streamSimple,
+};
+//# sourceMappingURL=bedrock-provider.js.map

package/dist/bedrock-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bedrock-provider.js","sourceRoot":"","sources":["../src/bedrock-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,MAAM;IACN,YAAY;CACZ,CAAC","sourcesContent":["import { stream, streamSimple } from \"./api/bedrock-converse-stream.ts\";\n\nexport const bedrockProviderModule = {\n\tstream,\n\tstreamSimple,\n};\n"]}

package/dist/bun-oauth.d.ts

@@ -0,0 +1,3 @@
+/** Register OAuth flows statically embedded in the standalone Bun binary. */
+export declare function registerBunOAuthFlows(): void;
+//# sourceMappingURL=bun-oauth.d.ts.map

package/dist/bun-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-oauth.d.ts","sourceRoot":"","sources":["../src/bun-oauth.ts"],"names":[],"mappings":"AASA,6EAA6E;AAC7E,wBAAgB,qBAAqB,IAAI,IAAI,CAU5C"}

package/dist/bun-oauth.js

@@ -0,0 +1,21 @@
+import { anthropicOAuth } from "./auth/oauth/anthropic.js";
+import { githubCopilotOAuth } from "./auth/oauth/github-copilot.js";
+import { kimiCodingOAuth } from "./auth/oauth/kimi-coding.js";
+import { registerBundledOAuthFlowLoaders } from "./auth/oauth/load.js";
+import { openaiCodexOAuth } from "./auth/oauth/openai-codex.js";
+import { openRouterOAuth } from "./auth/oauth/openrouter.js";
+import { createRadiusOAuth } from "./auth/oauth/radius.js";
+import { xaiOAuth } from "./auth/oauth/xai.js";
+/** Register OAuth flows statically embedded in the standalone Bun binary. */
+export function registerBunOAuthFlows() {
+    registerBundledOAuthFlowLoaders({
+        anthropic: () => anthropicOAuth,
+        openaiCodex: () => openaiCodexOAuth,
+        githubCopilot: () => githubCopilotOAuth,
+        openrouter: () => openRouterOAuth,
+        kimiCoding: () => kimiCodingOAuth,
+        xai: () => xaiOAuth,
+        radius: createRadiusOAuth,
+    });
+}
+//# sourceMappingURL=bun-oauth.js.map

package/dist/bun-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-oauth.js","sourceRoot":"","sources":["../src/bun-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB;IACpC,+BAA+B,CAAC;QAC/B,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc;QAC/B,WAAW,EAAE,GAAG,EAAE,CAAC,gBAAgB;QACnC,aAAa,EAAE,GAAG,EAAE,CAAC,kBAAkB;QACvC,UAAU,EAAE,GAAG,EAAE,CAAC,eAAe;QACjC,UAAU,EAAE,GAAG,EAAE,CAAC,eAAe;QACjC,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ;QACnB,MAAM,EAAE,iBAAiB;KACzB,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { anthropicOAuth } from \"./auth/oauth/anthropic.ts\";\nimport { githubCopilotOAuth } from \"./auth/oauth/github-copilot.ts\";\nimport { kimiCodingOAuth } from \"./auth/oauth/kimi-coding.ts\";\nimport { registerBundledOAuthFlowLoaders } from \"./auth/oauth/load.ts\";\nimport { openaiCodexOAuth } from \"./auth/oauth/openai-codex.ts\";\nimport { openRouterOAuth } from \"./auth/oauth/openrouter.ts\";\nimport { createRadiusOAuth } from \"./auth/oauth/radius.ts\";\nimport { xaiOAuth } from \"./auth/oauth/xai.ts\";\n\n/** Register OAuth flows statically embedded in the standalone Bun binary. */\nexport function registerBunOAuthFlows(): void {\n\tregisterBundledOAuthFlowLoaders({\n\t\tanthropic: () => anthropicOAuth,\n\t\topenaiCodex: () => openaiCodexOAuth,\n\t\tgithubCopilot: () => githubCopilotOAuth,\n\t\topenrouter: () => openRouterOAuth,\n\t\tkimiCoding: () => kimiCodingOAuth,\n\t\txai: () => xaiOAuth,\n\t\tradius: createRadiusOAuth,\n\t});\n}\n"]}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { createInterface } from "node:readline";
+import { builtinProviders } from "./providers/all.js";
+const AUTH_FILE = "auth.json";
+const PROVIDERS = builtinProviders().filter((provider) => provider.auth.oauth !== undefined);
+function prompt(rl, question) {
+    return new Promise((resolve) => rl.question(question, resolve));
+}
+function loadAuth() {
+    if (!existsSync(AUTH_FILE))
+        return {};
+    try {
+        return JSON.parse(readFileSync(AUTH_FILE, "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+function saveAuth(auth) {
+    writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), "utf-8");
+}
+async function answerPrompt(rl, authPrompt) {
+    if (authPrompt.type === "select") {
+        console.log(`\n${authPrompt.message}`);
+        for (let index = 0; index < authPrompt.options.length; index++) {
+            console.log(`  ${index + 1}. ${authPrompt.options[index].label}`);
+        }
+        const choice = Number.parseInt(await prompt(rl, `Enter number (1-${authPrompt.options.length}): `), 10) - 1;
+        const selected = authPrompt.options[choice];
+        if (!selected)
+            throw new Error("Invalid selection");
+        return selected.id;
+    }
+    return prompt(rl, `${authPrompt.message}${authPrompt.placeholder ? ` (${authPrompt.placeholder})` : ""}: `);
+}
+async function login(providerId) {
+    const provider = PROVIDERS.find((entry) => entry.id === providerId);
+    if (!provider)
+        throw new Error(`Unknown provider: ${providerId}`);
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const credential = await provider.auth.oauth.login({
+            prompt: (authPrompt) => answerPrompt(rl, authPrompt),
+            notify: (event) => {
+                switch (event.type) {
+                    case "auth_url":
+                        console.log(`\nOpen this URL in your browser:\n${event.url}`);
+                        if (event.instructions)
+                            console.log(event.instructions);
+                        break;
+                    case "device_code":
+                        console.log(`\nOpen this URL in your browser:\n${event.verificationUri}`);
+                        console.log(`Enter code: ${event.userCode}`);
+                        break;
+                    case "info":
+                    case "progress":
+                        console.log(event.message);
+                        break;
+                }
+            },
+        });
+        const auth = loadAuth();
+        auth[providerId] = credential;
+        saveAuth(auth);
+        console.log(`\nCredentials saved to ${AUTH_FILE}`);
+    }
+    finally {
+        rl.close();
+    }
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const command = args[0];
+    if (!command || command === "help" || command === "--help" || command === "-h") {
+        const providerList = PROVIDERS.map((provider) => `  ${provider.id.padEnd(20)} ${provider.name}`).join("\n");
+        console.log(`Usage: npx @earendil-works/pi-ai <command> [provider]\n\nCommands:\n  login [provider]  Login to an OAuth provider\n  list              List available providers\n\nProviders:\n${providerList}`);
+        return;
+    }
+    if (command === "list") {
+        for (const provider of PROVIDERS)
+            console.log(`${provider.id.padEnd(20)} ${provider.name}`);
+        return;
+    }
+    if (command === "login") {
+        let providerId = args[1];
+        if (!providerId) {
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                for (let index = 0; index < PROVIDERS.length; index++) {
+                    console.log(`  ${index + 1}. ${PROVIDERS[index].name}`);
+                }
+                const index = Number.parseInt(await prompt(rl, `Enter number (1-${PROVIDERS.length}): `), 10) - 1;
+                providerId = PROVIDERS[index]?.id;
+            }
+            finally {
+                rl.close();
+            }
+        }
+        if (!providerId || !PROVIDERS.some((provider) => provider.id === providerId)) {
+            throw new Error(`Unknown provider: ${providerId ?? ""}`);
+        }
+        await login(providerId);
+        return;
+    }
+    throw new Error(`Unknown command: ${command}`);
+}
+main().catch((error) => {
+    console.error("Error:", error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,SAAS,GAAG,WAAW,CAAC;AAC9B,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC,MAAM,CAC1C,CAAC,QAAQ,EAAsF,EAAE,CAChG,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAClC,CAAC;AAEF,SAAS,MAAM,CAAC,EAAsC,EAAE,QAAgB;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,QAAQ;IAChB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAoC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAqC;IACtD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAsC,EAAE,UAAsB;IACzF,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,mBAAmB,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5G,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC,EAAE,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,UAAkB;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YAClD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC;YACpD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACpB,KAAK,UAAU;wBACd,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;wBAC9D,IAAI,KAAK,CAAC,YAAY;4BAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;wBACxD,MAAM;oBACP,KAAK,aAAa;wBACjB,OAAO,CAAC,GAAG,CAAC,qCAAqC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;wBAC1E,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;wBAC7C,MAAM;oBACP,KAAK,MAAM,CAAC;oBACZ,KAAK,UAAU;wBACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBAC3B,MAAM;gBACR,CAAC;YACF,CAAC;SACD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,IAAI;IAClB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChF,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5G,OAAO,CAAC,GAAG,CACV,mLAAmL,YAAY,EAAE,CACjM,CAAC;QACF,OAAO;IACR,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxB,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,OAAO;IACR,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC;gBACJ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;oBACvD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,mBAAmB,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;gBAClG,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACnC,CAAC;oBAAS,CAAC;gBACV,EAAE,CAAC,KAAK,EAAE,CAAC;YACZ,CAAC;QACF,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC/B,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\n\nimport { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { createInterface } from \"node:readline\";\nimport type { AuthPrompt, OAuthCredential, Provider } from \"./index.ts\";\nimport { builtinProviders } from \"./providers/all.ts\";\n\nconst AUTH_FILE = \"auth.json\";\nconst PROVIDERS = builtinProviders().filter(\n\t(provider): provider is Provider & { auth: { oauth: NonNullable<Provider[\"auth\"][\"oauth\"]> } } =>\n\t\tprovider.auth.oauth !== undefined,\n);\n\nfunction prompt(rl: ReturnType<typeof createInterface>, question: string): Promise<string> {\n\treturn new Promise((resolve) => rl.question(question, resolve));\n}\n\nfunction loadAuth(): Record<string, OAuthCredential> {\n\tif (!existsSync(AUTH_FILE)) return {};\n\ttry {\n\t\treturn JSON.parse(readFileSync(AUTH_FILE, \"utf-8\")) as Record<string, OAuthCredential>;\n\t} catch {\n\t\treturn {};\n\t}\n}\n\nfunction saveAuth(auth: Record<string, OAuthCredential>): void {\n\twriteFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), \"utf-8\");\n}\n\nasync function answerPrompt(rl: ReturnType<typeof createInterface>, authPrompt: AuthPrompt): Promise<string> {\n\tif (authPrompt.type === \"select\") {\n\t\tconsole.log(`\\n${authPrompt.message}`);\n\t\tfor (let index = 0; index < authPrompt.options.length; index++) {\n\t\t\tconsole.log(`  ${index + 1}. ${authPrompt.options[index].label}`);\n\t\t}\n\t\tconst choice = Number.parseInt(await prompt(rl, `Enter number (1-${authPrompt.options.length}): `), 10) - 1;\n\t\tconst selected = authPrompt.options[choice];\n\t\tif (!selected) throw new Error(\"Invalid selection\");\n\t\treturn selected.id;\n\t}\n\treturn prompt(rl, `${authPrompt.message}${authPrompt.placeholder ? ` (${authPrompt.placeholder})` : \"\"}: `);\n}\n\nasync function login(providerId: string): Promise<void> {\n\tconst provider = PROVIDERS.find((entry) => entry.id === providerId);\n\tif (!provider) throw new Error(`Unknown provider: ${providerId}`);\n\tconst rl = createInterface({ input: process.stdin, output: process.stdout });\n\ttry {\n\t\tconst credential = await provider.auth.oauth.login({\n\t\t\tprompt: (authPrompt) => answerPrompt(rl, authPrompt),\n\t\t\tnotify: (event) => {\n\t\t\t\tswitch (event.type) {\n\t\t\t\t\tcase \"auth_url\":\n\t\t\t\t\t\tconsole.log(`\\nOpen this URL in your browser:\\n${event.url}`);\n\t\t\t\t\t\tif (event.instructions) console.log(event.instructions);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase \"device_code\":\n\t\t\t\t\t\tconsole.log(`\\nOpen this URL in your browser:\\n${event.verificationUri}`);\n\t\t\t\t\t\tconsole.log(`Enter code: ${event.userCode}`);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\tcase \"info\":\n\t\t\t\t\tcase \"progress\":\n\t\t\t\t\t\tconsole.log(event.message);\n\t\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t},\n\t\t});\n\t\tconst auth = loadAuth();\n\t\tauth[providerId] = credential;\n\t\tsaveAuth(auth);\n\t\tconsole.log(`\\nCredentials saved to ${AUTH_FILE}`);\n\t} finally {\n\t\trl.close();\n\t}\n}\n\nasync function main(): Promise<void> {\n\tconst args = process.argv.slice(2);\n\tconst command = args[0];\n\tif (!command || command === \"help\" || command === \"--help\" || command === \"-h\") {\n\t\tconst providerList = PROVIDERS.map((provider) => `  ${provider.id.padEnd(20)} ${provider.name}`).join(\"\\n\");\n\t\tconsole.log(\n\t\t\t`Usage: npx @earendil-works/pi-ai <command> [provider]\\n\\nCommands:\\n  login [provider]  Login to an OAuth provider\\n  list              List available providers\\n\\nProviders:\\n${providerList}`,\n\t\t);\n\t\treturn;\n\t}\n\tif (command === \"list\") {\n\t\tfor (const provider of PROVIDERS) console.log(`${provider.id.padEnd(20)} ${provider.name}`);\n\t\treturn;\n\t}\n\tif (command === \"login\") {\n\t\tlet providerId = args[1];\n\t\tif (!providerId) {\n\t\t\tconst rl = createInterface({ input: process.stdin, output: process.stdout });\n\t\t\ttry {\n\t\t\t\tfor (let index = 0; index < PROVIDERS.length; index++) {\n\t\t\t\t\tconsole.log(`  ${index + 1}. ${PROVIDERS[index].name}`);\n\t\t\t\t}\n\t\t\t\tconst index = Number.parseInt(await prompt(rl, `Enter number (1-${PROVIDERS.length}): `), 10) - 1;\n\t\t\t\tproviderId = PROVIDERS[index]?.id;\n\t\t\t} finally {\n\t\t\t\trl.close();\n\t\t\t}\n\t\t}\n\t\tif (!providerId || !PROVIDERS.some((provider) => provider.id === providerId)) {\n\t\t\tthrow new Error(`Unknown provider: ${providerId ?? \"\"}`);\n\t\t}\n\t\tawait login(providerId);\n\t\treturn;\n\t}\n\tthrow new Error(`Unknown command: ${command}`);\n}\n\nmain().catch((error: unknown) => {\n\tconsole.error(\"Error:\", error instanceof Error ? error.message : String(error));\n\tprocess.exit(1);\n});\n"]}

package/dist/compat/extension-oauth-types.d.ts

@@ -0,0 +1,42 @@
+import type { OAuthCredentials } from "../auth/types.ts";
+/** Legacy provider identifier accepted by extension OAuth APIs. */
+export type OAuthProviderId = string;
+/** Legacy extension OAuth prompt. */
+export interface OAuthPrompt {
+    message: string;
+    placeholder?: string;
+    allowEmpty?: boolean;
+}
+/** Legacy extension OAuth authorization link. */
+export interface OAuthAuthInfo {
+    url: string;
+    instructions?: string;
+}
+/** Legacy extension OAuth device-code notification. */
+export interface OAuthDeviceCodeInfo {
+    userCode: string;
+    verificationUri: string;
+    intervalSeconds?: number;
+    expiresInSeconds?: number;
+}
+export interface OAuthSelectOption {
+    id: string;
+    label: string;
+    description?: string;
+}
+export interface OAuthSelectPrompt {
+    message: string;
+    options: readonly OAuthSelectOption[];
+}
+/** Callback surface retained only for coding-agent extension compatibility. */
+export interface OAuthLoginCallbacks {
+    onAuth(info: OAuthAuthInfo): void;
+    onDeviceCode(info: OAuthDeviceCodeInfo): void;
+    onPrompt(prompt: OAuthPrompt): Promise<string>;
+    onProgress?(message: string): void;
+    onManualCodeInput?(): Promise<string>;
+    onSelect(prompt: OAuthSelectPrompt): Promise<string | undefined>;
+    signal?: AbortSignal;
+}
+export type { OAuthCredentials };
+//# sourceMappingURL=extension-oauth-types.d.ts.map

package/dist/compat/extension-oauth-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-oauth-types.d.ts","sourceRoot":"","sources":["../../src/compat/extension-oauth-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACtC;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAAC;IAClC,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,UAAU,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,YAAY,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/compat/extension-oauth-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=extension-oauth-types.js.map

package/dist/compat/extension-oauth-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-oauth-types.js","sourceRoot":"","sources":["../../src/compat/extension-oauth-types.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthCredentials } from \"../auth/types.ts\";\n\n/** Legacy provider identifier accepted by extension OAuth APIs. */\nexport type OAuthProviderId = string;\n\n/** Legacy extension OAuth prompt. */\nexport interface OAuthPrompt {\n\tmessage: string;\n\tplaceholder?: string;\n\tallowEmpty?: boolean;\n}\n\n/** Legacy extension OAuth authorization link. */\nexport interface OAuthAuthInfo {\n\turl: string;\n\tinstructions?: string;\n}\n\n/** Legacy extension OAuth device-code notification. */\nexport interface OAuthDeviceCodeInfo {\n\tuserCode: string;\n\tverificationUri: string;\n\tintervalSeconds?: number;\n\texpiresInSeconds?: number;\n}\n\nexport interface OAuthSelectOption {\n\tid: string;\n\tlabel: string;\n\tdescription?: string;\n}\n\nexport interface OAuthSelectPrompt {\n\tmessage: string;\n\toptions: readonly OAuthSelectOption[];\n}\n\n/** Callback surface retained only for coding-agent extension compatibility. */\nexport interface OAuthLoginCallbacks {\n\tonAuth(info: OAuthAuthInfo): void;\n\tonDeviceCode(info: OAuthDeviceCodeInfo): void;\n\tonPrompt(prompt: OAuthPrompt): Promise<string>;\n\tonProgress?(message: string): void;\n\tonManualCodeInput?(): Promise<string>;\n\tonSelect(prompt: OAuthSelectPrompt): Promise<string | undefined>;\n\tsignal?: AbortSignal;\n}\n\nexport type { OAuthCredentials };\n"]}

package/dist/compat.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Temporary compatibility entrypoint preserving the old global pi-ai API
+ * surface: api-dispatch `stream()`/`complete()` with env API key injection,
+ * the api-registry, generated catalog reads (`getModel`/`getModels`/
+ * `getProviders`), per-API lazy stream wrappers, and image generation.
+ *
+ * Existing apps switch imports from "@earendil-works/pi-ai" to
+ * "@earendil-works/pi-ai/compat" unchanged; new code uses `createModels()`
+ * and the provider factories. This module is deleted with the coding-agent
+ * ModelManager migration.
+ */
+export * from "./api/anthropic-messages.lazy.ts";
+export * from "./api/azure-openai-responses.lazy.ts";
+export * from "./api/bedrock-converse-stream.lazy.ts";
+export * from "./api/google-generative-ai.lazy.ts";
+export * from "./api/google-vertex.lazy.ts";
+export * from "./api/mistral-conversations.lazy.ts";
+export * from "./api/openai-codex-responses.lazy.ts";
+export * from "./api/openai-completions.lazy.ts";
+export * from "./api/openai-responses.lazy.ts";
+export * from "./api/pi-messages.lazy.ts";
+export * from "./env-api-keys.ts";
+export * from "./image-models.ts";
+export * from "./images.ts";
+export * from "./images-api-registry.ts";
+export * from "./index.ts";
+export * from "./legacy-api-aliases.ts";
+export * from "./providers/images/register-builtins.ts";
+export { getProtocol, getToolCallFormat, transformContext, wrapStreamWithToolCallMiddleware, } from "./tool-call-middleware/index.ts";
+import { getBuiltinModel, getBuiltinModels, getBuiltinProviders } from "./providers/all.ts";
+export type { BuiltinProvider } from "./providers/all.ts";
+import { type FauxProviderRegistration, type RegisterFauxProviderOptions } from "./providers/faux.ts";
+import type { Api, AssistantMessage, AssistantMessageEventStream, Context, Model, ProviderStreamOptions, SimpleStreamOptions } from "./types.ts";
+/** @deprecated Static catalog read. Use `getBuiltinModel` from "@earendil-works/pi-ai/providers/all" or `Models.getModel()`. */
+export declare const getModel: typeof getBuiltinModel;
+/** @deprecated Static catalog read. Use `getBuiltinModels` from "@earendil-works/pi-ai/providers/all" or `Models.getModels()`. */
+export declare const getModels: typeof getBuiltinModels;
+/** @deprecated Static catalog read. Use `getBuiltinProviders` from "@earendil-works/pi-ai/providers/all" or `Models.getProviders()`. */
+export declare const getProviders: typeof getBuiltinProviders;
+export { type ApiProvider, type ApiProviderInternal, type ApiStreamFunction, type ApiStreamSimpleFunction, getApiProvider, getApiProviders, registerApiProvider, unregisterApiProviders, } from "./api-registry.ts";
+export declare function registerFauxProvider(options?: RegisterFauxProviderOptions): FauxProviderRegistration;
+/**
+ * Registers the builtin API implementations into the api-registry without
+ * clobbering existing entries: compat may load after a test or extension has
+ * already registered an override for a builtin api id.
+ */
+export declare function registerBuiltInApiProviders(): void;
+export declare function resetApiProviders(): void;
+export declare function stream<TApi extends Api>(model: Model<TApi>, context: Context, options?: ProviderStreamOptions): AssistantMessageEventStream;
+export declare function complete<TApi extends Api>(model: Model<TApi>, context: Context, options?: ProviderStreamOptions): Promise<AssistantMessage>;
+export declare function streamSimple<TApi extends Api>(model: Model<TApi>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream;
+export declare function completeSimple<TApi extends Api>(model: Model<TApi>, context: Context, options?: SimpleStreamOptions): Promise<AssistantMessage>;
+//# sourceMappingURL=compat.d.ts.map

package/dist/compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat.d.ts","sourceRoot":"","sources":["../src/compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,cAAc,kCAAkC,CAAC;AACjD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,0BAA0B,CAAC;AACzC,cAAc,YAAY,CAAC;AAC3B,cAAc,yBAAyB,CAAC;AACxC,cAAc,yCAAyC,CAAC;AACxD,OAAO,EACN,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,gCAAgC,GAChC,MAAM,iCAAiC,CAAC;AAczC,OAAO,EAAiB,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE3G,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAkB,KAAK,wBAAwB,EAAE,KAAK,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAOtH,OAAO,KAAK,EACX,GAAG,EAEH,gBAAgB,EAChB,2BAA2B,EAC3B,OAAO,EACP,KAAK,EACL,qBAAqB,EAErB,mBAAmB,EAEnB,MAAM,YAAY,CAAC;AAEpB,gIAAgI;AAChI,eAAO,MAAM,QAAQ,wBAAkB,CAAC;AAExC,kIAAkI;AAClI,eAAO,MAAM,SAAS,yBAAmB,CAAC;AAE1C,wIAAwI;AACxI,eAAO,MAAM,YAAY,4BAAsB,CAAC;AAEhD,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAU3B,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,wBAAwB,CAiBxG;AAiBD;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,IAAI,CAQlD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAIxC;AAuCD,wBAAgB,MAAM,CAAC,IAAI,SAAS,GAAG,EACtC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,2BAA2B,CAkB7B;AAED,wBAAsB,QAAQ,CAAC,IAAI,SAAS,GAAG,EAC9C,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED,wBAAgB,YAAY,CAAC,IAAI,SAAS,GAAG,EAC5C,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC3B,2BAA2B,CAkB7B;AAED,wBAAsB,cAAc,CAAC,IAAI,SAAS,GAAG,EACpD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAG3B"}