@code-yeongyu/senpi-ai 2026.9.21 → 2026.9.22-3

package/dist/auth/oauth/kimi-region.js

@@ -0,0 +1,120 @@
+import { getProviderEnvValue } from "../../utils/provider-env.js";
+export const KIMI_CODE_REGION_ENV = "KIMI_CODE_REGION";
+export const KIMI_CODE_OAUTH_HOST_ENV = "KIMI_CODE_OAUTH_HOST";
+export const KIMI_OAUTH_HOST_ENV = "KIMI_OAUTH_HOST";
+export const DEFAULT_KIMI_CODE_REGION = "mainland-cn";
+export const KIMI_CODE_REGION_PROFILES = {
+    "mainland-cn": {
+        id: "mainland-cn",
+        label: "Mainland China (kimi.com)",
+        description: "Accounts created on kimi.com",
+        oauthHost: "https://auth.kimi.com",
+        apiBaseUrl: "https://api.kimi.com/coding",
+    },
+    global: {
+        id: "global",
+        label: "Outside mainland China (kimi.ai)",
+        description: "Accounts created on kimi.ai",
+        oauthHost: "https://auth.kimi.ai",
+        apiBaseUrl: "https://api.kimi.ai/coding",
+    },
+};
+export function isKimiCodeRegion(value) {
+    return value === "mainland-cn" || value === "global";
+}
+function normalizeHost(host) {
+    return host.trim().replace(/\/+$/, "");
+}
+export function kimiCodeRegionForOauthHost(host) {
+    const normalized = normalizeHost(host);
+    for (const profile of Object.values(KIMI_CODE_REGION_PROFILES)) {
+        if (profile.oauthHost === normalized)
+            return profile.id;
+    }
+    return undefined;
+}
+function endpointsForRegion(region) {
+    const profile = KIMI_CODE_REGION_PROFILES[region];
+    return {
+        region,
+        oauthHost: profile.oauthHost,
+        apiBaseUrl: region === DEFAULT_KIMI_CODE_REGION ? undefined : profile.apiBaseUrl,
+        env: { [KIMI_CODE_REGION_ENV]: region },
+    };
+}
+function endpointsForHost(host) {
+    const region = kimiCodeRegionForOauthHost(host);
+    if (region !== undefined)
+        return endpointsForRegion(region);
+    return {
+        region: undefined,
+        oauthHost: normalizeHost(host),
+        apiBaseUrl: undefined,
+        env: { [KIMI_CODE_OAUTH_HOST_ENV]: normalizeHost(host) },
+    };
+}
+/**
+ * A credential's stored host or region owns its refresh and inference routing;
+ * the process env only decides for credentials that predate regions and for
+ * new logins.
+ */
+export function resolveKimiCodeEndpoints(input) {
+    if (typeof input.storedOauthHost === "string" && input.storedOauthHost.trim()) {
+        return endpointsForHost(input.storedOauthHost);
+    }
+    if (isKimiCodeRegion(input.storedRegion))
+        return endpointsForRegion(input.storedRegion);
+    if (input.envOauthHost?.trim())
+        return endpointsForHost(input.envOauthHost);
+    if (isKimiCodeRegion(input.envRegion))
+        return endpointsForRegion(input.envRegion);
+    return { ...endpointsForRegion(DEFAULT_KIMI_CODE_REGION), env: undefined };
+}
+export function kimiCodeCredentialEnv(credential) {
+    const value = credential.env;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const env = {};
+    for (const [name, entry] of Object.entries(value)) {
+        if (typeof entry === "string")
+            env[name] = entry;
+    }
+    return env;
+}
+export function kimiCodeEndpointsForCredential(credential) {
+    const env = kimiCodeCredentialEnv(credential);
+    return resolveKimiCodeEndpoints({
+        storedRegion: env?.[KIMI_CODE_REGION_ENV],
+        storedOauthHost: env?.[KIMI_CODE_OAUTH_HOST_ENV],
+        envOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),
+        envRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),
+    });
+}
+export function kimiCodeRegionPrompt() {
+    return {
+        type: "select",
+        message: "Which Kimi service hosts your account?",
+        options: Object.values(KIMI_CODE_REGION_PROFILES).map((profile) => ({
+            id: profile.id,
+            label: profile.label,
+            description: profile.description,
+        })),
+    };
+}
+/** An explicit host or region in the env skips the prompt so headless logins keep working. */
+export async function chooseKimiCodeLoginEndpoints(interaction) {
+    const fromEnv = resolveKimiCodeEndpoints({
+        envOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),
+        envRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),
+    });
+    if (fromEnv.env !== undefined)
+        return fromEnv;
+    interaction.signal.throwIfAborted();
+    const answer = await interaction.prompt(kimiCodeRegionPrompt());
+    interaction.signal.throwIfAborted();
+    if (!isKimiCodeRegion(answer)) {
+        throw new Error(`Unknown Kimi Code region: ${answer}`);
+    }
+    return endpointsForRegion(answer);
+}
+//# sourceMappingURL=kimi-region.js.map

package/dist/auth/oauth/kimi-region.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-region.js","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-region.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMlE,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAmB,aAAa,CAAC;AAUtE,MAAM,CAAC,MAAM,yBAAyB,GAA4D;IACjG,aAAa,EAAE;QACd,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,8BAA8B;QAC3C,SAAS,EAAE,uBAAuB;QAClC,UAAU,EAAE,6BAA6B;KACzC;IACD,MAAM,EAAE;QACP,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,kCAAkC;QACzC,WAAW,EAAE,6BAA6B;QAC1C,SAAS,EAAE,sBAAsB;QACjC,UAAU,EAAE,4BAA4B;KACxC;CACD,CAAC;AAkBF,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,QAAQ,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAsB;IACjD,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO;QACN,MAAM;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,MAAM,KAAK,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;QAChF,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE;KACvC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO;QACN,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC;QAC9B,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE;KACxD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA4B;IACpE,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/E,OAAO,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClF,OAAO,EAAE,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAA6C;IAClF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAA6C;IAC3F,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,wBAAwB,CAAC;QAC/B,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC;QACzC,eAAe,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC;QAChD,YAAY,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,CAAC;QACvG,SAAS,EAAE,mBAAmB,CAAC,oBAAoB,CAAC;KACpD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACnE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;SAChC,CAAC,CAAC;KACH,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,WAAoC;IACtF,MAAM,OAAO,GAAG,wBAAwB,CAAC;QACxC,YAAY,EAAE,mBAAmB,CAAC,wBAAwB,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,CAAC;QACvG,SAAS,EAAE,mBAAmB,CAAC,oBAAoB,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC9C,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAChE,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { ProviderEnv } from \"../../types.ts\";\nimport { getProviderEnvValue } from \"../../utils/provider-env.ts\";\nimport type { AuthPrompt, ProviderAuthInteraction } from \"../types.ts\";\n\n/** Region ids match the official Kimi Code CLI's `kimi login --region` values. */\nexport type KimiCodeRegion = \"mainland-cn\" | \"global\";\n\nexport const KIMI_CODE_REGION_ENV = \"KIMI_CODE_REGION\";\nexport const KIMI_CODE_OAUTH_HOST_ENV = \"KIMI_CODE_OAUTH_HOST\";\nexport const KIMI_OAUTH_HOST_ENV = \"KIMI_OAUTH_HOST\";\nexport const DEFAULT_KIMI_CODE_REGION: KimiCodeRegion = \"mainland-cn\";\n\nexport interface KimiCodeRegionProfile {\n\treadonly id: KimiCodeRegion;\n\treadonly label: string;\n\treadonly description: string;\n\treadonly oauthHost: string;\n\treadonly apiBaseUrl: string;\n}\n\nexport const KIMI_CODE_REGION_PROFILES: Readonly<Record<KimiCodeRegion, KimiCodeRegionProfile>> = {\n\t\"mainland-cn\": {\n\t\tid: \"mainland-cn\",\n\t\tlabel: \"Mainland China (kimi.com)\",\n\t\tdescription: \"Accounts created on kimi.com\",\n\t\toauthHost: \"https://auth.kimi.com\",\n\t\tapiBaseUrl: \"https://api.kimi.com/coding\",\n\t},\n\tglobal: {\n\t\tid: \"global\",\n\t\tlabel: \"Outside mainland China (kimi.ai)\",\n\t\tdescription: \"Accounts created on kimi.ai\",\n\t\toauthHost: \"https://auth.kimi.ai\",\n\t\tapiBaseUrl: \"https://api.kimi.ai/coding\",\n\t},\n};\n\nexport interface KimiCodeEndpoints {\n\treadonly region: KimiCodeRegion | undefined;\n\treadonly oauthHost: string;\n\t/** Set only when the region moves inference off the provider's catalog base. */\n\treadonly apiBaseUrl: string | undefined;\n\t/** Credential metadata that makes refresh and inference follow this choice. */\n\treadonly env: ProviderEnv | undefined;\n}\n\nexport interface KimiCodeEndpointInput {\n\treadonly storedRegion?: unknown;\n\treadonly storedOauthHost?: unknown;\n\treadonly envOauthHost?: string | undefined;\n\treadonly envRegion?: string | undefined;\n}\n\nexport function isKimiCodeRegion(value: unknown): value is KimiCodeRegion {\n\treturn value === \"mainland-cn\" || value === \"global\";\n}\n\nfunction normalizeHost(host: string): string {\n\treturn host.trim().replace(/\\/+$/, \"\");\n}\n\nexport function kimiCodeRegionForOauthHost(host: string): KimiCodeRegion | undefined {\n\tconst normalized = normalizeHost(host);\n\tfor (const profile of Object.values(KIMI_CODE_REGION_PROFILES)) {\n\t\tif (profile.oauthHost === normalized) return profile.id;\n\t}\n\treturn undefined;\n}\n\nfunction endpointsForRegion(region: KimiCodeRegion): KimiCodeEndpoints {\n\tconst profile = KIMI_CODE_REGION_PROFILES[region];\n\treturn {\n\t\tregion,\n\t\toauthHost: profile.oauthHost,\n\t\tapiBaseUrl: region === DEFAULT_KIMI_CODE_REGION ? undefined : profile.apiBaseUrl,\n\t\tenv: { [KIMI_CODE_REGION_ENV]: region },\n\t};\n}\n\nfunction endpointsForHost(host: string): KimiCodeEndpoints {\n\tconst region = kimiCodeRegionForOauthHost(host);\n\tif (region !== undefined) return endpointsForRegion(region);\n\treturn {\n\t\tregion: undefined,\n\t\toauthHost: normalizeHost(host),\n\t\tapiBaseUrl: undefined,\n\t\tenv: { [KIMI_CODE_OAUTH_HOST_ENV]: normalizeHost(host) },\n\t};\n}\n\n/**\n * A credential's stored host or region owns its refresh and inference routing;\n * the process env only decides for credentials that predate regions and for\n * new logins.\n */\nexport function resolveKimiCodeEndpoints(input: KimiCodeEndpointInput): KimiCodeEndpoints {\n\tif (typeof input.storedOauthHost === \"string\" && input.storedOauthHost.trim()) {\n\t\treturn endpointsForHost(input.storedOauthHost);\n\t}\n\tif (isKimiCodeRegion(input.storedRegion)) return endpointsForRegion(input.storedRegion);\n\tif (input.envOauthHost?.trim()) return endpointsForHost(input.envOauthHost);\n\tif (isKimiCodeRegion(input.envRegion)) return endpointsForRegion(input.envRegion);\n\treturn { ...endpointsForRegion(DEFAULT_KIMI_CODE_REGION), env: undefined };\n}\n\nexport function kimiCodeCredentialEnv(credential: Readonly<Record<string, unknown>>): ProviderEnv | undefined {\n\tconst value = credential.env;\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n\tconst env: ProviderEnv = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (typeof entry === \"string\") env[name] = entry;\n\t}\n\treturn env;\n}\n\nexport function kimiCodeEndpointsForCredential(credential: Readonly<Record<string, unknown>>): KimiCodeEndpoints {\n\tconst env = kimiCodeCredentialEnv(credential);\n\treturn resolveKimiCodeEndpoints({\n\t\tstoredRegion: env?.[KIMI_CODE_REGION_ENV],\n\t\tstoredOauthHost: env?.[KIMI_CODE_OAUTH_HOST_ENV],\n\t\tenvOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),\n\t\tenvRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),\n\t});\n}\n\nexport function kimiCodeRegionPrompt(): AuthPrompt {\n\treturn {\n\t\ttype: \"select\",\n\t\tmessage: \"Which Kimi service hosts your account?\",\n\t\toptions: Object.values(KIMI_CODE_REGION_PROFILES).map((profile) => ({\n\t\t\tid: profile.id,\n\t\t\tlabel: profile.label,\n\t\t\tdescription: profile.description,\n\t\t})),\n\t};\n}\n\n/** An explicit host or region in the env skips the prompt so headless logins keep working. */\nexport async function chooseKimiCodeLoginEndpoints(interaction: ProviderAuthInteraction): Promise<KimiCodeEndpoints> {\n\tconst fromEnv = resolveKimiCodeEndpoints({\n\t\tenvOauthHost: getProviderEnvValue(KIMI_CODE_OAUTH_HOST_ENV) || getProviderEnvValue(KIMI_OAUTH_HOST_ENV),\n\t\tenvRegion: getProviderEnvValue(KIMI_CODE_REGION_ENV),\n\t});\n\tif (fromEnv.env !== undefined) return fromEnv;\n\tinteraction.signal.throwIfAborted();\n\tconst answer = await interaction.prompt(kimiCodeRegionPrompt());\n\tinteraction.signal.throwIfAborted();\n\tif (!isKimiCodeRegion(answer)) {\n\t\tthrow new Error(`Unknown Kimi Code region: ${answer}`);\n\t}\n\treturn endpointsForRegion(answer);\n}\n"]}

package/dist/auth/oauth/load.d.ts

@@ -1,7 +1,7 @@
 import type { OAuthAuth } from "../types.ts";
 type OAuthFlowLoaders = {
     anthropic: () => OAuthAuth | Promise<OAuthAuth>;
-    openaiCodex: () => OAuthAuth | Promise<OAuthAuth>;
+    chatgptSubscription: () => OAuthAuth | Promise<OAuthAuth>;
     githubCopilot: () => OAuthAuth | Promise<OAuthAuth>;
     openrouter: () => OAuthAuth | Promise<OAuthAuth>;
     kimiCoding: () => OAuthAuth | Promise<OAuthAuth>;
@@ -16,7 +16,7 @@ type OAuthFlowLoaders = {
 /** Registers statically bundled OAuth flows for standalone Bun binaries. */
 export declare function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void;
 export declare const loadAnthropicOAuth: () => Promise<OAuthAuth>;
-export declare const loadOpenAICodexOAuth: () => Promise<OAuthAuth>;
+export declare const loadChatGptSubscriptionOAuth: () => Promise<OAuthAuth>;
 export declare const loadGitHubCopilotOAuth: () => Promise<OAuthAuth>;
 export declare const loadOpenRouterOAuth: () => Promise<OAuthAuth>;
 export declare const loadKimiCodingOAuth: () => Promise<OAuthAuth>;

package/dist/auth/oauth/load.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAa7C,KAAK,gBAAgB,GAAG;IACvB,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,WAAW,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,aAAa,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,GAAG,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,KAAK,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACvF,CAAC;AAIF,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,SAAS,CAG5D,CAAC;AAEF,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,SAAS,CAG9D,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,SAAS,CAGhE,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,SAAS,CAGtD,CAAC;AAEF,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,SAAS,CAGzD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAa,OAAO,CAAC,SAAS,CAGxD,CAAC;AAEF,eAAO,MAAM,eAAe,YAAmB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,SAAS,CAOnG,CAAC"}
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAa7C,KAAK,gBAAgB,GAAG;IACvB,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,mBAAmB,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,aAAa,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,GAAG,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,KAAK,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACvF,CAAC;AAIF,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,SAAS,CAG5D,CAAC;AAEF,eAAO,MAAM,4BAA4B,QAAa,OAAO,CAAC,SAAS,CAItE,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,SAAS,CAGhE,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,SAAS,CAGtD,CAAC;AAEF,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,SAAS,CAGzD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAa,OAAO,CAAC,SAAS,CAGxD,CAAC;AAEF,eAAO,MAAM,eAAe,YAAmB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,SAAS,CAOnG,CAAC"}

package/dist/auth/oauth/load.js

@@ -26,10 +26,11 @@ export const loadAnthropicOAuth = async () => {
         return bundledLoaders.anthropic();
     return (await importOAuthModule("./anthropic.ts")).anthropicOAuth;
 };
-export const loadOpenAICodexOAuth = async () => {
+export const loadChatGptSubscriptionOAuth = async () => {
     if (bundledLoaders)
-        return bundledLoaders.openaiCodex();
-    return (await importOAuthModule("./openai-codex.ts")).openaiCodexOAuth;
+        return bundledLoaders.chatgptSubscription();
+    return (await importOAuthModule("./chatgpt-subscription.ts"))
+        .chatgptSubscriptionOAuth;
 };
 export const loadGitHubCopilotOAuth = async () => {
     if (bundledLoaders)

package/dist/auth/oauth/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAoB,EAAE;IACjE,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,MAAM,kCAAC,gBAAgB,EAAC,CAAC;AACjC,CAAC,CAAC;AAcF,IAAI,cAA4C,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAAC,OAAyB;IACxE,cAAc,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAwB,EAAE;IAChE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,SAAS,EAAE,CAAC;IACtD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAmC,CAAC,cAAc,CAAC;AACtG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAAwB,EAAE;IAClE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,WAAW,EAAE,CAAC;IACxD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAqC,CAAC,gBAAgB,CAAC;AAC7G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAwB,EAAE;IACpE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAQ,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAuC,CAAC,kBAAkB,CAAC;AACnH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAoC,CAAC,eAAe,CAAC;AACzG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAoC,CAAC,eAAe,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAwB,EAAE;IAC1D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC;IAChD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAA6B,CAAC,QAAQ,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAAwB,EAAE;IAC7D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,CAAC;IACnD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAgC,CAAC,WAAW,CAAC;AAC7F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAAwB,EAAE;IAC5D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,CAAC;IAClD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAA+B,CAAC,UAAU,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAA0C,EAAsB,EAAE;IACvG,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,OACC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAGvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC","sourcesContent":["import type { OAuthAuth } from \"../types.ts\";\n\n/**\n * Loads an OAuth flow module through a variable specifier so bundlers cannot\n * follow the import into Node-only flow code (`node:http` callback servers,\n * `node:crypto` PKCE). The `.ts`/`.js` rewrite keeps the trick working from\n * both source and built output.\n */\nconst importOAuthModule = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\ntype OAuthFlowLoaders = {\n\tanthropic: () => OAuthAuth | Promise<OAuthAuth>;\n\topenaiCodex: () => OAuthAuth | Promise<OAuthAuth>;\n\tgithubCopilot: () => OAuthAuth | Promise<OAuthAuth>;\n\topenrouter: () => OAuthAuth | Promise<OAuthAuth>;\n\tkimiCoding: () => OAuthAuth | Promise<OAuthAuth>;\n\txai: () => OAuthAuth | Promise<OAuthAuth>;\n\tcursor: () => OAuthAuth | Promise<OAuthAuth>;\n\tdevin: () => OAuthAuth | Promise<OAuthAuth>;\n\tradius: (options: { name: string; gateway: string }) => OAuthAuth | Promise<OAuthAuth>;\n};\n\nlet bundledLoaders: OAuthFlowLoaders | undefined;\n\n/** Registers statically bundled OAuth flows for standalone Bun binaries. */\nexport function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void {\n\tbundledLoaders = loaders;\n}\n\nexport const loadAnthropicOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.anthropic();\n\treturn ((await importOAuthModule(\"./anthropic.ts\")) as { anthropicOAuth: OAuthAuth }).anthropicOAuth;\n};\n\nexport const loadOpenAICodexOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openaiCodex();\n\treturn ((await importOAuthModule(\"./openai-codex.ts\")) as { openaiCodexOAuth: OAuthAuth }).openaiCodexOAuth;\n};\n\nexport const loadGitHubCopilotOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.githubCopilot();\n\treturn ((await importOAuthModule(\"./github-copilot.ts\")) as { githubCopilotOAuth: OAuthAuth }).githubCopilotOAuth;\n};\n\nexport const loadOpenRouterOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openrouter();\n\treturn ((await importOAuthModule(\"./openrouter.ts\")) as { openRouterOAuth: OAuthAuth }).openRouterOAuth;\n};\n\nexport const loadKimiCodingOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.kimiCoding();\n\treturn ((await importOAuthModule(\"./kimi-coding.ts\")) as { kimiCodingOAuth: OAuthAuth }).kimiCodingOAuth;\n};\n\nexport const loadXaiOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.xai();\n\treturn ((await importOAuthModule(\"./xai.ts\")) as { xaiOAuth: OAuthAuth }).xaiOAuth;\n};\n\nexport const loadCursorOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.cursor();\n\treturn ((await importOAuthModule(\"./cursor.ts\")) as { cursorOAuth: OAuthAuth }).cursorOAuth;\n};\n\nexport const loadDevinOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.devin();\n\treturn ((await importOAuthModule(\"./devin.ts\")) as { devinOAuth: OAuthAuth }).devinOAuth;\n};\n\nexport const loadRadiusOAuth = async (options: { name: string; gateway: string }): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.radius(options);\n\treturn (\n\t\t(await importOAuthModule(\"./radius.ts\")) as {\n\t\t\tcreateRadiusOAuth: (input: { name: string; gateway: string }) => OAuthAuth;\n\t\t}\n\t).createRadiusOAuth(options);\n};\n"]}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAoB,EAAE;IACjE,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,MAAM,kCAAC,gBAAgB,EAAC,CAAC;AACjC,CAAC,CAAC;AAcF,IAAI,cAA4C,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAAC,OAAyB;IACxE,cAAc,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAwB,EAAE;IAChE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,SAAS,EAAE,CAAC;IACtD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAmC,CAAC,cAAc,CAAC;AACtG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,IAAwB,EAAE;IAC1E,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,mBAAmB,EAAE,CAAC;IAChE,OAAQ,CAAC,MAAM,iBAAiB,CAAC,2BAA2B,CAAC,CAA6C;SACxG,wBAAwB,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAwB,EAAE;IACpE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAQ,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAuC,CAAC,kBAAkB,CAAC;AACnH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAoC,CAAC,eAAe,CAAC;AACzG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAoC,CAAC,eAAe,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAwB,EAAE;IAC1D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC;IAChD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAA6B,CAAC,QAAQ,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAAwB,EAAE;IAC7D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,CAAC;IACnD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAgC,CAAC,WAAW,CAAC;AAC7F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAAwB,EAAE;IAC5D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,CAAC;IAClD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAA+B,CAAC,UAAU,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAA0C,EAAsB,EAAE;IACvG,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,OACC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAGvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC","sourcesContent":["import type { OAuthAuth } from \"../types.ts\";\n\n/**\n * Loads an OAuth flow module through a variable specifier so bundlers cannot\n * follow the import into Node-only flow code (`node:http` callback servers,\n * `node:crypto` PKCE). The `.ts`/`.js` rewrite keeps the trick working from\n * both source and built output.\n */\nconst importOAuthModule = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\ntype OAuthFlowLoaders = {\n\tanthropic: () => OAuthAuth | Promise<OAuthAuth>;\n\tchatgptSubscription: () => OAuthAuth | Promise<OAuthAuth>;\n\tgithubCopilot: () => OAuthAuth | Promise<OAuthAuth>;\n\topenrouter: () => OAuthAuth | Promise<OAuthAuth>;\n\tkimiCoding: () => OAuthAuth | Promise<OAuthAuth>;\n\txai: () => OAuthAuth | Promise<OAuthAuth>;\n\tcursor: () => OAuthAuth | Promise<OAuthAuth>;\n\tdevin: () => OAuthAuth | Promise<OAuthAuth>;\n\tradius: (options: { name: string; gateway: string }) => OAuthAuth | Promise<OAuthAuth>;\n};\n\nlet bundledLoaders: OAuthFlowLoaders | undefined;\n\n/** Registers statically bundled OAuth flows for standalone Bun binaries. */\nexport function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void {\n\tbundledLoaders = loaders;\n}\n\nexport const loadAnthropicOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.anthropic();\n\treturn ((await importOAuthModule(\"./anthropic.ts\")) as { anthropicOAuth: OAuthAuth }).anthropicOAuth;\n};\n\nexport const loadChatGptSubscriptionOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.chatgptSubscription();\n\treturn ((await importOAuthModule(\"./chatgpt-subscription.ts\")) as { chatgptSubscriptionOAuth: OAuthAuth })\n\t\t.chatgptSubscriptionOAuth;\n};\n\nexport const loadGitHubCopilotOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.githubCopilot();\n\treturn ((await importOAuthModule(\"./github-copilot.ts\")) as { githubCopilotOAuth: OAuthAuth }).githubCopilotOAuth;\n};\n\nexport const loadOpenRouterOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openrouter();\n\treturn ((await importOAuthModule(\"./openrouter.ts\")) as { openRouterOAuth: OAuthAuth }).openRouterOAuth;\n};\n\nexport const loadKimiCodingOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.kimiCoding();\n\treturn ((await importOAuthModule(\"./kimi-coding.ts\")) as { kimiCodingOAuth: OAuthAuth }).kimiCodingOAuth;\n};\n\nexport const loadXaiOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.xai();\n\treturn ((await importOAuthModule(\"./xai.ts\")) as { xaiOAuth: OAuthAuth }).xaiOAuth;\n};\n\nexport const loadCursorOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.cursor();\n\treturn ((await importOAuthModule(\"./cursor.ts\")) as { cursorOAuth: OAuthAuth }).cursorOAuth;\n};\n\nexport const loadDevinOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.devin();\n\treturn ((await importOAuthModule(\"./devin.ts\")) as { devinOAuth: OAuthAuth }).devinOAuth;\n};\n\nexport const loadRadiusOAuth = async (options: { name: string; gateway: string }): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.radius(options);\n\treturn (\n\t\t(await importOAuthModule(\"./radius.ts\")) as {\n\t\t\tcreateRadiusOAuth: (input: { name: string; gateway: string }) => OAuthAuth;\n\t\t}\n\t).createRadiusOAuth(options);\n};\n"]}

package/dist/auth/pool/failover.d.ts

@@ -1,7 +1,7 @@
+import { TURN_RETRY_SUPPRESSION_PREFIX } from "../../utils/provider-failure-description.ts";
 import { type PoolFailureClassification } from "./classify.ts";
 import type { SelectableSlot } from "./select.ts";
-/** Must stay byte-identical to the claude-sdk-oauth marker AgentSession already honors. */
-export declare const TURN_RETRY_SUPPRESSION_PREFIX = "senpi:no-turn-retry:";
+export { TURN_RETRY_SUPPRESSION_PREFIX };
 export declare const DEFAULT_SLOT_BLOCK_MS = 60000;
 export declare const MAX_SLOT_BLOCK_MS: number;
 export type PoolFailoverEvent<TSlot extends SelectableSlot> = {

package/dist/auth/pool/failover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"failover.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,2FAA2F;AAC3F,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AACpE,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AAEtD,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,cAAc,IAAI;IAC7D,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,cAAc,EAAE,yBAAyB,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,IAAI;IACvE,KAAK,EAAE,SAAS,KAAK,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,KAAK,KAAK,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,yBAAyB,CAAC;IACzD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAEpC,YAAY,cAAc,EAAE,yBAAyB,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAOnG;CACD;AAoBD;;;;;;GAMG;AACH,wBAAuB,eAAe,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,EAC1E,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,GACzC,cAAc,CAAC,MAAM,CAAC,CA4CxB"}
+{"version":3,"file":"failover.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,6BAA6B,EAAE,CAAC;AACzC,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAC5C,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AAEtD,MAAM,MAAM,iBAAiB,CAAC,KAAK,SAAS,cAAc,IAAI;IAC7D,IAAI,EAAE,KAAK,CAAC;IACZ,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,cAAc,EAAE,yBAAyB,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,IAAI;IACvE,KAAK,EAAE,SAAS,KAAK,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,KAAK,KAAK,CAAC;IAC3C,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,yBAAyB,CAAC;IACzD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,cAAc,EAAE,yBAAyB,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAEpC,YAAY,cAAc,EAAE,yBAAyB,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAOnG;CACD;AAoBD;;;;;;GAMG;AACH,wBAAuB,eAAe,CAAC,MAAM,EAAE,KAAK,SAAS,cAAc,EAC1E,OAAO,EAAE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,GACzC,cAAc,CAAC,MAAM,CAAC,CA4CxB"}

package/dist/auth/pool/failover.js

@@ -1,6 +1,6 @@
+import { TURN_RETRY_SUPPRESSION_PREFIX } from "../../utils/provider-failure-description.js";
 import { classifyPoolFailure } from "./classify.js";
-/** Must stay byte-identical to the claude-sdk-oauth marker AgentSession already honors. */
-export const TURN_RETRY_SUPPRESSION_PREFIX = "senpi:no-turn-retry:";
+export { TURN_RETRY_SUPPRESSION_PREFIX };
 export const DEFAULT_SLOT_BLOCK_MS = 60_000;
 export const MAX_SLOT_BLOCK_MS = 48 * 60 * 60 * 1_000;
 export class PoolFailoverError extends Error {

package/dist/auth/pool/failover.js.map

@@ -1 +1 @@
-{"version":3,"file":"failover.js","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAkC,MAAM,eAAe,CAAC;AAGpF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AA4BtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAK3C,YAAY,cAAyC,EAAE,QAAiB,EAAE,iBAA0B;QACnG,MAAM,MAAM,GAAG,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,KAAK,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,WAAW,CACnB,IAAW,EACX,cAAyC,EACzC,GAAW,EACX,OAAe,EACf,WAAmB;IAEnB,IAAI,cAAc,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACjD,kEAAkE;QAClE,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,YAAY,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACrC,OAA2C;IAE3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,SAAwC,CAAC;IAE7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACzC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,cAAc,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9E,SAAS,GAAG,OAAO,CAAC;YACpB,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YAEtD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAC/E,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1F,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,QAAQ,GAA6B;gBAC1C,IAAI,EAAE,OAAO;gBACb,cAAc;gBACd,OAAO,EAAE,OAAO,GAAG,CAAC;gBACpB,eAAe;aACf,CAAC;YACF,IAAI,CAAC;gBACJ,IAAI,CAAC,eAAe,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACpD,QAAQ,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACF,CAAC;oBAAS,CAAC;gBACV,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,eAAe;gBAAE,MAAM,OAAO,CAAC;QACpC,CAAC;IACF,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { classifyPoolFailure, type PoolFailureClassification } from \"./classify.ts\";\nimport type { SelectableSlot } from \"./select.ts\";\n\n/** Must stay byte-identical to the claude-sdk-oauth marker AgentSession already honors. */\nexport const TURN_RETRY_SUPPRESSION_PREFIX = \"senpi:no-turn-retry:\";\nexport const DEFAULT_SLOT_BLOCK_MS = 60_000;\nexport const MAX_SLOT_BLOCK_MS = 48 * 60 * 60 * 1_000;\n\nexport type PoolFailoverEvent<TSlot extends SelectableSlot> = {\n\tslot: TSlot;\n\tnextSlot?: TSlot;\n\tclassification: PoolFailureClassification;\n\tattempt: number;\n\tcommittedOutput: boolean;\n};\n\nexport type PoolFailoverOptions<TEvent, TSlot extends SelectableSlot> = {\n\tslots: readonly TSlot[];\n\tselect: (slots: readonly TSlot[]) => TSlot;\n\trunAttempt: (slot: TSlot) => AsyncIterable<TEvent> | Promise<AsyncIterable<TEvent>>;\n\tclassify?: (error: unknown) => PoolFailureClassification;\n\t/**\n\t * Rotation is transparent only before committed output. Absent, every yielded\n\t * event counts as committed (default-DENY), so silent mid-stream rotation\n\t * requires an explicit opt-in from a caller that knows which events are\n\t * bookkeeping rather than user-visible output.\n\t */\n\tisCommittedOutput?: (event: TEvent) => boolean;\n\tpersistBlock?: (slot: TSlot) => void | Promise<void>;\n\tonRotate?: (event: PoolFailoverEvent<TSlot>) => void | Promise<void>;\n\tnow?: () => number;\n\tbaseBlockMs?: number;\n};\n\nexport class PoolFailoverError extends Error {\n\treadonly classification: PoolFailureClassification;\n\treadonly original: unknown;\n\treadonly suppressTurnRetry: boolean;\n\n\tconstructor(classification: PoolFailureClassification, original: unknown, suppressTurnRetry: boolean) {\n\t\tconst detail = original instanceof Error ? original.message : String(original);\n\t\tsuper(`${suppressTurnRetry ? TURN_RETRY_SUPPRESSION_PREFIX : \"\"}${detail}`);\n\t\tthis.name = \"PoolFailoverError\";\n\t\tthis.classification = classification;\n\t\tthis.original = original;\n\t\tthis.suppressTurnRetry = suppressTurnRetry;\n\t}\n}\n\nfunction blockedSlot<TSlot extends SelectableSlot>(\n\tslot: TSlot,\n\tclassification: PoolFailureClassification,\n\tnow: number,\n\tattempt: number,\n\tbaseBlockMs: number,\n): TSlot {\n\tif (classification.blockReason === \"auth_error\") {\n\t\t// An auth block has no expiry: only a re-login rewrites the slot.\n\t\tconst next = { ...slot, blockReason: \"auth_error\" };\n\t\tdelete next.blockedUntil;\n\t\treturn next;\n\t}\n\tconst fallback = Math.min(MAX_SLOT_BLOCK_MS, baseBlockMs * 2 ** attempt);\n\tconst duration = Math.min(MAX_SLOT_BLOCK_MS, classification.retryAfterMs ?? fallback);\n\treturn { ...slot, blockedUntil: now + duration, blockReason: \"rate_limit\" };\n}\n\n/**\n * Runs at most one attempt per slot. A rotation is transparent only while no\n * committed output has reached the caller; afterwards the classified error is\n * thrown with the turn-retry suppression marker so the session layer never\n * replays a partially delivered turn. Non-rotate classes throw immediately and\n * compose with the retry/model-fallback machinery above this engine.\n */\nexport async function* runSlotFailover<TEvent, TSlot extends SelectableSlot>(\n\toptions: PoolFailoverOptions<TEvent, TSlot>,\n): AsyncGenerator<TEvent> {\n\tconst now = options.now ?? Date.now;\n\tconst classify = options.classify ?? classifyPoolFailure;\n\tconst committed = options.isCommittedOutput ?? (() => true);\n\tconst baseBlockMs = options.baseBlockMs ?? DEFAULT_SLOT_BLOCK_MS;\n\tlet slots = [...options.slots];\n\tlet lastError: PoolFailoverError | undefined;\n\n\tfor (let attempt = 0; attempt < options.slots.length; attempt++) {\n\t\tconst slot = options.select(slots);\n\t\tlet committedOutput = false;\n\t\ttry {\n\t\t\tconst attemptStream = await options.runAttempt(slot);\n\t\t\tfor await (const event of attemptStream) {\n\t\t\t\tcommittedOutput ||= committed(event);\n\t\t\t\tyield event;\n\t\t\t}\n\t\t\treturn;\n\t\t} catch (error) {\n\t\t\tconst classification = classify(error);\n\t\t\tconst failure = new PoolFailoverError(classification, error, committedOutput);\n\t\t\tlastError = failure;\n\t\t\tif (classification.action !== \"rotate\") throw failure;\n\n\t\t\tconst blocked = blockedSlot(slot, classification, now(), attempt, baseBlockMs);\n\t\t\tslots = slots.map((candidate) => (candidate.name === blocked.name ? blocked : candidate));\n\t\t\tawait options.persistBlock?.(blocked);\n\t\t\tconst rotation: PoolFailoverEvent<TSlot> = {\n\t\t\t\tslot: blocked,\n\t\t\t\tclassification,\n\t\t\t\tattempt: attempt + 1,\n\t\t\t\tcommittedOutput,\n\t\t\t};\n\t\t\ttry {\n\t\t\t\tif (!committedOutput && attempt + 1 < slots.length) {\n\t\t\t\t\trotation.nextSlot = options.select(slots);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tawait options.onRotate?.(rotation);\n\t\t\t}\n\t\t\tif (committedOutput) throw failure;\n\t\t}\n\t}\n\tthrow lastError ?? new Error(\"Credential pool failover exhausted without an attempt\");\n}\n"]}
+{"version":3,"file":"failover.js","sourceRoot":"","sources":["../../../src/auth/pool/failover.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAkC,MAAM,eAAe,CAAC;AAGpF,OAAO,EAAE,6BAA6B,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AA4BtD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAK3C,YAAY,cAAyC,EAAE,QAAiB,EAAE,iBAA0B;QACnG,MAAM,MAAM,GAAG,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,KAAK,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,WAAW,CACnB,IAAW,EACX,cAAyC,EACzC,GAAW,EACX,OAAe,EACf,WAAmB;IAEnB,IAAI,cAAc,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACjD,kEAAkE;QAClE,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,YAAY,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,GAAG,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACrC,OAA2C;IAE3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,SAAwC,CAAC;IAE7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;gBACzC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,OAAO;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC,cAAc,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9E,SAAS,GAAG,OAAO,CAAC;YACpB,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YAEtD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAC/E,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YAC1F,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,QAAQ,GAA6B;gBAC1C,IAAI,EAAE,OAAO;gBACb,cAAc;gBACd,OAAO,EAAE,OAAO,GAAG,CAAC;gBACpB,eAAe;aACf,CAAC;YACF,IAAI,CAAC;gBACJ,IAAI,CAAC,eAAe,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBACpD,QAAQ,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACF,CAAC;oBAAS,CAAC;gBACV,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,eAAe;gBAAE,MAAM,OAAO,CAAC;QACpC,CAAC;IACF,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AACvF,CAAC","sourcesContent":["import { TURN_RETRY_SUPPRESSION_PREFIX } from \"../../utils/provider-failure-description.ts\";\nimport { classifyPoolFailure, type PoolFailureClassification } from \"./classify.ts\";\nimport type { SelectableSlot } from \"./select.ts\";\n\nexport { TURN_RETRY_SUPPRESSION_PREFIX };\nexport const DEFAULT_SLOT_BLOCK_MS = 60_000;\nexport const MAX_SLOT_BLOCK_MS = 48 * 60 * 60 * 1_000;\n\nexport type PoolFailoverEvent<TSlot extends SelectableSlot> = {\n\tslot: TSlot;\n\tnextSlot?: TSlot;\n\tclassification: PoolFailureClassification;\n\tattempt: number;\n\tcommittedOutput: boolean;\n};\n\nexport type PoolFailoverOptions<TEvent, TSlot extends SelectableSlot> = {\n\tslots: readonly TSlot[];\n\tselect: (slots: readonly TSlot[]) => TSlot;\n\trunAttempt: (slot: TSlot) => AsyncIterable<TEvent> | Promise<AsyncIterable<TEvent>>;\n\tclassify?: (error: unknown) => PoolFailureClassification;\n\t/**\n\t * Rotation is transparent only before committed output. Absent, every yielded\n\t * event counts as committed (default-DENY), so silent mid-stream rotation\n\t * requires an explicit opt-in from a caller that knows which events are\n\t * bookkeeping rather than user-visible output.\n\t */\n\tisCommittedOutput?: (event: TEvent) => boolean;\n\tpersistBlock?: (slot: TSlot) => void | Promise<void>;\n\tonRotate?: (event: PoolFailoverEvent<TSlot>) => void | Promise<void>;\n\tnow?: () => number;\n\tbaseBlockMs?: number;\n};\n\nexport class PoolFailoverError extends Error {\n\treadonly classification: PoolFailureClassification;\n\treadonly original: unknown;\n\treadonly suppressTurnRetry: boolean;\n\n\tconstructor(classification: PoolFailureClassification, original: unknown, suppressTurnRetry: boolean) {\n\t\tconst detail = original instanceof Error ? original.message : String(original);\n\t\tsuper(`${suppressTurnRetry ? TURN_RETRY_SUPPRESSION_PREFIX : \"\"}${detail}`);\n\t\tthis.name = \"PoolFailoverError\";\n\t\tthis.classification = classification;\n\t\tthis.original = original;\n\t\tthis.suppressTurnRetry = suppressTurnRetry;\n\t}\n}\n\nfunction blockedSlot<TSlot extends SelectableSlot>(\n\tslot: TSlot,\n\tclassification: PoolFailureClassification,\n\tnow: number,\n\tattempt: number,\n\tbaseBlockMs: number,\n): TSlot {\n\tif (classification.blockReason === \"auth_error\") {\n\t\t// An auth block has no expiry: only a re-login rewrites the slot.\n\t\tconst next = { ...slot, blockReason: \"auth_error\" };\n\t\tdelete next.blockedUntil;\n\t\treturn next;\n\t}\n\tconst fallback = Math.min(MAX_SLOT_BLOCK_MS, baseBlockMs * 2 ** attempt);\n\tconst duration = Math.min(MAX_SLOT_BLOCK_MS, classification.retryAfterMs ?? fallback);\n\treturn { ...slot, blockedUntil: now + duration, blockReason: \"rate_limit\" };\n}\n\n/**\n * Runs at most one attempt per slot. A rotation is transparent only while no\n * committed output has reached the caller; afterwards the classified error is\n * thrown with the turn-retry suppression marker so the session layer never\n * replays a partially delivered turn. Non-rotate classes throw immediately and\n * compose with the retry/model-fallback machinery above this engine.\n */\nexport async function* runSlotFailover<TEvent, TSlot extends SelectableSlot>(\n\toptions: PoolFailoverOptions<TEvent, TSlot>,\n): AsyncGenerator<TEvent> {\n\tconst now = options.now ?? Date.now;\n\tconst classify = options.classify ?? classifyPoolFailure;\n\tconst committed = options.isCommittedOutput ?? (() => true);\n\tconst baseBlockMs = options.baseBlockMs ?? DEFAULT_SLOT_BLOCK_MS;\n\tlet slots = [...options.slots];\n\tlet lastError: PoolFailoverError | undefined;\n\n\tfor (let attempt = 0; attempt < options.slots.length; attempt++) {\n\t\tconst slot = options.select(slots);\n\t\tlet committedOutput = false;\n\t\ttry {\n\t\t\tconst attemptStream = await options.runAttempt(slot);\n\t\t\tfor await (const event of attemptStream) {\n\t\t\t\tcommittedOutput ||= committed(event);\n\t\t\t\tyield event;\n\t\t\t}\n\t\t\treturn;\n\t\t} catch (error) {\n\t\t\tconst classification = classify(error);\n\t\t\tconst failure = new PoolFailoverError(classification, error, committedOutput);\n\t\t\tlastError = failure;\n\t\t\tif (classification.action !== \"rotate\") throw failure;\n\n\t\t\tconst blocked = blockedSlot(slot, classification, now(), attempt, baseBlockMs);\n\t\t\tslots = slots.map((candidate) => (candidate.name === blocked.name ? blocked : candidate));\n\t\t\tawait options.persistBlock?.(blocked);\n\t\t\tconst rotation: PoolFailoverEvent<TSlot> = {\n\t\t\t\tslot: blocked,\n\t\t\t\tclassification,\n\t\t\t\tattempt: attempt + 1,\n\t\t\t\tcommittedOutput,\n\t\t\t};\n\t\t\ttry {\n\t\t\t\tif (!committedOutput && attempt + 1 < slots.length) {\n\t\t\t\t\trotation.nextSlot = options.select(slots);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tawait options.onRotate?.(rotation);\n\t\t\t}\n\t\t\tif (committedOutput) throw failure;\n\t\t}\n\t}\n\tthrow lastError ?? new Error(\"Credential pool failover exhausted without an attempt\");\n}\n"]}

package/dist/auth/pool/slots.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderEnv } from "../../types.ts";
 import type { Credential } from "../types.ts";
 export type { Credential };
 export declare const DEFAULT_SLOT_NAME = "default";
@@ -12,6 +13,8 @@ export type CredentialSlot = {
     access?: string;
     refresh?: string;
     expires?: number;
+    /** Provider-scoped values this account carries (a Kimi region, a Cloudflare account id). */
+    env?: ProviderEnv;
 };
 export type PooledCredential = Credential & {
     accounts?: CredentialSlot[];
@@ -91,6 +94,13 @@ export declare function appendLoginSlot(current: PooledCredential | undefined, f
  * `<providerId>-managed` in both OAuth fields. It is a marker, never a token.
  */
 export declare function managedSentinelMaterial(providerId: string): string;
+/**
+ * Every sentinel material a stored credential may legitimately carry for this
+ * provider: the canonical `<providerId>-managed` plus the legacy material of
+ * any renamed ancestor id, because credentials written before a rename keep
+ * the old literal verbatim.
+ */
+export declare function managedSentinelMaterials(providerId: string): string[];
 /**
  * A POOL SLOT carrying that marker can never authenticate: `projectSlot` hands
  * it to the provider's `check`, which rejects it, and the request dies with

package/dist/auth/pool/slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slots.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC3C,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAIF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtD;AAID;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAiC3C,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAoBD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,GAClB,gBAAgB,CA8BlB;AAmBD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,EAAE,CAIpF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAc3G;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW/G;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAGpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAU1G;AA+CD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,IAAI,EAAE,UAAU,EAChB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,KAAK,IAAI,GACpE,UAAU,CA2BZ;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAQnH;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAS7G;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAe3F"}
+{"version":3,"file":"slots.d.ts","sourceRoot":"","sources":["../../../src/auth/pool/slots.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,cAAc,GAAG;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG;IAC3C,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAIF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtD;AAID;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAiC3C,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAoBD,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASrE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGpF;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CACpC,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GAAG,IAAI,GAClB,gBAAgB,CA8BlB;AAqBD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,EAAE,CAIpF;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,GAAG,gBAAgB,CAc3G;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW/G;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAGpF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAW1G;AAgDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,IAAI,EAAE,UAAU,EAChB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,UAAU,KAAK,IAAI,GACpE,UAAU,CA2BZ;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AASD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAKrE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAQnH;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAS7G;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,UAAU,CAe3F"}

package/dist/auth/pool/slots.js

@@ -1,3 +1,4 @@
+import { LEGACY_PROVIDER_IDS } from "../../legacy-provider-ids.js";
 export const DEFAULT_SLOT_NAME = "default";
 const SLOT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 export function assertValidSlotName(name) {
@@ -119,17 +120,20 @@ export function renameSlotDisplayName(credential, name, value) {
 function storedSlots(credential) {
     return Array.isArray(credential.accounts) ? credential.accounts : [];
 }
-function slotFromFlatCredential(credential) {
-    if (credential.type === "oauth") {
-        return {
-            name: DEFAULT_SLOT_NAME,
-            source: "login",
-            access: credential.access,
-            refresh: credential.refresh,
-            expires: credential.expires,
-        };
+function credentialSlotEnv(credential) {
+    const value = credential.env;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return {};
+    const env = {};
+    for (const [name, entry] of Object.entries(value)) {
+        if (typeof entry !== "string")
+            return {};
+        env[name] = entry;
     }
-    return { name: DEFAULT_SLOT_NAME, source: "login", key: credential.key };
+    return { env };
+}
+function slotFromFlatCredential(credential) {
+    return slotFromFlatCredentialNamed(credential, DEFAULT_SLOT_NAME);
 }
 /**
  * A flat credential written by a build predating pools is read as a one-slot pool
@@ -170,12 +174,13 @@ function slotMirrorsFlat(credential, slot) {
 }
 /** Rewrites the flat top-level projection to carry the given slot's material. */
 function projectFlatFields(credential, slot) {
+    const env = slot.env === undefined ? {} : { env: slot.env };
     if (credential.type === "oauth") {
         if (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined)
             return credential;
-        return { ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires };
+        return { ...credential, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };
     }
-    return { ...credential, key: slot.key };
+    return { ...credential, key: slot.key, ...env };
 }
 /**
  * Removes one slot. The credential is dropped entirely once its last slot is gone,
@@ -219,12 +224,13 @@ export function projectSlot(credential, name) {
     if (!slot)
         return undefined;
     const { accounts: _accounts, pinned: _pinned, ...flat } = credential;
+    const env = slot.env === undefined ? {} : { env: slot.env };
     if (flat.type === "oauth") {
         if (slot.access === undefined || slot.refresh === undefined || slot.expires === undefined)
             return undefined;
-        return { ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires };
+        return { ...flat, access: slot.access, refresh: slot.refresh, expires: slot.expires, ...env };
     }
-    return { ...flat, key: slot.key };
+    return { ...flat, key: slot.key, ...env };
 }
 function slotFromFlatCredentialNamed(credential, name) {
     if (credential.type === "oauth") {
@@ -234,9 +240,10 @@ function slotFromFlatCredentialNamed(credential, name) {
             access: credential.access,
             refresh: credential.refresh,
             expires: credential.expires,
+            ...credentialSlotEnv(credential),
         };
     }
-    return { name, source: "login", key: credential.key };
+    return { name, source: "login", key: credential.key, ...credentialSlotEnv(credential) };
 }
 function nextLoginSlotName(credential) {
     const taken = new Set(listSlots(credential).map((slot) => slot.name));
@@ -316,6 +323,23 @@ export function appendLoginSlot(current, flat, onAllocated) {
 export function managedSentinelMaterial(providerId) {
     return `${providerId}-managed`;
 }
+const LEGACY_SENTINEL_MATERIALS = new Map(Object.entries(LEGACY_PROVIDER_IDS).map(([legacyId, canonicalId]) => [
+    canonicalId,
+    managedSentinelMaterial(legacyId),
+]));
+/**
+ * Every sentinel material a stored credential may legitimately carry for this
+ * provider: the canonical `<providerId>-managed` plus the legacy material of
+ * any renamed ancestor id, because credentials written before a rename keep
+ * the old literal verbatim.
+ */
+export function managedSentinelMaterials(providerId) {
+    const materials = [managedSentinelMaterial(providerId)];
+    const legacy = LEGACY_SENTINEL_MATERIALS.get(providerId);
+    if (legacy !== undefined && !materials.includes(legacy))
+        materials.push(legacy);
+    return materials;
+}
 /**
  * A POOL SLOT carrying that marker can never authenticate: `projectSlot` hands
  * it to the provider's `check`, which rejects it, and the request dies with
@@ -324,8 +348,8 @@ export function managedSentinelMaterial(providerId) {
  * slot.
  */
 export function isManagedSentinelSlot(providerId, slot) {
-    const sentinel = managedSentinelMaterial(providerId);
-    return slot.access === sentinel && slot.refresh === sentinel;
+    const materials = managedSentinelMaterials(providerId);
+    return materials.includes(slot.access ?? "") && slot.refresh === slot.access;
 }
 /**
  * Drops those poisoned slots from a stored credential, clearing a pin that