@code-yeongyu/senpi-ai 2026.9.28 → 2026.9.29

package/dist/auth/resolve.js

@@ -56,7 +56,7 @@ async function resolveProviderAuthWithSignal(provider, credentials, authContext,
         if (!projected)
             return undefined;
         if (projected.type === "oauth" && provider.auth.oauth) {
-            return resolveStoredOAuth(credentials, provider.id, provider.auth.oauth, projected, requestAuthContext, overrides?.env, signal, overrides?.minOAuthValidityMs, slotName);
+            return resolveStoredOAuth(credentials, provider.id, provider.auth.oauth, projected, requestAuthContext, overrides?.env, signal, overrides?.minOAuthValidityMs, slotName, overrides?.rejectedAccess);
         }
         if (projected.type === "api_key" && provider.auth.apiKey) {
             const credential = overrides?.env ? { ...projected, env: { ...projected.env, ...overrides.env } } : projected;
@@ -66,7 +66,7 @@ async function resolveProviderAuthWithSignal(provider, credentials, authContext,
     }
     if (stored) {
         if (stored.type === "oauth" && provider.auth.oauth) {
-            return resolveStoredOAuth(credentials, provider.id, provider.auth.oauth, stored, requestAuthContext, overrides?.env, signal, overrides?.minOAuthValidityMs);
+            return resolveStoredOAuth(credentials, provider.id, provider.auth.oauth, stored, requestAuthContext, overrides?.env, signal, overrides?.minOAuthValidityMs, undefined, overrides?.rejectedAccess);
         }
         if (stored.type === "api_key" && provider.auth.apiKey) {
             const credential = overrides?.env ? { ...stored, env: { ...stored.env, ...overrides.env } } : stored;
@@ -107,11 +107,12 @@ export function oauthRefreshModelsError(error, providerId) {
  * through `refreshOAuthCredential`, which re-checks the stored value, runs the
  * exchange outside the store lock, and compare-and-swaps the rotated slot.
  */
-async function resolveStoredOAuth(credentials, providerId, oauth, stored, authContext, requestEnv, signal, minOAuthValidityMs, slotName) {
+async function resolveStoredOAuth(credentials, providerId, oauth, stored, authContext, requestEnv, signal, minOAuthValidityMs, slotName, rejectedAccess) {
     const minimumValidityMs = Math.max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS, minOAuthValidityMs ?? 0);
     const expiresSoon = (credential) => Date.now() + minimumValidityMs >= credential.expires;
+    const isStale = (credential) => expiresSoon(credential) || (rejectedAccess !== undefined && credential.access === rejectedAccess);
     let credential = stored;
-    if (expiresSoon(credential)) {
+    if (isStale(credential)) {
         let post;
         try {
             post = await refreshOAuthCredential({
@@ -120,7 +121,7 @@ async function resolveStoredOAuth(credentials, providerId, oauth, stored, authCo
                 oauth,
                 stale: credential,
                 slotName,
-                isStale: expiresSoon,
+                isStale,
                 signal,
                 owning: true,
             });

package/dist/auth/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA6B9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC;AAE7E,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC9D,OAAO,GAAG,8BAA8B,GAAG,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGrC,YAAY,IAAqB,EAAE,OAAe,EAAE,OAA6B;QAChF,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,OAAe,EAAE,KAAc;IACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IACxD,OAAO,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAClC,QAA4C,EAC5C,WAA4B,EAC5B,WAAwB,EACxB,SAAmC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,mBAAmB,CACzB,6BAA6B,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EACpF,MAAM,CACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC3C,QAA4C,EAC5C,WAA4B,EAC5B,WAAwB,EACxB,SAA8C,EAC9C,MAAmB;IAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,kBAAkB,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5G,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;IAEpC,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACtE,OAAO,aAAa,CACnB,kBAAkB,EAClB,MAAM,EACN,QAAQ,CAAC,EAAE,EACX;YACC,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,SAAS,CAAC,MAAM;YACrB,GAAG,EAAE,SAAS,CAAC,GAAG;SAClB,EACD,MAAM,CACN,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,SAAS,EAAE,QAAQ,CAAC;IACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO,kBAAkB,CACxB,WAAW,EACX,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,IAAI,CAAC,KAAK,EACnB,SAAS,EACT,kBAAkB,EAClB,SAAS,EAAE,GAAG,EACd,MAAM,EACN,SAAS,EAAE,kBAAkB,EAC7B,QAAQ,CACR,CAAC;QACH,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9G,OAAO,aAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACpD,OAAO,kBAAkB,CACxB,WAAW,EACX,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,IAAI,CAAC,KAAK,EACnB,MAAM,EACN,kBAAkB,EAClB,SAAS,EAAE,GAAG,EACd,MAAM,EACN,SAAS,EAAE,kBAAkB,CAC7B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACrG,OAAO,aAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/C,OAAO,aAAa,CACnB,kBAAkB,EAClB,MAAM,EACN,QAAQ,CAAC,EAAE,EACX;YACC,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,SAAS,CAAC,MAAM;YACrB,GAAG,EAAE,SAAS,CAAC,GAAG;SAClB,EACD,MAAM,CACN,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,iBAAiB,GACtB,MAAM,EAAE,WAAW,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAkB,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB,EAAE,GAAgB;IACjE,OAAO;QACN,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjF,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;KAC3C,CAAC;AACH,CAAC;AAED,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,UAAkB;IACzE,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;QAChD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,4BAA4B,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,sCAAsC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAChC,WAA4B,EAC5B,UAAkB,EAClB,KAAgB,EAChB,MAAuB,EACvB,WAAwB,EACxB,UAAmC,EACnC,MAAmB,EACnB,kBAA2B,EAC3B,QAAiB;IAEjB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAC/F,MAAM,WAAW,GAAG,CAAC,UAA2B,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,IAAI,UAAU,CAAC,OAAO,CAAC;IAC1G,IAAI,UAAU,GAAG,MAAM,CAAC;IAExB,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,sBAAsB,CAAC;gBACnC,WAAW;gBACX,UAAU;gBACV,KAAK;gBACL,KAAK,EAAE,UAAU;gBACjB,QAAQ;gBACR,OAAO,EAAE,WAAW;gBACpB,MAAM;gBACN,MAAM,EAAE,IAAI;aACZ,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,CAAC,uBAAuB;QACrE,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,CAAC,yBAAyB;QAC1D,UAAU,GAAG,QAAQ,CAAC;QACtB,yEAAyE;QACzE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,kBAAkB,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,4DAA4D,UAAU,EAAE,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IAE7F,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC3G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,wCAAwC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,OAAO;YACN,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC7C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,OAAO;SACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,oCAAoC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,UAA2B;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,WAAW,GAAgB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,WAAwB,EACxB,MAAkB,EAClB,UAAkB,EAClB,UAAwC,EACxC,MAAmB;IAEnB,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,oCAAoC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;AACF,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,WAA4B,EAC5B,UAAkB,EAClB,MAAmB;IAEnB,IAAI,CAAC;QACJ,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,oCAAoC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;AACF,CAAC","sourcesContent":["import type { ProviderEnv } from \"../types.ts\";\nimport { operationSignal, raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { formatThrownValue } from \"../utils/diagnostics.ts\";\nimport {\n\tOAuthRefreshExchangeError,\n\tOAuthRefreshStoreError,\n\tprojectOAuthSlot,\n\trefreshOAuthCredential,\n} from \"./oauth-refresh.ts\";\nimport { projectSlot } from \"./pool/slots.ts\";\nimport type {\n\tApiKeyAuth,\n\tApiKeyCredential,\n\tAuthContext,\n\tAuthResult,\n\tCredential,\n\tCredentialStore,\n\tOAuthAuth,\n\tOAuthCredential,\n\tProviderAuth,\n} from \"./types.ts\";\n\nexport type ModelsErrorCode = \"model_source\" | \"model_validation\" | \"provider\" | \"stream\" | \"auth\" | \"oauth\";\n\nexport interface AuthResolutionOverrides {\n\tapiKey?: string;\n\tenv?: ProviderEnv;\n\t/** Require this much remaining OAuth-token validity; defaults to five minutes. */\n\tminOAuthValidityMs?: number;\n\t/**\n\t * Resolve against one named slot of a pooled credential. A missing entry or\n\t * slot resolves to undefined rather than falling back to another account or\n\t * ambient env, so a slot-scoped request can never silently switch identities.\n\t */\n\tslotName?: string;\n\tsignal?: AbortSignal;\n}\n\n/**\n * Prefix of the auth-miss every resolution site raises when a provider has no\n * usable credential. Consumers key recovery decisions off this exact wording,\n * so it is a shared constant instead of a literal repeated at each throw site:\n * rewording one copy would silently disable the other's behavior.\n */\nexport const PROVIDER_NOT_CONFIGURED_PREFIX = \"Provider is not configured: \";\n\nexport function providerNotConfiguredMessage(providerId: string): string {\n\treturn `${PROVIDER_NOT_CONFIGURED_PREFIX}${providerId}`;\n}\n\nexport class ModelsError extends Error {\n\treadonly code: ModelsErrorCode;\n\n\tconstructor(code: ModelsErrorCode, message: string, options?: { cause?: unknown }) {\n\t\tsuper(withCauseDetail(message, options?.cause), options);\n\t\tthis.name = \"ModelsError\";\n\t\tthis.code = code;\n\t}\n}\n\n/** Callers surface `error.message` only, so keep the underlying reason in it. */\nfunction withCauseDetail(message: string, cause: unknown): string {\n\tif (cause === undefined || cause === null) return message;\n\tconst detail = formatThrownValue(cause).trim();\n\tif (!detail || message.includes(detail)) return message;\n\treturn `${message}: ${detail}`;\n}\n\n/**\n * Auth resolution shared by the `Models` and `ImagesModels` collections.\n * A stored credential owns the provider: ambient/env is consulted only when\n * nothing is stored. No silent env fallback after a failed refresh or for a\n * credential type without a matching handler.\n */\nexport function resolveProviderAuth(\n\tprovider: { id: string; auth: ProviderAuth },\n\tcredentials: CredentialStore,\n\tauthContext: AuthContext,\n\toverrides?: AuthResolutionOverrides,\n): Promise<AuthResult | undefined> {\n\tconst signal = operationSignal(overrides?.signal);\n\treturn raceWithAbortSignal(\n\t\tresolveProviderAuthWithSignal(provider, credentials, authContext, overrides, signal),\n\t\tsignal,\n\t);\n}\n\nasync function resolveProviderAuthWithSignal(\n\tprovider: { id: string; auth: ProviderAuth },\n\tcredentials: CredentialStore,\n\tauthContext: AuthContext,\n\toverrides: AuthResolutionOverrides | undefined,\n\tsignal: AbortSignal,\n): Promise<AuthResult | undefined> {\n\tsignal.throwIfAborted();\n\tconst requestAuthContext = overrides?.env ? overlayEnvAuthContext(authContext, overrides.env) : authContext;\n\tconst apiKey = provider.auth.apiKey;\n\n\tif (overrides?.apiKey !== undefined && apiKey && !apiKey.ambientOnly) {\n\t\treturn resolveApiKey(\n\t\t\trequestAuthContext,\n\t\t\tapiKey,\n\t\t\tprovider.id,\n\t\t\t{\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: overrides.apiKey,\n\t\t\t\tenv: overrides.env,\n\t\t\t},\n\t\t\tsignal,\n\t\t);\n\t}\n\n\tconst stored = await readCredential(credentials, provider.id, signal);\n\tconst slotName = overrides?.slotName;\n\tif (slotName !== undefined) {\n\t\tconst projected = stored === undefined ? undefined : projectSlot(stored, slotName);\n\t\tif (!projected) return undefined;\n\t\tif (projected.type === \"oauth\" && provider.auth.oauth) {\n\t\t\treturn resolveStoredOAuth(\n\t\t\t\tcredentials,\n\t\t\t\tprovider.id,\n\t\t\t\tprovider.auth.oauth,\n\t\t\t\tprojected,\n\t\t\t\trequestAuthContext,\n\t\t\t\toverrides?.env,\n\t\t\t\tsignal,\n\t\t\t\toverrides?.minOAuthValidityMs,\n\t\t\t\tslotName,\n\t\t\t);\n\t\t}\n\t\tif (projected.type === \"api_key\" && provider.auth.apiKey) {\n\t\t\tconst credential = overrides?.env ? { ...projected, env: { ...projected.env, ...overrides.env } } : projected;\n\t\t\treturn resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, credential, signal);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (stored) {\n\t\tif (stored.type === \"oauth\" && provider.auth.oauth) {\n\t\t\treturn resolveStoredOAuth(\n\t\t\t\tcredentials,\n\t\t\t\tprovider.id,\n\t\t\t\tprovider.auth.oauth,\n\t\t\t\tstored,\n\t\t\t\trequestAuthContext,\n\t\t\t\toverrides?.env,\n\t\t\t\tsignal,\n\t\t\t\toverrides?.minOAuthValidityMs,\n\t\t\t);\n\t\t}\n\t\tif (stored.type === \"api_key\" && provider.auth.apiKey) {\n\t\t\tconst credential = overrides?.env ? { ...stored, env: { ...stored.env, ...overrides.env } } : stored;\n\t\t\treturn resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, credential, signal);\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tif (overrides?.apiKey !== undefined && apiKey) {\n\t\treturn resolveApiKey(\n\t\t\trequestAuthContext,\n\t\t\tapiKey,\n\t\t\tprovider.id,\n\t\t\t{\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: overrides.apiKey,\n\t\t\t\tenv: overrides.env,\n\t\t\t},\n\t\t\tsignal,\n\t\t);\n\t}\n\n\t// Ambient (env vars, AWS profiles, ADC files).\n\tconst ambientCredential =\n\t\tapiKey?.ambientOnly && overrides?.env ? { type: \"api_key\" as const, key: \"\", env: overrides.env } : undefined;\n\treturn apiKey ? resolveApiKey(requestAuthContext, apiKey, provider.id, ambientCredential, signal) : undefined;\n}\n\nfunction overlayEnvAuthContext(base: AuthContext, env: ProviderEnv): AuthContext {\n\treturn {\n\t\tenv: async (name) => (env[name] !== undefined ? env[name] : await base.env(name)),\n\t\tfileExists: (path) => base.fileExists(path),\n\t};\n}\n\nconst DEFAULT_OAUTH_MINIMUM_VALIDITY_MS = 5 * 60 * 1000;\n\n/** Maps a shared-refresh failure onto the `ModelsError` codes callers match on. */\nexport function oauthRefreshModelsError(error: unknown, providerId: string): ModelsError {\n\tif (error instanceof ModelsError) return error;\n\tif (error instanceof OAuthRefreshExchangeError) {\n\t\treturn new ModelsError(\"oauth\", `OAuth refresh failed for ${providerId}`, { cause: error.cause });\n\t}\n\tconst cause = error instanceof OAuthRefreshStoreError ? error.cause : error;\n\treturn new ModelsError(\"auth\", `Credential store modify failed for ${providerId}`, { cause });\n}\n\n/**\n * OAuth resolution: a token with less than five minutes remaining is refreshed\n * through `refreshOAuthCredential`, which re-checks the stored value, runs the\n * exchange outside the store lock, and compare-and-swaps the rotated slot.\n */\nasync function resolveStoredOAuth(\n\tcredentials: CredentialStore,\n\tproviderId: string,\n\toauth: OAuthAuth,\n\tstored: OAuthCredential,\n\tauthContext: AuthContext,\n\trequestEnv: ProviderEnv | undefined,\n\tsignal: AbortSignal,\n\tminOAuthValidityMs?: number,\n\tslotName?: string,\n): Promise<AuthResult | undefined> {\n\tconst minimumValidityMs = Math.max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS, minOAuthValidityMs ?? 0);\n\tconst expiresSoon = (credential: OAuthCredential) => Date.now() + minimumValidityMs >= credential.expires;\n\tlet credential = stored;\n\n\tif (expiresSoon(credential)) {\n\t\tlet post: Credential | undefined;\n\t\ttry {\n\t\t\tpost = await refreshOAuthCredential({\n\t\t\t\tcredentials,\n\t\t\t\tproviderId,\n\t\t\t\toauth,\n\t\t\t\tstale: credential,\n\t\t\t\tslotName,\n\t\t\t\tisStale: expiresSoon,\n\t\t\t\tsignal,\n\t\t\t\towning: true,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthrow oauthRefreshModelsError(error, providerId);\n\t\t}\n\t\tif (post?.type !== \"oauth\") return undefined; // logged out meanwhile\n\t\tconst postView = slotName === undefined ? post : projectOAuthSlot(post, slotName);\n\t\tif (!postView) return undefined; // slot removed meanwhile\n\t\tcredential = postView;\n\t\t// The normal five-minute window triggers a refresh but does not impose a\n\t\t// provider contract. Explicit callers (such as bearer-token export) do\n\t\t// require the requested minimum after the refresh.\n\t\tif (minOAuthValidityMs !== undefined && expiresSoon(credential)) {\n\t\t\tthrow new ModelsError(\"oauth\", `OAuth refresh returned a token that expires too soon for ${providerId}`);\n\t\t}\n\t}\n\n\tconst storedEnv = credentialEnvironment(credential);\n\tconst effectiveEnv = requestEnv ? { ...storedEnv, ...requestEnv } : storedEnv;\n\tconst effectiveCredential = effectiveEnv ? { ...credential, env: effectiveEnv } : credential;\n\n\tif (oauth.check) {\n\t\ttry {\n\t\t\tif (!(await oauth.check({ ctx: authContext, credential: effectiveCredential, signal }))) return undefined;\n\t\t} catch (error) {\n\t\t\tthrow new ModelsError(\"auth\", `OAuth auth check failed for provider ${providerId}`, { cause: error });\n\t\t}\n\t}\n\n\ttry {\n\t\treturn {\n\t\t\tauth: await oauth.toAuth(effectiveCredential),\n\t\t\t...(effectiveEnv ? { env: effectiveEnv } : {}),\n\t\t\tsource: \"OAuth\",\n\t\t};\n\t} catch (error) {\n\t\tthrow new ModelsError(\"oauth\", `OAuth auth derivation failed for ${providerId}`, { cause: error });\n\t}\n}\n\nfunction credentialEnvironment(credential: OAuthCredential): ProviderEnv | undefined {\n\tconst value = credential.env;\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n\tconst environment: ProviderEnv = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (typeof entry !== \"string\") return undefined;\n\t\tenvironment[name] = entry;\n\t}\n\treturn environment;\n}\n\nasync function resolveApiKey(\n\tauthContext: AuthContext,\n\tapiKey: ApiKeyAuth,\n\tproviderId: string,\n\tcredential: ApiKeyCredential | undefined,\n\tsignal: AbortSignal,\n): Promise<AuthResult | undefined> {\n\ttry {\n\t\treturn await apiKey.resolve({ ctx: authContext, credential, signal });\n\t} catch (error) {\n\t\tthrow new ModelsError(\"auth\", `API key auth failed for provider ${providerId}`, { cause: error });\n\t}\n}\n\nasync function readCredential(\n\tcredentials: CredentialStore,\n\tproviderId: string,\n\tsignal: AbortSignal,\n): Promise<Credential | undefined> {\n\ttry {\n\t\treturn await credentials.read(providerId, { signal });\n\t} catch (error) {\n\t\tthrow new ModelsError(\"auth\", `Credential store read failed for ${providerId}`, { cause: error });\n\t}\n}\n"]}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/auth/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmC9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAC;AAE7E,MAAM,UAAU,4BAA4B,CAAC,UAAkB;IAC9D,OAAO,GAAG,8BAA8B,GAAG,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGrC,YAAY,IAAqB,EAAE,OAAe,EAAE,OAA6B;QAChF,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,OAAe,EAAE,KAAc;IACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IACxD,OAAO,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAClC,QAA4C,EAC5C,WAA4B,EAC5B,WAAwB,EACxB,SAAmC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO,mBAAmB,CACzB,6BAA6B,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EACpF,MAAM,CACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC3C,QAA4C,EAC5C,WAA4B,EAC5B,WAAwB,EACxB,SAA8C,EAC9C,MAAmB;IAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,kBAAkB,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5G,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;IAEpC,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACtE,OAAO,aAAa,CACnB,kBAAkB,EAClB,MAAM,EACN,QAAQ,CAAC,EAAE,EACX;YACC,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,SAAS,CAAC,MAAM;YACrB,GAAG,EAAE,SAAS,CAAC,GAAG;SAClB,EACD,MAAM,CACN,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,SAAS,EAAE,QAAQ,CAAC;IACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACvD,OAAO,kBAAkB,CACxB,WAAW,EACX,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,IAAI,CAAC,KAAK,EACnB,SAAS,EACT,kBAAkB,EAClB,SAAS,EAAE,GAAG,EACd,MAAM,EACN,SAAS,EAAE,kBAAkB,EAC7B,QAAQ,EACR,SAAS,EAAE,cAAc,CACzB,CAAC;QACH,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9G,OAAO,aAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACpD,OAAO,kBAAkB,CACxB,WAAW,EACX,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,IAAI,CAAC,KAAK,EACnB,MAAM,EACN,kBAAkB,EAClB,SAAS,EAAE,GAAG,EACd,MAAM,EACN,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EACT,SAAS,EAAE,cAAc,CACzB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACrG,OAAO,aAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/C,OAAO,aAAa,CACnB,kBAAkB,EAClB,MAAM,EACN,QAAQ,CAAC,EAAE,EACX;YACC,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,SAAS,CAAC,MAAM;YACrB,GAAG,EAAE,SAAS,CAAC,GAAG;SAClB,EACD,MAAM,CACN,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,MAAM,iBAAiB,GACtB,MAAM,EAAE,WAAW,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAkB,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,OAAO,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB,EAAE,GAAgB;IACjE,OAAO;QACN,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjF,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;KAC3C,CAAC;AACH,CAAC;AAED,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,UAAkB;IACzE,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,KAAK,YAAY,yBAAyB,EAAE,CAAC;QAChD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,4BAA4B,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,sCAAsC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAChC,WAA4B,EAC5B,UAAkB,EAClB,KAAgB,EAChB,MAAuB,EACvB,WAAwB,EACxB,UAAmC,EACnC,MAAmB,EACnB,kBAA2B,EAC3B,QAAiB,EACjB,cAAuB;IAEvB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAC/F,MAAM,WAAW,GAAG,CAAC,UAA2B,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,IAAI,UAAU,CAAC,OAAO,CAAC;IAC1G,MAAM,OAAO,GAAG,CAAC,UAA2B,EAAE,EAAE,CAC/C,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC;IACnG,IAAI,UAAU,GAAG,MAAM,CAAC;IAExB,IAAI,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzB,IAAI,IAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,sBAAsB,CAAC;gBACnC,WAAW;gBACX,UAAU;gBACV,KAAK;gBACL,KAAK,EAAE,UAAU;gBACjB,QAAQ;gBACR,OAAO;gBACP,MAAM;gBACN,MAAM,EAAE,IAAI;aACZ,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,uBAAuB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC,CAAC,uBAAuB;QACrE,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,CAAC,yBAAyB;QAC1D,UAAU,GAAG,QAAQ,CAAC;QACtB,yEAAyE;QACzE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,kBAAkB,KAAK,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,4DAA4D,UAAU,EAAE,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,mBAAmB,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IAE7F,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QAC3G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,wCAAwC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,CAAC;IACF,CAAC;IAED,IAAI,CAAC;QACJ,OAAO;YACN,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC7C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,OAAO;SACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,oCAAoC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACpG,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAAC,UAA2B;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,WAAW,GAAgB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,WAAwB,EACxB,MAAkB,EAClB,UAAkB,EAClB,UAAwC,EACxC,MAAmB;IAEnB,IAAI,CAAC;QACJ,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,oCAAoC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;AACF,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,WAA4B,EAC5B,UAAkB,EAClB,MAAmB;IAEnB,IAAI,CAAC;QACJ,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,oCAAoC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;AACF,CAAC","sourcesContent":["import type { ProviderEnv } from \"../types.ts\";\nimport { operationSignal, raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { formatThrownValue } from \"../utils/diagnostics.ts\";\nimport {\n\tOAuthRefreshExchangeError,\n\tOAuthRefreshStoreError,\n\tprojectOAuthSlot,\n\trefreshOAuthCredential,\n} from \"./oauth-refresh.ts\";\nimport { projectSlot } from \"./pool/slots.ts\";\nimport type {\n\tApiKeyAuth,\n\tApiKeyCredential,\n\tAuthContext,\n\tAuthResult,\n\tCredential,\n\tCredentialStore,\n\tOAuthAuth,\n\tOAuthCredential,\n\tProviderAuth,\n} from \"./types.ts\";\n\nexport type ModelsErrorCode = \"model_source\" | \"model_validation\" | \"provider\" | \"stream\" | \"auth\" | \"oauth\";\n\nexport interface AuthResolutionOverrides {\n\tapiKey?: string;\n\tenv?: ProviderEnv;\n\t/** Require this much remaining OAuth-token validity; defaults to five minutes. */\n\tminOAuthValidityMs?: number;\n\t/**\n\t * Resolve against one named slot of a pooled credential. A missing entry or\n\t * slot resolves to undefined rather than falling back to another account or\n\t * ambient env, so a slot-scoped request can never silently switch identities.\n\t */\n\tslotName?: string;\n\t/**\n\t * An access token the provider just refused with one of its\n\t * `OAuthAuth.rejectedTokenStatuses`. A stored OAuth credential still carrying it\n\t * is re-exchanged regardless of its expiry; one already rotated is used as is.\n\t */\n\trejectedAccess?: string;\n\tsignal?: AbortSignal;\n}\n\n/**\n * Prefix of the auth-miss every resolution site raises when a provider has no\n * usable credential. Consumers key recovery decisions off this exact wording,\n * so it is a shared constant instead of a literal repeated at each throw site:\n * rewording one copy would silently disable the other's behavior.\n */\nexport const PROVIDER_NOT_CONFIGURED_PREFIX = \"Provider is not configured: \";\n\nexport function providerNotConfiguredMessage(providerId: string): string {\n\treturn `${PROVIDER_NOT_CONFIGURED_PREFIX}${providerId}`;\n}\n\nexport class ModelsError extends Error {\n\treadonly code: ModelsErrorCode;\n\n\tconstructor(code: ModelsErrorCode, message: string, options?: { cause?: unknown }) {\n\t\tsuper(withCauseDetail(message, options?.cause), options);\n\t\tthis.name = \"ModelsError\";\n\t\tthis.code = code;\n\t}\n}\n\n/** Callers surface `error.message` only, so keep the underlying reason in it. */\nfunction withCauseDetail(message: string, cause: unknown): string {\n\tif (cause === undefined || cause === null) return message;\n\tconst detail = formatThrownValue(cause).trim();\n\tif (!detail || message.includes(detail)) return message;\n\treturn `${message}: ${detail}`;\n}\n\n/**\n * Auth resolution shared by the `Models` and `ImagesModels` collections.\n * A stored credential owns the provider: ambient/env is consulted only when\n * nothing is stored. No silent env fallback after a failed refresh or for a\n * credential type without a matching handler.\n */\nexport function resolveProviderAuth(\n\tprovider: { id: string; auth: ProviderAuth },\n\tcredentials: CredentialStore,\n\tauthContext: AuthContext,\n\toverrides?: AuthResolutionOverrides,\n): Promise<AuthResult | undefined> {\n\tconst signal = operationSignal(overrides?.signal);\n\treturn raceWithAbortSignal(\n\t\tresolveProviderAuthWithSignal(provider, credentials, authContext, overrides, signal),\n\t\tsignal,\n\t);\n}\n\nasync function resolveProviderAuthWithSignal(\n\tprovider: { id: string; auth: ProviderAuth },\n\tcredentials: CredentialStore,\n\tauthContext: AuthContext,\n\toverrides: AuthResolutionOverrides | undefined,\n\tsignal: AbortSignal,\n): Promise<AuthResult | undefined> {\n\tsignal.throwIfAborted();\n\tconst requestAuthContext = overrides?.env ? overlayEnvAuthContext(authContext, overrides.env) : authContext;\n\tconst apiKey = provider.auth.apiKey;\n\n\tif (overrides?.apiKey !== undefined && apiKey && !apiKey.ambientOnly) {\n\t\treturn resolveApiKey(\n\t\t\trequestAuthContext,\n\t\t\tapiKey,\n\t\t\tprovider.id,\n\t\t\t{\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: overrides.apiKey,\n\t\t\t\tenv: overrides.env,\n\t\t\t},\n\t\t\tsignal,\n\t\t);\n\t}\n\n\tconst stored = await readCredential(credentials, provider.id, signal);\n\tconst slotName = overrides?.slotName;\n\tif (slotName !== undefined) {\n\t\tconst projected = stored === undefined ? undefined : projectSlot(stored, slotName);\n\t\tif (!projected) return undefined;\n\t\tif (projected.type === \"oauth\" && provider.auth.oauth) {\n\t\t\treturn resolveStoredOAuth(\n\t\t\t\tcredentials,\n\t\t\t\tprovider.id,\n\t\t\t\tprovider.auth.oauth,\n\t\t\t\tprojected,\n\t\t\t\trequestAuthContext,\n\t\t\t\toverrides?.env,\n\t\t\t\tsignal,\n\t\t\t\toverrides?.minOAuthValidityMs,\n\t\t\t\tslotName,\n\t\t\t\toverrides?.rejectedAccess,\n\t\t\t);\n\t\t}\n\t\tif (projected.type === \"api_key\" && provider.auth.apiKey) {\n\t\t\tconst credential = overrides?.env ? { ...projected, env: { ...projected.env, ...overrides.env } } : projected;\n\t\t\treturn resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, credential, signal);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (stored) {\n\t\tif (stored.type === \"oauth\" && provider.auth.oauth) {\n\t\t\treturn resolveStoredOAuth(\n\t\t\t\tcredentials,\n\t\t\t\tprovider.id,\n\t\t\t\tprovider.auth.oauth,\n\t\t\t\tstored,\n\t\t\t\trequestAuthContext,\n\t\t\t\toverrides?.env,\n\t\t\t\tsignal,\n\t\t\t\toverrides?.minOAuthValidityMs,\n\t\t\t\tundefined,\n\t\t\t\toverrides?.rejectedAccess,\n\t\t\t);\n\t\t}\n\t\tif (stored.type === \"api_key\" && provider.auth.apiKey) {\n\t\t\tconst credential = overrides?.env ? { ...stored, env: { ...stored.env, ...overrides.env } } : stored;\n\t\t\treturn resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, credential, signal);\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tif (overrides?.apiKey !== undefined && apiKey) {\n\t\treturn resolveApiKey(\n\t\t\trequestAuthContext,\n\t\t\tapiKey,\n\t\t\tprovider.id,\n\t\t\t{\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: overrides.apiKey,\n\t\t\t\tenv: overrides.env,\n\t\t\t},\n\t\t\tsignal,\n\t\t);\n\t}\n\n\t// Ambient (env vars, AWS profiles, ADC files).\n\tconst ambientCredential =\n\t\tapiKey?.ambientOnly && overrides?.env ? { type: \"api_key\" as const, key: \"\", env: overrides.env } : undefined;\n\treturn apiKey ? resolveApiKey(requestAuthContext, apiKey, provider.id, ambientCredential, signal) : undefined;\n}\n\nfunction overlayEnvAuthContext(base: AuthContext, env: ProviderEnv): AuthContext {\n\treturn {\n\t\tenv: async (name) => (env[name] !== undefined ? env[name] : await base.env(name)),\n\t\tfileExists: (path) => base.fileExists(path),\n\t};\n}\n\nconst DEFAULT_OAUTH_MINIMUM_VALIDITY_MS = 5 * 60 * 1000;\n\n/** Maps a shared-refresh failure onto the `ModelsError` codes callers match on. */\nexport function oauthRefreshModelsError(error: unknown, providerId: string): ModelsError {\n\tif (error instanceof ModelsError) return error;\n\tif (error instanceof OAuthRefreshExchangeError) {\n\t\treturn new ModelsError(\"oauth\", `OAuth refresh failed for ${providerId}`, { cause: error.cause });\n\t}\n\tconst cause = error instanceof OAuthRefreshStoreError ? error.cause : error;\n\treturn new ModelsError(\"auth\", `Credential store modify failed for ${providerId}`, { cause });\n}\n\n/**\n * OAuth resolution: a token with less than five minutes remaining is refreshed\n * through `refreshOAuthCredential`, which re-checks the stored value, runs the\n * exchange outside the store lock, and compare-and-swaps the rotated slot.\n */\nasync function resolveStoredOAuth(\n\tcredentials: CredentialStore,\n\tproviderId: string,\n\toauth: OAuthAuth,\n\tstored: OAuthCredential,\n\tauthContext: AuthContext,\n\trequestEnv: ProviderEnv | undefined,\n\tsignal: AbortSignal,\n\tminOAuthValidityMs?: number,\n\tslotName?: string,\n\trejectedAccess?: string,\n): Promise<AuthResult | undefined> {\n\tconst minimumValidityMs = Math.max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS, minOAuthValidityMs ?? 0);\n\tconst expiresSoon = (credential: OAuthCredential) => Date.now() + minimumValidityMs >= credential.expires;\n\tconst isStale = (credential: OAuthCredential) =>\n\t\texpiresSoon(credential) || (rejectedAccess !== undefined && credential.access === rejectedAccess);\n\tlet credential = stored;\n\n\tif (isStale(credential)) {\n\t\tlet post: Credential | undefined;\n\t\ttry {\n\t\t\tpost = await refreshOAuthCredential({\n\t\t\t\tcredentials,\n\t\t\t\tproviderId,\n\t\t\t\toauth,\n\t\t\t\tstale: credential,\n\t\t\t\tslotName,\n\t\t\t\tisStale,\n\t\t\t\tsignal,\n\t\t\t\towning: true,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthrow oauthRefreshModelsError(error, providerId);\n\t\t}\n\t\tif (post?.type !== \"oauth\") return undefined; // logged out meanwhile\n\t\tconst postView = slotName === undefined ? post : projectOAuthSlot(post, slotName);\n\t\tif (!postView) return undefined; // slot removed meanwhile\n\t\tcredential = postView;\n\t\t// The normal five-minute window triggers a refresh but does not impose a\n\t\t// provider contract. Explicit callers (such as bearer-token export) do\n\t\t// require the requested minimum after the refresh.\n\t\tif (minOAuthValidityMs !== undefined && expiresSoon(credential)) {\n\t\t\tthrow new ModelsError(\"oauth\", `OAuth refresh returned a token that expires too soon for ${providerId}`);\n\t\t}\n\t}\n\n\tconst storedEnv = credentialEnvironment(credential);\n\tconst effectiveEnv = requestEnv ? { ...storedEnv, ...requestEnv } : storedEnv;\n\tconst effectiveCredential = effectiveEnv ? { ...credential, env: effectiveEnv } : credential;\n\n\tif (oauth.check) {\n\t\ttry {\n\t\t\tif (!(await oauth.check({ ctx: authContext, credential: effectiveCredential, signal }))) return undefined;\n\t\t} catch (error) {\n\t\t\tthrow new ModelsError(\"auth\", `OAuth auth check failed for provider ${providerId}`, { cause: error });\n\t\t}\n\t}\n\n\ttry {\n\t\treturn {\n\t\t\tauth: await oauth.toAuth(effectiveCredential),\n\t\t\t...(effectiveEnv ? { env: effectiveEnv } : {}),\n\t\t\tsource: \"OAuth\",\n\t\t};\n\t} catch (error) {\n\t\tthrow new ModelsError(\"oauth\", `OAuth auth derivation failed for ${providerId}`, { cause: error });\n\t}\n}\n\nfunction credentialEnvironment(credential: OAuthCredential): ProviderEnv | undefined {\n\tconst value = credential.env;\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n\tconst environment: ProviderEnv = {};\n\tfor (const [name, entry] of Object.entries(value)) {\n\t\tif (typeof entry !== \"string\") return undefined;\n\t\tenvironment[name] = entry;\n\t}\n\treturn environment;\n}\n\nasync function resolveApiKey(\n\tauthContext: AuthContext,\n\tapiKey: ApiKeyAuth,\n\tproviderId: string,\n\tcredential: ApiKeyCredential | undefined,\n\tsignal: AbortSignal,\n): Promise<AuthResult | undefined> {\n\ttry {\n\t\treturn await apiKey.resolve({ ctx: authContext, credential, signal });\n\t} catch (error) {\n\t\tthrow new ModelsError(\"auth\", `API key auth failed for provider ${providerId}`, { cause: error });\n\t}\n}\n\nasync function readCredential(\n\tcredentials: CredentialStore,\n\tproviderId: string,\n\tsignal: AbortSignal,\n): Promise<Credential | undefined> {\n\ttry {\n\t\treturn await credentials.read(providerId, { signal });\n\t} catch (error) {\n\t\tthrow new ModelsError(\"auth\", `Credential store read failed for ${providerId}`, { cause: error });\n\t}\n}\n"]}

package/dist/auth/types.d.ts

@@ -91,10 +91,17 @@ export interface AuthResult {
     env?: ProviderEnv;
     /** Human-readable label for status UI: "ANTHROPIC_API_KEY", "OAuth", "~/.aws/credentials". */
     source?: string;
+    /**
+     * Resolved only from a shared cloud credential chain (AWS profile/keys/roles, Google ADC)
+     * that exists for other tools too, not from a credential configured for this provider.
+     */
+    ambient?: true;
 }
 export interface AuthCheck {
     source?: string;
     type: "api_key" | "oauth";
+    /** Same meaning as `AuthResult.ambient`. */
+    ambient?: true;
 }
 export type AuthType = "api_key" | "oauth";
 /**
@@ -217,6 +224,13 @@ export interface OAuthAuth {
     isSubscription?: boolean;
     /** Selector label for the OAuth login option, e.g. "Sign in with SuperGrok or X Premium". */
     loginLabel?: string;
+    /**
+     * HTTP statuses with which the provider refuses a stored access token before its
+     * own expiry says so (GitHub Copilot revokes its short-lived token server-side and
+     * answers 401/403). The runtime re-exchanges that exact token once and retries the
+     * request before surfacing the failure.
+     */
+    rejectedTokenStatuses?: readonly number[];
     login(interaction: ProviderAuthInteraction): Promise<OAuthCredential>;
     /**
      * Exchange the refresh token. Network call; throws on failure

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACxD,IAAI,EAAE,OAAO,CAAC;CACd;AAED,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE5D,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAE1F;;;OAGG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAEzE;;;;;;;OAOG;IACH,MAAM,CACL,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEnC,qFAAqF;IACrF,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,qFAAqF;IACrF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,CACjD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GAC5G;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAChE,CAAC;AAEF,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,SAAS,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IACA,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+EAA+E;IAC/E,kBAAkB,CAAC,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAExD,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,eAAe,EAAE,oBAAoB,CAAC,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAE5G;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IAEb,qFAAqF;IACrF,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,8EAA8E;IAC9E,KAAK,CAAC,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAExE;;;;OAIG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE;QACb,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,MAAM,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAEnC;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE;QACd,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,MAAM,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IAEb,oFAAoF;IACpF,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,KAAK,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEtE;;;OAGG;IACH,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEpF;;;;;OAKG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE;QACb,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,MAAM,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhE;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACxD,IAAI,EAAE,OAAO,CAAC;CACd;AAED,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE5D,qEAAqE;AACrE,MAAM,WAAW,cAAc;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAE1F;;;OAGG;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAAC;IAEzE;;;;;;;OAOG;IACH,MAAM,CACL,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEnC,qFAAqF;IACrF,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,qFAAqF;IACrF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED,4CAA4C;AAC5C,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,IAAI,CAAC;CACf;AAED,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,CACjD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GAC5G;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAChE,CAAC;AAEF,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,SAAS,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,GAClE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IACA,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,UAAU,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+EAA+E;IAC/E,kBAAkB,CAAC,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAExD,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;CAC/B;AAED,uEAAuE;AACvE,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,eAAe,EAAE,oBAAoB,CAAC,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAE5G;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IAEb,qFAAqF;IACrF,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,8EAA8E;IAC9E,KAAK,CAAC,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAExE;;;;OAIG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE;QACb,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,MAAM,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAEnC;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE;QACd,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,MAAM,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IAEb,oFAAoF;IACpF,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,KAAK,CAAC,WAAW,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEtE;;;OAGG;IACH,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEpF;;;;;OAKG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE;QACb,GAAG,EAAE,WAAW,CAAC;QACjB,UAAU,CAAC,EAAE,eAAe,CAAC;QAC7B,MAAM,EAAE,WAAW,CAAC;KACpB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAEnC;;;;OAIG;IACH,MAAM,CAAC,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB"}

package/dist/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ProviderEnv, ProviderHeaders } from \"../types.ts\";\n\n/**\n * Request auth for a single model request. If a value cannot be expressed as\n * `apiKey`, `headers`, or `baseUrl`, it is provider config, not auth.\n */\nexport interface ModelAuth {\n\tapiKey?: string;\n\theaders?: ProviderHeaders;\n\tbaseUrl?: string;\n}\n\n/**\n * Stored api-key credential. `env` holds provider-scoped environment/config\n * values such as Cloudflare account/gateway ids.\n */\nexport interface ApiKeyCredential {\n\ttype: \"api_key\";\n\tkey?: string;\n\tenv?: ProviderEnv;\n}\n\n/** OAuth token data returned by extension compatibility flows. */\nexport interface OAuthCredentials {\n\trefresh: string;\n\taccess: string;\n\texpires: number;\n\t[key: string]: unknown;\n}\n\n/** Stored canonical OAuth credential. */\nexport interface OAuthCredential extends OAuthCredentials {\n\ttype: \"oauth\";\n}\n\n/** One type-tagged credential per provider — the shape of today's auth.json. */\nexport type Credential = ApiKeyCredential | OAuthCredential;\n\n/** Non-secret credential metadata for account/status enumeration. */\nexport interface CredentialInfo {\n\tproviderId: string;\n\ttype: Credential[\"type\"];\n}\n\n/** Optional cancellation for public auth and credential operations. */\nexport interface AuthOperationOptions {\n\tsignal?: AbortSignal;\n}\n\n/**\n * App-owned credential storage, keyed by `Provider.id`, one entry per\n * provider; an entry may pool sibling slots under `accounts` while its flat\n * fields remain a valid credential. `modify` is the only write path, so every mutation is a\n * serialized read-modify-write; `Models.getAuth()` runs OAuth refresh inside\n * `modify` so concurrent requests cannot double-refresh a rotated token. The\n * app persists a credential after login via\n * `modify(provider.id, async () => credential)`. Login/logout orchestration\n * is app-owned.\n *\n * Error semantics: `read` resolves `undefined` for missing entries. Methods\n * reject only on storage failure; `Models` wraps such rejections in\n * `ModelsError` with code \"auth\". Best-effort stores that serve an in-memory\n * view and record persistence errors internally (like coding-agent's\n * AuthStorage) are valid implementations.\n */\nexport interface CredentialStore {\n\t/**\n\t * Read the stored credential, possibly expired. Display/status use;\n\t * resolved request auth comes from `Models.getAuth()`.\n\t */\n\tread(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;\n\n\t/**\n\t * List stored credential metadata without resolving or exposing secrets.\n\t * Implementations must not execute configured API-key commands while listing.\n\t */\n\tlist(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;\n\n\t/**\n\t * Serialized write — the only write path. `fn` sees the current credential\n\t * because correct writes (refresh, login-during-refresh) depend on it;\n\t * return the new credential, or undefined to leave the entry unchanged.\n\t * Mutual exclusion per provider id, cross-process too where the backing\n\t * store supports it (e.g. a file lock). Resolves with the post-write\n\t * credential. Rejections from `fn` propagate.\n\t */\n\tmodify(\n\t\tproviderId: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined>;\n\n\t/** Remove a credential (logout). Implementations serialize this against `modify`. */\n\tdelete(providerId: string, options?: AuthOperationOptions): Promise<void>;\n}\n\n/** Environment access for auth resolution. Injectable for tests and browsers. */\nexport interface AuthContext {\n\tenv(name: string): Promise<string | undefined>;\n\t/** Check whether a file exists. Supports a leading `~`. Always false in browsers. */\n\tfileExists(path: string): Promise<boolean>;\n}\n\n/** Result of resolving auth for a model. */\nexport interface AuthResult {\n\tauth: ModelAuth;\n\t/** Provider-scoped environment/config values resolved from credentials and ambient context. */\n\tenv?: ProviderEnv;\n\t/** Human-readable label for status UI: \"ANTHROPIC_API_KEY\", \"OAuth\", \"~/.aws/credentials\". */\n\tsource?: string;\n}\n\nexport interface AuthCheck {\n\tsource?: string;\n\ttype: \"api_key\" | \"oauth\";\n}\n\nexport type AuthType = \"api_key\" | \"oauth\";\n\n/**\n * Prompt shown to the user during login. `signal` lets the flow cancel a\n * pending prompt when an out-of-band event resolves the step, e.g. a\n * `manual_code` prompt raced against a callback server, aborted when the\n * callback wins.\n */\nexport type AuthPrompt = { signal?: AbortSignal } & (\n\t| { type: \"text\"; message: string; placeholder?: string }\n\t| { type: \"secret\"; message: string; placeholder?: string }\n\t| { type: \"select\"; message: string; options: readonly { id: string; label: string; description?: string }[] }\n\t| { type: \"manual_code\"; message: string; placeholder?: string }\n);\n\nexport interface AuthInfoLink {\n\turl: string;\n\tlabel?: string;\n}\n\nexport type AuthEvent =\n\t| { type: \"info\"; message: string; links?: readonly AuthInfoLink[] }\n\t| { type: \"auth_url\"; url: string; instructions?: string }\n\t| {\n\t\t\ttype: \"device_code\";\n\t\t\tuserCode: string;\n\t\t\tverificationUri: string;\n\t\t\tintervalSeconds?: number;\n\t\t\texpiresInSeconds?: number;\n\t  }\n\t| { type: \"progress\"; message: string };\n\n/** Secret-free receipt emitted only after the account write succeeds. */\nexport interface AccountLoginReceipt {\n\treadonly providerId: string;\n\treadonly name: string;\n\treadonly origin: \"generated\" | \"provider\";\n}\n\n/**\n * Login interaction callbacks serving both api-key and OAuth flows.\n *\n * `prompt()` returns the entered/selected string (`select` returns the option\n * id). Rejects on cancel/abort. `signal` aborts the whole login flow;\n * per-prompt cancellation uses `AuthPrompt.signal`.\n */\nexport interface AuthInteraction {\n\tsignal?: AbortSignal;\n\t/** Absent for provider-owned envelopes without one unambiguous new slot ID. */\n\tonAccountCommitted?(receipt: AccountLoginReceipt): void;\n\n\tprompt(prompt: AuthPrompt): Promise<string>;\n\tnotify(event: AuthEvent): void;\n}\n\n/** Normalized interaction passed to provider login implementations. */\nexport type ProviderAuthInteraction = Omit<AuthInteraction, \"onAccountCommitted\"> & { signal: AbortSignal };\n\n/**\n * Api-key auth: stored key/provider env plus ambient sources (env vars, AWS\n * profiles, ADC files). Ambient-only providers omit `login`.\n */\nexport interface ApiKeyAuth {\n\t/** Display name, e.g. \"Anthropic API key\". */\n\tname: string;\n\n\t/** Ambient compatibility adapter that must not outrank a stored OAuth credential. */\n\tambientOnly?: boolean;\n\n\t/** Interactive setup (prompt for key/provider env). Absent = ambient-only. */\n\tlogin?(interaction: ProviderAuthInteraction): Promise<ApiKeyCredential>;\n\n\t/**\n\t * Optional side-effect-free availability check. Use this when `resolve()` may\n\t * execute commands or perform other request-time work. Missing means Models\n\t * checks availability by resolving auth.\n\t */\n\tcheck?(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: ApiKeyCredential;\n\t\tsignal: AbortSignal;\n\t}): Promise<AuthCheck | undefined>;\n\n\t/**\n\t * Resolve auth from the stored credential and/or ambient sources, merging\n\t * per field (`credential.key ?? env(\"...\")`, `credential.env?.NAME ?? env(\"...\")`).\n\t * undefined = not configured. Resolution is provider-scoped; model-specific\n\t * endpoint preparation happens after auth has been resolved.\n\t */\n\tresolve(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: ApiKeyCredential;\n\t\tsignal: AbortSignal;\n\t}): Promise<AuthResult | undefined>;\n}\n\n/**\n * OAuth auth. The `refresh`/`toAuth` split lets `Models` own the locked\n * refresh pattern: `refresh` produces a credential, `toAuth` derives request\n * auth from whatever credential ends up stored.\n */\nexport interface OAuthAuth {\n\t/** Display name, e.g. \"Anthropic (Claude Pro/Max)\". */\n\tname: string;\n\n\t/** Whether access through this auth method is backed by a provider subscription. */\n\tisSubscription?: boolean;\n\n\t/** Selector label for the OAuth login option, e.g. \"Sign in with SuperGrok or X Premium\". */\n\tloginLabel?: string;\n\n\tlogin(interaction: ProviderAuthInteraction): Promise<OAuthCredential>;\n\n\t/**\n\t * Exchange the refresh token. Network call; throws on failure\n\t * (invalid_grant etc.). `Models` runs this under the store lock.\n\t */\n\trefresh(credential: OAuthCredential, signal: AbortSignal): Promise<OAuthCredential>;\n\n\t/**\n\t * Optional side-effect-free availability check, mirroring `ApiKeyAuth.check`.\n\t * Supply this when a stored OAuth credential does not by itself imply the\n\t * provider is usable — for example a sentinel envelope that carries zero\n\t * accounts. When absent, any stored OAuth credential counts as configured.\n\t */\n\tcheck?(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: OAuthCredential;\n\t\tsignal: AbortSignal;\n\t}): Promise<AuthCheck | undefined>;\n\n\t/**\n\t * Side-effect-free derivation of request auth from a valid credential.\n\t * Covers per-credential baseUrl (GitHub Copilot). Async so lazy wrappers\n\t * can load the implementation on first use.\n\t */\n\ttoAuth(credential: OAuthCredential): Promise<ModelAuth>;\n}\n\n/**\n * Provider auth. At least one of `apiKey`/`oauth` must be present: even\n * ambient-credential providers and keyless local servers provide `apiKey`\n * auth whose `resolve()` reports whether the provider is configured.\n */\nexport interface ProviderAuth {\n\tapiKey?: ApiKeyAuth;\n\toauth?: OAuthAuth;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ProviderEnv, ProviderHeaders } from \"../types.ts\";\n\n/**\n * Request auth for a single model request. If a value cannot be expressed as\n * `apiKey`, `headers`, or `baseUrl`, it is provider config, not auth.\n */\nexport interface ModelAuth {\n\tapiKey?: string;\n\theaders?: ProviderHeaders;\n\tbaseUrl?: string;\n}\n\n/**\n * Stored api-key credential. `env` holds provider-scoped environment/config\n * values such as Cloudflare account/gateway ids.\n */\nexport interface ApiKeyCredential {\n\ttype: \"api_key\";\n\tkey?: string;\n\tenv?: ProviderEnv;\n}\n\n/** OAuth token data returned by extension compatibility flows. */\nexport interface OAuthCredentials {\n\trefresh: string;\n\taccess: string;\n\texpires: number;\n\t[key: string]: unknown;\n}\n\n/** Stored canonical OAuth credential. */\nexport interface OAuthCredential extends OAuthCredentials {\n\ttype: \"oauth\";\n}\n\n/** One type-tagged credential per provider — the shape of today's auth.json. */\nexport type Credential = ApiKeyCredential | OAuthCredential;\n\n/** Non-secret credential metadata for account/status enumeration. */\nexport interface CredentialInfo {\n\tproviderId: string;\n\ttype: Credential[\"type\"];\n}\n\n/** Optional cancellation for public auth and credential operations. */\nexport interface AuthOperationOptions {\n\tsignal?: AbortSignal;\n}\n\n/**\n * App-owned credential storage, keyed by `Provider.id`, one entry per\n * provider; an entry may pool sibling slots under `accounts` while its flat\n * fields remain a valid credential. `modify` is the only write path, so every mutation is a\n * serialized read-modify-write; `Models.getAuth()` runs OAuth refresh inside\n * `modify` so concurrent requests cannot double-refresh a rotated token. The\n * app persists a credential after login via\n * `modify(provider.id, async () => credential)`. Login/logout orchestration\n * is app-owned.\n *\n * Error semantics: `read` resolves `undefined` for missing entries. Methods\n * reject only on storage failure; `Models` wraps such rejections in\n * `ModelsError` with code \"auth\". Best-effort stores that serve an in-memory\n * view and record persistence errors internally (like coding-agent's\n * AuthStorage) are valid implementations.\n */\nexport interface CredentialStore {\n\t/**\n\t * Read the stored credential, possibly expired. Display/status use;\n\t * resolved request auth comes from `Models.getAuth()`.\n\t */\n\tread(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;\n\n\t/**\n\t * List stored credential metadata without resolving or exposing secrets.\n\t * Implementations must not execute configured API-key commands while listing.\n\t */\n\tlist(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;\n\n\t/**\n\t * Serialized write — the only write path. `fn` sees the current credential\n\t * because correct writes (refresh, login-during-refresh) depend on it;\n\t * return the new credential, or undefined to leave the entry unchanged.\n\t * Mutual exclusion per provider id, cross-process too where the backing\n\t * store supports it (e.g. a file lock). Resolves with the post-write\n\t * credential. Rejections from `fn` propagate.\n\t */\n\tmodify(\n\t\tproviderId: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined>;\n\n\t/** Remove a credential (logout). Implementations serialize this against `modify`. */\n\tdelete(providerId: string, options?: AuthOperationOptions): Promise<void>;\n}\n\n/** Environment access for auth resolution. Injectable for tests and browsers. */\nexport interface AuthContext {\n\tenv(name: string): Promise<string | undefined>;\n\t/** Check whether a file exists. Supports a leading `~`. Always false in browsers. */\n\tfileExists(path: string): Promise<boolean>;\n}\n\n/** Result of resolving auth for a model. */\nexport interface AuthResult {\n\tauth: ModelAuth;\n\t/** Provider-scoped environment/config values resolved from credentials and ambient context. */\n\tenv?: ProviderEnv;\n\t/** Human-readable label for status UI: \"ANTHROPIC_API_KEY\", \"OAuth\", \"~/.aws/credentials\". */\n\tsource?: string;\n\t/**\n\t * Resolved only from a shared cloud credential chain (AWS profile/keys/roles, Google ADC)\n\t * that exists for other tools too, not from a credential configured for this provider.\n\t */\n\tambient?: true;\n}\n\nexport interface AuthCheck {\n\tsource?: string;\n\ttype: \"api_key\" | \"oauth\";\n\t/** Same meaning as `AuthResult.ambient`. */\n\tambient?: true;\n}\n\nexport type AuthType = \"api_key\" | \"oauth\";\n\n/**\n * Prompt shown to the user during login. `signal` lets the flow cancel a\n * pending prompt when an out-of-band event resolves the step, e.g. a\n * `manual_code` prompt raced against a callback server, aborted when the\n * callback wins.\n */\nexport type AuthPrompt = { signal?: AbortSignal } & (\n\t| { type: \"text\"; message: string; placeholder?: string }\n\t| { type: \"secret\"; message: string; placeholder?: string }\n\t| { type: \"select\"; message: string; options: readonly { id: string; label: string; description?: string }[] }\n\t| { type: \"manual_code\"; message: string; placeholder?: string }\n);\n\nexport interface AuthInfoLink {\n\turl: string;\n\tlabel?: string;\n}\n\nexport type AuthEvent =\n\t| { type: \"info\"; message: string; links?: readonly AuthInfoLink[] }\n\t| { type: \"auth_url\"; url: string; instructions?: string }\n\t| {\n\t\t\ttype: \"device_code\";\n\t\t\tuserCode: string;\n\t\t\tverificationUri: string;\n\t\t\tintervalSeconds?: number;\n\t\t\texpiresInSeconds?: number;\n\t  }\n\t| { type: \"progress\"; message: string };\n\n/** Secret-free receipt emitted only after the account write succeeds. */\nexport interface AccountLoginReceipt {\n\treadonly providerId: string;\n\treadonly name: string;\n\treadonly origin: \"generated\" | \"provider\";\n}\n\n/**\n * Login interaction callbacks serving both api-key and OAuth flows.\n *\n * `prompt()` returns the entered/selected string (`select` returns the option\n * id). Rejects on cancel/abort. `signal` aborts the whole login flow;\n * per-prompt cancellation uses `AuthPrompt.signal`.\n */\nexport interface AuthInteraction {\n\tsignal?: AbortSignal;\n\t/** Absent for provider-owned envelopes without one unambiguous new slot ID. */\n\tonAccountCommitted?(receipt: AccountLoginReceipt): void;\n\n\tprompt(prompt: AuthPrompt): Promise<string>;\n\tnotify(event: AuthEvent): void;\n}\n\n/** Normalized interaction passed to provider login implementations. */\nexport type ProviderAuthInteraction = Omit<AuthInteraction, \"onAccountCommitted\"> & { signal: AbortSignal };\n\n/**\n * Api-key auth: stored key/provider env plus ambient sources (env vars, AWS\n * profiles, ADC files). Ambient-only providers omit `login`.\n */\nexport interface ApiKeyAuth {\n\t/** Display name, e.g. \"Anthropic API key\". */\n\tname: string;\n\n\t/** Ambient compatibility adapter that must not outrank a stored OAuth credential. */\n\tambientOnly?: boolean;\n\n\t/** Interactive setup (prompt for key/provider env). Absent = ambient-only. */\n\tlogin?(interaction: ProviderAuthInteraction): Promise<ApiKeyCredential>;\n\n\t/**\n\t * Optional side-effect-free availability check. Use this when `resolve()` may\n\t * execute commands or perform other request-time work. Missing means Models\n\t * checks availability by resolving auth.\n\t */\n\tcheck?(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: ApiKeyCredential;\n\t\tsignal: AbortSignal;\n\t}): Promise<AuthCheck | undefined>;\n\n\t/**\n\t * Resolve auth from the stored credential and/or ambient sources, merging\n\t * per field (`credential.key ?? env(\"...\")`, `credential.env?.NAME ?? env(\"...\")`).\n\t * undefined = not configured. Resolution is provider-scoped; model-specific\n\t * endpoint preparation happens after auth has been resolved.\n\t */\n\tresolve(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: ApiKeyCredential;\n\t\tsignal: AbortSignal;\n\t}): Promise<AuthResult | undefined>;\n}\n\n/**\n * OAuth auth. The `refresh`/`toAuth` split lets `Models` own the locked\n * refresh pattern: `refresh` produces a credential, `toAuth` derives request\n * auth from whatever credential ends up stored.\n */\nexport interface OAuthAuth {\n\t/** Display name, e.g. \"Anthropic (Claude Pro/Max)\". */\n\tname: string;\n\n\t/** Whether access through this auth method is backed by a provider subscription. */\n\tisSubscription?: boolean;\n\n\t/** Selector label for the OAuth login option, e.g. \"Sign in with SuperGrok or X Premium\". */\n\tloginLabel?: string;\n\n\t/**\n\t * HTTP statuses with which the provider refuses a stored access token before its\n\t * own expiry says so (GitHub Copilot revokes its short-lived token server-side and\n\t * answers 401/403). The runtime re-exchanges that exact token once and retries the\n\t * request before surfacing the failure.\n\t */\n\trejectedTokenStatuses?: readonly number[];\n\n\tlogin(interaction: ProviderAuthInteraction): Promise<OAuthCredential>;\n\n\t/**\n\t * Exchange the refresh token. Network call; throws on failure\n\t * (invalid_grant etc.). `Models` runs this under the store lock.\n\t */\n\trefresh(credential: OAuthCredential, signal: AbortSignal): Promise<OAuthCredential>;\n\n\t/**\n\t * Optional side-effect-free availability check, mirroring `ApiKeyAuth.check`.\n\t * Supply this when a stored OAuth credential does not by itself imply the\n\t * provider is usable — for example a sentinel envelope that carries zero\n\t * accounts. When absent, any stored OAuth credential counts as configured.\n\t */\n\tcheck?(input: {\n\t\tctx: AuthContext;\n\t\tcredential?: OAuthCredential;\n\t\tsignal: AbortSignal;\n\t}): Promise<AuthCheck | undefined>;\n\n\t/**\n\t * Side-effect-free derivation of request auth from a valid credential.\n\t * Covers per-credential baseUrl (GitHub Copilot). Async so lazy wrappers\n\t * can load the implementation on first use.\n\t */\n\ttoAuth(credential: OAuthCredential): Promise<ModelAuth>;\n}\n\n/**\n * Provider auth. At least one of `apiKey`/`oauth` must be present: even\n * ambient-credential providers and keyless local servers provide `apiKey`\n * auth whose `resolve()` reports whether the provider is configured.\n */\nexport interface ProviderAuth {\n\tapiKey?: ApiKeyAuth;\n\toauth?: OAuthAuth;\n}\n"]}

package/dist/cursor/context-limit-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-limit-store.d.ts","sourceRoot":"","sources":["../../src/cursor/context-limit-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,6BAA6B,GAAG;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;CAC7D,CAAC;AAMF,gFAAgF;AAChF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,6BAA6B,GAAG,IAAI,CAI9F;AAYD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAM7F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,IAAI,IAAI,CAG1D"}
+{"version":3,"file":"context-limit-store.d.ts","sourceRoot":"","sources":["../../src/cursor/context-limit-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,MAAM,6BAA6B,GAAG;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;CAC7D,CAAC;AAgBF,gFAAgF;AAChF,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,6BAA6B,GAAG,IAAI,CAI9F;AAYD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAM7F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,IAAI,IAAI,CAG1D"}

package/dist/cursor/context-limit-store.js

@@ -11,26 +11,31 @@
  * the browser. Node processes install file persistence through
  * `installCursorContextLimitPersistence` - see `utils/cursor-context-limit.ts`.
  */
-const observedLimits = new Map();
-let persistence;
-let hydrated = false;
+import { processSingleton } from "../utils/process-singleton.js";
+// The Cursor stream records into this store and the coding agent reads it; the release bundle
+// gives each of them its own copy of this module, so the state is process-wide.
+const store = processSingleton("@earendil-works/pi-ai:cursor-context-limits", () => ({
+    limits: new Map(),
+    persistence: undefined,
+    hydrated: false,
+}));
 /** Installs the process-wide persistence port. Idempotent per port identity. */
 export function installCursorContextLimitPersistence(port) {
-    if (persistence === port)
+    if (store.persistence === port)
         return;
-    persistence = port;
-    hydrated = false;
+    store.persistence = port;
+    store.hydrated = false;
 }
 function hydrate() {
-    if (hydrated)
+    if (store.hydrated)
         return;
     // Set before loading: a load that observes nothing must not retry per read.
-    hydrated = true;
-    if (!persistence)
+    store.hydrated = true;
+    if (!store.persistence)
         return;
-    for (const [modelId, maxTokens] of persistence.load()) {
-        if (!observedLimits.has(modelId))
-            observedLimits.set(modelId, maxTokens);
+    for (const [modelId, maxTokens] of store.persistence.load()) {
+        if (!store.limits.has(modelId))
+            store.limits.set(modelId, maxTokens);
     }
 }
 /**
@@ -41,14 +46,14 @@ export function recordCursorContextLimit(modelId, maxTokens) {
     if (maxTokens === undefined || !Number.isFinite(maxTokens) || maxTokens <= 0)
         return;
     hydrate();
-    if (observedLimits.get(modelId) === maxTokens)
+    if (store.limits.get(modelId) === maxTokens)
         return;
-    observedLimits.set(modelId, maxTokens);
-    persistence?.save(observedLimits);
+    store.limits.set(modelId, maxTokens);
+    store.persistence?.save(store.limits);
 }
 export function getCursorContextLimit(modelId) {
     hydrate();
-    return observedLimits.get(modelId);
+    return store.limits.get(modelId);
 }
 /** The window to trust for `modelId`: what the server reported, else the catalog. */
 export function resolveCursorContextWindow(modelId, catalogWindow) {
@@ -56,7 +61,7 @@ export function resolveCursorContextWindow(modelId, catalogWindow) {
 }
 /** Drops in-memory state so the next read re-hydrates from the installed port. */
 export function resetCursorContextLimitStoreForTest() {
-    observedLimits.clear();
-    hydrated = false;
+    store.limits.clear();
+    store.hydrated = false;
 }
 //# sourceMappingURL=context-limit-store.js.map

package/dist/cursor/context-limit-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"context-limit-store.js","sourceRoot":"","sources":["../../src/cursor/context-limit-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;AACjD,IAAI,WAAsD,CAAC;AAC3D,IAAI,QAAQ,GAAG,KAAK,CAAC;AAErB,gFAAgF;AAChF,MAAM,UAAU,oCAAoC,CAAC,IAAmC;IACvF,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO;IACjC,WAAW,GAAG,IAAI,CAAC;IACnB,QAAQ,GAAG,KAAK,CAAC;AAClB,CAAC;AAED,SAAS,OAAO;IACf,IAAI,QAAQ;QAAE,OAAO;IACrB,4EAA4E;IAC5E,QAAQ,GAAG,IAAI,CAAC;IAChB,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1E,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,SAA6B;IACtF,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO;IACrF,OAAO,EAAE,CAAC;IACV,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO;IACtD,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,OAAO,EAAE,CAAC;IACV,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,aAAqB;IAChF,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC;AACxD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mCAAmC;IAClD,cAAc,CAAC,KAAK,EAAE,CAAC;IACvB,QAAQ,GAAG,KAAK,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Context ceilings Cursor itself reported, keyed by model id.\n *\n * `GetUsableModels` carries no window, so `CURSOR_MODEL_CAPABILITIES` is a\n * committed guess at what each family accepts. The server states the truth on\n * every conversation checkpoint (`tokenDetails.maxTokens`), so once a model has\n * been observed, that value outranks the catalog for every later request.\n *\n * This module stays browser-safe: `providers/cursor.ts` and\n * `cursor/store-migration.ts` materialize catalog windows and are bundled for\n * the browser. Node processes install file persistence through\n * `installCursorContextLimitPersistence` - see `utils/cursor-context-limit.ts`.\n */\n\nexport type CursorContextLimitPersistence = {\n\t/** Limits observed by earlier processes. Called at most once per install. */\n\treadonly load: () => ReadonlyMap<string, number>;\n\t/** Called only when a recorded limit actually changed the store. */\n\treadonly save: (limits: ReadonlyMap<string, number>) => void;\n};\n\nconst observedLimits = new Map<string, number>();\nlet persistence: CursorContextLimitPersistence | undefined;\nlet hydrated = false;\n\n/** Installs the process-wide persistence port. Idempotent per port identity. */\nexport function installCursorContextLimitPersistence(port: CursorContextLimitPersistence): void {\n\tif (persistence === port) return;\n\tpersistence = port;\n\thydrated = false;\n}\n\nfunction hydrate(): void {\n\tif (hydrated) return;\n\t// Set before loading: a load that observes nothing must not retry per read.\n\thydrated = true;\n\tif (!persistence) return;\n\tfor (const [modelId, maxTokens] of persistence.load()) {\n\t\tif (!observedLimits.has(modelId)) observedLimits.set(modelId, maxTokens);\n\t}\n}\n\n/**\n * Records the server-reported ceiling for `modelId`. The first checkpoint of a\n * conversation reports 0, so non-positive and non-finite values are ignored.\n */\nexport function recordCursorContextLimit(modelId: string, maxTokens: number | undefined): void {\n\tif (maxTokens === undefined || !Number.isFinite(maxTokens) || maxTokens <= 0) return;\n\thydrate();\n\tif (observedLimits.get(modelId) === maxTokens) return;\n\tobservedLimits.set(modelId, maxTokens);\n\tpersistence?.save(observedLimits);\n}\n\nexport function getCursorContextLimit(modelId: string): number | undefined {\n\thydrate();\n\treturn observedLimits.get(modelId);\n}\n\n/** The window to trust for `modelId`: what the server reported, else the catalog. */\nexport function resolveCursorContextWindow(modelId: string, catalogWindow: number): number {\n\treturn getCursorContextLimit(modelId) ?? catalogWindow;\n}\n\n/** Drops in-memory state so the next read re-hydrates from the installed port. */\nexport function resetCursorContextLimitStoreForTest(): void {\n\tobservedLimits.clear();\n\thydrated = false;\n}\n"]}
+{"version":3,"file":"context-limit-store.js","sourceRoot":"","sources":["../../src/cursor/context-limit-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAejE,8FAA8F;AAC9F,gFAAgF;AAChF,MAAM,KAAK,GAAG,gBAAgB,CAAsB,6CAA6C,EAAE,GAAG,EAAE,CAAC,CAAC;IACzG,MAAM,EAAE,IAAI,GAAG,EAAE;IACjB,WAAW,EAAE,SAAS;IACtB,QAAQ,EAAE,KAAK;CACf,CAAC,CAAC,CAAC;AAEJ,gFAAgF;AAChF,MAAM,UAAU,oCAAoC,CAAC,IAAmC;IACvF,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO;IACvC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,OAAO;IACf,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO;IAC3B,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO;IAC/B,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,SAA6B;IACtF,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO;IACrF,OAAO,EAAE,CAAC;IACV,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO;IACpD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,OAAO,EAAE,CAAC;IACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,OAAe,EAAE,aAAqB;IAChF,OAAO,qBAAqB,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC;AACxD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mCAAmC;IAClD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC;AACxB,CAAC","sourcesContent":["/**\n * Context ceilings Cursor itself reported, keyed by model id.\n *\n * `GetUsableModels` carries no window, so `CURSOR_MODEL_CAPABILITIES` is a\n * committed guess at what each family accepts. The server states the truth on\n * every conversation checkpoint (`tokenDetails.maxTokens`), so once a model has\n * been observed, that value outranks the catalog for every later request.\n *\n * This module stays browser-safe: `providers/cursor.ts` and\n * `cursor/store-migration.ts` materialize catalog windows and are bundled for\n * the browser. Node processes install file persistence through\n * `installCursorContextLimitPersistence` - see `utils/cursor-context-limit.ts`.\n */\n\nimport { processSingleton } from \"../utils/process-singleton.ts\";\n\nexport type CursorContextLimitPersistence = {\n\t/** Limits observed by earlier processes. Called at most once per install. */\n\treadonly load: () => ReadonlyMap<string, number>;\n\t/** Called only when a recorded limit actually changed the store. */\n\treadonly save: (limits: ReadonlyMap<string, number>) => void;\n};\n\ntype ObservedLimitsStore = {\n\treadonly limits: Map<string, number>;\n\tpersistence: CursorContextLimitPersistence | undefined;\n\thydrated: boolean;\n};\n\n// The Cursor stream records into this store and the coding agent reads it; the release bundle\n// gives each of them its own copy of this module, so the state is process-wide.\nconst store = processSingleton<ObservedLimitsStore>(\"@earendil-works/pi-ai:cursor-context-limits\", () => ({\n\tlimits: new Map(),\n\tpersistence: undefined,\n\thydrated: false,\n}));\n\n/** Installs the process-wide persistence port. Idempotent per port identity. */\nexport function installCursorContextLimitPersistence(port: CursorContextLimitPersistence): void {\n\tif (store.persistence === port) return;\n\tstore.persistence = port;\n\tstore.hydrated = false;\n}\n\nfunction hydrate(): void {\n\tif (store.hydrated) return;\n\t// Set before loading: a load that observes nothing must not retry per read.\n\tstore.hydrated = true;\n\tif (!store.persistence) return;\n\tfor (const [modelId, maxTokens] of store.persistence.load()) {\n\t\tif (!store.limits.has(modelId)) store.limits.set(modelId, maxTokens);\n\t}\n}\n\n/**\n * Records the server-reported ceiling for `modelId`. The first checkpoint of a\n * conversation reports 0, so non-positive and non-finite values are ignored.\n */\nexport function recordCursorContextLimit(modelId: string, maxTokens: number | undefined): void {\n\tif (maxTokens === undefined || !Number.isFinite(maxTokens) || maxTokens <= 0) return;\n\thydrate();\n\tif (store.limits.get(modelId) === maxTokens) return;\n\tstore.limits.set(modelId, maxTokens);\n\tstore.persistence?.save(store.limits);\n}\n\nexport function getCursorContextLimit(modelId: string): number | undefined {\n\thydrate();\n\treturn store.limits.get(modelId);\n}\n\n/** The window to trust for `modelId`: what the server reported, else the catalog. */\nexport function resolveCursorContextWindow(modelId: string, catalogWindow: number): number {\n\treturn getCursorContextLimit(modelId) ?? catalogWindow;\n}\n\n/** Drops in-memory state so the next read re-hydrates from the installed port. */\nexport function resetCursorContextLimitStoreForTest(): void {\n\tstore.limits.clear();\n\tstore.hydrated = false;\n}\n"]}

package/dist/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAKA,OAAO,EACN,KAAK,uBAAuB,EAI5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACX,SAAS,EACT,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,eAAe,EACf,YAAY,EACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAuB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,KAAK,EACX,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,2BAA2B,EAC3B,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,KAAK,EAEL,kBAAkB,EAElB,eAAe,EAEf,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,OAAO,EACN,WAAW,EACX,KAAK,eAAe,EACpB,8BAA8B,EAC9B,4BAA4B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IACjC,6FAA6F;IAC7F,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACpC,8FAA8F;IAC9F,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,qFAAqF;IACrF,MAAM,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,sDAAsD;IACtD,YAAY,EAAE,OAAO,CAAC;IACtB,6FAA6F;IAC7F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,MAAM,EAAE,WAAW,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wFAAwF;IACxF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACvC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5F;AAED,MAAM,MAAM,sBAAsB,CAAC,IAAI,SAAS,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC;AACxG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;AACtF,MAAM,MAAM,0BAA0B,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AACxF,MAAM,MAAM,2BAA2B,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,mEAAmE;IACnE,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAE1C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B;;;;;OAKG;IACH,SAAS,IAAI,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAEpC;;;;;OAKG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;OAIG;IACH,YAAY,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAE1G,MAAM,CAAC,CAAC,SAAS,IAAI,EACpB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,2BAA2B,CAAC;IAE/B,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,2BAA2B,CAAC;IAC/G,aAAa,CAAC,CACb,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,2BAA2B,CAAC;IAC/B,cAAc,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED;;;;GAIG;AACH,MAAM,WAAW,MAAM;IACtB,YAAY,IAAI,SAAS,QAAQ,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAE9C;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAEpD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAE/D;;;;OAIG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEtE,yFAAyF;IACzF,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAE9F,sEAAsE;IACtE,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAElG;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAClG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEjG,2EAA2E;IAC3E,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE7F,mDAAmD;IACnD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhG,MAAM,CAAC,IAAI,SAAS,GAAG,EACtB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,sBAAsB,CAAC,IAAI,CAAC,GACpC,2BAA2B,CAAC;IAE/B,QAAQ,CAAC,IAAI,SAAS,GAAG,EACxB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,sBAAsB,CAAC,IAAI,CAAC,GACpC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE7B,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,2BAA2B,CAAC;IACpH,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpH,cAAc,CACb,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,0BAA0B,GAClC,2BAA2B,CAAC;IAC/B,aAAa,CACZ,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,0BAA0B,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChH;AAED,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC5C,8DAA8D;IAC9D,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtC,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,IAAI,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;CAC1B;AAsgBD,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAEzE;AAED,MAAM,WAAW,qBAAqB,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,mEAAmE;IACnE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,+EAA+E;IAC/E,IAAI,EAAE,YAAY,CAAC;IACnB,uEAAuE;IACvE,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/B,+FAA+F;IAC/F,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS,KAAK,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9G,kFAAkF;IAClF,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CA4GzG;AAED;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAE3F;AAED,wBAAgB,aAAa,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAoB/F;AAmBD,yFAAyF;AACzF,wBAAgB,2BAA2B,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,gBAAgB,GAAG,SAAS,CAM9G;AAED,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,EAAE,CAUrG;AAED,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,GAAG,EAClD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,KAAK,EAAE,kBAAkB,GACvB,kBAAkB,CAgBpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAM3E;AA2CD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAMzE;AAQD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAGzF;AAgCD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAS,GAAG,EAC9C,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS,EACjC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS,GAC/B,OAAO,CAGT"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAKA,OAAO,EACN,KAAK,uBAAuB,EAI5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACX,SAAS,EACT,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,eAAe,EACf,YAAY,EACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAuB,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,KAAK,EACX,GAAG,EACH,gBAAgB,EAChB,gBAAgB,EAChB,2BAA2B,EAC3B,OAAO,EACP,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,KAAK,EAEL,kBAAkB,EAElB,eAAe,EAEf,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,EACL,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,OAAO,EACN,WAAW,EACX,KAAK,eAAe,EACpB,8BAA8B,EAC9B,4BAA4B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IACjC,6FAA6F;IAC7F,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACpC,8FAA8F;IAC9F,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,qFAAqF;IACrF,MAAM,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpC;;;OAGG;IACH,OAAO,CAAC,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,sDAAsD;IACtD,YAAY,EAAE,OAAO,CAAC;IACtB,6FAA6F;IAC7F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,MAAM,EAAE,WAAW,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wFAAwF;IACxF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACvC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5F;AAED,MAAM,MAAM,sBAAsB,CAAC,IAAI,SAAS,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC;AACxG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;AACtF,MAAM,MAAM,0BAA0B,GAAG,oBAAoB,GAAG,uBAAuB,CAAC;AACxF,MAAM,MAAM,2BAA2B,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,mEAAmE;IACnE,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAE1C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B;;;;;OAKG;IACH,SAAS,IAAI,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAEpC;;;;;OAKG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;OAIG;IACH,YAAY,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAE1G,MAAM,CAAC,CAAC,SAAS,IAAI,EACpB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EACf,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAC3B,2BAA2B,CAAC;IAE/B,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,2BAA2B,CAAC;IAC/G,aAAa,CAAC,CACb,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,2BAA2B,CAAC;IAC/B,cAAc,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED;;;;GAIG;AACH,MAAM,WAAW,MAAM;IACtB,YAAY,IAAI,SAAS,QAAQ,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAE9C;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAEpD;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAE/D;;;;OAIG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEtE,yFAAyF;IACzF,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAE9F,sEAAsE;IACtE,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAElG;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAClG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEjG,2EAA2E;IAC3E,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE7F,mDAAmD;IACnD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhG,MAAM,CAAC,IAAI,SAAS,GAAG,EACtB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,sBAAsB,CAAC,IAAI,CAAC,GACpC,2BAA2B,CAAC;IAE/B,QAAQ,CAAC,IAAI,SAAS,GAAG,EACxB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,sBAAsB,CAAC,IAAI,CAAC,GACpC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE7B,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,2BAA2B,CAAC;IACpH,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpH,cAAc,CACb,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,0BAA0B,GAClC,2BAA2B,CAAC;IAC/B,aAAa,CACZ,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE,0BAA0B,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChH;AAED,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC5C,8DAA8D;IAC9D,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtC,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,IAAI,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;CAC1B;AAwgBD,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAEzE;AAED,MAAM,WAAW,qBAAqB,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,mEAAmE;IACnE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,+EAA+E;IAC/E,IAAI,EAAE,YAAY,CAAC;IACnB,uEAAuE;IACvE,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/B,+FAA+F;IAC/F,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjF;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3E,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,SAAS,KAAK,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9G,kFAAkF;IAClF,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG,EAAE,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CA4GzG;AAED;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAE3F;AAED,wBAAgB,aAAa,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAoB/F;AAmBD,yFAAyF;AACzF,wBAAgB,2BAA2B,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,gBAAgB,GAAG,SAAS,CAM9G;AAED,wBAAgB,0BAA0B,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,EAAE,CAUrG;AAED,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,GAAG,EAClD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAClB,KAAK,EAAE,kBAAkB,GACvB,kBAAkB,CAgBpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAM3E;AA2CD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAMzE;AAQD;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,SAAS,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAGzF;AAgCD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAS,GAAG,EAC9C,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS,EACjC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,SAAS,GAC/B,OAAO,CAGT"}

package/dist/models.js

@@ -225,8 +225,9 @@ class ModelsImpl {
             }
             else {
                 const resolution = await resolveProviderAuth(provider, this.credentials, this.authContext, { signal });
-                if (resolution)
-                    return { source: resolution.source, type: "api_key" };
+                if (resolution) {
+                    return { source: resolution.source, type: "api_key", ...(resolution.ambient ? { ambient: true } : {}) };
+                }
             }
         }
         if (!oauth?.check)