@code-yeongyu/senpi 2026.7.23 → 2026.7.24

package/node_modules/@earendil-works/pi-ai/dist/api-registry.js

@@ -1,5 +1,23 @@
 import { getRegisteredFauxProvider } from "./providers/faux.js";
 const apiProviderRegistry = new Map();
+const builtinApiProviderRegistry = new Map();
+let getProviderScope = () => undefined;
+let providerScopeStrictMode = false;
+/** Installs the optional node-only scope lookup without importing node APIs here. */
+export function installProviderScopeAccessor(accessor) {
+    getProviderScope = accessor;
+}
+export function setProviderScopeStrictMode(enabled) {
+    providerScopeStrictMode = enabled;
+}
+function getActiveProviderScope() {
+    const scope = getProviderScope();
+    if (scope?.state === "closed")
+        throw new Error("Provider scope is closed");
+    if (!scope && providerScopeStrictMode)
+        throw new Error("Provider scope is required in strict mode");
+    return scope;
+}
 function wrapStream(api, stream) {
     return (model, context, options) => {
         if (model.api !== api)
@@ -14,17 +32,35 @@ function wrapStreamSimple(api, streamSimple) {
         return streamSimple(model, context, options);
     };
 }
-export function registerApiProvider(provider, sourceId) {
-    apiProviderRegistry.set(provider.api, {
+function createRegisteredProvider(provider, sourceId) {
+    return {
         provider: {
             api: provider.api,
             stream: wrapStream(provider.api, provider.stream),
             streamSimple: wrapStreamSimple(provider.api, provider.streamSimple),
         },
         sourceId,
-    });
+    };
+}
+export function registerApiProvider(provider, sourceId) {
+    const scope = getActiveProviderScope();
+    const registry = scope ? scope.overlay : apiProviderRegistry;
+    registry.set(provider.api, createRegisteredProvider(provider, sourceId));
+}
+/** Registers a builtin once, retaining its immutable identity for active scopes. */
+export function registerBuiltinApiProvider(provider) {
+    const registered = builtinApiProviderRegistry.get(provider.api) ?? createRegisteredProvider(provider);
+    builtinApiProviderRegistry.set(provider.api, registered);
+    if (!apiProviderRegistry.has(provider.api))
+        apiProviderRegistry.set(provider.api, registered);
+}
+export function getBuiltinApiProvider(api) {
+    return builtinApiProviderRegistry.get(api)?.provider;
 }
 export function getApiProvider(api) {
+    const scope = getActiveProviderScope();
+    if (scope)
+        return scope.overlay.get(api)?.provider ?? builtinApiProviderRegistry.get(api)?.provider;
     const faux = getRegisteredFauxProvider(api);
     if (faux) {
         return {
@@ -36,15 +72,25 @@ export function getApiProvider(api) {
     return apiProviderRegistry.get(api)?.provider;
 }
 export function getApiProviders() {
+    const scope = getActiveProviderScope();
+    if (scope) {
+        const providers = new Map(builtinApiProviderRegistry);
+        for (const [api, entry] of scope.overlay)
+            providers.set(api, entry);
+        return Array.from(providers.values(), (entry) => entry.provider);
+    }
     return Array.from(apiProviderRegistry.values(), (entry) => entry.provider);
 }
 export function unregisterApiProviders(sourceId) {
-    for (const [api, entry] of apiProviderRegistry.entries()) {
+    const scope = getActiveProviderScope();
+    const registry = scope ? scope.overlay : apiProviderRegistry;
+    for (const [api, entry] of registry.entries()) {
         if (entry.sourceId === sourceId)
-            apiProviderRegistry.delete(api);
+            registry.delete(api);
     }
 }
 export function clearApiProviders() {
-    apiProviderRegistry.clear();
+    const scope = getActiveProviderScope();
+    (scope ? scope.overlay : apiProviderRegistry).clear();
 }
 //# sourceMappingURL=api-registry.js.map

package/node_modules/@earendil-works/pi-ai/dist/api-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-registry.js","sourceRoot":"","sources":["../src/api-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAwChE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAErE,SAAS,UAAU,CAClB,GAAS,EACT,MAAsC;IAEtC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,GAAG,aAAa,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,KAAoB,EAAE,OAAO,EAAE,OAAmB,CAAC,CAAC;IACnE,CAAC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,GAAS,EACT,YAAuD;IAEvD,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,GAAG,aAAa,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,YAAY,CAAC,KAAoB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAClC,QAAqC,EACrC,QAAiB;IAEjB,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE;QACrC,QAAQ,EAAE;YACT,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC;YACjD,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC;SACnE;QACD,QAAQ;KACR,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAQ;IACtC,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,IAAI,EAAE,CAAC;QACV,OAAO;YACN,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACzC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;SAC3D,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,mBAAmB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["import { getRegisteredFauxProvider } from \"./providers/faux.ts\";\nimport type {\n\tApi,\n\tAssistantMessageEventStream,\n\tContext,\n\tModel,\n\tSimpleStreamOptions,\n\tStreamFunction,\n\tStreamOptions,\n} from \"./types.ts\";\n\nexport type ApiStreamFunction = (\n\tmodel: Model<Api>,\n\tcontext: Context,\n\toptions?: StreamOptions,\n) => AssistantMessageEventStream;\n\nexport type ApiStreamSimpleFunction = (\n\tmodel: Model<Api>,\n\tcontext: Context,\n\toptions?: SimpleStreamOptions,\n) => AssistantMessageEventStream;\n\nexport interface ApiProvider<TApi extends Api = Api, TOptions extends StreamOptions = StreamOptions> {\n\tapi: TApi;\n\tstream: StreamFunction<TApi, TOptions>;\n\tstreamSimple: StreamFunction<TApi, SimpleStreamOptions>;\n}\n\nexport interface ApiProviderInternal {\n\tapi: Api;\n\tstream: ApiStreamFunction;\n\tstreamSimple: ApiStreamSimpleFunction;\n}\n\ntype RegisteredApiProvider = {\n\tprovider: ApiProviderInternal;\n\tsourceId?: string;\n};\n\nconst apiProviderRegistry = new Map<string, RegisteredApiProvider>();\n\nfunction wrapStream<TApi extends Api, TOptions extends StreamOptions>(\n\tapi: TApi,\n\tstream: StreamFunction<TApi, TOptions>,\n): ApiStreamFunction {\n\treturn (model, context, options) => {\n\t\tif (model.api !== api) throw new Error(`Mismatched api: ${model.api} expected ${api}`);\n\t\treturn stream(model as Model<TApi>, context, options as TOptions);\n\t};\n}\n\nfunction wrapStreamSimple<TApi extends Api>(\n\tapi: TApi,\n\tstreamSimple: StreamFunction<TApi, SimpleStreamOptions>,\n): ApiStreamSimpleFunction {\n\treturn (model, context, options) => {\n\t\tif (model.api !== api) throw new Error(`Mismatched api: ${model.api} expected ${api}`);\n\t\treturn streamSimple(model as Model<TApi>, context, options);\n\t};\n}\n\nexport function registerApiProvider<TApi extends Api, TOptions extends StreamOptions>(\n\tprovider: ApiProvider<TApi, TOptions>,\n\tsourceId?: string,\n): void {\n\tapiProviderRegistry.set(provider.api, {\n\t\tprovider: {\n\t\t\tapi: provider.api,\n\t\t\tstream: wrapStream(provider.api, provider.stream),\n\t\t\tstreamSimple: wrapStreamSimple(provider.api, provider.streamSimple),\n\t\t},\n\t\tsourceId,\n\t});\n}\n\nexport function getApiProvider(api: Api): ApiProviderInternal | undefined {\n\tconst faux = getRegisteredFauxProvider(api);\n\tif (faux) {\n\t\treturn {\n\t\t\tapi: faux.api,\n\t\t\tstream: wrapStream(faux.api, faux.stream),\n\t\t\tstreamSimple: wrapStreamSimple(faux.api, faux.streamSimple),\n\t\t};\n\t}\n\treturn apiProviderRegistry.get(api)?.provider;\n}\n\nexport function getApiProviders(): ApiProviderInternal[] {\n\treturn Array.from(apiProviderRegistry.values(), (entry) => entry.provider);\n}\n\nexport function unregisterApiProviders(sourceId: string): void {\n\tfor (const [api, entry] of apiProviderRegistry.entries()) {\n\t\tif (entry.sourceId === sourceId) apiProviderRegistry.delete(api);\n\t}\n}\n\nexport function clearApiProviders(): void {\n\tapiProviderRegistry.clear();\n}\n"]}
+{"version":3,"file":"api-registry.js","sourceRoot":"","sources":["../src/api-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AA8ChE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAiC,CAAC;AACrE,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAiC,CAAC;AAC5E,IAAI,gBAAgB,GAA0C,GAAG,EAAE,CAAC,SAAS,CAAC;AAC9E,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC,qFAAqF;AACrF,MAAM,UAAU,4BAA4B,CAAC,QAA+C;IAC3F,gBAAgB,GAAG,QAAQ,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IAC1D,uBAAuB,GAAG,OAAO,CAAC;AACnC,CAAC;AAED,SAAS,sBAAsB;IAC9B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3E,IAAI,CAAC,KAAK,IAAI,uBAAuB;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpG,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAClB,GAAS,EACT,MAAsC;IAEtC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,GAAG,aAAa,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC,KAAoB,EAAE,OAAO,EAAE,OAAmB,CAAC,CAAC;IACnE,CAAC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,GAAS,EACT,YAAuD;IAEvD,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,GAAG,aAAa,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,YAAY,CAAC,KAAoB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAChC,QAAqC,EACrC,QAAiB;IAEjB,OAAO;QACN,QAAQ,EAAE;YACT,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC;YACjD,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC;SACnE;QACD,QAAQ;KACR,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAClC,QAAqC,EACrC,QAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,0BAA0B,CACzC,QAAqC;IAErC,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACtG,0BAA0B,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAQ;IAC7C,OAAO,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAQ;IACtC,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC;IAEpG,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,IAAI,EAAE,CAAC;QACV,OAAO;YACN,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACzC,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC;SAC3D,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB;IAChC,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAC;AACvD,CAAC","sourcesContent":["import { getRegisteredFauxProvider } from \"./providers/faux.ts\";\nimport type {\n\tApi,\n\tAssistantMessageEventStream,\n\tContext,\n\tModel,\n\tSimpleStreamOptions,\n\tStreamFunction,\n\tStreamOptions,\n} from \"./types.ts\";\n\nexport type ApiStreamFunction = (\n\tmodel: Model<Api>,\n\tcontext: Context,\n\toptions?: StreamOptions,\n) => AssistantMessageEventStream;\n\nexport type ApiStreamSimpleFunction = (\n\tmodel: Model<Api>,\n\tcontext: Context,\n\toptions?: SimpleStreamOptions,\n) => AssistantMessageEventStream;\n\nexport interface ApiProvider<TApi extends Api = Api, TOptions extends StreamOptions = StreamOptions> {\n\tapi: TApi;\n\tstream: StreamFunction<TApi, TOptions>;\n\tstreamSimple: StreamFunction<TApi, SimpleStreamOptions>;\n}\n\nexport interface ApiProviderInternal {\n\tapi: Api;\n\tstream: ApiStreamFunction;\n\tstreamSimple: ApiStreamSimpleFunction;\n}\n\nexport type RegisteredApiProvider = {\n\tprovider: ApiProviderInternal;\n\tsourceId?: string;\n};\n\n/** Browser-neutral shape installed by the node-only provider-scope subpath. */\nexport interface ProviderScopeAccess {\n\tstate: \"active\" | \"closed\";\n\toverlay: Map<string, RegisteredApiProvider>;\n}\n\nconst apiProviderRegistry = new Map<string, RegisteredApiProvider>();\nconst builtinApiProviderRegistry = new Map<string, RegisteredApiProvider>();\nlet getProviderScope: () => ProviderScopeAccess | undefined = () => undefined;\nlet providerScopeStrictMode = false;\n\n/** Installs the optional node-only scope lookup without importing node APIs here. */\nexport function installProviderScopeAccessor(accessor: () => ProviderScopeAccess | undefined): void {\n\tgetProviderScope = accessor;\n}\n\nexport function setProviderScopeStrictMode(enabled: boolean): void {\n\tproviderScopeStrictMode = enabled;\n}\n\nfunction getActiveProviderScope(): ProviderScopeAccess | undefined {\n\tconst scope = getProviderScope();\n\tif (scope?.state === \"closed\") throw new Error(\"Provider scope is closed\");\n\tif (!scope && providerScopeStrictMode) throw new Error(\"Provider scope is required in strict mode\");\n\treturn scope;\n}\n\nfunction wrapStream<TApi extends Api, TOptions extends StreamOptions>(\n\tapi: TApi,\n\tstream: StreamFunction<TApi, TOptions>,\n): ApiStreamFunction {\n\treturn (model, context, options) => {\n\t\tif (model.api !== api) throw new Error(`Mismatched api: ${model.api} expected ${api}`);\n\t\treturn stream(model as Model<TApi>, context, options as TOptions);\n\t};\n}\n\nfunction wrapStreamSimple<TApi extends Api>(\n\tapi: TApi,\n\tstreamSimple: StreamFunction<TApi, SimpleStreamOptions>,\n): ApiStreamSimpleFunction {\n\treturn (model, context, options) => {\n\t\tif (model.api !== api) throw new Error(`Mismatched api: ${model.api} expected ${api}`);\n\t\treturn streamSimple(model as Model<TApi>, context, options);\n\t};\n}\n\nfunction createRegisteredProvider<TApi extends Api, TOptions extends StreamOptions>(\n\tprovider: ApiProvider<TApi, TOptions>,\n\tsourceId?: string,\n): RegisteredApiProvider {\n\treturn {\n\t\tprovider: {\n\t\t\tapi: provider.api,\n\t\t\tstream: wrapStream(provider.api, provider.stream),\n\t\t\tstreamSimple: wrapStreamSimple(provider.api, provider.streamSimple),\n\t\t},\n\t\tsourceId,\n\t};\n}\n\nexport function registerApiProvider<TApi extends Api, TOptions extends StreamOptions>(\n\tprovider: ApiProvider<TApi, TOptions>,\n\tsourceId?: string,\n): void {\n\tconst scope = getActiveProviderScope();\n\tconst registry = scope ? scope.overlay : apiProviderRegistry;\n\tregistry.set(provider.api, createRegisteredProvider(provider, sourceId));\n}\n\n/** Registers a builtin once, retaining its immutable identity for active scopes. */\nexport function registerBuiltinApiProvider<TApi extends Api, TOptions extends StreamOptions>(\n\tprovider: ApiProvider<TApi, TOptions>,\n): void {\n\tconst registered = builtinApiProviderRegistry.get(provider.api) ?? createRegisteredProvider(provider);\n\tbuiltinApiProviderRegistry.set(provider.api, registered);\n\tif (!apiProviderRegistry.has(provider.api)) apiProviderRegistry.set(provider.api, registered);\n}\n\nexport function getBuiltinApiProvider(api: Api): ApiProviderInternal | undefined {\n\treturn builtinApiProviderRegistry.get(api)?.provider;\n}\n\nexport function getApiProvider(api: Api): ApiProviderInternal | undefined {\n\tconst scope = getActiveProviderScope();\n\tif (scope) return scope.overlay.get(api)?.provider ?? builtinApiProviderRegistry.get(api)?.provider;\n\n\tconst faux = getRegisteredFauxProvider(api);\n\tif (faux) {\n\t\treturn {\n\t\t\tapi: faux.api,\n\t\t\tstream: wrapStream(faux.api, faux.stream),\n\t\t\tstreamSimple: wrapStreamSimple(faux.api, faux.streamSimple),\n\t\t};\n\t}\n\treturn apiProviderRegistry.get(api)?.provider;\n}\n\nexport function getApiProviders(): ApiProviderInternal[] {\n\tconst scope = getActiveProviderScope();\n\tif (scope) {\n\t\tconst providers = new Map(builtinApiProviderRegistry);\n\t\tfor (const [api, entry] of scope.overlay) providers.set(api, entry);\n\t\treturn Array.from(providers.values(), (entry) => entry.provider);\n\t}\n\treturn Array.from(apiProviderRegistry.values(), (entry) => entry.provider);\n}\n\nexport function unregisterApiProviders(sourceId: string): void {\n\tconst scope = getActiveProviderScope();\n\tconst registry = scope ? scope.overlay : apiProviderRegistry;\n\tfor (const [api, entry] of registry.entries()) {\n\t\tif (entry.sourceId === sourceId) registry.delete(api);\n\t}\n}\n\nexport function clearApiProviders(): void {\n\tconst scope = getActiveProviderScope();\n\t(scope ? scope.overlay : apiProviderRegistry).clear();\n}\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/auth/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAgBlF;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAA;CAAE,GAAG,SAAS,CAajH"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/auth/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAkBlF;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAA;CAAE,GAAG,SAAS,CAajH"}

package/node_modules/@earendil-works/pi-ai/dist/auth/helpers.js

@@ -12,8 +12,9 @@ export function envApiKeyAuth(name, envVars) {
             return { type: "api_key", key };
         },
         resolve: async ({ ctx, credential }) => {
-            if (credential?.key)
-                return { auth: { apiKey: credential.key }, source: "stored credential" };
+            if (credential?.key) {
+                return { auth: { apiKey: credential.key }, env: credential.env, source: "stored credential" };
+            }
             for (const envVar of envVars) {
                 const value = await ctx.env(envVar);
                 if (value)

package/node_modules/@earendil-works/pi-ai/dist/auth/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/auth/helpers.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAA0B;IACrE,OAAO;QACN,IAAI;QACJ,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;YACtC,IAAI,UAAU,EAAE,GAAG;gBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC9F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,KAAK;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,SAAS,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAA4E;IACrG,IAAI,OAAuC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,OAAO,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;KACjE,CAAC;AACH,CAAC","sourcesContent":["import type { ApiKeyAuth, OAuthAuth } from \"./types.ts\";\n\n/**\n * Standard api-key auth: a stored credential key wins, otherwise the first\n * set env var resolves. Includes a `login` that prompts for the key.\n * Providers with non-standard resolution (provider env, ambient files, IAM)\n * write their own `ApiKeyAuth`.\n */\nexport function envApiKeyAuth(name: string, envVars: readonly string[]): ApiKeyAuth {\n\treturn {\n\t\tname,\n\t\tlogin: async (interaction) => {\n\t\t\tconst key = await interaction.prompt({ type: \"secret\", message: `Enter ${name}` });\n\t\t\treturn { type: \"api_key\", key };\n\t\t},\n\t\tresolve: async ({ ctx, credential }) => {\n\t\t\tif (credential?.key) return { auth: { apiKey: credential.key }, source: \"stored credential\" };\n\t\t\tfor (const envVar of envVars) {\n\t\t\t\tconst value = await ctx.env(envVar);\n\t\t\t\tif (value) return { auth: { apiKey: value }, source: envVar };\n\t\t\t}\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n\n/**\n * Wraps a dynamically imported `OAuthAuth` so provider definitions can\n * advertise OAuth without importing the implementation. The flow loads on\n * first `login`/`refresh`/`toAuth` call; callers keep Node-only flow code out\n * of bundles by loading through a bundler-opaque dynamic import (variable\n * specifier, see the bedrock lazy wrapper).\n */\nexport function lazyOAuth(input: { name: string; loginLabel?: string; load: () => Promise<OAuthAuth> }): OAuthAuth {\n\tlet promise: Promise<OAuthAuth> | undefined;\n\tconst loaded = () => {\n\t\tpromise ??= input.load();\n\t\treturn promise;\n\t};\n\treturn {\n\t\tname: input.name,\n\t\tloginLabel: input.loginLabel,\n\t\tlogin: async (interaction) => (await loaded()).login(interaction),\n\t\trefresh: async (credential) => (await loaded()).refresh(credential),\n\t\ttoAuth: async (credential) => (await loaded()).toAuth(credential),\n\t};\n}\n"]}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../src/auth/helpers.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAA0B;IACrE,OAAO;QACN,IAAI;QACJ,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;YACtC,IAAI,UAAU,EAAE,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC/F,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,KAAK;oBAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,SAAS,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAA4E;IACrG,IAAI,OAAuC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,OAAO,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;KACjE,CAAC;AACH,CAAC","sourcesContent":["import type { ApiKeyAuth, OAuthAuth } from \"./types.ts\";\n\n/**\n * Standard api-key auth: a stored credential key wins, otherwise the first\n * set env var resolves. Includes a `login` that prompts for the key.\n * Providers with non-standard resolution (provider env, ambient files, IAM)\n * write their own `ApiKeyAuth`.\n */\nexport function envApiKeyAuth(name: string, envVars: readonly string[]): ApiKeyAuth {\n\treturn {\n\t\tname,\n\t\tlogin: async (interaction) => {\n\t\t\tconst key = await interaction.prompt({ type: \"secret\", message: `Enter ${name}` });\n\t\t\treturn { type: \"api_key\", key };\n\t\t},\n\t\tresolve: async ({ ctx, credential }) => {\n\t\t\tif (credential?.key) {\n\t\t\t\treturn { auth: { apiKey: credential.key }, env: credential.env, source: \"stored credential\" };\n\t\t\t}\n\t\t\tfor (const envVar of envVars) {\n\t\t\t\tconst value = await ctx.env(envVar);\n\t\t\t\tif (value) return { auth: { apiKey: value }, source: envVar };\n\t\t\t}\n\t\t\treturn undefined;\n\t\t},\n\t};\n}\n\n/**\n * Wraps a dynamically imported `OAuthAuth` so provider definitions can\n * advertise OAuth without importing the implementation. The flow loads on\n * first `login`/`refresh`/`toAuth` call; callers keep Node-only flow code out\n * of bundles by loading through a bundler-opaque dynamic import (variable\n * specifier, see the bedrock lazy wrapper).\n */\nexport function lazyOAuth(input: { name: string; loginLabel?: string; load: () => Promise<OAuthAuth> }): OAuthAuth {\n\tlet promise: Promise<OAuthAuth> | undefined;\n\tconst loaded = () => {\n\t\tpromise ??= input.load();\n\t\treturn promise;\n\t};\n\treturn {\n\t\tname: input.name,\n\t\tloginLabel: input.loginLabel,\n\t\tlogin: async (interaction) => (await loaded()).login(interaction),\n\t\trefresh: async (credential) => (await loaded()).refresh(credential),\n\t\ttoAuth: async (credential) => (await loaded()).toAuth(credential),\n\t};\n}\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Kimi Code (subscription) OAuth flow
+ *
+ * RFC 8628 device authorization grant against https://auth.kimi.com with JSON
+ * responses. The access token authenticates requests to
+ * https://api.kimi.com/coding as an `Authorization: Bearer` header.
+ */
+import type { OAuthAuth } from "../types.ts";
+export declare const kimiCodingOAuth: OAuthAuth;
+//# sourceMappingURL=kimi-coding.d.ts.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-coding.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-coding.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAmB,SAAS,EAAmB,MAAM,aAAa,CAAC;AAsR/E,eAAO,MAAM,eAAe,EAAE,SAc7B,CAAC"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.js

@@ -0,0 +1,249 @@
+/**
+ * Kimi Code (subscription) OAuth flow
+ *
+ * RFC 8628 device authorization grant against https://auth.kimi.com with JSON
+ * responses. The access token authenticates requests to
+ * https://api.kimi.com/coding as an `Authorization: Bearer` header.
+ */
+import { getProviderEnvValue } from "../../utils/provider-env.js";
+import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+const DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;
+const DEFAULT_POLL_INTERVAL_SECONDS = 5;
+const REQUEST_TIMEOUT_MS = 30 * 1000;
+const REFRESH_MAX_RETRIES = 3;
+function getOauthHost() {
+    const override = getProviderEnvValue("KIMI_CODE_OAUTH_HOST") || getProviderEnvValue("KIMI_OAUTH_HOST");
+    return (override || DEFAULT_OAUTH_HOST).replace(/\/+$/, "");
+}
+function requestSignal(signal) {
+    return AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), ...(signal ? [signal] : [])]);
+}
+function formUrlEncode(fields) {
+    return new URLSearchParams(fields).toString();
+}
+async function readJson(response) {
+    try {
+        const json = await response.json();
+        return json && typeof json === "object" ? json : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The verification URI is opened in the user's browser; only http(s) URLs are trusted. */
+function trustedHttpUrl(value) {
+    if (typeof value !== "string" || !value)
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:" && url.protocol !== "http:")
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+async function startDeviceAuthorization(oauthHost, signal) {
+    const response = await fetch(`${oauthHost}/api/oauth/device_authorization`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        },
+        body: formUrlEncode({ client_id: CLIENT_ID }),
+        signal: requestSignal(signal),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Kimi Code device authorization failed with status ${response.status}${text ? `: ${text}` : ""}`);
+    }
+    const json = await readJson(response);
+    const deviceCode = json?.device_code;
+    const userCode = json?.user_code;
+    const verificationUri = json?.verification_uri;
+    const verificationUriComplete = json?.verification_uri_complete;
+    if (typeof deviceCode !== "string" ||
+        typeof userCode !== "string" ||
+        typeof verificationUri !== "string" ||
+        typeof verificationUriComplete !== "string" ||
+        !trustedHttpUrl(verificationUriComplete) ||
+        !trustedHttpUrl(verificationUri)) {
+        throw new Error(`Invalid Kimi Code device authorization response: ${JSON.stringify(json)}`);
+    }
+    const interval = json?.interval;
+    const expiresIn = json?.expires_in;
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        verificationUriComplete,
+        intervalSeconds: typeof interval === "number" && Number.isFinite(interval) && interval > 0
+            ? interval
+            : DEFAULT_POLL_INTERVAL_SECONDS,
+        expiresInSeconds: typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0
+            ? expiresIn
+            : DEVICE_CODE_TIMEOUT_SECONDS,
+    };
+}
+function parseTokenResponse(json, operation) {
+    const accessToken = json?.access_token;
+    const refreshToken = json?.refresh_token;
+    const expiresIn = json?.expires_in;
+    if (typeof accessToken !== "string" ||
+        !accessToken ||
+        typeof refreshToken !== "string" ||
+        !refreshToken ||
+        typeof expiresIn !== "number" ||
+        !Number.isFinite(expiresIn) ||
+        expiresIn <= 0) {
+        throw new Error(`Kimi Code token ${operation} response missing fields: ${JSON.stringify(json)}`);
+    }
+    return {
+        access: accessToken,
+        refresh: refreshToken,
+        expires: Date.now() + expiresIn * 1000,
+    };
+}
+async function pollForToken(oauthHost, device, signal) {
+    return pollOAuthDeviceCodeFlow({
+        intervalSeconds: device.intervalSeconds,
+        expiresInSeconds: device.expiresInSeconds,
+        waitBeforeFirstPoll: true,
+        signal,
+        poll: async () => {
+            const response = await fetch(`${oauthHost}/api/oauth/token`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json",
+                },
+                body: formUrlEncode({
+                    client_id: CLIENT_ID,
+                    device_code: device.deviceCode,
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                }),
+                signal: requestSignal(signal),
+            });
+            if (response.status >= 500) {
+                const text = await response.text().catch(() => "");
+                return {
+                    status: "failed",
+                    message: `Kimi Code device token request failed with status ${response.status}${text ? `: ${text}` : ""}`,
+                };
+            }
+            const json = await readJson(response);
+            if (response.ok && typeof json?.access_token === "string") {
+                try {
+                    return { status: "complete", value: parseTokenResponse(json, "poll") };
+                }
+                catch (error) {
+                    return { status: "failed", message: error instanceof Error ? error.message : String(error) };
+                }
+            }
+            const error = json?.error;
+            const description = typeof json?.error_description === "string" ? `: ${json.error_description}` : "";
+            if (error === "authorization_pending") {
+                return { status: "pending" };
+            }
+            if (error === "slow_down") {
+                const interval = json?.interval;
+                return {
+                    status: "slow_down",
+                    intervalSeconds: typeof interval === "number" && interval > 0 ? interval : undefined,
+                };
+            }
+            if (error === "expired_token") {
+                return { status: "failed", message: "Kimi Code device authorization expired. Please restart login." };
+            }
+            if (error === "access_denied") {
+                return { status: "failed", message: "Kimi Code login was denied." };
+            }
+            return {
+                status: "failed",
+                message: `Kimi Code device token request failed (status ${response.status})${typeof error === "string" ? `: ${error}${description}` : ""}`,
+            };
+        },
+    });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isRetryableRefreshFailure(response) {
+    return response.status === 429 || response.status >= 500;
+}
+async function refreshToken(oauthHost, refreshTokenValue, signal) {
+    let lastError;
+    for (let attempt = 0; attempt <= REFRESH_MAX_RETRIES; attempt++) {
+        if (attempt > 0) {
+            await sleep(1000 * 2 ** (attempt - 1));
+        }
+        if (signal?.aborted) {
+            throw new Error("Kimi Code token refresh aborted");
+        }
+        let response;
+        try {
+            response = await fetch(`${oauthHost}/api/oauth/token`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Accept: "application/json",
+                },
+                body: formUrlEncode({
+                    client_id: CLIENT_ID,
+                    grant_type: "refresh_token",
+                    refresh_token: refreshTokenValue,
+                }),
+                signal: requestSignal(signal),
+            });
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+            continue;
+        }
+        const json = await readJson(response);
+        if (response.ok) {
+            return parseTokenResponse(json, "refresh");
+        }
+        // Unauthorized: the stored credential is dead; Models clears it and prompts re-login.
+        if (response.status === 401 || response.status === 403 || json?.error === "invalid_grant") {
+            const description = typeof json?.error_description === "string" ? `: ${json.error_description}` : "";
+            throw new Error(`Kimi Code token refresh unauthorized (status ${response.status})${description}`);
+        }
+        if (isRetryableRefreshFailure(response) && attempt < REFRESH_MAX_RETRIES) {
+            lastError = new Error(`Kimi Code token refresh failed with status ${response.status}`);
+            continue;
+        }
+        const text = JSON.stringify(json);
+        throw new Error(`Kimi Code token refresh failed with status ${response.status}${text ? `: ${text}` : ""}`);
+    }
+    throw lastError ?? new Error("Kimi Code token refresh failed");
+}
+async function loginKimiCoding(interaction) {
+    const oauthHost = getOauthHost();
+    const device = await startDeviceAuthorization(oauthHost, interaction.signal);
+    interaction.notify({
+        type: "device_code",
+        userCode: device.userCode,
+        verificationUri: device.verificationUriComplete,
+        intervalSeconds: device.intervalSeconds,
+        expiresInSeconds: device.expiresInSeconds,
+    });
+    const token = await pollForToken(oauthHost, device, interaction.signal);
+    return { type: "oauth", access: token.access, refresh: token.refresh, expires: token.expires };
+}
+export const kimiCodingOAuth = {
+    name: "Kimi Code (subscription)",
+    loginLabel: "Sign in with Kimi Code",
+    login: loginKimiCoding,
+    refresh: async (credential, signal) => {
+        const token = await refreshToken(getOauthHost(), credential.refresh, signal);
+        return { type: "oauth", access: token.access, refresh: token.refresh, expires: token.expires };
+    },
+    async toAuth(credential) {
+        return { headers: { Authorization: `Bearer ${credential.access}` } };
+    },
+};
+//# sourceMappingURL=kimi-coding.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/kimi-coding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-coding.js","sourceRoot":"","sources":["../../../src/auth/oauth/kimi-coding.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAiB9B,SAAS,YAAY;IACpB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACvG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IAC1C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,aAAa,CAAC,MAA8B;IACpD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACzC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,SAAiB,EAAE,MAAoB;IAC9E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,iCAAiC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC7C,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,EAAE,WAAW,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;IACjC,MAAM,eAAe,GAAG,IAAI,EAAE,gBAAgB,CAAC;IAC/C,MAAM,uBAAuB,GAAG,IAAI,EAAE,yBAAyB,CAAC;IAChE,IACC,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,eAAe,KAAK,QAAQ;QACnC,OAAO,uBAAuB,KAAK,QAAQ;QAC3C,CAAC,cAAc,CAAC,uBAAuB,CAAC;QACxC,CAAC,cAAc,CAAC,eAAe,CAAC,EAC/B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,CAAC;IACnC,OAAO;QACN,UAAU;QACV,QAAQ;QACR,eAAe;QACf,uBAAuB;QACvB,eAAe,EACd,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YACxE,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,6BAA6B;QACjC,gBAAgB,EACf,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC3E,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,2BAA2B;KAC/B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAoC,EAAE,SAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,EAAE,YAAY,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,EAAE,aAAa,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,EAAE,UAAU,CAAC;IACnC,IACC,OAAO,WAAW,KAAK,QAAQ;QAC/B,CAAC,WAAW;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,CAAC,YAAY;QACb,OAAO,SAAS,KAAK,QAAQ;QAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,SAAS,IAAI,CAAC,EACb,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,6BAA6B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;QACN,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;KACtC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,SAAiB,EACjB,MAA2B,EAC3B,MAAoB;IAEpB,OAAO,uBAAuB,CAAgB;QAC7C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,mBAAmB,EAAE,IAAI;QACzB,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC1B;gBACD,IAAI,EAAE,aAAa,CAAC;oBACnB,SAAS,EAAE,SAAS;oBACpB,WAAW,EAAE,MAAM,CAAC,UAAU;oBAC9B,UAAU,EAAE,8CAA8C;iBAC1D,CAAC;gBACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,OAAO;oBACN,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,qDAAqD,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACzG,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACJ,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBACxE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9F,CAAC;YACF,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;YAC1B,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;gBAChC,OAAO;oBACN,MAAM,EAAE,WAAW;oBACnB,eAAe,EAAE,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACpF,CAAC;YACH,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;YACvG,CAAC;YACD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;YACrE,CAAC;YACD,OAAO;gBACN,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,iDAAiD,QAAQ,CAAC,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aAC1I,CAAC;QACH,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAkB;IACpD,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,SAAiB,EACjB,iBAAyB,EACzB,MAAoB;IAEpB,IAAI,SAA4B,CAAC;IACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,kBAAkB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,cAAc,EAAE,mCAAmC;oBACnD,MAAM,EAAE,kBAAkB;iBAC1B;gBACD,IAAI,EAAE,aAAa,CAAC;oBACnB,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,iBAAiB;iBAChC,CAAC;gBACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC;QAED,sFAAsF;QACtF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;YAC3F,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,GAAG,mBAAmB,EAAE,CAAC;YAC1E,SAAS,GAAG,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,WAA4B;IAC1D,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7E,WAAW,CAAC,MAAM,CAAC;QAClB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,uBAAuB;QAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAc;IACzC,IAAI,EAAE,0BAA0B;IAChC,UAAU,EAAE,wBAAwB;IAEpC,KAAK,EAAE,eAAe;IAEtB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAU;QACtB,OAAO,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,CAAC;CACD,CAAC","sourcesContent":["/**\n * Kimi Code (subscription) OAuth flow\n *\n * RFC 8628 device authorization grant against https://auth.kimi.com with JSON\n * responses. The access token authenticates requests to\n * https://api.kimi.com/coding as an `Authorization: Bearer` header.\n */\n\nimport { getProviderEnvValue } from \"../../utils/provider-env.ts\";\nimport type { AuthInteraction, OAuthAuth, OAuthCredential } from \"../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\n\nconst CLIENT_ID = \"17e5f671-d194-4dfb-9706-5516cb48c098\";\nconst DEFAULT_OAUTH_HOST = \"https://auth.kimi.com\";\nconst DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;\nconst DEFAULT_POLL_INTERVAL_SECONDS = 5;\nconst REQUEST_TIMEOUT_MS = 30 * 1000;\nconst REFRESH_MAX_RETRIES = 3;\n\ntype DeviceAuthorization = {\n\tdeviceCode: string;\n\tuserCode: string;\n\tverificationUri: string;\n\tverificationUriComplete: string;\n\tintervalSeconds: number;\n\texpiresInSeconds: number;\n};\n\ntype TokenResponse = {\n\taccess: string;\n\trefresh: string;\n\texpires: number;\n};\n\nfunction getOauthHost(): string {\n\tconst override = getProviderEnvValue(\"KIMI_CODE_OAUTH_HOST\") || getProviderEnvValue(\"KIMI_OAUTH_HOST\");\n\treturn (override || DEFAULT_OAUTH_HOST).replace(/\\/+$/, \"\");\n}\n\nfunction requestSignal(signal?: AbortSignal): AbortSignal {\n\treturn AbortSignal.any([AbortSignal.timeout(REQUEST_TIMEOUT_MS), ...(signal ? [signal] : [])]);\n}\n\nfunction formUrlEncode(fields: Record<string, string>): string {\n\treturn new URLSearchParams(fields).toString();\n}\n\nasync function readJson(response: Response): Promise<Record<string, unknown> | null> {\n\ttry {\n\t\tconst json = await response.json();\n\t\treturn json && typeof json === \"object\" ? (json as Record<string, unknown>) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/** The verification URI is opened in the user's browser; only http(s) URLs are trusted. */\nfunction trustedHttpUrl(value: unknown): string | null {\n\tif (typeof value !== \"string\" || !value) return null;\n\ttry {\n\t\tconst url = new URL(value);\n\t\tif (url.protocol !== \"https:\" && url.protocol !== \"http:\") return null;\n\t\treturn url.href;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nasync function startDeviceAuthorization(oauthHost: string, signal?: AbortSignal): Promise<DeviceAuthorization> {\n\tconst response = await fetch(`${oauthHost}/api/oauth/device_authorization`, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\tAccept: \"application/json\",\n\t\t},\n\t\tbody: formUrlEncode({ client_id: CLIENT_ID }),\n\t\tsignal: requestSignal(signal),\n\t});\n\n\tif (!response.ok) {\n\t\tconst text = await response.text().catch(() => \"\");\n\t\tthrow new Error(`Kimi Code device authorization failed with status ${response.status}${text ? `: ${text}` : \"\"}`);\n\t}\n\n\tconst json = await readJson(response);\n\tconst deviceCode = json?.device_code;\n\tconst userCode = json?.user_code;\n\tconst verificationUri = json?.verification_uri;\n\tconst verificationUriComplete = json?.verification_uri_complete;\n\tif (\n\t\ttypeof deviceCode !== \"string\" ||\n\t\ttypeof userCode !== \"string\" ||\n\t\ttypeof verificationUri !== \"string\" ||\n\t\ttypeof verificationUriComplete !== \"string\" ||\n\t\t!trustedHttpUrl(verificationUriComplete) ||\n\t\t!trustedHttpUrl(verificationUri)\n\t) {\n\t\tthrow new Error(`Invalid Kimi Code device authorization response: ${JSON.stringify(json)}`);\n\t}\n\n\tconst interval = json?.interval;\n\tconst expiresIn = json?.expires_in;\n\treturn {\n\t\tdeviceCode,\n\t\tuserCode,\n\t\tverificationUri,\n\t\tverificationUriComplete,\n\t\tintervalSeconds:\n\t\t\ttypeof interval === \"number\" && Number.isFinite(interval) && interval > 0\n\t\t\t\t? interval\n\t\t\t\t: DEFAULT_POLL_INTERVAL_SECONDS,\n\t\texpiresInSeconds:\n\t\t\ttypeof expiresIn === \"number\" && Number.isFinite(expiresIn) && expiresIn > 0\n\t\t\t\t? expiresIn\n\t\t\t\t: DEVICE_CODE_TIMEOUT_SECONDS,\n\t};\n}\n\nfunction parseTokenResponse(json: Record<string, unknown> | null, operation: string): TokenResponse {\n\tconst accessToken = json?.access_token;\n\tconst refreshToken = json?.refresh_token;\n\tconst expiresIn = json?.expires_in;\n\tif (\n\t\ttypeof accessToken !== \"string\" ||\n\t\t!accessToken ||\n\t\ttypeof refreshToken !== \"string\" ||\n\t\t!refreshToken ||\n\t\ttypeof expiresIn !== \"number\" ||\n\t\t!Number.isFinite(expiresIn) ||\n\t\texpiresIn <= 0\n\t) {\n\t\tthrow new Error(`Kimi Code token ${operation} response missing fields: ${JSON.stringify(json)}`);\n\t}\n\treturn {\n\t\taccess: accessToken,\n\t\trefresh: refreshToken,\n\t\texpires: Date.now() + expiresIn * 1000,\n\t};\n}\n\nasync function pollForToken(\n\toauthHost: string,\n\tdevice: DeviceAuthorization,\n\tsignal?: AbortSignal,\n): Promise<TokenResponse> {\n\treturn pollOAuthDeviceCodeFlow<TokenResponse>({\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t\twaitBeforeFirstPoll: true,\n\t\tsignal,\n\t\tpoll: async () => {\n\t\t\tconst response = await fetch(`${oauthHost}/api/oauth/token`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: formUrlEncode({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tdevice_code: device.deviceCode,\n\t\t\t\t\tgrant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n\t\t\t\t}),\n\t\t\t\tsignal: requestSignal(signal),\n\t\t\t});\n\n\t\t\tif (response.status >= 500) {\n\t\t\t\tconst text = await response.text().catch(() => \"\");\n\t\t\t\treturn {\n\t\t\t\t\tstatus: \"failed\",\n\t\t\t\t\tmessage: `Kimi Code device token request failed with status ${response.status}${text ? `: ${text}` : \"\"}`,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst json = await readJson(response);\n\t\t\tif (response.ok && typeof json?.access_token === \"string\") {\n\t\t\t\ttry {\n\t\t\t\t\treturn { status: \"complete\", value: parseTokenResponse(json, \"poll\") };\n\t\t\t\t} catch (error) {\n\t\t\t\t\treturn { status: \"failed\", message: error instanceof Error ? error.message : String(error) };\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst error = json?.error;\n\t\t\tconst description = typeof json?.error_description === \"string\" ? `: ${json.error_description}` : \"\";\n\t\t\tif (error === \"authorization_pending\") {\n\t\t\t\treturn { status: \"pending\" };\n\t\t\t}\n\t\t\tif (error === \"slow_down\") {\n\t\t\t\tconst interval = json?.interval;\n\t\t\t\treturn {\n\t\t\t\t\tstatus: \"slow_down\",\n\t\t\t\t\tintervalSeconds: typeof interval === \"number\" && interval > 0 ? interval : undefined,\n\t\t\t\t};\n\t\t\t}\n\t\t\tif (error === \"expired_token\") {\n\t\t\t\treturn { status: \"failed\", message: \"Kimi Code device authorization expired. Please restart login.\" };\n\t\t\t}\n\t\t\tif (error === \"access_denied\") {\n\t\t\t\treturn { status: \"failed\", message: \"Kimi Code login was denied.\" };\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: \"failed\",\n\t\t\t\tmessage: `Kimi Code device token request failed (status ${response.status})${typeof error === \"string\" ? `: ${error}${description}` : \"\"}`,\n\t\t\t};\n\t\t},\n\t});\n}\n\nfunction sleep(ms: number): Promise<void> {\n\treturn new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction isRetryableRefreshFailure(response: Response): boolean {\n\treturn response.status === 429 || response.status >= 500;\n}\n\nasync function refreshToken(\n\toauthHost: string,\n\trefreshTokenValue: string,\n\tsignal?: AbortSignal,\n): Promise<TokenResponse> {\n\tlet lastError: Error | undefined;\n\tfor (let attempt = 0; attempt <= REFRESH_MAX_RETRIES; attempt++) {\n\t\tif (attempt > 0) {\n\t\t\tawait sleep(1000 * 2 ** (attempt - 1));\n\t\t}\n\t\tif (signal?.aborted) {\n\t\t\tthrow new Error(\"Kimi Code token refresh aborted\");\n\t\t}\n\n\t\tlet response: Response;\n\t\ttry {\n\t\t\tresponse = await fetch(`${oauthHost}/api/oauth/token`, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t},\n\t\t\t\tbody: formUrlEncode({\n\t\t\t\t\tclient_id: CLIENT_ID,\n\t\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\t\trefresh_token: refreshTokenValue,\n\t\t\t\t}),\n\t\t\t\tsignal: requestSignal(signal),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tlastError = error instanceof Error ? error : new Error(String(error));\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst json = await readJson(response);\n\t\tif (response.ok) {\n\t\t\treturn parseTokenResponse(json, \"refresh\");\n\t\t}\n\n\t\t// Unauthorized: the stored credential is dead; Models clears it and prompts re-login.\n\t\tif (response.status === 401 || response.status === 403 || json?.error === \"invalid_grant\") {\n\t\t\tconst description = typeof json?.error_description === \"string\" ? `: ${json.error_description}` : \"\";\n\t\t\tthrow new Error(`Kimi Code token refresh unauthorized (status ${response.status})${description}`);\n\t\t}\n\n\t\tif (isRetryableRefreshFailure(response) && attempt < REFRESH_MAX_RETRIES) {\n\t\t\tlastError = new Error(`Kimi Code token refresh failed with status ${response.status}`);\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst text = JSON.stringify(json);\n\t\tthrow new Error(`Kimi Code token refresh failed with status ${response.status}${text ? `: ${text}` : \"\"}`);\n\t}\n\n\tthrow lastError ?? new Error(\"Kimi Code token refresh failed\");\n}\n\nasync function loginKimiCoding(interaction: AuthInteraction): Promise<OAuthCredential> {\n\tconst oauthHost = getOauthHost();\n\tconst device = await startDeviceAuthorization(oauthHost, interaction.signal);\n\tinteraction.notify({\n\t\ttype: \"device_code\",\n\t\tuserCode: device.userCode,\n\t\tverificationUri: device.verificationUriComplete,\n\t\tintervalSeconds: device.intervalSeconds,\n\t\texpiresInSeconds: device.expiresInSeconds,\n\t});\n\tconst token = await pollForToken(oauthHost, device, interaction.signal);\n\treturn { type: \"oauth\", access: token.access, refresh: token.refresh, expires: token.expires };\n}\n\nexport const kimiCodingOAuth: OAuthAuth = {\n\tname: \"Kimi Code (subscription)\",\n\tloginLabel: \"Sign in with Kimi Code\",\n\n\tlogin: loginKimiCoding,\n\n\trefresh: async (credential, signal) => {\n\t\tconst token = await refreshToken(getOauthHost(), credential.refresh, signal);\n\t\treturn { type: \"oauth\", access: token.access, refresh: token.refresh, expires: token.expires };\n\t},\n\n\tasync toAuth(credential) {\n\t\treturn { headers: { Authorization: `Bearer ${credential.access}` } };\n\t},\n};\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/load.d.ts

@@ -3,6 +3,8 @@ type OAuthFlowLoaders = {
     anthropic: () => OAuthAuth | Promise<OAuthAuth>;
     openaiCodex: () => OAuthAuth | Promise<OAuthAuth>;
     githubCopilot: () => OAuthAuth | Promise<OAuthAuth>;
+    openrouter: () => OAuthAuth | Promise<OAuthAuth>;
+    kimiCoding: () => OAuthAuth | Promise<OAuthAuth>;
     xai: () => OAuthAuth | Promise<OAuthAuth>;
     radius: (options: {
         name: string;
@@ -14,6 +16,8 @@ export declare function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoader
 export declare const loadAnthropicOAuth: () => Promise<OAuthAuth>;
 export declare const loadOpenAICodexOAuth: () => Promise<OAuthAuth>;
 export declare const loadGitHubCopilotOAuth: () => Promise<OAuthAuth>;
+export declare const loadOpenRouterOAuth: () => Promise<OAuthAuth>;
+export declare const loadKimiCodingOAuth: () => Promise<OAuthAuth>;
 export declare const loadXaiOAuth: () => Promise<OAuthAuth>;
 export declare const loadRadiusOAuth: (options: {
     name: string;

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/load.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAa7C,KAAK,gBAAgB,GAAG;IACvB,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,WAAW,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,aAAa,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,GAAG,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACvF,CAAC;AAIF,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,SAAS,CAG5D,CAAC;AAEF,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,SAAS,CAG9D,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,SAAS,CAGhE,CAAC;AAEF,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,SAAS,CAGtD,CAAC;AAEF,eAAO,MAAM,eAAe,YAAmB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,SAAS,CAOnG,CAAC"}
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAa7C,KAAK,gBAAgB,GAAG;IACvB,SAAS,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,WAAW,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,aAAa,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,GAAG,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CACvF,CAAC;AAIF,4EAA4E;AAC5E,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAE/E;AAED,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,SAAS,CAG5D,CAAC;AAEF,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,SAAS,CAG9D,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,SAAS,CAGhE,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,OAAO,CAAC,SAAS,CAG7D,CAAC;AAEF,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,SAAS,CAGtD,CAAC;AAEF,eAAO,MAAM,eAAe,YAAmB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,SAAS,CAOnG,CAAC"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/load.js

@@ -36,6 +36,16 @@ export const loadGitHubCopilotOAuth = async () => {
         return bundledLoaders.githubCopilot();
     return (await importOAuthModule("./github-copilot.ts")).githubCopilotOAuth;
 };
+export const loadOpenRouterOAuth = async () => {
+    if (bundledLoaders)
+        return bundledLoaders.openrouter();
+    return (await importOAuthModule("./openrouter.ts")).openRouterOAuth;
+};
+export const loadKimiCodingOAuth = async () => {
+    if (bundledLoaders)
+        return bundledLoaders.kimiCoding();
+    return (await importOAuthModule("./kimi-coding.ts")).kimiCodingOAuth;
+};
 export const loadXaiOAuth = async () => {
     if (bundledLoaders)
         return bundledLoaders.xai();

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/load.js.map

@@ -1 +1 @@
-{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAoB,EAAE;IACjE,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,MAAM,kCAAC,gBAAgB,EAAC,CAAC;AACjC,CAAC,CAAC;AAUF,IAAI,cAA4C,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAAC,OAAyB;IACxE,cAAc,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAwB,EAAE;IAChE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,SAAS,EAAE,CAAC;IACtD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAmC,CAAC,cAAc,CAAC;AACtG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAAwB,EAAE;IAClE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,WAAW,EAAE,CAAC;IACxD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAqC,CAAC,gBAAgB,CAAC;AAC7G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAwB,EAAE;IACpE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAQ,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAuC,CAAC,kBAAkB,CAAC;AACnH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAwB,EAAE;IAC1D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC;IAChD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAA6B,CAAC,QAAQ,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAA0C,EAAsB,EAAE;IACvG,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,OACC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAGvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC","sourcesContent":["import type { OAuthAuth } from \"../types.ts\";\n\n/**\n * Loads an OAuth flow module through a variable specifier so bundlers cannot\n * follow the import into Node-only flow code (`node:http` callback servers,\n * `node:crypto` PKCE). The `.ts`/`.js` rewrite keeps the trick working from\n * both source and built output.\n */\nconst importOAuthModule = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\ntype OAuthFlowLoaders = {\n\tanthropic: () => OAuthAuth | Promise<OAuthAuth>;\n\topenaiCodex: () => OAuthAuth | Promise<OAuthAuth>;\n\tgithubCopilot: () => OAuthAuth | Promise<OAuthAuth>;\n\txai: () => OAuthAuth | Promise<OAuthAuth>;\n\tradius: (options: { name: string; gateway: string }) => OAuthAuth | Promise<OAuthAuth>;\n};\n\nlet bundledLoaders: OAuthFlowLoaders | undefined;\n\n/** Registers statically bundled OAuth flows for standalone Bun binaries. */\nexport function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void {\n\tbundledLoaders = loaders;\n}\n\nexport const loadAnthropicOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.anthropic();\n\treturn ((await importOAuthModule(\"./anthropic.ts\")) as { anthropicOAuth: OAuthAuth }).anthropicOAuth;\n};\n\nexport const loadOpenAICodexOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openaiCodex();\n\treturn ((await importOAuthModule(\"./openai-codex.ts\")) as { openaiCodexOAuth: OAuthAuth }).openaiCodexOAuth;\n};\n\nexport const loadGitHubCopilotOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.githubCopilot();\n\treturn ((await importOAuthModule(\"./github-copilot.ts\")) as { githubCopilotOAuth: OAuthAuth }).githubCopilotOAuth;\n};\n\nexport const loadXaiOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.xai();\n\treturn ((await importOAuthModule(\"./xai.ts\")) as { xaiOAuth: OAuthAuth }).xaiOAuth;\n};\n\nexport const loadRadiusOAuth = async (options: { name: string; gateway: string }): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.radius(options);\n\treturn (\n\t\t(await importOAuthModule(\"./radius.ts\")) as {\n\t\t\tcreateRadiusOAuth: (input: { name: string; gateway: string }) => OAuthAuth;\n\t\t}\n\t).createRadiusOAuth(options);\n};\n"]}
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../../src/auth/oauth/load.ts"],"names":[],"mappings":";;;;;;;;AAEA;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAoB,EAAE;IACjE,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,OAAO,MAAM,kCAAC,gBAAgB,EAAC,CAAC;AACjC,CAAC,CAAC;AAYF,IAAI,cAA4C,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,+BAA+B,CAAC,OAAyB;IACxE,cAAc,GAAG,OAAO,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,IAAwB,EAAE;IAChE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,SAAS,EAAE,CAAC;IACtD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAmC,CAAC,cAAc,CAAC;AACtG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,IAAwB,EAAE;IAClE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,WAAW,EAAE,CAAC;IACxD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,mBAAmB,CAAC,CAAqC,CAAC,gBAAgB,CAAC;AAC7G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,IAAwB,EAAE;IACpE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAQ,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,CAAuC,CAAC,kBAAkB,CAAC;AACnH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,CAAoC,CAAC,eAAe,CAAC;AACzG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,IAAwB,EAAE;IACjE,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,UAAU,EAAE,CAAC;IACvD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAoC,CAAC,eAAe,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,IAAwB,EAAE;IAC1D,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC;IAChD,OAAQ,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAA6B,CAAC,QAAQ,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAA0C,EAAsB,EAAE;IACvG,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1D,OACC,CAAC,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAGvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC","sourcesContent":["import type { OAuthAuth } from \"../types.ts\";\n\n/**\n * Loads an OAuth flow module through a variable specifier so bundlers cannot\n * follow the import into Node-only flow code (`node:http` callback servers,\n * `node:crypto` PKCE). The `.ts`/`.js` rewrite keeps the trick working from\n * both source and built output.\n */\nconst importOAuthModule = (specifier: string): Promise<unknown> => {\n\tconst runtimeSpecifier = import.meta.url.endsWith(\".js\") ? specifier.replace(/\\.ts$/, \".js\") : specifier;\n\treturn import(runtimeSpecifier);\n};\n\ntype OAuthFlowLoaders = {\n\tanthropic: () => OAuthAuth | Promise<OAuthAuth>;\n\topenaiCodex: () => OAuthAuth | Promise<OAuthAuth>;\n\tgithubCopilot: () => OAuthAuth | Promise<OAuthAuth>;\n\topenrouter: () => OAuthAuth | Promise<OAuthAuth>;\n\tkimiCoding: () => OAuthAuth | Promise<OAuthAuth>;\n\txai: () => OAuthAuth | Promise<OAuthAuth>;\n\tradius: (options: { name: string; gateway: string }) => OAuthAuth | Promise<OAuthAuth>;\n};\n\nlet bundledLoaders: OAuthFlowLoaders | undefined;\n\n/** Registers statically bundled OAuth flows for standalone Bun binaries. */\nexport function registerBundledOAuthFlowLoaders(loaders: OAuthFlowLoaders): void {\n\tbundledLoaders = loaders;\n}\n\nexport const loadAnthropicOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.anthropic();\n\treturn ((await importOAuthModule(\"./anthropic.ts\")) as { anthropicOAuth: OAuthAuth }).anthropicOAuth;\n};\n\nexport const loadOpenAICodexOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openaiCodex();\n\treturn ((await importOAuthModule(\"./openai-codex.ts\")) as { openaiCodexOAuth: OAuthAuth }).openaiCodexOAuth;\n};\n\nexport const loadGitHubCopilotOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.githubCopilot();\n\treturn ((await importOAuthModule(\"./github-copilot.ts\")) as { githubCopilotOAuth: OAuthAuth }).githubCopilotOAuth;\n};\n\nexport const loadOpenRouterOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.openrouter();\n\treturn ((await importOAuthModule(\"./openrouter.ts\")) as { openRouterOAuth: OAuthAuth }).openRouterOAuth;\n};\n\nexport const loadKimiCodingOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.kimiCoding();\n\treturn ((await importOAuthModule(\"./kimi-coding.ts\")) as { kimiCodingOAuth: OAuthAuth }).kimiCodingOAuth;\n};\n\nexport const loadXaiOAuth = async (): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.xai();\n\treturn ((await importOAuthModule(\"./xai.ts\")) as { xaiOAuth: OAuthAuth }).xaiOAuth;\n};\n\nexport const loadRadiusOAuth = async (options: { name: string; gateway: string }): Promise<OAuthAuth> => {\n\tif (bundledLoaders) return bundledLoaders.radius(options);\n\treturn (\n\t\t(await importOAuthModule(\"./radius.ts\")) as {\n\t\t\tcreateRadiusOAuth: (input: { name: string; gateway: string }) => OAuthAuth;\n\t\t}\n\t).createRadiusOAuth(options);\n};\n"]}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/openai-codex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-codex.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/openai-codex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,OAAO,KAAK,EAAmB,SAAS,EAAmB,MAAM,aAAa,CAAC;AAye/E,eAAO,MAAM,gBAAgB,EAAE,SA4B9B,CAAC"}
+{"version":3,"file":"openai-codex.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/openai-codex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,OAAO,KAAK,EAAmB,SAAS,EAAmB,MAAM,aAAa,CAAC;AAkd/E,eAAO,MAAM,gBAAgB,EAAE,SA4B9B,CAAC"}

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/openai-codex.js

@@ -15,6 +15,7 @@ if (typeof process !== "undefined" && (process.versions?.node || process.version
         _http = m;
     });
 }
+import { extractOpenAiCodexAccountId } from "../../utils/openai-codex-auth.js";
 import { getProviderEnvValue } from "../../utils/provider-env.js";
 import { pollOAuthDeviceCodeFlow } from "./device-code.js";
 import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
@@ -32,7 +33,6 @@ const DEVICE_CODE_TIMEOUT_SECONDS = 15 * 60;
 const OPENAI_CODEX_BROWSER_LOGIN_METHOD = "browser";
 const OPENAI_CODEX_DEVICE_CODE_LOGIN_METHOD = "device_code";
 const SCOPE = "openid profile email offline_access";
-const JWT_CLAIM_PATH = "https://api.openai.com/auth";
 function getCallbackHost() {
     return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
 }
@@ -69,19 +69,6 @@ function parseAuthorizationInput(input) {
     }
     return { code: value };
 }
-function decodeJwt(token) {
-    try {
-        const parts = token.split(".");
-        if (parts.length !== 3)
-            return null;
-        const payload = parts[1] ?? "";
-        const decoded = atob(payload);
-        return JSON.parse(decoded);
-    }
-    catch {
-        return null;
-    }
-}
 async function fetchWithLoginCancellation(input, init) {
     try {
         return await fetch(input, init);
@@ -317,10 +304,7 @@ function startLocalOAuthServer(state) {
     });
 }
 function getAccountId(accessToken) {
-    const payload = decodeJwt(accessToken);
-    const auth = payload?.[JWT_CLAIM_PATH];
-    const accountId = auth?.chatgpt_account_id;
-    return typeof accountId === "string" && accountId.length > 0 ? accountId : null;
+    return extractOpenAiCodexAccountId(accessToken) ?? null;
 }
 function credentialsFromToken(token) {
     const accountId = getAccountId(token.access);