@dorely13/ai-imagegen-cli 0.1.3 → 0.2.0

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { mkdir as mkdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "node:fs/promises";
-import { basename, dirname as dirname2, extname, join as join3, resolve as resolve2 } from "node:path";
+import { mkdir as mkdir3, readFile as readFile3, stat, writeFile as writeFile3 } from "node:fs/promises";
+import { basename, dirname as dirname3, extname, join as join4, resolve as resolve2 } from "node:path";
 
 // ../../packages/core/dist/types.js
 var ProviderError = class extends Error {
@@ -10,6 +10,8 @@ var ProviderError = class extends Error {
   statusCode;
   requestId;
   responseId;
+  upstreamProvider;
+  retryAfterSeconds;
   constructor(details) {
     super(details.message);
     this.name = "ProviderError";
@@ -17,6 +19,8 @@ var ProviderError = class extends Error {
     this.statusCode = details.statusCode;
     this.requestId = details.requestId;
     this.responseId = details.responseId;
+    this.upstreamProvider = details.upstreamProvider;
+    this.retryAfterSeconds = details.retryAfterSeconds;
   }
 };
 var MAX_REFERENCE_IMAGES = 4;
@@ -288,9 +292,9 @@ async function waitForOAuthCallback(timeoutMs = FLOW_TIMEOUT_MINUTES * 60 * 1e3,
       clearTimeout(timer);
       server?.close();
     };
-    const fail2 = (error) => {
+    const fail2 = (error2) => {
       closeServer();
-      reject(error);
+      reject(error2);
     };
     server = createServer((req, res) => {
       try {
@@ -319,16 +323,16 @@ async function waitForOAuthCallback(timeoutMs = FLOW_TIMEOUT_MINUTES * 60 * 1e3,
         res.end(callbackPage("Connected", "ImageGenCli is connected. You can close this tab."));
         closeServer();
         resolve3({ code, state });
-      } catch (error) {
-        fail2(error instanceof Error ? error : new LoopbackError("OAuth callback failed.", "callback_error"));
+      } catch (error2) {
+        fail2(error2 instanceof Error ? error2 : new LoopbackError("OAuth callback failed.", "callback_error"));
       }
     });
-    server.on("error", (error) => {
-      if (error.code === "EADDRINUSE") {
+    server.on("error", (error2) => {
+      if (error2.code === "EADDRINUSE") {
         fail2(new LoopbackError(`Port ${port} is busy. Close the conflicting process and retry.`, "port_busy"));
         return;
       }
-      fail2(error);
+      fail2(error2);
     });
     server.listen(port, "127.0.0.1");
   });
@@ -480,32 +484,32 @@ var CodexTokenManager = class {
   }
 };
 
-// ../../packages/providers-codex/dist/token-store.js
+// ../../packages/credentials/dist/index.js
 import { homedir } from "node:os";
 import { join } from "node:path";
 function asKeytar(module) {
   if (typeof module !== "object" || module === null)
     return null;
-  const record = module;
-  const candidate = record["default"] ?? module;
+  const record2 = module;
+  const candidate = record2["default"] ?? module;
   if (typeof candidate.getPassword === "function" && typeof candidate.setPassword === "function" && typeof candidate.deletePassword === "function") {
     return candidate;
   }
   return null;
 }
-async function resolveTokenStore() {
+async function resolveCredentialStore() {
   try {
     const keytar = asKeytar(await import("keytar"));
     if (!keytar)
-      return new FileTokenStore();
-    const store = new KeytarTokenStore(keytar);
+      return new FileCredentialStore();
+    const store = new KeytarCredentialStore(keytar);
     await store.probe();
     return store;
   } catch {
-    return new FileTokenStore();
+    return new FileCredentialStore();
   }
 }
-var KeytarTokenStore = class {
+var KeytarCredentialStore = class {
   keytar;
   constructor(keytar) {
     this.keytar = keytar;
@@ -517,7 +521,11 @@ var KeytarTokenStore = class {
     const raw = await this.keytar.getPassword("ImageGenCli", provider);
     if (!raw)
       return null;
-    return JSON.parse(raw);
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error("Stored credential record is invalid. Run the provider login command.");
+    }
   }
   async save(provider, tokens) {
     await this.keytar.setPassword("ImageGenCli", provider, JSON.stringify(tokens));
@@ -526,13 +534,16 @@ var KeytarTokenStore = class {
     await this.keytar.deletePassword("ImageGenCli", provider);
   }
   describe() {
-    return { backend: "vault", location: "OS credential vault (service ImageGenCli)" };
+    return {
+      backend: "vault",
+      location: "OS credential vault (service ImageGenCli)"
+    };
   }
 };
-var FileTokenStore = class {
+var FileCredentialStore = class {
   filePath;
   constructor(filePath) {
-    this.filePath = filePath ?? defaultTokenFilePath();
+    this.filePath = filePath ?? defaultCredentialFilePath();
   }
   async load(provider) {
     const all = await this.readAll();
@@ -552,27 +563,37 @@ var FileTokenStore = class {
     return { backend: "file", location: this.filePath };
   }
   async readAll() {
-    const { readFile: readFile3 } = await import("node:fs/promises");
+    const { readFile: readFile4 } = await import("node:fs/promises");
     try {
-      const raw = await readFile3(this.filePath, "utf8");
-      return JSON.parse(raw);
-    } catch (error) {
-      if (error.code === "ENOENT")
+      const raw = await readFile4(this.filePath, "utf8");
+      let value;
+      try {
+        value = JSON.parse(raw);
+      } catch {
+        throw new Error("Credential file is invalid. Restore a valid credential file before retrying.");
+      }
+      if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error("Credential file must contain provider records.");
+      return value;
+    } catch (error2) {
+      if (error2.code === "ENOENT")
         return {};
-      throw error;
+      throw error2;
     }
   }
   async writeAll(all) {
-    const { mkdir: mkdir3, writeFile: writeFile3, chmod } = await import("node:fs/promises");
-    const { dirname: dirname3 } = await import("node:path");
-    await mkdir3(dirname3(this.filePath), { recursive: true });
-    await writeFile3(this.filePath, JSON.stringify(all, null, 2), { mode: 384 });
+    const { mkdir: mkdir4, writeFile: writeFile4, chmod } = await import("node:fs/promises");
+    const { dirname: dirname4 } = await import("node:path");
+    await mkdir4(dirname4(this.filePath), { recursive: true });
+    await writeFile4(this.filePath, JSON.stringify(all, null, 2), {
+      mode: 384
+    });
     if (process.platform !== "win32") {
       await chmod(this.filePath, 384);
     }
   }
 };
-function defaultTokenFilePath() {
+function defaultCredentialFilePath() {
   if (process.platform === "win32") {
     const base2 = process.env["LOCALAPPDATA"] ?? join(process.env["USERPROFILE"] ?? ".", "AppData", "Local");
     return join(base2, "ImageGenCli", "tokens.json");
@@ -581,6 +602,26 @@ function defaultTokenFilePath() {
   return join(base, "ImageGenCli", "tokens.json");
 }
 
+// ../../packages/providers-codex/dist/token-store.js
+async function resolveTokenStore() {
+  const store = await resolveCredentialStore();
+  return {
+    ...store,
+    load: async (provider) => {
+      const value = await store.load(provider);
+      if (value === null)
+        return null;
+      if (typeof value.accessToken !== "string" || typeof value.expiresAt !== "number" || value.refreshToken !== void 0 && typeof value.refreshToken !== "string") {
+        throw new Error("Stored Codex credentials are invalid. Run imagegen auth codex login.");
+      }
+      return value;
+    },
+    save: (provider, value) => store.save(provider, value),
+    clear: (provider) => store.clear(provider),
+    describe: () => store.describe()
+  };
+}
+
 // ../../packages/providers-codex/dist/account-id.js
 function extractAccountId(token) {
   const parts = token.split(".");
@@ -628,14 +669,14 @@ function readEventError(event) {
     return direct;
   if (typeof event !== "object" || event === null)
     return void 0;
-  const record = event;
-  const nested = record["error"];
+  const record2 = event;
+  const nested = record2["error"];
   if (typeof nested === "object" && nested !== null) {
     const message = readString(nested, "message");
     if (message)
       return message;
   }
-  const response = record["response"];
+  const response = record2["response"];
   if (typeof response === "object" && response !== null) {
     const responseError = response["error"];
     if (typeof responseError === "object" && responseError !== null) {
@@ -731,10 +772,10 @@ function normalizeCount(count) {
 function resolveSize(size) {
   try {
     return parseSize(size ?? "auto");
-  } catch (error) {
+  } catch (error2) {
     throw new ProviderError({
       kind: "usage",
-      message: error instanceof Error ? error.message : String(error)
+      message: error2 instanceof Error ? error2.message : String(error2)
     });
   }
 }
@@ -902,8 +943,8 @@ var CodexImageProvider = class {
     let parsed;
     try {
       parsed = parseImageStreamEvents(lines);
-    } catch (error) {
-      throw toProviderError(error, requestId);
+    } catch (error2) {
+      throw toProviderError(error2, requestId);
     }
     return {
       data: parsed.data,
@@ -945,14 +986,14 @@ function readErrorMessage(body) {
   try {
     const parsed = JSON.parse(body);
     if (typeof parsed === "object" && parsed !== null) {
-      const record = parsed;
-      if (typeof record["message"] === "string")
-        return record["message"];
-      if (typeof record["detail"] === "string")
-        return record["detail"];
-      const error = record["error"];
-      if (typeof error === "object" && error !== null && typeof error["message"] === "string") {
-        return error["message"];
+      const record2 = parsed;
+      if (typeof record2["message"] === "string")
+        return record2["message"];
+      if (typeof record2["detail"] === "string")
+        return record2["detail"];
+      const error2 = record2["error"];
+      if (typeof error2 === "object" && error2 !== null && typeof error2["message"] === "string") {
+        return error2["message"];
       }
     }
   } catch {
@@ -960,8 +1001,8 @@ function readErrorMessage(body) {
   }
   return null;
 }
-function toProviderError(error, requestId) {
-  const message = error instanceof Error ? error.message : String(error);
+function toProviderError(error2, requestId) {
+  const message = error2 instanceof Error ? error2.message : String(error2);
   const separator = message.indexOf(":");
   const kind = separator > 0 ? message.slice(0, separator) : "api_error";
   return new ProviderError({ kind, message, requestId });
@@ -1007,13 +1048,876 @@ function createCodexEntry() {
   };
 }
 
+// ../../packages/providers-google/dist/gemini-client.js
+import sharp from "sharp";
+
+// ../../packages/providers-google/dist/image-size.js
+var DEFAULT_IMAGE_MODEL2 = "gemini-nano-banana-2.1";
+var native = {
+  "1:1": [1024, 1024],
+  "1:4": [512, 2048],
+  "1:8": [384, 3072],
+  "2:3": [848, 1264],
+  "3:2": [1264, 848],
+  "3:4": [896, 1200],
+  "4:1": [2048, 512],
+  "4:3": [1200, 896],
+  "4:5": [928, 1152],
+  "5:4": [1152, 928],
+  "8:1": [3072, 384],
+  "9:16": [768, 1376],
+  "16:9": [1376, 768],
+  "21:9": [1584, 672]
+};
+var legacy = {
+  "1:1": [1024, 1024],
+  "2:3": [832, 1248],
+  "3:2": [1248, 832],
+  "3:4": [864, 1184],
+  "4:3": [1184, 864],
+  "4:5": [896, 1152],
+  "5:4": [1152, 896],
+  "9:16": [768, 1344],
+  "16:9": [1344, 768],
+  "21:9": [1536, 672]
+};
+function resolveGeminiSize(size, model = DEFAULT_IMAGE_MODEL2) {
+  const value = (size ?? "auto").trim().toLowerCase();
+  const table = model === "gemini-2.5-flash-image" ? legacy : native;
+  const restricted = model === "gemini-3-pro-image" || model === "nano-banana-pro-preview";
+  const ratios = Object.keys(table).filter((r) => !restricted || !["1:4", "4:1", "1:8", "8:1"].includes(r));
+  const presets = {
+    square: "1:1",
+    portrait: "2:3",
+    landscape: "3:2",
+    wide: "16:9",
+    widescreen: "16:9"
+  };
+  const normalized = presets[value] ?? value;
+  const pixels = /^(\d+(?:\.\d+)?)\s*x\s*(\d+(?:\.\d+)?)$/.exec(normalized);
+  const ratio = /^(\d+(?:\.\d+)?)\s*[:/]\s*(\d+(?:\.\d+)?)$/.exec(normalized);
+  const auto = normalized === "auto" || normalized === "";
+  const width = Number(pixels?.[1] ?? ratio?.[1] ?? (auto ? 1 : normalized));
+  const height = Number(pixels?.[2] ?? ratio?.[2] ?? 1);
+  if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0) {
+    throw new ProviderError({
+      kind: "usage",
+      message: "Invalid Gemini size. Use WIDTHxHEIGHT, an aspect ratio, preset, or auto."
+    });
+  }
+  const aspect = width / height;
+  const selected = ratios.sort((a, b) => {
+    const number = (r) => {
+      const [x, y] = r.split(":").map(Number);
+      return x / y;
+    };
+    return Math.abs(Math.log(number(a) / aspect)) - Math.abs(Math.log(number(b) / aspect));
+  })[0];
+  const scales = model === "gemini-2.5-flash-image" || model === "gemini-3.1-flash-lite-image" ? [1] : model === "gemini-3.1-flash-image" ? [0.5, 1, 2, 4] : [1, 2, 4];
+  const candidates = scales.map((scale) => ({
+    width: table[selected][0] * scale,
+    height: table[selected][1] * scale,
+    scale
+  }));
+  const chosen = pixels ? candidates.sort((a, b) => (a.width - width) ** 2 + (a.height - height) ** 2 - ((b.width - width) ** 2 + (b.height - height) ** 2) || a.scale - b.scale)[0] : candidates.find((c) => c.scale === 1);
+  return {
+    ...chosen,
+    size: `${chosen.width}x${chosen.height}`,
+    pixels: chosen.width * chosen.height,
+    aspectRatio: auto ? void 0 : selected,
+    imageSize: auto || model === "gemini-2.5-flash-image" ? void 0 : chosen.scale === 0.5 ? "512" : `${chosen.scale}K`
+  };
+}
+
+// ../../packages/providers-google/dist/gemini-client.js
+var error = (kind, message, statusCode) => new ProviderError({ kind, message, statusCode });
+var GeminiImageProvider = class {
+  getKey;
+  options;
+  name = "gemini";
+  sizePolicy = {
+    resolveSize: (size) => resolveGeminiSize(size, this.options.imageModel)
+  };
+  constructor(getKey, options = {}) {
+    this.getKey = getKey;
+    this.options = options;
+  }
+  generate(request) {
+    return this.run(request, request.referenceImages ?? []);
+  }
+  edit(request) {
+    if (request.mask)
+      throw error("usage", "Gemini does not support --mask. Describe the region to edit in the prompt.");
+    return this.run(request, [
+      request.sourceImage,
+      ...request.referenceImages ?? []
+    ]);
+  }
+  async run(request, inputs) {
+    const model = (request.model ?? this.options.imageModel ?? process.env["IMAGEGEN_GEMINI_IMAGE_MODEL"] ?? DEFAULT_IMAGE_MODEL2).trim();
+    if (!model)
+      throw error("usage", "Image model must not be blank.");
+    if (request.quality && request.quality.trim().toLowerCase() !== "auto")
+      throw error("usage", "Gemini supports only --quality auto. Use --size to select native resolution.");
+    if ((request.referenceImages?.length ?? 0) > MAX_REFERENCE_IMAGES)
+      throw error("usage", "At most four reference images are allowed.");
+    if (model === "gemini-2.5-flash-image" && inputs.length > 3)
+      throw error("usage", "gemini-2.5-flash-image supports up to three input images in this tool, including the edit source.");
+    if (inputs.some((i) => !["image/png", "image/jpeg", "image/webp"].includes(i.contentType)))
+      throw error("usage", "Gemini inputs must be PNG, JPEG, or WebP.");
+    const count = request.count ?? 1;
+    if (!Number.isInteger(count) || count < 1 || count > 4)
+      throw error("usage", "Image count must be from 1 to 4.");
+    if (request.format && !["png", "jpeg", "jpg", "webp"].includes(request.format.trim().toLowerCase()))
+      throw error("usage", "Output format must be png, jpeg, or webp.");
+    const format = normalizeOutputFormat(request.format);
+    const size = resolveGeminiSize(request.size, model);
+    const payload = {
+      model,
+      store: false,
+      stream: false,
+      input: [
+        { type: "text", text: request.prompt },
+        ...inputs.map((i) => ({
+          type: "image",
+          mime_type: i.contentType,
+          data: Buffer.from(i.data).toString("base64")
+        }))
+      ],
+      // The live image endpoint rejects delivery even though the reference lists it.
+      // Omit it and consume the default base64 response.
+      response_format: {
+        type: "image",
+        ...format === "jpeg" ? { mime_type: "image/jpeg" } : {},
+        ...size.aspectRatio ? { aspect_ratio: size.aspectRatio } : {},
+        ...size.imageSize ? { image_size: size.imageSize } : {}
+      }
+    };
+    if (Buffer.byteLength(JSON.stringify(payload)) > 2e7)
+      throw error("usage", "Gemini inline request exceeds 20 MB. Use smaller reference images.");
+    let key;
+    try {
+      key = await this.getKey();
+    } catch {
+      throw error("auth", "Could not load Gemini credentials. Run imagegen auth gemini login.");
+    }
+    const images = [];
+    for (let i = 0; i < count; i++)
+      images.push(await this.send(payload, key, format, request.prompt));
+    return { provider: this.name, imageModel: model, images };
+  }
+  async send(payload, key, format, prompt) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), (this.options.timeoutSeconds ?? 180) * 1e3);
+    try {
+      const response = await (this.options.fetchImpl ?? fetch)("https://generativelanguage.googleapis.com/v1beta/interactions", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-goog-api-key": key
+        },
+        body: JSON.stringify(payload),
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const status = response.status;
+        const failure2 = await response.json().catch(() => null);
+        const invalidKey = Array.isArray(failure2?.error?.details) && failure2.error.details.some((detail) => detail.reason === "API_KEY_INVALID" || detail.reason === "API_KEY_EXPIRED");
+        throw error(invalidKey || status === 401 || status === 403 ? "auth" : status === 429 ? "rate_limit" : status >= 500 ? "server" : "usage", invalidKey || status === 401 || status === 403 ? "Gemini rejected the API key or access. Check project access and run imagegen auth gemini login." : `Gemini returned HTTP ${status}. Check model access, request options, and project quota.`, status);
+      }
+      const body = await response.json().catch(() => {
+        throw error("malformed", "Gemini returned invalid JSON.");
+      });
+      if (!body || typeof body !== "object")
+        throw error("malformed", "Gemini returned an invalid interaction.");
+      if (body.status !== "completed")
+        throw error(body.status === "failed" ? "blocked" : "incomplete", "Gemini did not complete the image request. Check the prompt and model access.");
+      if (body.steps !== void 0 && !Array.isArray(body.steps))
+        throw error("malformed", "Gemini returned invalid output steps.");
+      if ((body.steps ?? []).some((step) => !step || typeof step !== "object" || step.content !== void 0 && !Array.isArray(step.content))) {
+        throw error("malformed", "Gemini returned invalid output content.");
+      }
+      const parts = (body.steps ?? []).filter((s) => s.type === "model_output").flatMap((s) => s.content ?? []).filter((p) => p && p.type === "image" && !p.thought);
+      const image = parts.at(-1);
+      if (!image)
+        throw error("no_image", "Gemini returned no final image. Refine the image request and try again.");
+      if (typeof image.data !== "string" || !image.data || !/^[A-Za-z0-9+/]+={0,2}$/.test(image.data) || image.data.length % 4 !== 0)
+        throw error("malformed", "Gemini returned invalid inline image data.");
+      const original = Buffer.from(image.data, "base64");
+      const metadata = await sharp(original).metadata().catch(() => {
+        throw error("malformed", "Gemini returned undecodable image bytes.");
+      });
+      if (!metadata.width || !metadata.height || !["png", "jpeg", "webp"].includes(metadata.format ?? "") || image.mime_type !== `image/${metadata.format}`)
+        throw error("malformed", "Gemini returned an invalid image or inconsistent MIME type.");
+      const data = metadata.format === format ? original : await sharp(original).toFormat(format).toBuffer();
+      return {
+        data,
+        mimeType: `image/${format}`,
+        width: metadata.width,
+        height: metadata.height,
+        prompt,
+        responseId: typeof body.id === "string" ? body.id : void 0
+      };
+    } catch (e) {
+      if (controller.signal.aborted)
+        throw error("timeout", "Gemini image request timed out. Try again when connectivity is restored.");
+      if (e instanceof ProviderError)
+        throw e;
+      throw error("transport", "Gemini request failed while receiving or decoding the image. Check connectivity and try again.");
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// ../../packages/providers-google/dist/auth.js
+function validateKey(value) {
+  const key = value.trim();
+  if (!key || /\s/.test(key))
+    throw new ProviderError({
+      kind: "auth",
+      message: "Enter a non-empty Gemini API key without whitespace."
+    });
+  return key;
+}
+async function geminiStore() {
+  return resolveCredentialStore();
+}
+async function storedKey(store) {
+  const value = await store.load("gemini");
+  if (!value || typeof value.apiKey !== "string")
+    throw new ProviderError({
+      kind: "auth",
+      message: "Run imagegen auth gemini login to configure an API key."
+    });
+  return validateKey(value.apiKey);
+}
+
+// ../../packages/providers-google/dist/index.js
+function createGeminiEntry() {
+  return {
+    provider: new GeminiImageProvider(async () => storedKey(await geminiStore())),
+    authStatus: async () => {
+      const store = await geminiStore();
+      let configured = false;
+      try {
+        await storedKey(store);
+        configured = true;
+      } catch {
+      }
+      return {
+        name: "gemini",
+        configured,
+        detail: configured ? void 0 : "Run imagegen auth gemini login to configure an API key."
+      };
+    }
+  };
+}
+
+// ../../packages/providers-configurable/dist/profiles.js
+import { readFile, mkdir, writeFile, rename, rm } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+import { randomUUID } from "node:crypto";
+var usage = (message) => new ProviderError({ kind: "usage", message });
+var profileStore = () => resolveCredentialStore();
+function validateApiKey(value) {
+  const key = value.trim();
+  if (!key || /\s/.test(key))
+    throw new ProviderError({
+      kind: "auth",
+      message: "Enter a non-empty API key without whitespace."
+    });
+  return key;
+}
+function validateProfile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw usage("Invalid endpoint profile.");
+  const p = value;
+  if (Object.keys(p).some((k) => !["name", "api", "baseUrl", "model", "auth"].includes(k)))
+    throw usage("Endpoint profiles accept only name, api, baseUrl, model, and auth; store keys through auth login.");
+  if (typeof p.name !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(p.name) || ["codex", "gemini"].includes(p.name))
+    throw usage("Endpoint name must use lowercase letters, digits, and hyphens, and cannot be codex or gemini.");
+  if (p.api !== "openrouter" && p.api !== "openai-images")
+    throw usage("API format must be openrouter or openai-images.");
+  if (p.auth !== void 0 && p.auth !== "bearer" && p.auth !== "none")
+    throw usage("Auth must be bearer or none.");
+  const raw = p.baseUrl ?? (p.api === "openrouter" ? "https://openrouter.ai/api/v1" : void 0);
+  let url;
+  try {
+    if (typeof raw !== "string")
+      throw new Error();
+    url = new URL(raw);
+  } catch {
+    throw usage("Supply a valid --base-url including the API prefix.");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "127.0.0.1";
+  if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
+    throw usage("Base URL must use HTTPS (or loopback HTTP), without credentials, query, or fragment.");
+  if (p.model !== void 0 && (typeof p.model !== "string" || !p.model.trim()))
+    throw usage("Default model must not be blank.");
+  return {
+    name: p.name,
+    api: p.api,
+    baseUrl: url.toString().replace(/\/+$/, ""),
+    auth: p.auth ?? "bearer",
+    ...typeof p.model === "string" ? { model: p.model.trim() } : {}
+  };
+}
+var ProfileRepository = class {
+  path;
+  credentials;
+  constructor(path = join2(dirname(defaultCredentialFilePath()), "providers.json"), credentials = profileStore) {
+    this.path = path;
+    this.credentials = credentials;
+  }
+  async list() {
+    let text;
+    try {
+      text = await readFile(this.path, "utf8");
+    } catch (e) {
+      if (e.code === "ENOENT")
+        return [];
+      throw new ProviderError({
+        kind: "io",
+        message: "Could not read endpoint configuration."
+      });
+    }
+    let value;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      throw usage("Endpoint configuration is invalid JSON. Repair providers.json before retrying.");
+    }
+    const doc = value;
+    if (!doc || doc.version !== 1 || !Array.isArray(doc.profiles))
+      throw usage("Endpoint configuration requires version 1 and a profiles array.");
+    const profiles = doc.profiles.map(validateProfile);
+    if (new Set(profiles.map((p) => p.name)).size !== profiles.length)
+      throw usage("Endpoint configuration contains duplicate names.");
+    return profiles;
+  }
+  async get(name) {
+    const p = (await this.list()).find((p2) => p2.name === name);
+    if (!p)
+      throw usage("Unknown endpoint profile. Run imagegen providers to list providers.");
+    return p;
+  }
+  async add(value) {
+    const p = validateProfile(value);
+    const profiles = await this.list();
+    if (profiles.some((v) => v.name === p.name))
+      throw usage("Endpoint already exists. Use providers update.");
+    await this.save([...profiles, p]);
+    return p;
+  }
+  async update(name, patch) {
+    const profiles = await this.list();
+    const old = profiles.find((p2) => p2.name === name);
+    if (!old)
+      throw usage("Unknown endpoint profile.");
+    const p = validateProfile({ ...old, ...patch, name });
+    if (new URL(old.baseUrl).origin !== new URL(p.baseUrl).origin || old.auth !== p.auth)
+      await (await this.credentials()).clear(name);
+    await this.save(profiles.map((v) => v.name === name ? p : v));
+    return p;
+  }
+  async remove(name) {
+    const profiles = await this.list();
+    if (!profiles.some((p) => p.name === name))
+      throw usage("Unknown endpoint profile.");
+    await (await this.credentials()).clear(name);
+    await this.save(profiles.filter((p) => p.name !== name));
+  }
+  async save(profiles) {
+    const temporary = `${this.path}.${randomUUID()}.tmp`;
+    try {
+      await mkdir(dirname(this.path), { recursive: true });
+      await writeFile(temporary, JSON.stringify({ version: 1, profiles }, null, 2) + "\n", { mode: 384 });
+      await rename(temporary, this.path);
+    } catch {
+      throw new ProviderError({
+        kind: "io",
+        message: "Could not save endpoint configuration."
+      });
+    } finally {
+      await rm(temporary, { force: true }).catch(() => {
+      });
+    }
+  }
+};
+async function profileKey(profile, store) {
+  if (profile.auth === "none")
+    return void 0;
+  try {
+    const record2 = await store.load(profile.name);
+    if (record2 && typeof record2.apiKey === "string")
+      return validateApiKey(record2.apiKey);
+  } catch {
+  }
+  throw new ProviderError({
+    kind: "auth",
+    message: `Run imagegen auth ${profile.name} login to configure an API key.`
+  });
+}
+
+// ../../packages/providers-configurable/dist/provider.js
+import sharp2 from "sharp";
+
+// ../../packages/providers-configurable/dist/image-size.js
+function imageSize(value, api) {
+  const size = (value ?? "auto").trim().toLowerCase();
+  if (!size || size === "auto")
+    return {};
+  const presets = {
+    square: "1024x1024",
+    portrait: "1024x1536",
+    landscape: "1536x1024",
+    wide: "1536x864",
+    widescreen: "1536x864"
+  };
+  if (presets[size])
+    return { size: presets[size] };
+  const pixels = /^(\d+)\s*x\s*(\d+)$/.exec(size);
+  if (pixels && Number.isSafeInteger(Number(pixels[1])) && Number.isSafeInteger(Number(pixels[2])) && Number(pixels[1]) > 0 && Number(pixels[2]) > 0)
+    return { size: `${Number(pixels[1])}x${Number(pixels[2])}` };
+  const ratio = /^(\d+(?:\.\d+)?)\s*[:/]\s*(\d+(?:\.\d+)?)$/.exec(size);
+  if (api === "openrouter" && ratio && Number(ratio[1]) > 0 && Number(ratio[2]) > 0 && Number.isFinite(Number(ratio[1]) / Number(ratio[2])))
+    return { aspect_ratio: `${Number(ratio[1])}:${Number(ratio[2])}` };
+  throw usage(api === "openai-images" ? "This API format requires WIDTHxHEIGHT or a preset; arbitrary aspect-only sizes are unsupported." : "Use WIDTHxHEIGHT, an aspect ratio, preset, or auto.");
+}
+
+// ../../packages/providers-configurable/dist/http.js
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var EndpointHttp = class {
+  fetchImpl;
+  timeoutSeconds;
+  constructor(fetchImpl = fetch, timeoutSeconds = 180) {
+    this.fetchImpl = fetchImpl;
+    this.timeoutSeconds = timeoutSeconds;
+    if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0)
+      throw new ProviderError({
+        kind: "configuration",
+        message: "Request timeout must be positive and finite."
+      });
+  }
+  async run(action) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutSeconds * 1e3);
+    const send = async (url, init = {}, download = false) => {
+      const response = await this.fetchImpl(url, {
+        ...init,
+        redirect: download ? "follow" : "error",
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const status = response.status;
+        const failure2 = record(await response.json().catch(() => null));
+        const detail = record(failure2.error);
+        const upstream = record(detail.metadata).provider_name;
+        const token = new Headers(init.headers).get("authorization")?.replace(/^Bearer\s+/i, "");
+        const upstreamProvider = typeof upstream === "string" && /^[A-Za-z0-9][A-Za-z0-9 ._()-]{0,63}$/.test(upstream) && !(token && upstream.includes(token)) && !/(?:sk-|AIza)/.test(upstream) ? upstream : void 0;
+        const retryHeader = response.headers.get("retry-after");
+        const retryAfterSeconds = retryHeader && /^\d+$/.test(retryHeader) && Number.isSafeInteger(Number(retryHeader)) ? Number(retryHeader) : void 0;
+        const upstreamQuota = status === 429 && upstreamProvider && typeof detail.message === "string" && /quota|resource.exhausted/i.test(detail.message);
+        throw new ProviderError({
+          kind: download ? "download" : status === 401 || status === 403 ? "auth" : status === 429 ? "rate_limit" : status >= 500 ? "server" : "usage",
+          statusCode: status,
+          upstreamProvider,
+          retryAfterSeconds,
+          message: download ? `Image download failed (HTTP ${status}).` : status === 401 || status === 403 ? "Endpoint authentication failed. Check the saved key and model access." : upstreamQuota ? `Upstream ${upstreamProvider} quota is exhausted (HTTP 429). Gateway credits may still be available. Select a different model or upstream, or resolve that upstream's quota.` : status === 429 && upstreamProvider ? `Upstream ${upstreamProvider} rate limit reached (HTTP 429). Wait for its limit to reset or select another model/upstream.` : status === 429 ? "Endpoint quota or rate limit reached (HTTP 429). Check gateway and upstream limits before retrying." : `Endpoint returned HTTP ${status}. Check the API format, model ID, and supported image options.`
+        });
+      }
+      return response;
+    };
+    try {
+      return await action({
+        json: async (url, init) => {
+          const response = await send(url, init);
+          try {
+            const value = await response.json();
+            if (!value || typeof value !== "object" || Array.isArray(value))
+              throw new Error();
+            return record(value);
+          } catch {
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Endpoint returned an invalid JSON response."
+            });
+          }
+        },
+        bytes: async (url) => new Uint8Array(await (await send(url, {}, true)).arrayBuffer())
+      });
+    } catch (e) {
+      if (controller.signal.aborted)
+        throw new ProviderError({
+          kind: "timeout",
+          message: "Endpoint request timed out; no automatic retry was attempted."
+        });
+      if (e instanceof ProviderError)
+        throw e;
+      throw new ProviderError({
+        kind: "transport",
+        message: "Endpoint request failed. Check connectivity and the configured URL."
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// ../../packages/providers-configurable/dist/openrouter.js
+function openRouterRequest(model, request, images) {
+  return {
+    path: "images",
+    body: JSON.stringify({
+      model,
+      prompt: request.prompt,
+      n: 1,
+      ...imageSize(request.size, "openrouter"),
+      ...request.quality && request.quality !== "auto" ? { quality: request.quality } : {},
+      ...request.format ? { output_format: request.format === "jpg" ? "jpeg" : request.format } : {},
+      ...images.length ? {
+        input_references: images.map((image) => ({
+          type: "image_url",
+          image_url: {
+            url: `data:${image.contentType};base64,${Buffer.from(image.data).toString("base64")}`
+          }
+        }))
+      } : {}
+    }),
+    json: true
+  };
+}
+
+// ../../packages/providers-configurable/dist/openai-images.js
+function openAIRequest(model, request, images, mask) {
+  const fields = {
+    model,
+    prompt: request.prompt,
+    n: 1,
+    ...imageSize(request.size, "openai-images"),
+    ...request.quality && request.quality !== "auto" ? { quality: request.quality } : {},
+    ...request.format ? { output_format: request.format === "jpg" ? "jpeg" : request.format } : {}
+  };
+  if (!images.length)
+    return {
+      path: "images/generations",
+      body: JSON.stringify(fields),
+      json: true
+    };
+  const body = new FormData();
+  for (const [key, value] of Object.entries(fields))
+    body.set(key, String(value));
+  const add = (name, image, index) => body.append(name, new Blob([new Uint8Array(image.data)], { type: image.contentType }), image.filename ?? `image-${index}.png`);
+  images.forEach((image, i) => add(images.length === 1 ? "image" : "image[]", image, i));
+  if (mask)
+    add("mask", mask, 0);
+  return { path: "images/edits", body, json: false };
+}
+
+// ../../packages/providers-configurable/dist/provider.js
+var ConfigurableImageProvider = class {
+  getKey;
+  name;
+  profile;
+  http;
+  constructor(profile, getKey, options = {}) {
+    this.getKey = getKey;
+    this.profile = validateProfile(profile);
+    this.name = profile.name;
+    this.http = new EndpointHttp(options.fetchImpl, options.timeoutSeconds);
+  }
+  sizePolicy = {
+    resolveSize: (size) => {
+      const fields = imageSize(size, this.profile.api);
+      if (!fields.size)
+        return { size: fields.aspect_ratio ?? "auto" };
+      const [width, height] = fields.size.split("x").map(Number);
+      return {
+        width,
+        height,
+        pixels: width * height,
+        size: fields.size ?? fields.aspect_ratio ?? "auto"
+      };
+    }
+  };
+  generate(request) {
+    return this.run(request, request.referenceImages ?? []);
+  }
+  edit(request) {
+    return this.run(request, [request.sourceImage, ...request.referenceImages ?? []], request.mask);
+  }
+  async headers() {
+    if (this.profile.auth === "none")
+      return {};
+    try {
+      const key = await this.getKey();
+      if (!key)
+        throw new Error();
+      return { authorization: `Bearer ${validateApiKey(key)}` };
+    } catch {
+      throw new ProviderError({
+        kind: "auth",
+        message: `Could not load endpoint credentials. Run imagegen auth ${this.name} login.`
+      });
+    }
+  }
+  async models() {
+    const headers = await this.headers();
+    return this.http.run(async (http) => {
+      const body = await http.json(`${this.profile.baseUrl}/${this.profile.api === "openrouter" ? "images/models" : "models"}`, { headers });
+      if (!Array.isArray(body.data))
+        throw new ProviderError({
+          kind: "malformed",
+          message: "Model discovery response must contain a data array."
+        });
+      return body.data.map((value) => {
+        const model = record(value);
+        if (typeof model.id !== "string")
+          throw new ProviderError({
+            kind: "malformed",
+            message: "Discovered model has no string ID."
+          });
+        const architecture = record(model.architecture);
+        const supported = record(model.supported_parameters);
+        const strings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string") ? v : void 0;
+        return {
+          id: model.id,
+          ...typeof model.name === "string" ? { name: model.name } : {},
+          capabilities: this.profile.api === "openrouter" ? "reported" : "unknown",
+          ...this.profile.api === "openrouter" ? {
+            supportedParameters: supported,
+            inputModalities: strings(architecture.input_modalities),
+            outputModalities: strings(architecture.output_modalities)
+          } : {}
+        };
+      });
+    });
+  }
+  async run(request, images, mask) {
+    const model = (request.model ?? this.profile.model ?? "").trim();
+    if (!model)
+      throw usage("Supply --model or configure a default model with providers update.");
+    if ((request.referenceImages?.length ?? 0) > 4)
+      throw usage("At most four reference images are allowed.");
+    const count = request.count ?? 1;
+    if (!Number.isInteger(count) || count < 1 || count > 4)
+      throw usage("Image count must be from 1 to 4.");
+    if (mask && this.profile.api === "openrouter")
+      throw usage("OpenRouter image API does not expose masks. Describe the edit region in the prompt.");
+    for (const image of [...images, ...mask ? [mask] : []])
+      if (!["image/png", "image/jpeg", "image/webp"].includes(image.contentType))
+        throw usage("Input images must be PNG, JPEG, or WebP.");
+    const format = (request.format ?? "png").trim().toLowerCase().replace(/^jpg$/, "jpeg");
+    if (!["png", "jpeg", "webp"].includes(format))
+      throw usage("Output format must be png, jpeg, or webp.");
+    const quality = request.quality?.trim().toLowerCase();
+    if (quality && !/^[a-z][a-z0-9_-]*$/.test(quality))
+      throw usage("Quality must be a provider-supported quality name.");
+    const normalized = {
+      ...request,
+      ...request.format ? { format } : {},
+      quality
+    };
+    const payload = this.profile.api === "openrouter" ? openRouterRequest(model, normalized, images) : openAIRequest(model, normalized, images, mask);
+    const headers = await this.headers();
+    const results = [];
+    for (let i = 0; i < count; i++)
+      results.push(await this.http.run(async (http) => {
+        const body = await http.json(`${this.profile.baseUrl}/${payload.path}`, {
+          method: "POST",
+          headers: {
+            ...headers,
+            ...payload.json ? { "content-type": "application/json" } : {}
+          },
+          body: payload.body
+        });
+        if (!Array.isArray(body.data) || body.data.length !== 1)
+          throw new ProviderError({
+            kind: "malformed",
+            message: "Endpoint must return exactly one image for a single-image request."
+          });
+        const image = record(body.data[0]);
+        let data;
+        if (typeof image.b64_json === "string") {
+          if (!image.b64_json || image.b64_json.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(image.b64_json))
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Endpoint returned invalid base64 image data."
+            });
+          data = Buffer.from(image.b64_json, "base64");
+        } else if (typeof image.url === "string") {
+          let url;
+          try {
+            url = new URL(image.url);
+          } catch {
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Endpoint returned an invalid image URL."
+            });
+          }
+          if (headers.authorization && image.url.includes(headers.authorization.slice(7)) || url.username || url.password || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Image download URL must use HTTPS or loopback HTTP without embedded credentials."
+            });
+          data = await http.bytes(url.toString());
+        } else
+          throw new ProviderError({
+            kind: "no_image",
+            message: "Endpoint returned no image bytes or download URL."
+          });
+        try {
+          const metadata = await sharp2(data).metadata();
+          if (!metadata.width || !metadata.height || !["png", "jpeg", "webp"].includes(metadata.format ?? "") || typeof image.media_type === "string" && image.media_type !== `image/${metadata.format}`)
+            throw new Error();
+          await sharp2(data).stats();
+          if (metadata.format !== format)
+            data = await sharp2(data).toFormat(format).toBuffer();
+          return {
+            data,
+            width: metadata.width,
+            height: metadata.height,
+            mimeType: `image/${format}`,
+            prompt: request.prompt,
+            ...typeof body.id === "string" ? { responseId: body.id } : {}
+          };
+        } catch {
+          throw new ProviderError({
+            kind: "malformed",
+            message: "Endpoint returned an invalid raster image or inconsistent image format."
+          });
+        }
+      }));
+    return { provider: this.name, imageModel: model, images: results };
+  }
+};
+function createProfileEntry(profile) {
+  return {
+    provider: new ConfigurableImageProvider(profile, async () => profileKey(profile, await profileStore())),
+    authStatus: async () => {
+      let configured = profile.auth === "none";
+      if (!configured)
+        try {
+          await profileKey(profile, await profileStore());
+          configured = true;
+        } catch {
+        }
+      return {
+        name: profile.name,
+        configured,
+        detail: `Run imagegen auth ${profile.name} login.`
+      };
+    }
+  };
+}
+
+// src/key-input.ts
+import { emitKeypressEvents } from "node:readline";
+var failure = (message) => new ProviderError({ kind: "auth", message });
+async function readApiKey(fromStdin, input = process.stdin, output = process.stderr, providerName = "gemini") {
+  if (fromStdin) {
+    let text = "";
+    for await (const chunk of input) {
+      text += chunk.toString();
+      if (Buffer.byteLength(text) > 8192)
+        throw failure("API key input is too long.");
+    }
+    return text;
+  }
+  if (!input.isTTY)
+    throw failure(
+      "API-key login requires a terminal, or explicit --key-stdin."
+    );
+  const terminal = input;
+  const wasRaw = terminal.isRaw;
+  const wasFlowing = input.readableFlowing === true;
+  emitKeypressEvents(input);
+  return new Promise((resolve3, reject) => {
+    let text = "";
+    const cleanup = () => {
+      input.removeListener("keypress", onKey);
+      input.removeListener("end", onEnd);
+      input.removeListener("error", onError);
+      terminal.setRawMode(wasRaw);
+      if (!wasFlowing) input.pause();
+      output.write("\n");
+    };
+    const onEnd = () => {
+      cleanup();
+      reject(failure("API-key login cancelled before a key was entered."));
+    };
+    const onError = () => {
+      cleanup();
+      reject(failure("Could not read the API key."));
+    };
+    const onKey = (value, key) => {
+      if (key.ctrl && (key.name === "c" || key.name === "d")) {
+        onEnd();
+        return;
+      }
+      if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        resolve3(text);
+        return;
+      }
+      if (key.name === "backspace") {
+        text = text.slice(0, -1);
+        return;
+      }
+      if (value && !key.ctrl && !/[\x00-\x1f\x7f]/.test(value)) text += value;
+      if (text.length > 8192) {
+        cleanup();
+        reject(failure("API key input is too long."));
+      }
+    };
+    output.write(`${providerName} API key (hidden): `);
+    input.on("keypress", onKey);
+    input.once("end", onEnd);
+    input.once("error", onError);
+    terminal.setRawMode(true);
+    input.resume();
+  });
+}
+
 // src/help.ts
+var PROFILE_HELP = `Named endpoint profiles:
+  imagegen providers add <name> --api <openrouter|openai-images> [--base-url <url>]
+                         [--model <id>] [--auth <bearer|none>]
+  imagegen providers show <name>
+  imagegen providers update <name> [--api <format>] [--base-url <url>]
+                         [--model <id>] [--auth <bearer|none>]
+  imagegen providers remove <name>
+  imagegen auth <name> login [--key-stdin]
+  imagegen auth <name> status [--show-path]
+  imagegen auth <name> logout
+  imagegen models --provider <name>
+
+OpenRouter defaults to https://openrouter.ai/api/v1. openai-images requires
+--base-url including the API prefix (e.g. https://api.openai.com/v1).
+Keys use hidden terminal input or explicit --key-stdin and the existing vault/file
+store. --auth none supports endpoints without keys. Config is saved in providers.json
+alongside the credential file. Origin changes clear the saved key; removing a
+profile removes its credentials. Logout preserves profile configuration.
+
+Select named profiles with --provider. Model precedence: --model > profile default;
+provide one if no default is saved. models explicitly discovers model metadata;
+OpenAI-compatible model listings do not establish image capabilities.
+
+Supported protocols: OpenRouter dedicated Images API and OpenAI Images JSON /
+multipart endpoints, not arbitrary HTTP templates. Options vary by model.
+OpenRouter accepts aspect ratios; openai-images needs pixels or presets:
+square 1024x1024, portrait 1024x1536, landscape 1536x1024, wide 1536x864.
+Auto options are omitted. Native masks require openai-images or Codex.
+Outputs are measured and converted to PNG/JPEG/WebP without resizing. Count uses
+separate single-image requests without automatic retries or model substitution.
+`;
 var IMAGE_OPTIONS = `Image options (generate, edit):
   --prompt <text>        Prompt text (required)
   --out <path|dir>       Output file or directory (required)
   --provider <name>      Repeatable. Defaults to the only configured provider;
                          required when several are configured.
-  --model <id>          Image model override (Codex default gpt-image-2.5-flare)
+  --model <id>          Image model override (defaults listed below)
   --reference <file>     Reference image for continuity (repeatable, max 4)
   --size <size>          auto, WIDTHxHEIGHT, aspect (16:9), or preset
                      square, portrait, landscape, wide (validated per
@@ -1022,6 +1926,18 @@ var IMAGE_OPTIONS = `Image options (generate, edit):
   --format <format>      png, jpeg, or webp (default png)
   --count <n>            Number of images, 1-4 (default 1)
 
+Gemini provider:
+  gemini-nano-banana-2.1 Default; generation, references, and independent edits
+  gemini-3-pro-image    Precision creative work and brand consistency
+  gemini-3.1-flash-image Previous-generation Flash; also supports 512 resolution
+  gemini-2.5-flash-image Legacy; up to three inputs including edit source
+  --quality auto only; no --mask or guaranteed native alpha transparency.
+  --size normalizes to model-native ratios and resolution tiers without resizing.
+  auto keeps model defaults; aspect/preset requests use 1K. JSON reports actual pixels.
+  PNG/JPEG/WebP output; format conversion happens locally when needed.
+  Model precedence: --model > constructor imageModel > IMAGEGEN_GEMINI_IMAGE_MODEL
+  > gemini-nano-banana-2.1. Calls are independent; use prior output as --source.
+
 Supported Codex models (account availability is determined by the provider):
   gpt-image-2.5-flare     Default; fast image generation and editing
   gpt-image-2.5-sunburst  Higher-precision image generation and editing
@@ -1036,13 +1952,14 @@ Codex quality: auto (default), low, medium, high; Flare/Sunburst also support
 xhigh and max. gpt-image-2 rejects xhigh/max.
 `;
 var GENERATE_EXAMPLES = `Examples:
+  imagegen generate --provider gemini --size 16:9 --prompt "a lighthouse at dawn" --out ./gemini.png
   imagegen generate --prompt "a lighthouse at dawn" --out ./lighthouse.png
   imagegen generate --model gpt-image-2 --prompt "a lighthouse" --out ./classic.png
   imagegen generate --model gpt-image-2.5-sunburst --quality max --prompt "a product photo" --out ./product.png
 `;
 var EDIT_EXAMPLES = `Edit options:
   --source <file>        Source image (required)
-  --mask <file>          Optional edit mask
+  --mask <file>          Optional edit mask (Codex or openai-images)
 
 Examples:
   imagegen edit --format webp --source ./product.png --prompt "make the product blue" --out ./blue.webp
@@ -1051,21 +1968,28 @@ Examples:
 var USAGE = `imagegen - provider-agnostic image generation CLI
 
 Usage:
+  imagegen auth gemini login [--key-stdin]
+  imagegen auth gemini status [--show-path]
+  imagegen auth gemini logout
   imagegen auth codex login [--timeout <minutes>] [--no-open]
   imagegen auth codex status [--show-path]
   imagegen auth codex logout
   imagegen generate --prompt <text> --out <path|dir> [--provider <name>] [options]
   imagegen edit --prompt <text> --source <file> [--mask <file>] --out <path|dir> [--provider <name>] [options]
   imagegen providers
+  imagegen models --provider <profile-name>
   imagegen skill
   imagegen skill install --target <claude|codex|skills-dir> [--target <...>] [--force]
   imagegen help [command]
 
+${PROFILE_HELP}
 ${IMAGE_OPTIONS}
 ${GENERATE_EXAMPLES}
 ${EDIT_EXAMPLES}
 
 Auth options:
+  --key-stdin           Read an API key from explicit stdin; otherwise hidden
+                         terminal entry. Keys are stored in the vault/file fallback.
   --timeout <minutes>    Login wait timeout (default 10)
   --no-open              Print the URL without opening a browser
   --show-path            Show where tokens are stored (auth status)
@@ -1076,29 +2000,42 @@ Global:
 var COMMAND_HELP = {
   auth: `imagegen auth - manage provider credentials (one namespace per provider)
 
+${PROFILE_HELP}
+
 Usage:
+  imagegen auth gemini login [--key-stdin]
+  imagegen auth gemini status [--show-path]
+  imagegen auth gemini logout
   imagegen auth codex login [--timeout <minutes>] [--no-open]
   imagegen auth codex status [--show-path]
   imagegen auth codex logout
 `,
-  login: `imagegen auth codex login - connect Codex via browser OAuth
+  login: `imagegen auth login - connect Gemini with an API key or Codex via OAuth
 
 Usage:
+  imagegen auth gemini login [--key-stdin]
+  imagegen auth gemini status [--show-path]
+  imagegen auth gemini logout
   imagegen auth codex login [--timeout <minutes>] [--no-open]
 
-Starts a temporary localhost callback server, opens the browser,
+Gemini login reads a hidden API key (or explicit --key-stdin), stores it in the
+OS vault with file fallback, and makes no paid verification request.
+Codex login starts a temporary localhost callback server, opens the browser,
 exchanges the code, and stores tokens in the OS vault (file fallback).
 `,
-  status: `imagegen auth codex status - show Codex connection state
+  status: `imagegen auth status - show provider connection state
 
 Usage:
+  imagegen auth gemini status [--show-path]
   imagegen auth codex status [--show-path]
 
-Prints JSON without secrets. --show-path reveals the token location.
+Prints JSON without secrets. --show-path reveals the credential location.
+Gemini status is local configured state, not API-key validity.
 `,
-  logout: `imagegen auth codex logout - remove stored Codex credentials
+  logout: `imagegen auth logout - remove stored provider credentials
 
 Usage:
+  imagegen auth gemini logout
   imagegen auth codex logout
 `,
   generate: `imagegen generate - create images from a prompt
@@ -1106,6 +2043,7 @@ Usage:
 Usage:
   imagegen generate --prompt <text> --out <path|dir> [--provider <name>] [options]
 
+${PROFILE_HELP}
 ${IMAGE_OPTIONS}
 ${GENERATE_EXAMPLES}
 `,
@@ -1117,12 +2055,22 @@ Usage:
 ${IMAGE_OPTIONS}
 ${EDIT_EXAMPLES}
 `,
-  providers: `imagegen providers - list registered and configured providers
+  providers: `imagegen providers - list providers and manage named endpoints
 
 Usage:
   imagegen providers
 
 Prints JSON with each provider and whether it is configured.
+
+${PROFILE_HELP}`,
+  models: `imagegen models - discover models for a named endpoint profile
+
+Usage:
+  imagegen models --provider <profile-name>
+
+Discovery is explicit and may require saved credentials. OpenRouter returns image
+models and reported capabilities; generic /models results have unknown image
+capabilities. This command does not generate images.
 `,
   skill: `imagegen skill - print or install the reusable agent skill
 
@@ -1154,9 +2102,9 @@ ${USAGE}`;
 }
 
 // src/skill.ts
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname, join as join2, resolve } from "node:path";
+import { dirname as dirname2, join as join3, resolve } from "node:path";
 var SKILL_NAME = "imagegen-cli";
 var SkillExistsError = class extends Error {
   constructor(path) {
@@ -1165,18 +2113,18 @@ var SkillExistsError = class extends Error {
   }
 };
 async function skillText() {
-  return readFile(new URL("../skill/SKILL.md", import.meta.url), "utf8");
+  return readFile2(new URL("../skill/SKILL.md", import.meta.url), "utf8");
 }
 function targetPath(target) {
-  const root = target === "claude" ? join2(homedir2(), ".claude", "skills") : target === "codex" ? join2(homedir2(), ".agents", "skills") : resolve(target);
-  return join2(root, SKILL_NAME, "SKILL.md");
+  const root = target === "claude" ? join3(homedir2(), ".claude", "skills") : target === "codex" ? join3(homedir2(), ".agents", "skills") : resolve(target);
+  return join3(root, SKILL_NAME, "SKILL.md");
 }
 async function existingText(path) {
   try {
-    return await readFile(path, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
+    return await readFile2(path, "utf8");
+  } catch (error2) {
+    if (error2.code === "ENOENT") return void 0;
+    throw error2;
   }
 }
 async function installSkill(targets, force) {
@@ -1195,8 +2143,8 @@ async function installSkill(targets, force) {
   }
   for (const item of planned.values()) {
     if (item.status === "up-to-date") continue;
-    await mkdir(dirname(item.path), { recursive: true });
-    await writeFile(item.path, content, { encoding: "utf8", flag: item.status === "installed" ? "wx" : "w" });
+    await mkdir2(dirname2(item.path), { recursive: true });
+    await writeFile2(item.path, content, { encoding: "utf8", flag: item.status === "installed" ? "wx" : "w" });
   }
   return [...planned.values()];
 }
@@ -1206,8 +2154,11 @@ var EXIT_USAGE = 2;
 var EXIT_AUTH = 3;
 var EXIT_PROVIDER = 4;
 var EXIT_IO = 5;
-function fail(kind, message, exitCode) {
-  process.stderr.write(`${JSON.stringify({ error: { kind, message } })}
+function errorDetails(error2) {
+  return { statusCode: error2.statusCode, upstreamProvider: error2.upstreamProvider, retryAfterSeconds: error2.retryAfterSeconds };
+}
+function fail(kind, message, exitCode, details = {}) {
+  process.stderr.write(`${JSON.stringify({ error: { kind, message, ...details } })}
 `);
   process.exit(exitCode);
 }
@@ -1222,10 +2173,10 @@ function parseArgs(argv) {
     }
     if (arg.startsWith("--")) {
       const key = arg.slice(2);
-      if (!["prompt", "out", "provider", "model", "reference", "size", "quality", "format", "count", "source", "mask", "timeout", "no-open", "show-path", "target", "force"].includes(key)) {
+      if (!["prompt", "out", "provider", "model", "reference", "size", "quality", "format", "count", "source", "mask", "timeout", "api", "base-url", "auth", "key-stdin", "no-open", "show-path", "target", "force"].includes(key)) {
         fail("usage", `Unknown option --${key}. Run imagegen help.`, EXIT_USAGE);
       }
-      if (key === "no-open" || key === "show-path" || key === "force") {
+      if (key === "key-stdin" || key === "no-open" || key === "show-path" || key === "force") {
         flags.set(key, true);
         continue;
       }
@@ -1273,7 +2224,7 @@ function redirectPort(uri) {
 async function loadImageInput(path, label) {
   let data;
   try {
-    data = await readFile2(path);
+    data = await readFile3(path);
   } catch {
     fail("io", `${label} not found: ${path}`, EXIT_IO);
   }
@@ -1313,9 +2264,11 @@ function parseCount(flags) {
   }
   return count;
 }
-function registry() {
+async function registry() {
   const registry2 = new ProviderRegistry();
   registry2.register(createCodexEntry());
+  registry2.register(createGeminiEntry());
+  for (const profile of await new ProfileRepository().list()) registry2.register(createProfileEntry(profile));
   return registry2;
 }
 function requestedProviders(flags) {
@@ -1335,12 +2288,12 @@ async function resolveOutPaths(out, providerName, multiProvider, count, format)
   const extension = `.${normalizeOutputFormat(format)}`;
   const prefix = multiProvider ? `${providerName}-` : "";
   if (isDir) {
-    return Array.from({ length: count }, (_, i) => join3(resolved, `${prefix}image-${i + 1}${extension}`));
+    return Array.from({ length: count }, (_, i) => join4(resolved, `${prefix}image-${i + 1}${extension}`));
   }
   if (count > 1 || multiProvider) {
-    const dir = dirname2(resolved);
+    const dir = dirname3(resolved);
     const base = basename(resolved, extname(resolved));
-    return Array.from({ length: count }, (_, i) => join3(dir, `${prefix}${base}-${i + 1}${extension}`));
+    return Array.from({ length: count }, (_, i) => join4(dir, `${prefix}${base}-${i + 1}${extension}`));
   }
   return [resolved.endsWith(extension) ? resolved : `${resolved}${extension}`];
 }
@@ -1365,16 +2318,67 @@ async function saveImages(result, paths) {
   for (let i = 0; i < result.images.length; i += 1) {
     const path = paths[i];
     try {
-      await mkdir2(dirname2(path), { recursive: true });
-      await writeFile2(path, Buffer.from(result.images[i].data));
+      await mkdir3(dirname3(path), { recursive: true });
+      await writeFile3(path, Buffer.from(result.images[i].data));
     } catch {
       fail("io", `Could not write output file: ${path}`, EXIT_IO);
     }
   }
 }
+async function runApiKeyAuth(providerName, action, flags) {
+  const profile = providerName === "gemini" ? void 0 : await new ProfileRepository().get(providerName);
+  try {
+    if (profile?.auth === "none") {
+      process.stdout.write(`${JSON.stringify({ provider: providerName, ...action === "status" ? { connected: true, auth: "none" } : { status: "not-required" } })}
+`);
+      return;
+    }
+    const store = profile ? await profileStore() : await geminiStore();
+    if (action === "login") {
+      const apiKey = validateApiKey(
+        await readApiKey(flags.get("key-stdin") === true, process.stdin, process.stderr, providerName)
+      );
+      if (store.describe().backend === "file")
+        process.stderr.write(
+          `Warning: OS vault unavailable; credentials stored in a restricted file. Use auth ${providerName} status --show-path to inspect.
+`
+        );
+      await store.save(providerName, { apiKey });
+      process.stdout.write(
+        `${JSON.stringify({ provider: providerName, status: "connected" })}
+`
+      );
+    } else if (action === "logout") {
+      await store.clear(providerName);
+      process.stdout.write(
+        `${JSON.stringify({ provider: providerName, status: "disconnected" })}
+`
+      );
+    } else {
+      let connected = false;
+      try {
+        if (profile) await profileKey(profile, store);
+        else await storedKey(store);
+        connected = true;
+      } catch (error2) {
+        if (!(error2 instanceof ProviderError)) throw error2;
+      }
+      process.stdout.write(
+        `${JSON.stringify({ provider: providerName, connected, ...flags.get("show-path") ? { store: store.describe() } : {} })}
+`
+      );
+    }
+  } catch (error2) {
+    fail(
+      "auth",
+      error2 instanceof ProviderError ? error2.message : "Could not access API credentials. Check the credential store and retry login.",
+      EXIT_AUTH
+    );
+  }
+}
 async function runAuthLogin(providerName, flags) {
   if (providerName !== PROVIDER_NAME) {
-    fail("usage", `Unknown auth provider "${providerName}". Available: ${registry().describe()}.`, EXIT_USAGE);
+    fail("usage", `Unknown auth provider "${providerName}". Available: ${(await registry()).describe()}.`, EXIT_USAGE);
   }
   const uri = redirectUri();
   const port = redirectPort(uri);
@@ -1398,9 +2402,9 @@ ${url}
 `);
   try {
     callback = await waiter;
-  } catch (error) {
-    if (error instanceof LoopbackError) fail("auth", error.message, EXIT_AUTH);
-    throw error;
+  } catch (error2) {
+    if (error2 instanceof LoopbackError) fail("auth", error2.message, EXIT_AUTH);
+    throw error2;
   }
   if (callback.state !== state) fail("auth", "OAuth state mismatch. Retry `imagegen auth codex login`.", EXIT_AUTH);
   const verifier = consumeVerifier(state);
@@ -1412,15 +2416,16 @@ ${url}
   const manager = new CodexTokenManager(store);
   try {
     await manager.exchangeAndSave({ code: callback.code, redirectUri: uri, codeVerifier: verifier });
-  } catch (error) {
-    if (error instanceof ReauthRequiredError) fail("auth", error.message, EXIT_AUTH);
-    throw error;
+  } catch (error2) {
+    if (error2 instanceof ReauthRequiredError) fail("auth", error2.message, EXIT_AUTH);
+    throw error2;
   }
   process.stdout.write(`${JSON.stringify({ provider: PROVIDER_NAME, status: "connected" })}
 `);
 }
 async function runProviders() {
-  const entries = registry().names().map((name) => registry().get(name));
+  const providersRegistry = await registry();
+  const entries = providersRegistry.names().map((name) => providersRegistry.get(name));
   const providers = [];
   for (const entry of entries) {
     const status = await entry.authStatus();
@@ -1431,7 +2436,7 @@ async function runProviders() {
 }
 async function runAuthStatus(providerName, flags) {
   if (providerName !== PROVIDER_NAME) {
-    fail("usage", `Unknown auth provider "${providerName}". Available: ${registry().describe()}.`, EXIT_USAGE);
+    fail("usage", `Unknown auth provider "${providerName}". Available: ${(await registry()).describe()}.`, EXIT_USAGE);
   }
   const store = await resolveTokenStore();
   const manager = new CodexTokenManager(store);
@@ -1447,7 +2452,7 @@ async function runAuthStatus(providerName, flags) {
 }
 async function runAuthLogout(providerName) {
   if (providerName !== PROVIDER_NAME) {
-    fail("usage", `Unknown auth provider "${providerName}". Available: ${registry().describe()}.`, EXIT_USAGE);
+    fail("usage", `Unknown auth provider "${providerName}". Available: ${(await registry()).describe()}.`, EXIT_USAGE);
   }
   const store = await resolveTokenStore();
   await store.clear(PROVIDER_NAME);
@@ -1475,9 +2480,9 @@ async function runGenerate(flags) {
 }
 async function resolveProviders(requested) {
   try {
-    return await registry().resolve(requested);
-  } catch (error) {
-    fail("usage", error instanceof Error ? error.message : String(error), EXIT_USAGE);
+    return await (await registry()).resolve(requested);
+  } catch (error2) {
+    fail("usage", error2 instanceof Error ? error2.message : String(error2), EXIT_USAGE);
   }
 }
 async function runEdit(flags) {
@@ -1508,13 +2513,14 @@ async function runImageRequest(request, edit, providers) {
     let result;
     try {
       result = edit ? await entry.provider.edit(edit) : await entry.provider.generate(request);
-    } catch (error) {
-      if (error instanceof ReauthRequiredError) fail("auth", `${entry.provider.name}: ${error.message}`, EXIT_AUTH);
-      if (error instanceof ProviderError) {
-        if (error.kind === "configuration" || error.kind === "usage") fail(error.kind, `${entry.provider.name}: ${error.message}`, EXIT_USAGE);
-        fail("provider", `${entry.provider.name}: ${error.kind}: ${error.message}`, EXIT_PROVIDER);
+    } catch (error2) {
+      if (error2 instanceof ReauthRequiredError) fail("auth", `${entry.provider.name}: ${error2.message}`, EXIT_AUTH);
+      if (error2 instanceof ProviderError) {
+        if (error2.kind === "auth") fail("auth", `${entry.provider.name}: ${error2.message}`, EXIT_AUTH, errorDetails(error2));
+        if (error2.kind === "configuration" || error2.kind === "usage") fail(error2.kind, `${entry.provider.name}: ${error2.message}`, EXIT_USAGE, errorDetails(error2));
+        fail("provider", `${entry.provider.name}: ${error2.kind}: ${error2.message}`, EXIT_PROVIDER, errorDetails(error2));
       }
-      throw error;
+      throw error2;
     }
     const paths = await resolveOutPaths(request.out, entry.provider.name, multiProvider, result.images.length, request.format ?? "png");
     await saveImages(result, paths);
@@ -1528,6 +2534,9 @@ async function main() {
     return;
   }
   const [command, sub, subSub] = positionals;
+  if (flags.has("key-stdin") && !(command === "auth" && sub !== "codex" && subSub === "login")) {
+    fail("usage", "--key-stdin is only supported by API-key auth login.", EXIT_USAGE);
+  }
   try {
     if (command === "help") {
       process.stdout.write(helpFor(sub));
@@ -1546,12 +2555,42 @@ async function main() {
         const installed = await installSkill(targets, flags.get("force") === true);
         process.stdout.write(`${JSON.stringify({ skill: "imagegen-cli", installed })}
 `);
-      } catch (error) {
-        if (error instanceof SkillExistsError) fail("usage", error.message, EXIT_USAGE);
-        fail("io", error instanceof Error ? error.message : String(error), EXIT_IO);
+      } catch (error2) {
+        if (error2 instanceof SkillExistsError) fail("usage", error2.message, EXIT_USAGE);
+        fail("io", error2 instanceof Error ? error2.message : String(error2), EXIT_IO);
       }
       return;
     }
+    if (command === "providers" && sub) {
+      if (!subSub || positionals.length !== 3) fail("usage", "Usage: imagegen providers add|show|update|remove <name> [options].", EXIT_USAGE);
+      const repository = new ProfileRepository();
+      if (sub === "show") process.stdout.write(`${JSON.stringify({ provider: await repository.get(subSub) })}
+`);
+      else if (sub === "remove") {
+        await repository.remove(subSub);
+        process.stdout.write(`${JSON.stringify({ provider: subSub, status: "removed" })}
+`);
+      } else if (sub === "add" || sub === "update") {
+        const patch = {};
+        for (const [flag, key] of [["api", "api"], ["base-url", "baseUrl"], ["auth", "auth"], ["model", "model"]]) {
+          const value = flagValue(flags, flag);
+          if (value !== void 0) patch[key] = value;
+        }
+        const profile = sub === "add" ? await repository.add({ name: subSub, ...patch }) : await repository.update(subSub, patch);
+        process.stdout.write(`${JSON.stringify({ provider: profile })}
+`);
+      } else fail("usage", "Unknown providers action. Use add, show, update, or remove.", EXIT_USAGE);
+      return;
+    }
+    if (command === "models" && !sub) {
+      const selected = requestedProviders(flags);
+      if (!selected || selected.length !== 1) fail("usage", "Model discovery requires exactly one --provider <profile-name>.", EXIT_USAGE);
+      const profile = await new ProfileRepository().get(selected[0]);
+      const provider = new ConfigurableImageProvider(profile, async () => profileKey(profile, await profileStore()));
+      process.stdout.write(`${JSON.stringify({ provider: profile.name, models: await provider.models() })}
+`);
+      return;
+    }
     if (command === "providers" && !sub) {
       await runProviders();
       return;
@@ -1559,6 +2598,10 @@ async function main() {
     if (command === "auth" && sub && !subSub) {
       fail("usage", `Missing auth action. Usage: imagegen auth ${sub} login|status|logout.`, EXIT_USAGE);
     }
+    if (command === "auth" && sub && sub !== "codex" && ["login", "status", "logout"].includes(subSub)) {
+      await runApiKeyAuth(sub, subSub, flags);
+      return;
+    }
     if (command === "auth" && sub) {
       if (subSub === "login") {
         await runAuthLogin(sub, flags);
@@ -1582,9 +2625,12 @@ async function main() {
       return;
     }
     fail("usage", `Unknown command: ${positionals.join(" ")}. Run \`imagegen help\`.`, EXIT_USAGE);
-  } catch (error) {
-    if (error instanceof ProviderError) fail("provider", `${error.kind}: ${error.message}`, EXIT_PROVIDER);
-    fail("provider", error instanceof Error ? error.message : String(error), EXIT_PROVIDER);
+  } catch (error2) {
+    if (error2 instanceof ProviderError) {
+      const exit = error2.kind === "auth" ? EXIT_AUTH : error2.kind === "usage" || error2.kind === "configuration" ? EXIT_USAGE : error2.kind === "io" ? EXIT_IO : EXIT_PROVIDER;
+      fail(error2.kind, error2.message, exit, errorDetails(error2));
+    }
+    fail("provider", error2 instanceof Error ? error2.message : String(error2), EXIT_PROVIDER);
   }
 }
 await main();