@dorely13/ai-imagegen-cli 0.1.3 → 0.3.0

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { mkdir as mkdir2, readFile as readFile2, stat, writeFile as writeFile2 } from "node:fs/promises";
-import { basename, dirname as dirname2, extname, join as join3, resolve as resolve2 } from "node:path";
+import { mkdir as mkdir5, readFile as readFile3, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import { basename, dirname as dirname5, extname, join as join5, resolve as resolve3 } from "node:path";
 
 // ../../packages/core/dist/types.js
 var ProviderError = class extends Error {
@@ -10,6 +10,8 @@ var ProviderError = class extends Error {
   statusCode;
   requestId;
   responseId;
+  upstreamProvider;
+  retryAfterSeconds;
   constructor(details) {
     super(details.message);
     this.name = "ProviderError";
@@ -17,6 +19,8 @@ var ProviderError = class extends Error {
     this.statusCode = details.statusCode;
     this.requestId = details.requestId;
     this.responseId = details.responseId;
+    this.upstreamProvider = details.upstreamProvider;
+    this.retryAfterSeconds = details.retryAfterSeconds;
   }
 };
 var MAX_REFERENCE_IMAGES = 4;
@@ -222,20 +226,24 @@ var AUTH_ENDPOINT = "https://auth.openai.com/oauth/authorize";
 var TOKEN_ENDPOINT = "https://auth.openai.com/oauth/token";
 var CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 var SCOPE = "openid profile email offline_access";
-var RESPONSES_ENDPOINT = "https://chatgpt.com/backend-api/codex/responses";
+var IMAGES_ENDPOINT = "https://chatgpt.com/backend-api/codex/images";
 var DEFAULT_REDIRECT_URI = "http://localhost:1455/auth/callback";
 var LOOPBACK_PORT = 1455;
 var CALLBACK_PATH = "/auth/callback";
 var DEFAULT_IMAGE_MODEL = "gpt-image-2.5-flare";
-var DEFAULT_ORCHESTRATION_MODEL = "gpt-5.6-luna";
 var DEFAULT_QUALITY = "auto";
 var REQUEST_TIMEOUT_SECONDS = 600;
-var PARTIAL_IMAGES = 2;
 var MAX_REFERENCE_IMAGES2 = 4;
 var MAX_IMAGE_COUNT2 = 4;
 var MIN_IMAGE_COUNT2 = 1;
 var FLOW_TIMEOUT_MINUTES = 10;
 var USER_AGENT = "ImageGenCli";
+var TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1e3;
+var TOKEN_REQUEST_TIMEOUT_MS = 30 * 1e3;
+var REFRESH_LOCK_FILE = "codex-refresh.lock";
+var REFRESH_LOCK_STALE_MS = 60 * 1e3;
+var REFRESH_LOCK_WAIT_MS = 90 * 1e3;
+var REFRESH_LOCK_POLL_MS = 100;
 
 // ../../packages/providers-codex/dist/pkce.js
 import { createHash, randomBytes } from "node:crypto";
@@ -278,7 +286,7 @@ function callbackPage(title, message) {
   return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family:sans-serif;padding:2rem"><h1>${title}</h1><p>${message}</p></body></html>`;
 }
 async function waitForOAuthCallback(timeoutMs = FLOW_TIMEOUT_MINUTES * 60 * 1e3, port = LOOPBACK_PORT) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     let server;
     const timer = setTimeout(() => {
       closeServer();
@@ -288,9 +296,9 @@ async function waitForOAuthCallback(timeoutMs = FLOW_TIMEOUT_MINUTES * 60 * 1e3,
       clearTimeout(timer);
       server?.close();
     };
-    const fail2 = (error) => {
+    const fail2 = (error2) => {
       closeServer();
-      reject(error);
+      reject(error2);
     };
     server = createServer((req, res) => {
       try {
@@ -318,17 +326,17 @@ async function waitForOAuthCallback(timeoutMs = FLOW_TIMEOUT_MINUTES * 60 * 1e3,
         res.writeHead(200, { "content-type": "text/html" });
         res.end(callbackPage("Connected", "ImageGenCli is connected. You can close this tab."));
         closeServer();
-        resolve3({ code, state });
-      } catch (error) {
-        fail2(error instanceof Error ? error : new LoopbackError("OAuth callback failed.", "callback_error"));
+        resolve4({ code, state });
+      } catch (error2) {
+        fail2(error2 instanceof Error ? error2 : new LoopbackError("OAuth callback failed.", "callback_error"));
       }
     });
-    server.on("error", (error) => {
-      if (error.code === "EADDRINUSE") {
+    server.on("error", (error2) => {
+      if (error2.code === "EADDRINUSE") {
         fail2(new LoopbackError(`Port ${port} is busy. Close the conflicting process and retry.`, "port_busy"));
         return;
       }
-      fail2(error);
+      fail2(error2);
     });
     server.listen(port, "127.0.0.1");
   });
@@ -336,7 +344,7 @@ async function waitForOAuthCallback(timeoutMs = FLOW_TIMEOUT_MINUTES * 60 * 1e3,
 
 // ../../packages/providers-codex/dist/codex-auth.js
 var ReauthRequiredError = class extends Error {
-  constructor(message = "Codex credentials are missing or expired. Run `imagegen auth login` to reconnect.") {
+  constructor(message = "Codex credentials are missing or expired. Run `imagegen auth codex login` to reconnect.") {
     super(message);
     this.name = "ReauthRequiredError";
   }
@@ -349,10 +357,24 @@ function toTokenSet(body, fallbackRefreshToken) {
     scope: body.scope
   };
 }
+var REJECTED_GRANT_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  "invalid_token",
+  "refresh_token_expired",
+  "refresh_token_reused",
+  "refresh_token_invalidated"
+]);
 async function readOAuthErrorCode(response) {
   try {
     const body = await response.json();
-    return typeof body.error === "string" ? body.error : null;
+    if (typeof body.error === "string")
+      return body.error;
+    if (typeof body.error === "object" && body.error !== null) {
+      const code = body.error["code"];
+      if (typeof code === "string")
+        return code;
+    }
+    return null;
   } catch {
     return null;
   }
@@ -361,30 +383,31 @@ async function postTokenRequest(params) {
   const response = await fetch(TOKEN_ENDPOINT, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(params)
+    body: new URLSearchParams(params),
+    signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS)
   });
   if (!response.ok) {
     const errorCode = await readOAuthErrorCode(response.clone());
-    if (response.status === 401 || response.status === 400 && (errorCode === "invalid_grant" || errorCode === "invalid_token")) {
-      return null;
+    if (response.status === 401 || errorCode !== null && REJECTED_GRANT_CODES.has(errorCode)) {
+      return { ok: false, reason: errorCode ?? `status ${response.status}` };
     }
-    throw new Error(`Token request failed with status ${response.status}.`);
+    throw new Error(`Token request failed with status ${response.status}${errorCode ? ` (${errorCode})` : ""}.`);
   }
   const body = await response.json();
-  return toTokenSet(body, params["refresh_token"]);
+  return { ok: true, tokens: toTokenSet(body, params["refresh_token"]) };
 }
 async function exchangeCodeForTokens(args) {
-  const tokens = await postTokenRequest({
+  const outcome = await postTokenRequest({
     grant_type: "authorization_code",
     client_id: CLIENT_ID,
     code: args.code,
     redirect_uri: args.redirectUri,
     code_verifier: args.codeVerifier
   });
-  if (!tokens) {
-    throw new ReauthRequiredError("The authorization code was rejected. Run `imagegen auth login` again.");
+  if (!outcome.ok) {
+    throw new ReauthRequiredError(`The authorization code was rejected (${outcome.reason}). Run \`imagegen auth codex login\` again.`);
   }
-  return tokens;
+  return outcome.tokens;
 }
 async function refreshTokens(refreshToken) {
   return postTokenRequest({
@@ -393,8 +416,8 @@ async function refreshTokens(refreshToken) {
     refresh_token: refreshToken
   });
 }
-function isTokenExpired(tokens, now = Date.now()) {
-  return tokens.expiresAt <= now;
+function needsRefresh(tokens, now = Date.now()) {
+  return tokens.expiresAt - TOKEN_REFRESH_MARGIN_MS <= now;
 }
 var pendingVerifiers = /* @__PURE__ */ new Map();
 function startPkceFlow(redirectUri2) {
@@ -420,92 +443,36 @@ function prunePendingVerifiers() {
   }
 }
 
-// ../../packages/providers-codex/dist/codex-token-manager.js
-var CodexTokenManager = class {
-  store;
-  pendingRefresh = null;
-  constructor(store) {
-    this.store = store;
-  }
-  async exchangeAndSave(args) {
-    const tokens = await exchangeCodeForTokens(args);
-    await this.store.save(PROVIDER_NAME, tokens);
-    return tokens;
-  }
-  async status() {
-    const tokens = await this.store.load(PROVIDER_NAME);
-    if (!tokens)
-      return { connected: false };
-    if (!isTokenExpired(tokens))
-      return { connected: true, expiresAt: tokens.expiresAt };
-    if (!tokens.refreshToken)
-      return { connected: false };
-    try {
-      const refreshed = await this.getValidAccessToken();
-      void refreshed;
-      const current = await this.store.load(PROVIDER_NAME);
-      return { connected: true, expiresAt: current?.expiresAt };
-    } catch {
-      return { connected: false };
-    }
-  }
-  async logout() {
-    await this.store.clear(PROVIDER_NAME);
-  }
-  async getValidAccessToken() {
-    const tokens = await this.store.load(PROVIDER_NAME);
-    if (!tokens)
-      throw new ReauthRequiredError();
-    if (!isTokenExpired(tokens))
-      return tokens.accessToken;
-    if (!tokens.refreshToken) {
-      await this.store.clear(PROVIDER_NAME);
-      throw new ReauthRequiredError();
-    }
-    if (!this.pendingRefresh) {
-      this.pendingRefresh = this.performRefresh(tokens.refreshToken).finally(() => {
-        this.pendingRefresh = null;
-      });
-    }
-    return this.pendingRefresh;
-  }
-  async performRefresh(refreshToken) {
-    const refreshed = await refreshTokens(refreshToken);
-    if (!refreshed) {
-      await this.store.clear(PROVIDER_NAME);
-      throw new ReauthRequiredError();
-    }
-    await this.store.save(PROVIDER_NAME, refreshed);
-    return refreshed.accessToken;
-  }
-};
+// ../../packages/providers-codex/dist/refresh-lock.js
+import { mkdir, open, rm, stat } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
 
-// ../../packages/providers-codex/dist/token-store.js
+// ../../packages/credentials/dist/index.js
 import { homedir } from "node:os";
 import { join } from "node:path";
 function asKeytar(module) {
   if (typeof module !== "object" || module === null)
     return null;
-  const record = module;
-  const candidate = record["default"] ?? module;
+  const record3 = module;
+  const candidate = record3["default"] ?? module;
   if (typeof candidate.getPassword === "function" && typeof candidate.setPassword === "function" && typeof candidate.deletePassword === "function") {
     return candidate;
   }
   return null;
 }
-async function resolveTokenStore() {
+async function resolveCredentialStore() {
   try {
     const keytar = asKeytar(await import("keytar"));
     if (!keytar)
-      return new FileTokenStore();
-    const store = new KeytarTokenStore(keytar);
+      return new FileCredentialStore();
+    const store = new KeytarCredentialStore(keytar);
     await store.probe();
     return store;
   } catch {
-    return new FileTokenStore();
+    return new FileCredentialStore();
   }
 }
-var KeytarTokenStore = class {
+var KeytarCredentialStore = class {
   keytar;
   constructor(keytar) {
     this.keytar = keytar;
@@ -517,7 +484,11 @@ var KeytarTokenStore = class {
     const raw = await this.keytar.getPassword("ImageGenCli", provider);
     if (!raw)
       return null;
-    return JSON.parse(raw);
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw new Error("Stored credential record is invalid. Run the provider login command.");
+    }
   }
   async save(provider, tokens) {
     await this.keytar.setPassword("ImageGenCli", provider, JSON.stringify(tokens));
@@ -526,13 +497,16 @@ var KeytarTokenStore = class {
     await this.keytar.deletePassword("ImageGenCli", provider);
   }
   describe() {
-    return { backend: "vault", location: "OS credential vault (service ImageGenCli)" };
+    return {
+      backend: "vault",
+      location: "OS credential vault (service ImageGenCli)"
+    };
   }
 };
-var FileTokenStore = class {
+var FileCredentialStore = class {
   filePath;
   constructor(filePath) {
-    this.filePath = filePath ?? defaultTokenFilePath();
+    this.filePath = filePath ?? defaultCredentialFilePath();
   }
   async load(provider) {
     const all = await this.readAll();
@@ -552,27 +526,37 @@ var FileTokenStore = class {
     return { backend: "file", location: this.filePath };
   }
   async readAll() {
-    const { readFile: readFile3 } = await import("node:fs/promises");
+    const { readFile: readFile4 } = await import("node:fs/promises");
     try {
-      const raw = await readFile3(this.filePath, "utf8");
-      return JSON.parse(raw);
-    } catch (error) {
-      if (error.code === "ENOENT")
+      const raw = await readFile4(this.filePath, "utf8");
+      let value;
+      try {
+        value = JSON.parse(raw);
+      } catch {
+        throw new Error("Credential file is invalid. Restore a valid credential file before retrying.");
+      }
+      if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error("Credential file must contain provider records.");
+      return value;
+    } catch (error2) {
+      if (error2.code === "ENOENT")
         return {};
-      throw error;
+      throw error2;
     }
   }
   async writeAll(all) {
-    const { mkdir: mkdir3, writeFile: writeFile3, chmod } = await import("node:fs/promises");
-    const { dirname: dirname3 } = await import("node:path");
-    await mkdir3(dirname3(this.filePath), { recursive: true });
-    await writeFile3(this.filePath, JSON.stringify(all, null, 2), { mode: 384 });
+    const { mkdir: mkdir6, writeFile: writeFile4, chmod } = await import("node:fs/promises");
+    const { dirname: dirname6 } = await import("node:path");
+    await mkdir6(dirname6(this.filePath), { recursive: true });
+    await writeFile4(this.filePath, JSON.stringify(all, null, 2), {
+      mode: 384
+    });
     if (process.platform !== "win32") {
       await chmod(this.filePath, 384);
     }
   }
 };
-function defaultTokenFilePath() {
+function defaultCredentialFilePath() {
   if (process.platform === "win32") {
     const base2 = process.env["LOCALAPPDATA"] ?? join(process.env["USERPROFILE"] ?? ".", "AppData", "Local");
     return join(base2, "ImageGenCli", "tokens.json");
@@ -581,6 +565,153 @@ function defaultTokenFilePath() {
   return join(base, "ImageGenCli", "tokens.json");
 }
 
+// ../../packages/providers-codex/dist/refresh-lock.js
+function defaultRefreshLockPath() {
+  return join2(dirname(defaultCredentialFilePath()), REFRESH_LOCK_FILE);
+}
+function createRefreshLock(options = {}) {
+  const path = options.path ?? defaultRefreshLockPath();
+  const staleMs = options.staleMs ?? REFRESH_LOCK_STALE_MS;
+  const waitMs = options.waitMs ?? REFRESH_LOCK_WAIT_MS;
+  const pollMs = options.pollMs ?? REFRESH_LOCK_POLL_MS;
+  return async (work) => {
+    await acquire(path, staleMs, waitMs, pollMs);
+    try {
+      return await work();
+    } finally {
+      await rm(path, { force: true });
+    }
+  };
+}
+async function acquire(path, staleMs, waitMs, pollMs) {
+  await mkdir(dirname(path), { recursive: true });
+  const deadline = Date.now() + waitMs;
+  for (; ; ) {
+    try {
+      const handle = await open(path, "wx");
+      try {
+        await handle.writeFile(`${process.pid}
+`);
+      } finally {
+        await handle.close();
+      }
+      return;
+    } catch (error2) {
+      if (!isContention(error2))
+        throw error2;
+    }
+    if (await isStale(path, staleMs)) {
+      await rm(path, { force: true });
+      continue;
+    }
+    if (Date.now() >= deadline) {
+      throw new Error("Timed out waiting for another imagegen process to refresh Codex credentials.");
+    }
+    await new Promise((resolve4) => setTimeout(resolve4, pollMs + Math.random() * pollMs));
+  }
+}
+function isContention(error2) {
+  const code = error2.code;
+  return code === "EEXIST" || process.platform === "win32" && (code === "EPERM" || code === "EACCES");
+}
+async function isStale(path, staleMs) {
+  try {
+    return Date.now() - (await stat(path)).mtimeMs > staleMs;
+  } catch {
+    return false;
+  }
+}
+
+// ../../packages/providers-codex/dist/codex-token-manager.js
+var CodexTokenManager = class {
+  store;
+  pendingRefresh = null;
+  lock;
+  refresh;
+  constructor(store, options = {}) {
+    this.store = store;
+    this.lock = options.lock ?? createRefreshLock();
+    this.refresh = options.refresh ?? refreshTokens;
+  }
+  async exchangeAndSave(args) {
+    const tokens = await exchangeCodeForTokens(args);
+    await this.store.save(PROVIDER_NAME, tokens);
+    return tokens;
+  }
+  async status() {
+    if (!await this.store.load(PROVIDER_NAME))
+      return { connected: false };
+    try {
+      await this.getValidAccessToken();
+      const current = await this.store.load(PROVIDER_NAME);
+      return { connected: true, expiresAt: current?.expiresAt };
+    } catch {
+      return { connected: false };
+    }
+  }
+  async logout() {
+    await this.store.clear(PROVIDER_NAME);
+  }
+  async getValidAccessToken() {
+    const tokens = await this.store.load(PROVIDER_NAME);
+    if (!tokens)
+      throw new ReauthRequiredError();
+    if (!needsRefresh(tokens))
+      return tokens.accessToken;
+    return this.refreshFrom(tokens.accessToken);
+  }
+  // The Codex image endpoint rejected this access token before its recorded expiry.
+  async recoverFromUnauthorized(rejectedAccessToken) {
+    return this.refreshFrom(rejectedAccessToken);
+  }
+  refreshFrom(staleAccessToken) {
+    if (!this.pendingRefresh) {
+      this.pendingRefresh = this.lock(() => this.refreshLocked(staleAccessToken)).finally(() => {
+        this.pendingRefresh = null;
+      });
+    }
+    return this.pendingRefresh;
+  }
+  async refreshLocked(staleAccessToken) {
+    const current = await this.store.load(PROVIDER_NAME);
+    if (!current)
+      throw new ReauthRequiredError();
+    if (current.accessToken !== staleAccessToken && !needsRefresh(current))
+      return current.accessToken;
+    if (!current.refreshToken) {
+      await this.store.clear(PROVIDER_NAME);
+      throw new ReauthRequiredError();
+    }
+    const outcome = await this.refresh(current.refreshToken);
+    if (!outcome.ok) {
+      await this.store.clear(PROVIDER_NAME);
+      throw new ReauthRequiredError(`Codex rejected the stored refresh token (${outcome.reason}). Run \`imagegen auth codex login\` to reconnect.`);
+    }
+    await this.store.save(PROVIDER_NAME, outcome.tokens);
+    return outcome.tokens.accessToken;
+  }
+};
+
+// ../../packages/providers-codex/dist/token-store.js
+async function resolveTokenStore() {
+  const store = await resolveCredentialStore();
+  return {
+    ...store,
+    load: async (provider) => {
+      const value = await store.load(provider);
+      if (value === null)
+        return null;
+      if (typeof value.accessToken !== "string" || typeof value.expiresAt !== "number" || value.refreshToken !== void 0 && typeof value.refreshToken !== "string") {
+        throw new Error("Stored Codex credentials are invalid. Run imagegen auth codex login.");
+      }
+      return value;
+    },
+    save: (provider, value) => store.save(provider, value),
+    clear: (provider) => store.clear(provider),
+    describe: () => store.describe()
+  };
+}
+
 // ../../packages/providers-codex/dist/account-id.js
 function extractAccountId(token) {
   const parts = token.split(".");
@@ -601,13 +732,18 @@ function extractAccountId(token) {
   return accountId;
 }
 
-// ../../packages/providers-codex/dist/sse.js
+// ../../packages/providers-codex/dist/codex-client.js
+import sharp from "sharp";
+
+// ../../packages/providers-codex/dist/errors.js
 function classifyImageError(message) {
   if (!message.trim())
     return "unknown";
   const lowerRate = message.includes("input-images") && message.includes("per min") && message.toLowerCase().includes("gpt-image");
   if (lowerRate)
     return "codex_image_input_rate_limit";
+  if (/usage limit/i.test(message))
+    return "usage_limit";
   if (/rate limit|429|too many requests|please try again/i.test(message))
     return "rate_limit";
   if (/403|forbidden|cloudflare/i.test(message))
@@ -616,107 +752,26 @@ function classifyImageError(message) {
     return "image_model_invalid";
   return "api_error";
 }
-function readString(value, property) {
-  if (typeof value !== "object" || value === null)
-    return void 0;
-  const candidate = value[property];
-  return typeof candidate === "string" ? candidate : void 0;
-}
-function readEventError(event) {
-  const direct = readString(event, "message");
-  if (direct)
-    return direct;
-  if (typeof event !== "object" || event === null)
-    return void 0;
-  const record = event;
-  const nested = record["error"];
-  if (typeof nested === "object" && nested !== null) {
-    const message = readString(nested, "message");
-    if (message)
-      return message;
-  }
-  const response = record["response"];
-  if (typeof response === "object" && response !== null) {
-    const responseError = response["error"];
-    if (typeof responseError === "object" && responseError !== null) {
-      return readString(responseError, "message");
-    }
-  }
-  return void 0;
-}
-function tryReadImageItem(item) {
-  if (readString(item, "type") !== "image_generation_call")
-    return null;
-  const result = readString(item, "result");
-  if (!result)
+function readErrorMessage(body) {
+  if (!body.trim())
     return null;
-  let data;
   try {
-    data = Buffer.from(result, "base64");
-  } catch {
-    throw new Error("invalid_image_result: Codex returned an image result that was not valid base64.");
-  }
-  return { data, revisedPrompt: readString(item, "revised_prompt"), callId: readString(item, "id") };
-}
-function parseImageStreamEvents(events) {
-  let eventCount = 0;
-  let lastEventType;
-  let responseId;
-  const finish = (image) => ({
-    ...image,
-    responseId,
-    eventCount,
-    lastEventType
-  });
-  for (const raw of events) {
-    const line = raw.trim();
-    if (!line.startsWith("data:"))
-      continue;
-    const payload = line.slice("data:".length).trim();
-    if (payload === "[DONE]")
-      break;
-    let event;
-    try {
-      event = JSON.parse(payload);
-    } catch {
-      continue;
-    }
-    const type = readString(event, "type");
-    lastEventType = type ?? lastEventType;
-    eventCount += 1;
-    if (type === "response.created" && typeof event === "object" && event !== null) {
-      const inner = event["response"];
-      const id = readString(inner, "id");
-      if (id)
-        responseId = id;
-    }
-    if (type === "response.failed" || type === "error") {
-      throw new Error(`${classifyImageError(readEventError(event) ?? "")}: ${readEventError(event) ?? "Codex image generation failed."}`);
-    }
-    if (type === "response.output_item.done" && typeof event === "object" && event !== null) {
-      const item = event["item"];
-      const image = tryReadImageItem(item);
-      if (image)
-        return finish(image);
-    }
-    if (type === "response.completed" && typeof event === "object" && event !== null) {
-      const response = event["response"];
-      const id = readString(response, "id");
-      if (id)
-        responseId = id;
-      if (typeof response === "object" && response !== null) {
-        const output = response["output"];
-        if (Array.isArray(output)) {
-          for (const item of output) {
-            const image = tryReadImageItem(item);
-            if (image)
-              return finish(image);
-          }
-        }
+    const parsed = JSON.parse(body);
+    if (typeof parsed === "object" && parsed !== null) {
+      const record3 = parsed;
+      if (typeof record3["message"] === "string")
+        return record3["message"];
+      if (typeof record3["detail"] === "string")
+        return record3["detail"];
+      const error2 = record3["error"];
+      if (typeof error2 === "object" && error2 !== null && typeof error2["message"] === "string") {
+        return error2["message"];
       }
     }
+  } catch {
+    return body.slice(0, 500);
   }
-  throw new Error(`stream_completed_without_image: Codex image generation completed without returning an image. responseId=${responseId ?? "unknown"}, events=${eventCount}, lastEvent=${lastEventType ?? "none"}.`);
+  return null;
 }
 
 // ../../packages/providers-codex/dist/codex-client.js
@@ -731,119 +786,46 @@ function normalizeCount(count) {
 function resolveSize(size) {
   try {
     return parseSize(size ?? "auto");
-  } catch (error) {
+  } catch (error2) {
     throw new ProviderError({
       kind: "usage",
-      message: error instanceof Error ? error.message : String(error)
+      message: error2 instanceof Error ? error2.message : String(error2)
     });
   }
 }
-function baseImageTool(args) {
-  const tool = {
-    type: "image_generation",
-    model: args.imageModel,
-    action: args.action,
-    size: args.size && args.size.trim() ? args.size.trim() : "auto",
-    output_format: args.outputFormat,
-    background: "auto"
-  };
-  if (args.partialImages > 0)
-    tool["partial_images"] = Math.min(3, Math.max(0, args.partialImages));
-  if (args.quality && args.quality.trim() && args.quality.trim().toLowerCase() !== "auto") {
-    tool["quality"] = args.quality.trim();
-  }
-  if (args.outputFormat === "jpeg" && typeof args.outputCompression === "number") {
-    tool["output_compression"] = Math.min(100, Math.max(0, Math.trunc(args.outputCompression)));
-  }
-  return tool;
-}
-function buildPayload(args) {
-  const content = [{ type: "input_text", text: args.prompt }];
-  for (const reference of args.references.slice(0, MAX_REFERENCE_IMAGES2)) {
-    content.push({ type: "input_image", image_url: toDataUrl(reference), detail: "auto" });
-  }
-  return {
+function buildBody(args) {
+  const body = {
+    prompt: args.prompt,
     model: args.model,
-    input: [{ role: "user", content }],
-    tools: [args.tool],
-    tool_choice: { type: "image_generation" },
-    stream: true,
-    store: false
+    size: args.size.size,
+    background: "auto"
   };
+  const quality = args.quality.trim();
+  if (quality && quality.toLowerCase() !== "auto")
+    body["quality"] = quality;
+  if (args.images.length > 0)
+    body["images"] = args.images.map((image) => ({ image_url: toDataUrl(image) }));
+  return body;
 }
 var CodexImageProvider = class {
   tokens;
   name = PROVIDER_NAME;
   sizePolicy = { resolveSize: (size) => resolveSize(size) };
-  orchestrationModel;
   imageModel;
   timeoutSeconds;
-  partialImages;
   fetchImpl;
   constructor(tokens, options = {}) {
     this.tokens = tokens;
-    this.orchestrationModel = options.model ?? process.env["IMAGEGEN_CODEX_MODEL"] ?? DEFAULT_ORCHESTRATION_MODEL;
     this.imageModel = options.imageModel ?? process.env["IMAGEGEN_CODEX_IMAGE_MODEL"] ?? DEFAULT_IMAGE_MODEL;
     this.timeoutSeconds = options.timeoutSeconds ?? REQUEST_TIMEOUT_SECONDS;
-    this.partialImages = options.partialImages ?? PARTIAL_IMAGES;
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async generate(request) {
-    const format = normalizeOutputFormat(request.format);
-    const size = this.sizePolicy.resolveSize(request.size);
-    const imageModel2 = this.resolveImageModel(request);
-    return this.runAll({
-      format,
-      imageModel: imageModel2,
-      count: normalizeCount(request.count),
-      prompt: request.prompt,
-      size,
-      build: () => buildPayload({
-        model: this.orchestrationModel,
-        prompt: request.prompt,
-        references: request.referenceImages ?? [],
-        tool: baseImageTool({
-          size: size.size,
-          quality: request.quality ?? DEFAULT_QUALITY,
-          outputFormat: format,
-          imageModel: imageModel2,
-          action: "generate",
-          partialImages: this.partialImages
-        })
-      })
-    });
+    const references = (request.referenceImages ?? []).slice(0, MAX_REFERENCE_IMAGES2);
+    return this.runAll(request, references.length > 0 ? "edits" : "generations", references);
   }
   async edit(request) {
-    const format = normalizeOutputFormat(request.format);
-    const size = this.sizePolicy.resolveSize(request.size);
-    const imageModel2 = this.resolveImageModel(request);
-    const references = [request.sourceImage, ...request.referenceImages ?? []];
-    return this.runAll({
-      format,
-      imageModel: imageModel2,
-      count: normalizeCount(request.count),
-      prompt: request.prompt,
-      size,
-      build: () => {
-        const tool = baseImageTool({
-          size: size.size,
-          quality: request.quality ?? DEFAULT_QUALITY,
-          outputFormat: format,
-          imageModel: imageModel2,
-          action: "edit",
-          partialImages: this.partialImages
-        });
-        if (request.mask) {
-          tool["input_image_mask"] = { image_url: toDataUrl(request.mask) };
-        }
-        return buildPayload({
-          model: this.orchestrationModel,
-          prompt: request.prompt,
-          references,
-          tool
-        });
-      }
-    });
+    return this.runAll(request, "edits", [request.sourceImage, ...request.referenceImages ?? []].slice(0, MAX_REFERENCE_IMAGES2));
   }
   resolveImageModel(request) {
     const model = (request.model ?? this.imageModel).trim();
@@ -855,116 +837,120 @@ var CodexImageProvider = class {
     }
     return model;
   }
-  async runAll(args) {
-    const images = [];
-    for (let i = 0; i < args.count; i += 1) {
-      images.push(await this.sendOnce(args.build(), args.format, args.prompt, args.size));
+  async runAll(request, endpoint, images) {
+    const format = normalizeOutputFormat(request.format);
+    const size = this.sizePolicy.resolveSize(request.size);
+    const imageModel2 = this.resolveImageModel(request);
+    const body = JSON.stringify(buildBody({ prompt: request.prompt, model: imageModel2, size, quality: request.quality ?? DEFAULT_QUALITY, images }));
+    const results = [];
+    for (let i = 0, count = normalizeCount(request.count); i < count; i += 1) {
+      results.push(await this.sendOnce(endpoint, body, format, request.prompt));
+    }
+    return { provider: this.name, imageModel: imageModel2, images: results };
+  }
+  async sendOnce(endpoint, body, format, prompt) {
+    let accessToken = await this.tokens.getValidAccessToken();
+    let response = await this.post(endpoint, accessToken, body);
+    if (response.status === 401) {
+      await response.body?.cancel();
+      accessToken = await this.tokens.recoverFromUnauthorized(accessToken);
+      response = await this.post(endpoint, accessToken, body);
+    }
+    const requestId = response.headers.get("x-codex-imagegen-request-id") ?? response.headers.get("x-oai-request-id") ?? response.headers.get("x-request-id") ?? void 0;
+    if (!response.ok) {
+      const errorText = await response.text().catch(() => "");
+      const kind = classifyImageError(errorText);
+      const detail = readErrorMessage(errorText);
+      const retryAfter = Number(response.headers.get("retry-after"));
+      throw new ProviderError({
+        kind,
+        message: detail ? `Codex image request returned ${response.status} (${kind}): ${detail}` : `Codex image request returned ${response.status} (${kind}).`,
+        statusCode: response.status,
+        requestId,
+        ...Number.isFinite(retryAfter) && retryAfter > 0 ? { retryAfterSeconds: retryAfter } : {}
+      });
+    }
+    const payload = record(await response.json().catch(() => null));
+    const item = Array.isArray(payload["data"]) ? record(payload["data"][0]) : {};
+    if (typeof item["b64_json"] !== "string" || !item["b64_json"]) {
+      throw new ProviderError({ kind: "no_image", message: "Codex image request returned no image data.", requestId });
     }
-    return { provider: this.name, imageModel: args.imageModel, images };
+    let data = Buffer.from(item["b64_json"], "base64");
+    let width;
+    let height;
+    try {
+      const metadata = await sharp(data).metadata();
+      if (!metadata.width || !metadata.height || !["png", "jpeg", "webp"].includes(metadata.format ?? ""))
+        throw new Error();
+      await sharp(data).stats();
+      if (metadata.format !== format)
+        data = await sharp(data).toFormat(format).toBuffer();
+      width = metadata.width;
+      height = metadata.height;
+    } catch {
+      throw new ProviderError({ kind: "malformed", message: "Codex returned an invalid raster image.", requestId });
+    }
+    return {
+      data,
+      mimeType: `image/${format}`,
+      width,
+      height,
+      prompt,
+      responseId: typeof item["generation_id"] === "string" ? item["generation_id"] : void 0,
+      usage: {
+        requestId,
+        imageGeneration: payload["usage"],
+        // What the backend actually rendered; it may override requested size and quality.
+        served: { size: payload["size"], quality: payload["quality"], background: payload["background"] },
+        planLimits: readPlanLimits(response.headers)
+      }
+    };
   }
-  async sendOnce(payload, format, prompt, size) {
-    const accessToken = await this.tokens.getValidAccessToken();
-    const accountId = extractAccountId(accessToken);
+  async post(endpoint, accessToken, body) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), this.timeoutSeconds * 1e3);
-    let response;
     try {
-      response = await this.fetchImpl(RESPONSES_ENDPOINT, {
+      return await this.fetchImpl(`${IMAGES_ENDPOINT}/${endpoint}`, {
         method: "POST",
         headers: {
           authorization: `Bearer ${accessToken}`,
-          "chatgpt-account-id": accountId,
-          "OpenAI-Beta": "responses=experimental",
+          "chatgpt-account-id": extractAccountId(accessToken),
           originator: "pi",
           "user-agent": USER_AGENT,
-          accept: "text/event-stream",
+          accept: "application/json",
           "content-type": "application/json"
         },
-        body: JSON.stringify(payload),
+        body,
         signal: controller.signal
       });
     } finally {
       clearTimeout(timer);
     }
-    const requestId = response.headers.get("x-request-id") ?? response.headers.get("openai-request-id") ?? response.headers.get("request-id") ?? void 0;
-    if (!response.ok || !response.body) {
-      const body = await response.text().catch(() => "");
-      const kind = classifyImageError(body);
-      const detail = readErrorMessage(body);
-      throw new ProviderError({
-        kind,
-        message: detail ? `Codex image request returned ${response.status} (${kind}): ${detail}` : `Codex image request returned ${response.status} (${kind}).`,
-        statusCode: response.status,
-        requestId
-      });
-    }
-    const lines = await readSseLines(response.body);
-    let parsed;
-    try {
-      parsed = parseImageStreamEvents(lines);
-    } catch (error) {
-      throw toProviderError(error, requestId);
-    }
-    return {
-      data: parsed.data,
-      mimeType: `image/${format}`,
-      width: size.width,
-      height: size.height,
-      prompt,
-      responseId: parsed.responseId,
-      callId: parsed.callId
-    };
   }
 };
-async function readSseLines(body) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  const lines = [];
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done)
-      break;
-    buffer += decoder.decode(value, { stream: true });
-    let index = buffer.indexOf("\n");
-    while (index >= 0) {
-      const line = buffer.slice(0, index);
-      buffer = buffer.slice(index + 1);
-      if (line.startsWith("data:"))
-        lines.push(line);
-      index = buffer.indexOf("\n");
-    }
-  }
-  if (buffer.startsWith("data:"))
-    lines.push(buffer);
-  return lines;
-}
-function readErrorMessage(body) {
-  if (!body.trim())
-    return null;
-  try {
-    const parsed = JSON.parse(body);
-    if (typeof parsed === "object" && parsed !== null) {
-      const record = parsed;
-      if (typeof record["message"] === "string")
-        return record["message"];
-      if (typeof record["detail"] === "string")
-        return record["detail"];
-      const error = record["error"];
-      if (typeof error === "object" && error !== null && typeof error["message"] === "string") {
-        return error["message"];
-      }
-    }
-  } catch {
-    return body.slice(0, 500);
-  }
-  return null;
-}
-function toProviderError(error, requestId) {
-  const message = error instanceof Error ? error.message : String(error);
-  const separator = message.indexOf(":");
-  const kind = separator > 0 ? message.slice(0, separator) : "api_error";
-  return new ProviderError({ kind, message, requestId });
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function readPlanLimits(headers) {
+  const number = (name) => {
+    const value = headers.get(`x-codex-${name}`);
+    const parsed = value === null ? Number.NaN : Number(value);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  };
+  const window = (name) => {
+    const usedPercent = number(`${name}-used-percent`);
+    const windowMinutes = number(`${name}-window-minutes`);
+    if (usedPercent === void 0 || !windowMinutes)
+      return void 0;
+    return { usedPercent, windowMinutes, resetAt: number(`${name}-reset-at`) };
+  };
+  const limits = {
+    planType: headers.get("x-codex-plan-type") ?? void 0,
+    activeLimit: headers.get("x-codex-active-limit") ?? void 0,
+    primary: window("primary"),
+    secondary: window("secondary")
+  };
+  return Object.values(limits).some((value) => value !== void 0) ? limits : void 0;
 }
 
 // ../../packages/providers-codex/dist/codex-entry.js
@@ -1007,13 +993,876 @@ function createCodexEntry() {
   };
 }
 
+// ../../packages/providers-google/dist/gemini-client.js
+import sharp2 from "sharp";
+
+// ../../packages/providers-google/dist/image-size.js
+var DEFAULT_IMAGE_MODEL2 = "gemini-nano-banana-2.1";
+var native = {
+  "1:1": [1024, 1024],
+  "1:4": [512, 2048],
+  "1:8": [384, 3072],
+  "2:3": [848, 1264],
+  "3:2": [1264, 848],
+  "3:4": [896, 1200],
+  "4:1": [2048, 512],
+  "4:3": [1200, 896],
+  "4:5": [928, 1152],
+  "5:4": [1152, 928],
+  "8:1": [3072, 384],
+  "9:16": [768, 1376],
+  "16:9": [1376, 768],
+  "21:9": [1584, 672]
+};
+var legacy = {
+  "1:1": [1024, 1024],
+  "2:3": [832, 1248],
+  "3:2": [1248, 832],
+  "3:4": [864, 1184],
+  "4:3": [1184, 864],
+  "4:5": [896, 1152],
+  "5:4": [1152, 896],
+  "9:16": [768, 1344],
+  "16:9": [1344, 768],
+  "21:9": [1536, 672]
+};
+function resolveGeminiSize(size, model = DEFAULT_IMAGE_MODEL2) {
+  const value = (size ?? "auto").trim().toLowerCase();
+  const table = model === "gemini-2.5-flash-image" ? legacy : native;
+  const restricted = model === "gemini-3-pro-image" || model === "nano-banana-pro-preview";
+  const ratios = Object.keys(table).filter((r) => !restricted || !["1:4", "4:1", "1:8", "8:1"].includes(r));
+  const presets = {
+    square: "1:1",
+    portrait: "2:3",
+    landscape: "3:2",
+    wide: "16:9",
+    widescreen: "16:9"
+  };
+  const normalized = presets[value] ?? value;
+  const pixels = /^(\d+(?:\.\d+)?)\s*x\s*(\d+(?:\.\d+)?)$/.exec(normalized);
+  const ratio = /^(\d+(?:\.\d+)?)\s*[:/]\s*(\d+(?:\.\d+)?)$/.exec(normalized);
+  const auto = normalized === "auto" || normalized === "";
+  const width = Number(pixels?.[1] ?? ratio?.[1] ?? (auto ? 1 : normalized));
+  const height = Number(pixels?.[2] ?? ratio?.[2] ?? 1);
+  if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0) {
+    throw new ProviderError({
+      kind: "usage",
+      message: "Invalid Gemini size. Use WIDTHxHEIGHT, an aspect ratio, preset, or auto."
+    });
+  }
+  const aspect = width / height;
+  const selected = ratios.sort((a, b) => {
+    const number = (r) => {
+      const [x, y] = r.split(":").map(Number);
+      return x / y;
+    };
+    return Math.abs(Math.log(number(a) / aspect)) - Math.abs(Math.log(number(b) / aspect));
+  })[0];
+  const scales = model === "gemini-2.5-flash-image" || model === "gemini-3.1-flash-lite-image" ? [1] : model === "gemini-3.1-flash-image" ? [0.5, 1, 2, 4] : [1, 2, 4];
+  const candidates = scales.map((scale) => ({
+    width: table[selected][0] * scale,
+    height: table[selected][1] * scale,
+    scale
+  }));
+  const chosen = pixels ? candidates.sort((a, b) => (a.width - width) ** 2 + (a.height - height) ** 2 - ((b.width - width) ** 2 + (b.height - height) ** 2) || a.scale - b.scale)[0] : candidates.find((c) => c.scale === 1);
+  return {
+    ...chosen,
+    size: `${chosen.width}x${chosen.height}`,
+    pixels: chosen.width * chosen.height,
+    aspectRatio: auto ? void 0 : selected,
+    imageSize: auto || model === "gemini-2.5-flash-image" ? void 0 : chosen.scale === 0.5 ? "512" : `${chosen.scale}K`
+  };
+}
+
+// ../../packages/providers-google/dist/gemini-client.js
+var error = (kind, message, statusCode) => new ProviderError({ kind, message, statusCode });
+var GeminiImageProvider = class {
+  getKey;
+  options;
+  name = "gemini";
+  sizePolicy = {
+    resolveSize: (size) => resolveGeminiSize(size, this.options.imageModel)
+  };
+  constructor(getKey, options = {}) {
+    this.getKey = getKey;
+    this.options = options;
+  }
+  generate(request) {
+    return this.run(request, request.referenceImages ?? []);
+  }
+  edit(request) {
+    if (request.mask)
+      throw error("usage", "Gemini does not support --mask. Describe the region to edit in the prompt.");
+    return this.run(request, [
+      request.sourceImage,
+      ...request.referenceImages ?? []
+    ]);
+  }
+  async run(request, inputs) {
+    const model = (request.model ?? this.options.imageModel ?? process.env["IMAGEGEN_GEMINI_IMAGE_MODEL"] ?? DEFAULT_IMAGE_MODEL2).trim();
+    if (!model)
+      throw error("usage", "Image model must not be blank.");
+    if (request.quality && request.quality.trim().toLowerCase() !== "auto")
+      throw error("usage", "Gemini supports only --quality auto. Use --size to select native resolution.");
+    if ((request.referenceImages?.length ?? 0) > MAX_REFERENCE_IMAGES)
+      throw error("usage", "At most four reference images are allowed.");
+    if (model === "gemini-2.5-flash-image" && inputs.length > 3)
+      throw error("usage", "gemini-2.5-flash-image supports up to three input images in this tool, including the edit source.");
+    if (inputs.some((i) => !["image/png", "image/jpeg", "image/webp"].includes(i.contentType)))
+      throw error("usage", "Gemini inputs must be PNG, JPEG, or WebP.");
+    const count = request.count ?? 1;
+    if (!Number.isInteger(count) || count < 1 || count > 4)
+      throw error("usage", "Image count must be from 1 to 4.");
+    if (request.format && !["png", "jpeg", "jpg", "webp"].includes(request.format.trim().toLowerCase()))
+      throw error("usage", "Output format must be png, jpeg, or webp.");
+    const format = normalizeOutputFormat(request.format);
+    const size = resolveGeminiSize(request.size, model);
+    const payload = {
+      model,
+      store: false,
+      stream: false,
+      input: [
+        { type: "text", text: request.prompt },
+        ...inputs.map((i) => ({
+          type: "image",
+          mime_type: i.contentType,
+          data: Buffer.from(i.data).toString("base64")
+        }))
+      ],
+      // The live image endpoint rejects delivery even though the reference lists it.
+      // Omit it and consume the default base64 response.
+      response_format: {
+        type: "image",
+        ...format === "jpeg" ? { mime_type: "image/jpeg" } : {},
+        ...size.aspectRatio ? { aspect_ratio: size.aspectRatio } : {},
+        ...size.imageSize ? { image_size: size.imageSize } : {}
+      }
+    };
+    if (Buffer.byteLength(JSON.stringify(payload)) > 2e7)
+      throw error("usage", "Gemini inline request exceeds 20 MB. Use smaller reference images.");
+    let key;
+    try {
+      key = await this.getKey();
+    } catch {
+      throw error("auth", "Could not load Gemini credentials. Run imagegen auth gemini login.");
+    }
+    const images = [];
+    for (let i = 0; i < count; i++)
+      images.push(await this.send(payload, key, format, request.prompt));
+    return { provider: this.name, imageModel: model, images };
+  }
+  async send(payload, key, format, prompt) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), (this.options.timeoutSeconds ?? 180) * 1e3);
+    try {
+      const response = await (this.options.fetchImpl ?? fetch)("https://generativelanguage.googleapis.com/v1beta/interactions", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          "x-goog-api-key": key
+        },
+        body: JSON.stringify(payload),
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const status = response.status;
+        const failure2 = await response.json().catch(() => null);
+        const invalidKey = Array.isArray(failure2?.error?.details) && failure2.error.details.some((detail) => detail.reason === "API_KEY_INVALID" || detail.reason === "API_KEY_EXPIRED");
+        throw error(invalidKey || status === 401 || status === 403 ? "auth" : status === 429 ? "rate_limit" : status >= 500 ? "server" : "usage", invalidKey || status === 401 || status === 403 ? "Gemini rejected the API key or access. Check project access and run imagegen auth gemini login." : `Gemini returned HTTP ${status}. Check model access, request options, and project quota.`, status);
+      }
+      const body = await response.json().catch(() => {
+        throw error("malformed", "Gemini returned invalid JSON.");
+      });
+      if (!body || typeof body !== "object")
+        throw error("malformed", "Gemini returned an invalid interaction.");
+      if (body.status !== "completed")
+        throw error(body.status === "failed" ? "blocked" : "incomplete", "Gemini did not complete the image request. Check the prompt and model access.");
+      if (body.steps !== void 0 && !Array.isArray(body.steps))
+        throw error("malformed", "Gemini returned invalid output steps.");
+      if ((body.steps ?? []).some((step) => !step || typeof step !== "object" || step.content !== void 0 && !Array.isArray(step.content))) {
+        throw error("malformed", "Gemini returned invalid output content.");
+      }
+      const parts = (body.steps ?? []).filter((s) => s.type === "model_output").flatMap((s) => s.content ?? []).filter((p) => p && p.type === "image" && !p.thought);
+      const image = parts.at(-1);
+      if (!image)
+        throw error("no_image", "Gemini returned no final image. Refine the image request and try again.");
+      if (typeof image.data !== "string" || !image.data || !/^[A-Za-z0-9+/]+={0,2}$/.test(image.data) || image.data.length % 4 !== 0)
+        throw error("malformed", "Gemini returned invalid inline image data.");
+      const original = Buffer.from(image.data, "base64");
+      const metadata = await sharp2(original).metadata().catch(() => {
+        throw error("malformed", "Gemini returned undecodable image bytes.");
+      });
+      if (!metadata.width || !metadata.height || !["png", "jpeg", "webp"].includes(metadata.format ?? "") || image.mime_type !== `image/${metadata.format}`)
+        throw error("malformed", "Gemini returned an invalid image or inconsistent MIME type.");
+      const data = metadata.format === format ? original : await sharp2(original).toFormat(format).toBuffer();
+      return {
+        data,
+        mimeType: `image/${format}`,
+        width: metadata.width,
+        height: metadata.height,
+        prompt,
+        responseId: typeof body.id === "string" ? body.id : void 0
+      };
+    } catch (e) {
+      if (controller.signal.aborted)
+        throw error("timeout", "Gemini image request timed out. Try again when connectivity is restored.");
+      if (e instanceof ProviderError)
+        throw e;
+      throw error("transport", "Gemini request failed while receiving or decoding the image. Check connectivity and try again.");
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// ../../packages/providers-google/dist/auth.js
+function validateKey(value) {
+  const key = value.trim();
+  if (!key || /\s/.test(key))
+    throw new ProviderError({
+      kind: "auth",
+      message: "Enter a non-empty Gemini API key without whitespace."
+    });
+  return key;
+}
+async function geminiStore() {
+  return resolveCredentialStore();
+}
+async function storedKey(store) {
+  const value = await store.load("gemini");
+  if (!value || typeof value.apiKey !== "string")
+    throw new ProviderError({
+      kind: "auth",
+      message: "Run imagegen auth gemini login to configure an API key."
+    });
+  return validateKey(value.apiKey);
+}
+
+// ../../packages/providers-google/dist/index.js
+function createGeminiEntry() {
+  return {
+    provider: new GeminiImageProvider(async () => storedKey(await geminiStore())),
+    authStatus: async () => {
+      const store = await geminiStore();
+      let configured = false;
+      try {
+        await storedKey(store);
+        configured = true;
+      } catch {
+      }
+      return {
+        name: "gemini",
+        configured,
+        detail: configured ? void 0 : "Run imagegen auth gemini login to configure an API key."
+      };
+    }
+  };
+}
+
+// ../../packages/providers-configurable/dist/profiles.js
+import { readFile, mkdir as mkdir2, writeFile, rename, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname2, join as join3 } from "node:path";
+import { randomUUID } from "node:crypto";
+var usage = (message) => new ProviderError({ kind: "usage", message });
+var profileStore = () => resolveCredentialStore();
+function validateApiKey(value) {
+  const key = value.trim();
+  if (!key || /\s/.test(key))
+    throw new ProviderError({
+      kind: "auth",
+      message: "Enter a non-empty API key without whitespace."
+    });
+  return key;
+}
+function validateProfile(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw usage("Invalid endpoint profile.");
+  const p = value;
+  if (Object.keys(p).some((k) => !["name", "api", "baseUrl", "model", "auth"].includes(k)))
+    throw usage("Endpoint profiles accept only name, api, baseUrl, model, and auth; store keys through auth login.");
+  if (typeof p.name !== "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(p.name) || ["codex", "gemini"].includes(p.name))
+    throw usage("Endpoint name must use lowercase letters, digits, and hyphens, and cannot be codex or gemini.");
+  if (p.api !== "openrouter" && p.api !== "openai-images")
+    throw usage("API format must be openrouter or openai-images.");
+  if (p.auth !== void 0 && p.auth !== "bearer" && p.auth !== "none")
+    throw usage("Auth must be bearer or none.");
+  const raw = p.baseUrl ?? (p.api === "openrouter" ? "https://openrouter.ai/api/v1" : void 0);
+  let url;
+  try {
+    if (typeof raw !== "string")
+      throw new Error();
+    url = new URL(raw);
+  } catch {
+    throw usage("Supply a valid --base-url including the API prefix.");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "[::1]" || url.hostname === "127.0.0.1";
+  if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
+    throw usage("Base URL must use HTTPS (or loopback HTTP), without credentials, query, or fragment.");
+  if (p.model !== void 0 && (typeof p.model !== "string" || !p.model.trim()))
+    throw usage("Default model must not be blank.");
+  return {
+    name: p.name,
+    api: p.api,
+    baseUrl: url.toString().replace(/\/+$/, ""),
+    auth: p.auth ?? "bearer",
+    ...typeof p.model === "string" ? { model: p.model.trim() } : {}
+  };
+}
+var ProfileRepository = class {
+  path;
+  credentials;
+  constructor(path = join3(dirname2(defaultCredentialFilePath()), "providers.json"), credentials = profileStore) {
+    this.path = path;
+    this.credentials = credentials;
+  }
+  async list() {
+    let text;
+    try {
+      text = await readFile(this.path, "utf8");
+    } catch (e) {
+      if (e.code === "ENOENT")
+        return [];
+      throw new ProviderError({
+        kind: "io",
+        message: "Could not read endpoint configuration."
+      });
+    }
+    let value;
+    try {
+      value = JSON.parse(text);
+    } catch {
+      throw usage("Endpoint configuration is invalid JSON. Repair providers.json before retrying.");
+    }
+    const doc = value;
+    if (!doc || doc.version !== 1 || !Array.isArray(doc.profiles))
+      throw usage("Endpoint configuration requires version 1 and a profiles array.");
+    const profiles = doc.profiles.map(validateProfile);
+    if (new Set(profiles.map((p) => p.name)).size !== profiles.length)
+      throw usage("Endpoint configuration contains duplicate names.");
+    return profiles;
+  }
+  async get(name) {
+    const p = (await this.list()).find((p2) => p2.name === name);
+    if (!p)
+      throw usage("Unknown endpoint profile. Run imagegen providers to list providers.");
+    return p;
+  }
+  async add(value) {
+    const p = validateProfile(value);
+    const profiles = await this.list();
+    if (profiles.some((v) => v.name === p.name))
+      throw usage("Endpoint already exists. Use providers update.");
+    await this.save([...profiles, p]);
+    return p;
+  }
+  async update(name, patch) {
+    const profiles = await this.list();
+    const old = profiles.find((p2) => p2.name === name);
+    if (!old)
+      throw usage("Unknown endpoint profile.");
+    const p = validateProfile({ ...old, ...patch, name });
+    if (new URL(old.baseUrl).origin !== new URL(p.baseUrl).origin || old.auth !== p.auth)
+      await (await this.credentials()).clear(name);
+    await this.save(profiles.map((v) => v.name === name ? p : v));
+    return p;
+  }
+  async remove(name) {
+    const profiles = await this.list();
+    if (!profiles.some((p) => p.name === name))
+      throw usage("Unknown endpoint profile.");
+    await (await this.credentials()).clear(name);
+    await this.save(profiles.filter((p) => p.name !== name));
+  }
+  async save(profiles) {
+    const temporary = `${this.path}.${randomUUID()}.tmp`;
+    try {
+      await mkdir2(dirname2(this.path), { recursive: true });
+      await writeFile(temporary, JSON.stringify({ version: 1, profiles }, null, 2) + "\n", { mode: 384 });
+      await rename(temporary, this.path);
+    } catch {
+      throw new ProviderError({
+        kind: "io",
+        message: "Could not save endpoint configuration."
+      });
+    } finally {
+      await rm2(temporary, { force: true }).catch(() => {
+      });
+    }
+  }
+};
+async function profileKey(profile, store) {
+  if (profile.auth === "none")
+    return void 0;
+  try {
+    const record3 = await store.load(profile.name);
+    if (record3 && typeof record3.apiKey === "string")
+      return validateApiKey(record3.apiKey);
+  } catch {
+  }
+  throw new ProviderError({
+    kind: "auth",
+    message: `Run imagegen auth ${profile.name} login to configure an API key.`
+  });
+}
+
+// ../../packages/providers-configurable/dist/provider.js
+import sharp3 from "sharp";
+
+// ../../packages/providers-configurable/dist/image-size.js
+function imageSize(value, api) {
+  const size = (value ?? "auto").trim().toLowerCase();
+  if (!size || size === "auto")
+    return {};
+  const presets = {
+    square: "1024x1024",
+    portrait: "1024x1536",
+    landscape: "1536x1024",
+    wide: "1536x864",
+    widescreen: "1536x864"
+  };
+  if (presets[size])
+    return { size: presets[size] };
+  const pixels = /^(\d+)\s*x\s*(\d+)$/.exec(size);
+  if (pixels && Number.isSafeInteger(Number(pixels[1])) && Number.isSafeInteger(Number(pixels[2])) && Number(pixels[1]) > 0 && Number(pixels[2]) > 0)
+    return { size: `${Number(pixels[1])}x${Number(pixels[2])}` };
+  const ratio = /^(\d+(?:\.\d+)?)\s*[:/]\s*(\d+(?:\.\d+)?)$/.exec(size);
+  if (api === "openrouter" && ratio && Number(ratio[1]) > 0 && Number(ratio[2]) > 0 && Number.isFinite(Number(ratio[1]) / Number(ratio[2])))
+    return { aspect_ratio: `${Number(ratio[1])}:${Number(ratio[2])}` };
+  throw usage(api === "openai-images" ? "This API format requires WIDTHxHEIGHT or a preset; arbitrary aspect-only sizes are unsupported." : "Use WIDTHxHEIGHT, an aspect ratio, preset, or auto.");
+}
+
+// ../../packages/providers-configurable/dist/http.js
+var record2 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var EndpointHttp = class {
+  fetchImpl;
+  timeoutSeconds;
+  constructor(fetchImpl = fetch, timeoutSeconds = 180) {
+    this.fetchImpl = fetchImpl;
+    this.timeoutSeconds = timeoutSeconds;
+    if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0)
+      throw new ProviderError({
+        kind: "configuration",
+        message: "Request timeout must be positive and finite."
+      });
+  }
+  async run(action) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutSeconds * 1e3);
+    const send = async (url, init = {}, download = false) => {
+      const response = await this.fetchImpl(url, {
+        ...init,
+        redirect: download ? "follow" : "error",
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        const status = response.status;
+        const failure2 = record2(await response.json().catch(() => null));
+        const detail = record2(failure2.error);
+        const upstream = record2(detail.metadata).provider_name;
+        const token = new Headers(init.headers).get("authorization")?.replace(/^Bearer\s+/i, "");
+        const upstreamProvider = typeof upstream === "string" && /^[A-Za-z0-9][A-Za-z0-9 ._()-]{0,63}$/.test(upstream) && !(token && upstream.includes(token)) && !/(?:sk-|AIza)/.test(upstream) ? upstream : void 0;
+        const retryHeader = response.headers.get("retry-after");
+        const retryAfterSeconds = retryHeader && /^\d+$/.test(retryHeader) && Number.isSafeInteger(Number(retryHeader)) ? Number(retryHeader) : void 0;
+        const upstreamQuota = status === 429 && upstreamProvider && typeof detail.message === "string" && /quota|resource.exhausted/i.test(detail.message);
+        throw new ProviderError({
+          kind: download ? "download" : status === 401 || status === 403 ? "auth" : status === 429 ? "rate_limit" : status >= 500 ? "server" : "usage",
+          statusCode: status,
+          upstreamProvider,
+          retryAfterSeconds,
+          message: download ? `Image download failed (HTTP ${status}).` : status === 401 || status === 403 ? "Endpoint authentication failed. Check the saved key and model access." : upstreamQuota ? `Upstream ${upstreamProvider} quota is exhausted (HTTP 429). Gateway credits may still be available. Select a different model or upstream, or resolve that upstream's quota.` : status === 429 && upstreamProvider ? `Upstream ${upstreamProvider} rate limit reached (HTTP 429). Wait for its limit to reset or select another model/upstream.` : status === 429 ? "Endpoint quota or rate limit reached (HTTP 429). Check gateway and upstream limits before retrying." : `Endpoint returned HTTP ${status}. Check the API format, model ID, and supported image options.`
+        });
+      }
+      return response;
+    };
+    try {
+      return await action({
+        json: async (url, init) => {
+          const response = await send(url, init);
+          try {
+            const value = await response.json();
+            if (!value || typeof value !== "object" || Array.isArray(value))
+              throw new Error();
+            return record2(value);
+          } catch {
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Endpoint returned an invalid JSON response."
+            });
+          }
+        },
+        bytes: async (url) => new Uint8Array(await (await send(url, {}, true)).arrayBuffer())
+      });
+    } catch (e) {
+      if (controller.signal.aborted)
+        throw new ProviderError({
+          kind: "timeout",
+          message: "Endpoint request timed out; no automatic retry was attempted."
+        });
+      if (e instanceof ProviderError)
+        throw e;
+      throw new ProviderError({
+        kind: "transport",
+        message: "Endpoint request failed. Check connectivity and the configured URL."
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// ../../packages/providers-configurable/dist/openrouter.js
+function openRouterRequest(model, request, images) {
+  return {
+    path: "images",
+    body: JSON.stringify({
+      model,
+      prompt: request.prompt,
+      n: 1,
+      ...imageSize(request.size, "openrouter"),
+      ...request.quality && request.quality !== "auto" ? { quality: request.quality } : {},
+      ...request.format ? { output_format: request.format === "jpg" ? "jpeg" : request.format } : {},
+      ...images.length ? {
+        input_references: images.map((image) => ({
+          type: "image_url",
+          image_url: {
+            url: `data:${image.contentType};base64,${Buffer.from(image.data).toString("base64")}`
+          }
+        }))
+      } : {}
+    }),
+    json: true
+  };
+}
+
+// ../../packages/providers-configurable/dist/openai-images.js
+function openAIRequest(model, request, images, mask) {
+  const fields = {
+    model,
+    prompt: request.prompt,
+    n: 1,
+    ...imageSize(request.size, "openai-images"),
+    ...request.quality && request.quality !== "auto" ? { quality: request.quality } : {},
+    ...request.format ? { output_format: request.format === "jpg" ? "jpeg" : request.format } : {}
+  };
+  if (!images.length)
+    return {
+      path: "images/generations",
+      body: JSON.stringify(fields),
+      json: true
+    };
+  const body = new FormData();
+  for (const [key, value] of Object.entries(fields))
+    body.set(key, String(value));
+  const add = (name, image, index) => body.append(name, new Blob([new Uint8Array(image.data)], { type: image.contentType }), image.filename ?? `image-${index}.png`);
+  images.forEach((image, i) => add(images.length === 1 ? "image" : "image[]", image, i));
+  if (mask)
+    add("mask", mask, 0);
+  return { path: "images/edits", body, json: false };
+}
+
+// ../../packages/providers-configurable/dist/provider.js
+var ConfigurableImageProvider = class {
+  getKey;
+  name;
+  profile;
+  http;
+  constructor(profile, getKey, options = {}) {
+    this.getKey = getKey;
+    this.profile = validateProfile(profile);
+    this.name = profile.name;
+    this.http = new EndpointHttp(options.fetchImpl, options.timeoutSeconds);
+  }
+  sizePolicy = {
+    resolveSize: (size) => {
+      const fields = imageSize(size, this.profile.api);
+      if (!fields.size)
+        return { size: fields.aspect_ratio ?? "auto" };
+      const [width, height] = fields.size.split("x").map(Number);
+      return {
+        width,
+        height,
+        pixels: width * height,
+        size: fields.size ?? fields.aspect_ratio ?? "auto"
+      };
+    }
+  };
+  generate(request) {
+    return this.run(request, request.referenceImages ?? []);
+  }
+  edit(request) {
+    return this.run(request, [request.sourceImage, ...request.referenceImages ?? []], request.mask);
+  }
+  async headers() {
+    if (this.profile.auth === "none")
+      return {};
+    try {
+      const key = await this.getKey();
+      if (!key)
+        throw new Error();
+      return { authorization: `Bearer ${validateApiKey(key)}` };
+    } catch {
+      throw new ProviderError({
+        kind: "auth",
+        message: `Could not load endpoint credentials. Run imagegen auth ${this.name} login.`
+      });
+    }
+  }
+  async models() {
+    const headers = await this.headers();
+    return this.http.run(async (http) => {
+      const body = await http.json(`${this.profile.baseUrl}/${this.profile.api === "openrouter" ? "images/models" : "models"}`, { headers });
+      if (!Array.isArray(body.data))
+        throw new ProviderError({
+          kind: "malformed",
+          message: "Model discovery response must contain a data array."
+        });
+      return body.data.map((value) => {
+        const model = record2(value);
+        if (typeof model.id !== "string")
+          throw new ProviderError({
+            kind: "malformed",
+            message: "Discovered model has no string ID."
+          });
+        const architecture = record2(model.architecture);
+        const supported = record2(model.supported_parameters);
+        const strings = (v) => Array.isArray(v) && v.every((s) => typeof s === "string") ? v : void 0;
+        return {
+          id: model.id,
+          ...typeof model.name === "string" ? { name: model.name } : {},
+          capabilities: this.profile.api === "openrouter" ? "reported" : "unknown",
+          ...this.profile.api === "openrouter" ? {
+            supportedParameters: supported,
+            inputModalities: strings(architecture.input_modalities),
+            outputModalities: strings(architecture.output_modalities)
+          } : {}
+        };
+      });
+    });
+  }
+  async run(request, images, mask) {
+    const model = (request.model ?? this.profile.model ?? "").trim();
+    if (!model)
+      throw usage("Supply --model or configure a default model with providers update.");
+    if ((request.referenceImages?.length ?? 0) > 4)
+      throw usage("At most four reference images are allowed.");
+    const count = request.count ?? 1;
+    if (!Number.isInteger(count) || count < 1 || count > 4)
+      throw usage("Image count must be from 1 to 4.");
+    if (mask && this.profile.api === "openrouter")
+      throw usage("OpenRouter image API does not expose masks. Describe the edit region in the prompt.");
+    for (const image of [...images, ...mask ? [mask] : []])
+      if (!["image/png", "image/jpeg", "image/webp"].includes(image.contentType))
+        throw usage("Input images must be PNG, JPEG, or WebP.");
+    const format = (request.format ?? "png").trim().toLowerCase().replace(/^jpg$/, "jpeg");
+    if (!["png", "jpeg", "webp"].includes(format))
+      throw usage("Output format must be png, jpeg, or webp.");
+    const quality = request.quality?.trim().toLowerCase();
+    if (quality && !/^[a-z][a-z0-9_-]*$/.test(quality))
+      throw usage("Quality must be a provider-supported quality name.");
+    const normalized = {
+      ...request,
+      ...request.format ? { format } : {},
+      quality
+    };
+    const payload = this.profile.api === "openrouter" ? openRouterRequest(model, normalized, images) : openAIRequest(model, normalized, images, mask);
+    const headers = await this.headers();
+    const results = [];
+    for (let i = 0; i < count; i++)
+      results.push(await this.http.run(async (http) => {
+        const body = await http.json(`${this.profile.baseUrl}/${payload.path}`, {
+          method: "POST",
+          headers: {
+            ...headers,
+            ...payload.json ? { "content-type": "application/json" } : {}
+          },
+          body: payload.body
+        });
+        if (!Array.isArray(body.data) || body.data.length !== 1)
+          throw new ProviderError({
+            kind: "malformed",
+            message: "Endpoint must return exactly one image for a single-image request."
+          });
+        const image = record2(body.data[0]);
+        let data;
+        if (typeof image.b64_json === "string") {
+          if (!image.b64_json || image.b64_json.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(image.b64_json))
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Endpoint returned invalid base64 image data."
+            });
+          data = Buffer.from(image.b64_json, "base64");
+        } else if (typeof image.url === "string") {
+          let url;
+          try {
+            url = new URL(image.url);
+          } catch {
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Endpoint returned an invalid image URL."
+            });
+          }
+          if (headers.authorization && image.url.includes(headers.authorization.slice(7)) || url.username || url.password || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+            throw new ProviderError({
+              kind: "malformed",
+              message: "Image download URL must use HTTPS or loopback HTTP without embedded credentials."
+            });
+          data = await http.bytes(url.toString());
+        } else
+          throw new ProviderError({
+            kind: "no_image",
+            message: "Endpoint returned no image bytes or download URL."
+          });
+        try {
+          const metadata = await sharp3(data).metadata();
+          if (!metadata.width || !metadata.height || !["png", "jpeg", "webp"].includes(metadata.format ?? "") || typeof image.media_type === "string" && image.media_type !== `image/${metadata.format}`)
+            throw new Error();
+          await sharp3(data).stats();
+          if (metadata.format !== format)
+            data = await sharp3(data).toFormat(format).toBuffer();
+          return {
+            data,
+            width: metadata.width,
+            height: metadata.height,
+            mimeType: `image/${format}`,
+            prompt: request.prompt,
+            ...typeof body.id === "string" ? { responseId: body.id } : {}
+          };
+        } catch {
+          throw new ProviderError({
+            kind: "malformed",
+            message: "Endpoint returned an invalid raster image or inconsistent image format."
+          });
+        }
+      }));
+    return { provider: this.name, imageModel: model, images: results };
+  }
+};
+function createProfileEntry(profile) {
+  return {
+    provider: new ConfigurableImageProvider(profile, async () => profileKey(profile, await profileStore())),
+    authStatus: async () => {
+      let configured = profile.auth === "none";
+      if (!configured)
+        try {
+          await profileKey(profile, await profileStore());
+          configured = true;
+        } catch {
+        }
+      return {
+        name: profile.name,
+        configured,
+        detail: `Run imagegen auth ${profile.name} login.`
+      };
+    }
+  };
+}
+
+// src/key-input.ts
+import { emitKeypressEvents } from "node:readline";
+var failure = (message) => new ProviderError({ kind: "auth", message });
+async function readApiKey(fromStdin, input = process.stdin, output = process.stderr, providerName = "gemini") {
+  if (fromStdin) {
+    let text = "";
+    for await (const chunk of input) {
+      text += chunk.toString();
+      if (Buffer.byteLength(text) > 8192)
+        throw failure("API key input is too long.");
+    }
+    return text;
+  }
+  if (!input.isTTY)
+    throw failure(
+      "API-key login requires a terminal, or explicit --key-stdin."
+    );
+  const terminal = input;
+  const wasRaw = terminal.isRaw;
+  const wasFlowing = input.readableFlowing === true;
+  emitKeypressEvents(input);
+  return new Promise((resolve4, reject) => {
+    let text = "";
+    const cleanup = () => {
+      input.removeListener("keypress", onKey);
+      input.removeListener("end", onEnd);
+      input.removeListener("error", onError);
+      terminal.setRawMode(wasRaw);
+      if (!wasFlowing) input.pause();
+      output.write("\n");
+    };
+    const onEnd = () => {
+      cleanup();
+      reject(failure("API-key login cancelled before a key was entered."));
+    };
+    const onError = () => {
+      cleanup();
+      reject(failure("Could not read the API key."));
+    };
+    const onKey = (value, key) => {
+      if (key.ctrl && (key.name === "c" || key.name === "d")) {
+        onEnd();
+        return;
+      }
+      if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        resolve4(text);
+        return;
+      }
+      if (key.name === "backspace") {
+        text = text.slice(0, -1);
+        return;
+      }
+      if (value && !key.ctrl && !/[\x00-\x1f\x7f]/.test(value)) text += value;
+      if (text.length > 8192) {
+        cleanup();
+        reject(failure("API key input is too long."));
+      }
+    };
+    output.write(`${providerName} API key (hidden): `);
+    input.on("keypress", onKey);
+    input.once("end", onEnd);
+    input.once("error", onError);
+    terminal.setRawMode(true);
+    input.resume();
+  });
+}
+
 // src/help.ts
+var PROFILE_HELP = `Named endpoint profiles:
+  imagegen providers add <name> --api <openrouter|openai-images> [--base-url <url>]
+                         [--model <id>] [--auth <bearer|none>]
+  imagegen providers show <name>
+  imagegen providers update <name> [--api <format>] [--base-url <url>]
+                         [--model <id>] [--auth <bearer|none>]
+  imagegen providers remove <name>
+  imagegen auth <name> login [--key-stdin]
+  imagegen auth <name> status [--show-path]
+  imagegen auth <name> logout
+  imagegen models --provider <name>
+
+OpenRouter defaults to https://openrouter.ai/api/v1. openai-images requires
+--base-url including the API prefix (e.g. https://api.openai.com/v1).
+Keys use hidden terminal input or explicit --key-stdin and the existing vault/file
+store. --auth none supports endpoints without keys. Config is saved in providers.json
+alongside the credential file. Origin changes clear the saved key; removing a
+profile removes its credentials. Logout preserves profile configuration.
+
+Select named profiles with --provider. Model precedence: --model > profile default;
+provide one if no default is saved. models explicitly discovers model metadata;
+OpenAI-compatible model listings do not establish image capabilities.
+
+Supported protocols: OpenRouter dedicated Images API and OpenAI Images JSON /
+multipart endpoints, not arbitrary HTTP templates. Options vary by model.
+OpenRouter accepts aspect ratios; openai-images needs pixels or presets:
+square 1024x1024, portrait 1024x1536, landscape 1536x1024, wide 1536x864.
+Auto options are omitted. Native masks require openai-images.
+Outputs are measured and converted to PNG/JPEG/WebP without resizing. Count uses
+separate single-image requests without automatic retries or model substitution.
+`;
 var IMAGE_OPTIONS = `Image options (generate, edit):
   --prompt <text>        Prompt text (required)
   --out <path|dir>       Output file or directory (required)
   --provider <name>      Repeatable. Defaults to the only configured provider;
                          required when several are configured.
-  --model <id>          Image model override (Codex default gpt-image-2.5-flare)
+  --model <id>          Image model override (defaults listed below)
   --reference <file>     Reference image for continuity (repeatable, max 4)
   --size <size>          auto, WIDTHxHEIGHT, aspect (16:9), or preset
                      square, portrait, landscape, wide (validated per
@@ -1022,6 +1871,18 @@ var IMAGE_OPTIONS = `Image options (generate, edit):
   --format <format>      png, jpeg, or webp (default png)
   --count <n>            Number of images, 1-4 (default 1)
 
+Gemini provider:
+  gemini-nano-banana-2.1 Default; generation, references, and independent edits
+  gemini-3-pro-image    Precision creative work and brand consistency
+  gemini-3.1-flash-image Previous-generation Flash; also supports 512 resolution
+  gemini-2.5-flash-image Legacy; up to three inputs including edit source
+  --quality auto only; no --mask or guaranteed native alpha transparency.
+  --size normalizes to model-native ratios and resolution tiers without resizing.
+  auto keeps model defaults; aspect/preset requests use 1K. JSON reports actual pixels.
+  PNG/JPEG/WebP output; format conversion happens locally when needed.
+  Model precedence: --model > constructor imageModel > IMAGEGEN_GEMINI_IMAGE_MODEL
+  > gemini-nano-banana-2.1. Calls are independent; use prior output as --source.
+
 Supported Codex models (account availability is determined by the provider):
   gpt-image-2.5-flare     Default; fast image generation and editing
   gpt-image-2.5-sunburst  Higher-precision image generation and editing
@@ -1030,19 +1891,22 @@ Supported Codex models (account availability is determined by the provider):
 Use full model IDs; other provider-supported IDs may also be supplied.
 Model precedence: --model > constructor imageModel (library callers) >
 IMAGEGEN_CODEX_IMAGE_MODEL > gpt-image-2.5-flare.
-IMAGEGEN_CODEX_MODEL configures orchestration separately; --model selects images.
+Codex may override the requested model, quality, and size; results report the
+returned dimensions. Codex ignores --mask; describe the region in the prompt.
+IMAGEGEN_USAGE_LOG=<file> appends one prompt-free JSON usage line per result.
 
 Codex quality: auto (default), low, medium, high; Flare/Sunburst also support
 xhigh and max. gpt-image-2 rejects xhigh/max.
 `;
 var GENERATE_EXAMPLES = `Examples:
+  imagegen generate --provider gemini --size 16:9 --prompt "a lighthouse at dawn" --out ./gemini.png
   imagegen generate --prompt "a lighthouse at dawn" --out ./lighthouse.png
   imagegen generate --model gpt-image-2 --prompt "a lighthouse" --out ./classic.png
   imagegen generate --model gpt-image-2.5-sunburst --quality max --prompt "a product photo" --out ./product.png
 `;
 var EDIT_EXAMPLES = `Edit options:
   --source <file>        Source image (required)
-  --mask <file>          Optional edit mask
+  --mask <file>          Optional edit mask (openai-images; Codex ignores it)
 
 Examples:
   imagegen edit --format webp --source ./product.png --prompt "make the product blue" --out ./blue.webp
@@ -1051,21 +1915,28 @@ Examples:
 var USAGE = `imagegen - provider-agnostic image generation CLI
 
 Usage:
+  imagegen auth gemini login [--key-stdin]
+  imagegen auth gemini status [--show-path]
+  imagegen auth gemini logout
   imagegen auth codex login [--timeout <minutes>] [--no-open]
   imagegen auth codex status [--show-path]
   imagegen auth codex logout
   imagegen generate --prompt <text> --out <path|dir> [--provider <name>] [options]
   imagegen edit --prompt <text> --source <file> [--mask <file>] --out <path|dir> [--provider <name>] [options]
   imagegen providers
+  imagegen models --provider <profile-name>
   imagegen skill
   imagegen skill install --target <claude|codex|skills-dir> [--target <...>] [--force]
   imagegen help [command]
 
+${PROFILE_HELP}
 ${IMAGE_OPTIONS}
 ${GENERATE_EXAMPLES}
 ${EDIT_EXAMPLES}
 
 Auth options:
+  --key-stdin           Read an API key from explicit stdin; otherwise hidden
+                         terminal entry. Keys are stored in the vault/file fallback.
   --timeout <minutes>    Login wait timeout (default 10)
   --no-open              Print the URL without opening a browser
   --show-path            Show where tokens are stored (auth status)
@@ -1076,29 +1947,42 @@ Global:
 var COMMAND_HELP = {
   auth: `imagegen auth - manage provider credentials (one namespace per provider)
 
+${PROFILE_HELP}
+
 Usage:
+  imagegen auth gemini login [--key-stdin]
+  imagegen auth gemini status [--show-path]
+  imagegen auth gemini logout
   imagegen auth codex login [--timeout <minutes>] [--no-open]
   imagegen auth codex status [--show-path]
   imagegen auth codex logout
 `,
-  login: `imagegen auth codex login - connect Codex via browser OAuth
+  login: `imagegen auth login - connect Gemini with an API key or Codex via OAuth
 
 Usage:
+  imagegen auth gemini login [--key-stdin]
+  imagegen auth gemini status [--show-path]
+  imagegen auth gemini logout
   imagegen auth codex login [--timeout <minutes>] [--no-open]
 
-Starts a temporary localhost callback server, opens the browser,
+Gemini login reads a hidden API key (or explicit --key-stdin), stores it in the
+OS vault with file fallback, and makes no paid verification request.
+Codex login starts a temporary localhost callback server, opens the browser,
 exchanges the code, and stores tokens in the OS vault (file fallback).
 `,
-  status: `imagegen auth codex status - show Codex connection state
+  status: `imagegen auth status - show provider connection state
 
 Usage:
+  imagegen auth gemini status [--show-path]
   imagegen auth codex status [--show-path]
 
-Prints JSON without secrets. --show-path reveals the token location.
+Prints JSON without secrets. --show-path reveals the credential location.
+Gemini status is local configured state, not API-key validity.
 `,
-  logout: `imagegen auth codex logout - remove stored Codex credentials
+  logout: `imagegen auth logout - remove stored provider credentials
 
 Usage:
+  imagegen auth gemini logout
   imagegen auth codex logout
 `,
   generate: `imagegen generate - create images from a prompt
@@ -1106,6 +1990,7 @@ Usage:
 Usage:
   imagegen generate --prompt <text> --out <path|dir> [--provider <name>] [options]
 
+${PROFILE_HELP}
 ${IMAGE_OPTIONS}
 ${GENERATE_EXAMPLES}
 `,
@@ -1117,12 +2002,22 @@ Usage:
 ${IMAGE_OPTIONS}
 ${EDIT_EXAMPLES}
 `,
-  providers: `imagegen providers - list registered and configured providers
+  providers: `imagegen providers - list providers and manage named endpoints
 
 Usage:
   imagegen providers
 
 Prints JSON with each provider and whether it is configured.
+
+${PROFILE_HELP}`,
+  models: `imagegen models - discover models for a named endpoint profile
+
+Usage:
+  imagegen models --provider <profile-name>
+
+Discovery is explicit and may require saved credentials. OpenRouter returns image
+models and reported capabilities; generic /models results have unknown image
+capabilities. This command does not generate images.
 `,
   skill: `imagegen skill - print or install the reusable agent skill
 
@@ -1154,9 +2049,9 @@ ${USAGE}`;
 }
 
 // src/skill.ts
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir as mkdir3, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname, join as join2, resolve } from "node:path";
+import { dirname as dirname3, join as join4, resolve } from "node:path";
 var SKILL_NAME = "imagegen-cli";
 var SkillExistsError = class extends Error {
   constructor(path) {
@@ -1165,18 +2060,18 @@ var SkillExistsError = class extends Error {
   }
 };
 async function skillText() {
-  return readFile(new URL("../skill/SKILL.md", import.meta.url), "utf8");
+  return readFile2(new URL("../skill/SKILL.md", import.meta.url), "utf8");
 }
 function targetPath(target) {
-  const root = target === "claude" ? join2(homedir2(), ".claude", "skills") : target === "codex" ? join2(homedir2(), ".agents", "skills") : resolve(target);
-  return join2(root, SKILL_NAME, "SKILL.md");
+  const root = target === "claude" ? join4(homedir2(), ".claude", "skills") : target === "codex" ? join4(homedir2(), ".agents", "skills") : resolve(target);
+  return join4(root, SKILL_NAME, "SKILL.md");
 }
 async function existingText(path) {
   try {
-    return await readFile(path, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
+    return await readFile2(path, "utf8");
+  } catch (error2) {
+    if (error2.code === "ENOENT") return void 0;
+    throw error2;
   }
 }
 async function installSkill(targets, force) {
@@ -1195,19 +2090,60 @@ async function installSkill(targets, force) {
   }
   for (const item of planned.values()) {
     if (item.status === "up-to-date") continue;
-    await mkdir(dirname(item.path), { recursive: true });
-    await writeFile(item.path, content, { encoding: "utf8", flag: item.status === "installed" ? "wx" : "w" });
+    await mkdir3(dirname3(item.path), { recursive: true });
+    await writeFile2(item.path, content, { encoding: "utf8", flag: item.status === "installed" ? "wx" : "w" });
   }
   return [...planned.values()];
 }
 
+// src/usage-log.ts
+import { appendFile, mkdir as mkdir4 } from "node:fs/promises";
+import { dirname as dirname4, resolve as resolve2 } from "node:path";
+var USAGE_LOG_ENV = "IMAGEGEN_USAGE_LOG";
+function usageLogEntry(request, edit, result, paths) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    command: edit ? "edit" : "generate",
+    provider: result.provider,
+    imageModel: result.imageModel,
+    requested: {
+      size: request.size ?? "auto",
+      quality: request.quality ?? "auto",
+      format: request.format ?? "png",
+      count: request.count ?? 1,
+      references: request.referenceImages?.length ?? 0,
+      mask: edit ? edit.mask !== void 0 : void 0
+    },
+    images: result.images.map((image, i) => ({
+      path: paths[i],
+      width: image.width,
+      height: image.height,
+      bytes: image.data.byteLength,
+      responseId: image.responseId,
+      usage: image.usage
+    }))
+  };
+}
+async function appendUsageLog(entry) {
+  const target = process.env[USAGE_LOG_ENV]?.trim();
+  if (!target) return void 0;
+  const path = resolve2(target);
+  await mkdir4(dirname4(path), { recursive: true });
+  await appendFile(path, `${JSON.stringify(entry)}
+`, "utf8");
+  return path;
+}
+
 // src/index.ts
 var EXIT_USAGE = 2;
 var EXIT_AUTH = 3;
 var EXIT_PROVIDER = 4;
 var EXIT_IO = 5;
-function fail(kind, message, exitCode) {
-  process.stderr.write(`${JSON.stringify({ error: { kind, message } })}
+function errorDetails(error2) {
+  return { statusCode: error2.statusCode, upstreamProvider: error2.upstreamProvider, retryAfterSeconds: error2.retryAfterSeconds };
+}
+function fail(kind, message, exitCode, details = {}) {
+  process.stderr.write(`${JSON.stringify({ error: { kind, message, ...details } })}
 `);
   process.exit(exitCode);
 }
@@ -1222,10 +2158,10 @@ function parseArgs(argv) {
     }
     if (arg.startsWith("--")) {
       const key = arg.slice(2);
-      if (!["prompt", "out", "provider", "model", "reference", "size", "quality", "format", "count", "source", "mask", "timeout", "no-open", "show-path", "target", "force"].includes(key)) {
+      if (!["prompt", "out", "provider", "model", "reference", "size", "quality", "format", "count", "source", "mask", "timeout", "api", "base-url", "auth", "key-stdin", "no-open", "show-path", "target", "force"].includes(key)) {
         fail("usage", `Unknown option --${key}. Run imagegen help.`, EXIT_USAGE);
       }
-      if (key === "no-open" || key === "show-path" || key === "force") {
+      if (key === "key-stdin" || key === "no-open" || key === "show-path" || key === "force") {
         flags.set(key, true);
         continue;
       }
@@ -1273,7 +2209,7 @@ function redirectPort(uri) {
 async function loadImageInput(path, label) {
   let data;
   try {
-    data = await readFile2(path);
+    data = await readFile3(path);
   } catch {
     fail("io", `${label} not found: ${path}`, EXIT_IO);
   }
@@ -1313,9 +2249,11 @@ function parseCount(flags) {
   }
   return count;
 }
-function registry() {
+async function registry() {
   const registry2 = new ProviderRegistry();
   registry2.register(createCodexEntry());
+  registry2.register(createGeminiEntry());
+  for (const profile of await new ProfileRepository().list()) registry2.register(createProfileEntry(profile));
   return registry2;
 }
 function requestedProviders(flags) {
@@ -1324,10 +2262,10 @@ function requestedProviders(flags) {
   return raw;
 }
 async function resolveOutPaths(out, providerName, multiProvider, count, format) {
-  const resolved = resolve2(out);
+  const resolved = resolve3(out);
   let isDir = false;
   try {
-    const info = await stat(resolved);
+    const info = await stat2(resolved);
     isDir = info.isDirectory();
   } catch {
     isDir = extname(resolved) === "";
@@ -1335,12 +2273,12 @@ async function resolveOutPaths(out, providerName, multiProvider, count, format)
   const extension = `.${normalizeOutputFormat(format)}`;
   const prefix = multiProvider ? `${providerName}-` : "";
   if (isDir) {
-    return Array.from({ length: count }, (_, i) => join3(resolved, `${prefix}image-${i + 1}${extension}`));
+    return Array.from({ length: count }, (_, i) => join5(resolved, `${prefix}image-${i + 1}${extension}`));
   }
   if (count > 1 || multiProvider) {
-    const dir = dirname2(resolved);
+    const dir = dirname5(resolved);
     const base = basename(resolved, extname(resolved));
-    return Array.from({ length: count }, (_, i) => join3(dir, `${prefix}${base}-${i + 1}${extension}`));
+    return Array.from({ length: count }, (_, i) => join5(dir, `${prefix}${base}-${i + 1}${extension}`));
   }
   return [resolved.endsWith(extension) ? resolved : `${resolved}${extension}`];
 }
@@ -1365,16 +2303,67 @@ async function saveImages(result, paths) {
   for (let i = 0; i < result.images.length; i += 1) {
     const path = paths[i];
     try {
-      await mkdir2(dirname2(path), { recursive: true });
-      await writeFile2(path, Buffer.from(result.images[i].data));
+      await mkdir5(dirname5(path), { recursive: true });
+      await writeFile3(path, Buffer.from(result.images[i].data));
     } catch {
       fail("io", `Could not write output file: ${path}`, EXIT_IO);
     }
   }
 }
+async function runApiKeyAuth(providerName, action, flags) {
+  const profile = providerName === "gemini" ? void 0 : await new ProfileRepository().get(providerName);
+  try {
+    if (profile?.auth === "none") {
+      process.stdout.write(`${JSON.stringify({ provider: providerName, ...action === "status" ? { connected: true, auth: "none" } : { status: "not-required" } })}
+`);
+      return;
+    }
+    const store = profile ? await profileStore() : await geminiStore();
+    if (action === "login") {
+      const apiKey = validateApiKey(
+        await readApiKey(flags.get("key-stdin") === true, process.stdin, process.stderr, providerName)
+      );
+      if (store.describe().backend === "file")
+        process.stderr.write(
+          `Warning: OS vault unavailable; credentials stored in a restricted file. Use auth ${providerName} status --show-path to inspect.
+`
+        );
+      await store.save(providerName, { apiKey });
+      process.stdout.write(
+        `${JSON.stringify({ provider: providerName, status: "connected" })}
+`
+      );
+    } else if (action === "logout") {
+      await store.clear(providerName);
+      process.stdout.write(
+        `${JSON.stringify({ provider: providerName, status: "disconnected" })}
+`
+      );
+    } else {
+      let connected = false;
+      try {
+        if (profile) await profileKey(profile, store);
+        else await storedKey(store);
+        connected = true;
+      } catch (error2) {
+        if (!(error2 instanceof ProviderError)) throw error2;
+      }
+      process.stdout.write(
+        `${JSON.stringify({ provider: providerName, connected, ...flags.get("show-path") ? { store: store.describe() } : {} })}
+`
+      );
+    }
+  } catch (error2) {
+    fail(
+      "auth",
+      error2 instanceof ProviderError ? error2.message : "Could not access API credentials. Check the credential store and retry login.",
+      EXIT_AUTH
+    );
+  }
+}
 async function runAuthLogin(providerName, flags) {
   if (providerName !== PROVIDER_NAME) {
-    fail("usage", `Unknown auth provider "${providerName}". Available: ${registry().describe()}.`, EXIT_USAGE);
+    fail("usage", `Unknown auth provider "${providerName}". Available: ${(await registry()).describe()}.`, EXIT_USAGE);
   }
   const uri = redirectUri();
   const port = redirectPort(uri);
@@ -1387,8 +2376,8 @@ async function runAuthLogin(providerName, flags) {
   const waiter = waitForOAuthCallback(timeoutMinutes * 60 * 1e3, port);
   if (!flags.get("no-open")) {
     try {
-      const { default: open } = await import("open");
-      await open(url);
+      const { default: open2 } = await import("open");
+      await open2(url);
     } catch {
       process.stderr.write("Could not open a browser automatically. Open this URL manually:\n");
     }
@@ -1398,9 +2387,9 @@ ${url}
 `);
   try {
     callback = await waiter;
-  } catch (error) {
-    if (error instanceof LoopbackError) fail("auth", error.message, EXIT_AUTH);
-    throw error;
+  } catch (error2) {
+    if (error2 instanceof LoopbackError) fail("auth", error2.message, EXIT_AUTH);
+    throw error2;
   }
   if (callback.state !== state) fail("auth", "OAuth state mismatch. Retry `imagegen auth codex login`.", EXIT_AUTH);
   const verifier = consumeVerifier(state);
@@ -1412,15 +2401,16 @@ ${url}
   const manager = new CodexTokenManager(store);
   try {
     await manager.exchangeAndSave({ code: callback.code, redirectUri: uri, codeVerifier: verifier });
-  } catch (error) {
-    if (error instanceof ReauthRequiredError) fail("auth", error.message, EXIT_AUTH);
-    throw error;
+  } catch (error2) {
+    if (error2 instanceof ReauthRequiredError) fail("auth", error2.message, EXIT_AUTH);
+    throw error2;
   }
   process.stdout.write(`${JSON.stringify({ provider: PROVIDER_NAME, status: "connected" })}
 `);
 }
 async function runProviders() {
-  const entries = registry().names().map((name) => registry().get(name));
+  const providersRegistry = await registry();
+  const entries = providersRegistry.names().map((name) => providersRegistry.get(name));
   const providers = [];
   for (const entry of entries) {
     const status = await entry.authStatus();
@@ -1431,7 +2421,7 @@ async function runProviders() {
 }
 async function runAuthStatus(providerName, flags) {
   if (providerName !== PROVIDER_NAME) {
-    fail("usage", `Unknown auth provider "${providerName}". Available: ${registry().describe()}.`, EXIT_USAGE);
+    fail("usage", `Unknown auth provider "${providerName}". Available: ${(await registry()).describe()}.`, EXIT_USAGE);
   }
   const store = await resolveTokenStore();
   const manager = new CodexTokenManager(store);
@@ -1447,7 +2437,7 @@ async function runAuthStatus(providerName, flags) {
 }
 async function runAuthLogout(providerName) {
   if (providerName !== PROVIDER_NAME) {
-    fail("usage", `Unknown auth provider "${providerName}". Available: ${registry().describe()}.`, EXIT_USAGE);
+    fail("usage", `Unknown auth provider "${providerName}". Available: ${(await registry()).describe()}.`, EXIT_USAGE);
   }
   const store = await resolveTokenStore();
   await store.clear(PROVIDER_NAME);
@@ -1475,9 +2465,9 @@ async function runGenerate(flags) {
 }
 async function resolveProviders(requested) {
   try {
-    return await registry().resolve(requested);
-  } catch (error) {
-    fail("usage", error instanceof Error ? error.message : String(error), EXIT_USAGE);
+    return await (await registry()).resolve(requested);
+  } catch (error2) {
+    fail("usage", error2 instanceof Error ? error2.message : String(error2), EXIT_USAGE);
   }
 }
 async function runEdit(flags) {
@@ -1508,17 +2498,24 @@ async function runImageRequest(request, edit, providers) {
     let result;
     try {
       result = edit ? await entry.provider.edit(edit) : await entry.provider.generate(request);
-    } catch (error) {
-      if (error instanceof ReauthRequiredError) fail("auth", `${entry.provider.name}: ${error.message}`, EXIT_AUTH);
-      if (error instanceof ProviderError) {
-        if (error.kind === "configuration" || error.kind === "usage") fail(error.kind, `${entry.provider.name}: ${error.message}`, EXIT_USAGE);
-        fail("provider", `${entry.provider.name}: ${error.kind}: ${error.message}`, EXIT_PROVIDER);
+    } catch (error2) {
+      if (error2 instanceof ReauthRequiredError) fail("auth", `${entry.provider.name}: ${error2.message}`, EXIT_AUTH);
+      if (error2 instanceof ProviderError) {
+        if (error2.kind === "auth") fail("auth", `${entry.provider.name}: ${error2.message}`, EXIT_AUTH, errorDetails(error2));
+        if (error2.kind === "configuration" || error2.kind === "usage") fail(error2.kind, `${entry.provider.name}: ${error2.message}`, EXIT_USAGE, errorDetails(error2));
+        fail("provider", `${entry.provider.name}: ${error2.kind}: ${error2.message}`, EXIT_PROVIDER, errorDetails(error2));
       }
-      throw error;
+      throw error2;
     }
     const paths = await resolveOutPaths(request.out, entry.provider.name, multiProvider, result.images.length, request.format ?? "png");
     await saveImages(result, paths);
     printResult(entry.provider.name, result, paths);
+    try {
+      await appendUsageLog(usageLogEntry(request, edit, result, paths));
+    } catch {
+      process.stderr.write(`${JSON.stringify({ warning: { kind: "io", message: `Could not append to ${USAGE_LOG_ENV} file.` } })}
+`);
+    }
   }
 }
 async function main() {
@@ -1528,6 +2525,9 @@ async function main() {
     return;
   }
   const [command, sub, subSub] = positionals;
+  if (flags.has("key-stdin") && !(command === "auth" && sub !== "codex" && subSub === "login")) {
+    fail("usage", "--key-stdin is only supported by API-key auth login.", EXIT_USAGE);
+  }
   try {
     if (command === "help") {
       process.stdout.write(helpFor(sub));
@@ -1546,12 +2546,42 @@ async function main() {
         const installed = await installSkill(targets, flags.get("force") === true);
         process.stdout.write(`${JSON.stringify({ skill: "imagegen-cli", installed })}
 `);
-      } catch (error) {
-        if (error instanceof SkillExistsError) fail("usage", error.message, EXIT_USAGE);
-        fail("io", error instanceof Error ? error.message : String(error), EXIT_IO);
+      } catch (error2) {
+        if (error2 instanceof SkillExistsError) fail("usage", error2.message, EXIT_USAGE);
+        fail("io", error2 instanceof Error ? error2.message : String(error2), EXIT_IO);
       }
       return;
     }
+    if (command === "providers" && sub) {
+      if (!subSub || positionals.length !== 3) fail("usage", "Usage: imagegen providers add|show|update|remove <name> [options].", EXIT_USAGE);
+      const repository = new ProfileRepository();
+      if (sub === "show") process.stdout.write(`${JSON.stringify({ provider: await repository.get(subSub) })}
+`);
+      else if (sub === "remove") {
+        await repository.remove(subSub);
+        process.stdout.write(`${JSON.stringify({ provider: subSub, status: "removed" })}
+`);
+      } else if (sub === "add" || sub === "update") {
+        const patch = {};
+        for (const [flag, key] of [["api", "api"], ["base-url", "baseUrl"], ["auth", "auth"], ["model", "model"]]) {
+          const value = flagValue(flags, flag);
+          if (value !== void 0) patch[key] = value;
+        }
+        const profile = sub === "add" ? await repository.add({ name: subSub, ...patch }) : await repository.update(subSub, patch);
+        process.stdout.write(`${JSON.stringify({ provider: profile })}
+`);
+      } else fail("usage", "Unknown providers action. Use add, show, update, or remove.", EXIT_USAGE);
+      return;
+    }
+    if (command === "models" && !sub) {
+      const selected = requestedProviders(flags);
+      if (!selected || selected.length !== 1) fail("usage", "Model discovery requires exactly one --provider <profile-name>.", EXIT_USAGE);
+      const profile = await new ProfileRepository().get(selected[0]);
+      const provider = new ConfigurableImageProvider(profile, async () => profileKey(profile, await profileStore()));
+      process.stdout.write(`${JSON.stringify({ provider: profile.name, models: await provider.models() })}
+`);
+      return;
+    }
     if (command === "providers" && !sub) {
       await runProviders();
       return;
@@ -1559,6 +2589,10 @@ async function main() {
     if (command === "auth" && sub && !subSub) {
       fail("usage", `Missing auth action. Usage: imagegen auth ${sub} login|status|logout.`, EXIT_USAGE);
     }
+    if (command === "auth" && sub && sub !== "codex" && ["login", "status", "logout"].includes(subSub)) {
+      await runApiKeyAuth(sub, subSub, flags);
+      return;
+    }
     if (command === "auth" && sub) {
       if (subSub === "login") {
         await runAuthLogin(sub, flags);
@@ -1582,9 +2616,12 @@ async function main() {
       return;
     }
     fail("usage", `Unknown command: ${positionals.join(" ")}. Run \`imagegen help\`.`, EXIT_USAGE);
-  } catch (error) {
-    if (error instanceof ProviderError) fail("provider", `${error.kind}: ${error.message}`, EXIT_PROVIDER);
-    fail("provider", error instanceof Error ? error.message : String(error), EXIT_PROVIDER);
+  } catch (error2) {
+    if (error2 instanceof ProviderError) {
+      const exit = error2.kind === "auth" ? EXIT_AUTH : error2.kind === "usage" || error2.kind === "configuration" ? EXIT_USAGE : error2.kind === "io" ? EXIT_IO : EXIT_PROVIDER;
+      fail(error2.kind, error2.message, exit, errorDetails(error2));
+    }
+    fail("provider", error2 instanceof Error ? error2.message : String(error2), EXIT_PROVIDER);
   }
 }
 await main();