@duetso/agent 0.2.6 → 0.3.1

package/dist/src/connected-providers/refresh.js

@@ -0,0 +1,72 @@
+import { githubCopilotOAuthProvider } from "@earendil-works/pi-ai/oauth";
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const OPENAI_CODEX_SCOPE = "openid profile email";
+/** Refresh one connected-provider credential using the provider's supported OAuth flow. */
+export async function refreshConnectedCredentials(provider, credentials) {
+    if (provider === "github-copilot") {
+        return githubCopilotOAuthProvider.refreshToken(credentials);
+    }
+    return refreshOpenAICodexCredentials(credentials.refresh);
+}
+/**
+ * Refresh ChatGPT credentials with the scope pi-ai currently omits. OpenAI
+ * rotates refresh tokens, so the caller must replace the stored credential
+ * object with this complete result rather than patching only `access`.
+ */
+export async function refreshOpenAICodexCredentials(refreshToken, fetchImpl = (input, init) => fetch(input, init), now = Date.now) {
+    const response = await fetchImpl(OPENAI_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: OPENAI_CODEX_CLIENT_ID,
+            scope: OPENAI_CODEX_SCOPE,
+        }),
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => "");
+        throw new Error(`OpenAI Codex token refresh failed (${response.status}): ${detail || response.statusText}`);
+    }
+    const value = await response.json();
+    if (!isTokenResponse(value)) {
+        throw new Error("OpenAI Codex token refresh response missing required fields");
+    }
+    const accountId = accountIdFromAccessToken(value.access_token);
+    if (!accountId)
+        throw new Error("Failed to extract accountId from refreshed OpenAI Codex token");
+    return {
+        access: value.access_token,
+        refresh: value.refresh_token,
+        expires: now() + value.expires_in * 1_000,
+        accountId,
+    };
+}
+function isTokenResponse(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const token = value;
+    return (typeof token.access_token === "string" &&
+        typeof token.refresh_token === "string" &&
+        typeof token.expires_in === "number");
+}
+function accountIdFromAccessToken(accessToken) {
+    try {
+        const payload = accessToken.split(".")[1];
+        if (!payload)
+            return undefined;
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        if (decoded === null || typeof decoded !== "object")
+            return undefined;
+        const auth = decoded["https://api.openai.com/auth"];
+        if (auth === null || typeof auth !== "object")
+            return undefined;
+        const accountId = auth.chatgpt_account_id;
+        return typeof accountId === "string" && accountId ? accountId : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/src/connected-providers/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/connected-providers/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAGzE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAIlD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAA6B,EAC7B,WAA6B;IAE7B,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,0BAA0B,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,6BAA6B,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,YAAoB,EACpB,YAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAC3D,MAAoB,IAAI,CAAC,GAAG;IAE5B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,sBAAsB;YACjC,KAAK,EAAE,kBAAkB;SAC1B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,MAAM,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACjG,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,YAAY;QAC1B,OAAO,EAAE,KAAK,CAAC,aAAa;QAC5B,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,KAAK;QACzC,SAAS;KACV,CAAC;AACJ,CAAC;AAQD,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACL,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,IAAI,GAAI,OAAmC,CAAC,6BAA6B,CAAC,CAAC;QACjF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,SAAS,GAAI,IAAgC,CAAC,kBAAkB,CAAC;QACvE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/src/connected-providers/registry.d.ts

@@ -0,0 +1,17 @@
+import { type OAuthProviderInterface } from "@earendil-works/pi-ai/oauth";
+import type { ConnectedProviderId } from "./store.js";
+export interface ConnectedProviderEntry {
+    /** Stable transport id used by pi-ai and the credential store. */
+    id: ConnectedProviderId;
+    /** User-facing subscription name. */
+    label: string;
+    /** Short CLI value accepted by `duet connect`. */
+    alias: string;
+    /** Login modes this provider can run; only device code is valid in a VM. */
+    loginModes: readonly ("device_code" | "browser")[];
+    /** Resolve the active pi-ai implementation, including an env-gated fake issuer. */
+    oauth(): OAuthProviderInterface;
+}
+export declare function connectedProviders(): readonly ConnectedProviderEntry[];
+export declare function resolveConnectedProviderAlias(input: string): ConnectedProviderId | undefined;
+//# sourceMappingURL=registry.d.ts.map

package/dist/src/connected-providers/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,EAAE,EAAE,mBAAmB,CAAC;IACxB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,UAAU,EAAE,SAAS,CAAC,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC;IACnD,mFAAmF;IACnF,KAAK,IAAI,sBAAsB,CAAC;CACjC;AAyBD,wBAAgB,kBAAkB,IAAI,SAAS,sBAAsB,EAAE,CAEtE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAE5F"}

package/dist/src/connected-providers/registry.js

@@ -0,0 +1,30 @@
+import { getOAuthProvider } from "@earendil-works/pi-ai/oauth";
+function oauthProvider(id) {
+    const provider = getOAuthProvider(id);
+    if (!provider)
+        throw new Error(`OAuth provider is not registered: ${id}`);
+    return provider;
+}
+const CONNECTED_PROVIDERS = [
+    {
+        id: "openai-codex",
+        label: "ChatGPT",
+        alias: "chatgpt",
+        loginModes: ["device_code", "browser"],
+        oauth: () => oauthProvider("openai-codex"),
+    },
+    {
+        id: "github-copilot",
+        label: "GitHub Copilot",
+        alias: "copilot",
+        loginModes: ["device_code"],
+        oauth: () => oauthProvider("github-copilot"),
+    },
+];
+export function connectedProviders() {
+    return CONNECTED_PROVIDERS;
+}
+export function resolveConnectedProviderAlias(input) {
+    return CONNECTED_PROVIDERS.find(({ id, alias }) => input === id || input === alias)?.id;
+}
+//# sourceMappingURL=registry.js.map

package/dist/src/connected-providers/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/connected-providers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+B,MAAM,6BAA6B,CAAC;AAgB5F,SAAS,aAAa,CAAC,EAAuB;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,mBAAmB,GAAsC;IAC7D;QACE,EAAE,EAAE,cAAc;QAClB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC;QACtC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC;KAC3C;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,gBAAgB;QACvB,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,CAAC,aAAa,CAAC;QAC3B,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC;KAC7C;CACF,CAAC;AAEF,MAAM,UAAU,kBAAkB;IAChC,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAa;IACzD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;AAC1F,CAAC"}

package/dist/src/connected-providers/store.d.ts

@@ -0,0 +1,41 @@
+import type { OAuthCredentials } from "@earendil-works/pi-ai/oauth";
+export type { OAuthCredentials } from "@earendil-works/pi-ai/oauth";
+export type ConnectedProviderId = "openai-codex" | "github-copilot";
+export type ConnectionEligibility = "unknown" | "eligible" | "plan_ineligible";
+/** Stable precedence for persisted records and connected transport selection. */
+export declare const CONNECTED_PROVIDER_ORDER: readonly ConnectedProviderId[];
+/** Narrow an arbitrary pi-ai provider id to one owned by the connected store. */
+export declare function isConnectedProviderId(provider: string): provider is ConnectedProviderId;
+export interface ConnectionRecord {
+    /** Transport whose subscription these credentials authorize. */
+    provider: ConnectedProviderId;
+    /** Complete pi-ai OAuth token set; refresh replaces this object wholesale. */
+    credentials: OAuthCredentials;
+    /** Epoch milliseconds when the user completed the connection flow. */
+    connectedAt: number;
+    /** Whether the linked subscription passed the provider capability probe. */
+    eligibility: ConnectionEligibility;
+    /** Epoch milliseconds of the latest capability probe, when one has run. */
+    eligibilityCheckedAt?: number;
+    /** Epoch milliseconds of the latest successful credential refresh. */
+    lastRefreshAt?: number;
+}
+export interface ConnectedProviderStore {
+    /** Read every valid record without taking the writer lock. */
+    read(): Promise<ConnectionRecord[]>;
+    /** Read one provider's current record without taking the writer lock. */
+    get(id: ConnectedProviderId): Promise<ConnectionRecord | undefined>;
+    /** Delete one provider while preserving every other valid record. */
+    remove(id: ConnectedProviderId): Promise<void>;
+    /** Locked read-modify-write; mutate receives the current on-disk record. */
+    withLock<T>(id: ConnectedProviderId, mutate: (current: ConnectionRecord | undefined) => Promise<{
+        next?: ConnectionRecord;
+        result: T;
+    }>): Promise<T>;
+}
+export declare const CONNECTED_PROVIDERS_FILE = "connected-providers.json";
+export declare function createConnectedProviderStore(opts?: {
+    homeDir?: string;
+    now?: () => number;
+}): ConnectedProviderStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/src/connected-providers/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAGpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,gBAAgB,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAE/E,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,SAAS,mBAAmB,EAGlE,CAAC;AAEF,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,IAAI,mBAAmB,CAEvF;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,8EAA8E;IAC9E,WAAW,EAAE,gBAAgB,CAAC;IAC9B,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,WAAW,EAAE,qBAAqB,CAAC;IACnC,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,8DAA8D;IAC9D,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACpC,yEAAyE;IACzE,GAAG,CAAC,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACpE,qEAAqE;IACrE,MAAM,CAAC,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,4EAA4E;IAC5E,QAAQ,CAAC,CAAC,EACR,EAAE,EAAE,mBAAmB,EACvB,MAAM,EAAE,CACN,OAAO,EAAE,gBAAgB,GAAG,SAAS,KAClC,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,CAAC,CAAA;KAAE,CAAC,GACnD,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAUnE,wBAAgB,4BAA4B,CAC1C,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GAClD,sBAAsB,CAkGxB"}

package/dist/src/connected-providers/store.js

@@ -0,0 +1,145 @@
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { acquireFileLock, releaseFileLock } from "../file-lock.js";
+/** Stable precedence for persisted records and connected transport selection. */
+export const CONNECTED_PROVIDER_ORDER = [
+    "openai-codex",
+    "github-copilot",
+];
+/** Narrow an arbitrary pi-ai provider id to one owned by the connected store. */
+export function isConnectedProviderId(provider) {
+    return CONNECTED_PROVIDER_ORDER.some((candidate) => candidate === provider);
+}
+export const CONNECTED_PROVIDERS_FILE = "connected-providers.json";
+const STORE_VERSION = 1;
+const LOCK_RETRY_MS = 20;
+export function createConnectedProviderStore(opts = {}) {
+    const duetDir = join(opts.homeDir ?? homedir(), ".duet");
+    const storePath = join(duetDir, CONNECTED_PROVIDERS_FILE);
+    const lockPath = join(duetDir, `${CONNECTED_PROVIDERS_FILE}.lock`);
+    const now = opts.now ?? (() => Date.now());
+    const readDocument = async () => {
+        let raw;
+        try {
+            raw = await readFile(storePath, "utf8");
+        }
+        catch (error) {
+            if (hasCode(error, "ENOENT"))
+                return emptyDocument();
+            warnUnreadable(storePath);
+            return emptyDocument();
+        }
+        try {
+            const value = JSON.parse(raw);
+            if (!isRecord(value) || value.version !== STORE_VERSION || !isRecord(value.connections)) {
+                warnUnreadable(storePath);
+                return emptyDocument();
+            }
+            const connections = {};
+            for (const provider of CONNECTED_PROVIDER_ORDER) {
+                const candidate = value.connections[provider];
+                if (candidate === undefined)
+                    continue;
+                if (isConnectionRecord(candidate, provider))
+                    connections[provider] = candidate;
+                else
+                    console.warn(`Ignoring invalid ${provider} record in ${storePath}.`);
+            }
+            return { version: STORE_VERSION, connections };
+        }
+        catch {
+            warnUnreadable(storePath);
+            return emptyDocument();
+        }
+    };
+    const writeDocument = async (document) => {
+        await mkdir(duetDir, { recursive: true, mode: 0o700 });
+        await chmod(duetDir, 0o700);
+        const tempPath = `${storePath}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(tempPath, `${JSON.stringify(document, null, 2)}\n`, { mode: 0o600 });
+            await chmod(tempPath, 0o600);
+            await rename(tempPath, storePath);
+            await chmod(storePath, 0o600);
+        }
+        catch (error) {
+            await unlink(tempPath).catch(() => undefined);
+            throw error;
+        }
+    };
+    const withLock = async (id, mutate) => {
+        await mkdir(duetDir, { recursive: true, mode: 0o700 });
+        await chmod(duetDir, 0o700);
+        let handle = acquireFileLock(lockPath, { now: now() });
+        while (handle === null) {
+            await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+            handle = acquireFileLock(lockPath, { now: now() });
+        }
+        try {
+            const document = await readDocument();
+            const { next, result } = await mutate(document.connections[id]);
+            if (next === undefined)
+                delete document.connections[id];
+            else {
+                if (!isConnectionRecord(next, id)) {
+                    throw new Error(`Connection record must match lock provider ${id}`);
+                }
+                document.connections[id] = next;
+            }
+            await writeDocument(document);
+            return result;
+        }
+        finally {
+            releaseFileLock(handle);
+        }
+    };
+    return {
+        async read() {
+            const document = await readDocument();
+            return CONNECTED_PROVIDER_ORDER.flatMap((provider) => {
+                const connection = document.connections[provider];
+                return connection ? [connection] : [];
+            });
+        },
+        async get(id) {
+            return (await readDocument()).connections[id];
+        },
+        async remove(id) {
+            await withLock(id, async () => ({ result: undefined }));
+        },
+        withLock,
+    };
+}
+function emptyDocument() {
+    return { version: STORE_VERSION, connections: {} };
+}
+function warnUnreadable(path) {
+    console.warn(`Ignoring corrupt or unsupported connected-provider store at ${path}.`);
+}
+function isConnectionRecord(value, provider) {
+    if (!isRecord(value) || value.provider !== provider || !isRecord(value.credentials))
+        return false;
+    const credentials = value.credentials;
+    return (typeof credentials.access === "string" &&
+        typeof credentials.refresh === "string" &&
+        typeof credentials.expires === "number" &&
+        typeof value.connectedAt === "number" &&
+        isEligibility(value.eligibility) &&
+        isOptionalNumber(value.eligibilityCheckedAt) &&
+        isOptionalNumber(value.lastRefreshAt));
+}
+function isEligibility(value) {
+    return value === "unknown" || value === "eligible" || value === "plan_ineligible";
+}
+function isOptionalNumber(value) {
+    return value === undefined || typeof value === "number";
+}
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+//# sourceMappingURL=store.js.map

package/dist/src/connected-providers/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/connected-providers/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAOnE,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAmC;IACtE,cAAc;IACd,gBAAgB;CACjB,CAAC;AAEF,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAiCD,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,aAAa,GAAG,EAAE,CAAC;AAOzB,MAAM,UAAU,4BAA4B,CAC1C,OAAiD,EAAE;IAEnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,wBAAwB,OAAO,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3C,MAAM,YAAY,GAAG,KAAK,IAA4B,EAAE;QACtD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO,aAAa,EAAE,CAAC;YACrD,cAAc,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACxF,cAAc,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO,aAAa,EAAE,CAAC;YACzB,CAAC;YACD,MAAM,WAAW,GAAiC,EAAE,CAAC;YACrD,KAAK,MAAM,QAAQ,IAAI,wBAAwB,EAAE,CAAC;gBAChD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAS;gBACtC,IAAI,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC;oBAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;;oBAC1E,OAAO,CAAC,IAAI,CAAC,oBAAoB,QAAQ,cAAc,SAAS,GAAG,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,QAAuB,EAAiB,EAAE;QACrE,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAuC,KAAK,EACxD,EAAuB,EACvB,MAEoD,EACxC,EAAE;QACd,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,IAAI,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,OAAO,MAAM,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;YACnE,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;YACtC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YAChE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;iBACnD,CAAC;gBACJ,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE,EAAE,CAAC,CAAC;gBACtE,CAAC;gBACD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;YAClC,CAAC;YACD,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;YACtC,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACnD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,OAAO,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,QAAQ,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,CAAC,IAAI,CAAC,+DAA+D,IAAI,GAAG,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAc,EACd,QAA6B;IAE7B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,OAAO,CACL,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ;QACtC,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ;QACvC,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC;QAChC,gBAAgB,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC5C,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,iBAAiB,CAAC;AACpF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY;IAC3C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1E,CAAC"}

package/dist/src/connected-providers/tokens.d.ts

@@ -0,0 +1,42 @@
+import { type ConnectedProviderId, type ConnectedProviderStore, type ConnectionRecord, type OAuthCredentials } from "./store.js";
+export interface ConnectedTokenManager {
+    /** Load the process-lifetime connection snapshot and seed every still-valid access token. */
+    loadSnapshot(): Promise<readonly ConnectionRecord[]>;
+    /** Refresh all usable providers discovered by the boot snapshot. */
+    ensureFreshTokens(): Promise<void>;
+    /** Return a fresh token, coalescing concurrent refreshes for this provider. */
+    ensureFreshToken(provider: ConnectedProviderId): Promise<string | undefined>;
+    /** Synchronously read a usable access token from the in-process cache. */
+    apiKey(provider: ConnectedProviderId): string | undefined;
+    /** Start a coalesced refresh without making a synchronous caller wait. */
+    refreshInBackground(provider: ConnectedProviderId): void;
+    /** Synchronously read the cached full credential set for a provider. */
+    credentials(provider: ConnectedProviderId): OAuthCredentials | undefined;
+}
+interface ConnectedTokenManagerOptions {
+    /** Durable source of credentials and cross-process refresh serialization. */
+    store: ConnectedProviderStore;
+    /** Clock used for independent provider expiry decisions. */
+    now?: () => number;
+    /** Provider refresh edge, injectable so tests never call live OAuth issuers. */
+    refreshCredentials?: (provider: ConnectedProviderId, credentials: OAuthCredentials) => Promise<OAuthCredentials>;
+}
+/** Build an isolated token cache around a connected-provider store. */
+export declare function createConnectedTokenManager(options: ConnectedTokenManagerOptions): ConnectedTokenManager;
+/**
+ * Run the provider's OAuth model hook against a resolved spec. Copilot
+ * credentials rewrite the endpoint for Enterprise accounts and filter models
+ * the account cannot serve; returns undefined when the account filters the
+ * model out, and the unhooked spec when no credentials are loaded.
+ */
+export declare function applyConnectedModelHook<T extends {
+    id: string;
+}>(provider: ConnectedProviderId, model: T): T | undefined;
+export declare function loadConnectedTokensSnapshot(): Promise<readonly ConnectionRecord[]>;
+export declare function ensureFreshConnectedTokens(): Promise<void>;
+export declare function connectedProviderApiKey(provider: ConnectedProviderId): string | undefined;
+export declare function refreshConnectedTokenInBackground(provider: ConnectedProviderId): void;
+/** Persist reconnect-needed eligibility without deleting or rewriting credentials. */
+export declare function markConnectedProviderReconnectNeeded(provider: ConnectedProviderId): Promise<void>;
+export {};
+//# sourceMappingURL=tokens.d.ts.map

package/dist/src/connected-providers/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/tokens.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,qBAAqB;IACpC,6FAA6F;IAC7F,YAAY,IAAI,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;IACrD,oEAAoE;IACpE,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,+EAA+E;IAC/E,gBAAgB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7E,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAAC;IAC1D,0EAA0E;IAC1E,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACzD,wEAAwE;IACxE,WAAW,CAAC,QAAQ,EAAE,mBAAmB,GAAG,gBAAgB,GAAG,SAAS,CAAC;CAC1E;AAED,UAAU,4BAA4B;IACpC,6EAA6E;IAC7E,KAAK,EAAE,sBAAsB,CAAC;IAC9B,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,CACnB,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,gBAAgB,KAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAID,uEAAuE;AACvE,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,qBAAqB,CAwFvB;AAUD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC9D,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,CAAC,GACP,CAAC,GAAG,SAAS,CASf;AAED,wBAAgB,2BAA2B,IAAI,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAElF;AAED,wBAAgB,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAE1D;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAEzF;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAErF;AAED,sFAAsF;AACtF,wBAAsB,oCAAoC,CACxD,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/src/connected-providers/tokens.js

@@ -0,0 +1,148 @@
+import { refreshConnectedCredentials } from "./refresh.js";
+import { connectedProviders } from "./registry.js";
+import { createConnectedProviderStore, } from "./store.js";
+const REFRESH_SKEW_MS = 60_000;
+/** Build an isolated token cache around a connected-provider store. */
+export function createConnectedTokenManager(options) {
+    const now = options.now ?? Date.now;
+    const refreshCredentials = options.refreshCredentials ?? refreshConnectedCredentials;
+    const cache = new Map();
+    const refreshes = new Map();
+    let bootConnections = [];
+    const isFresh = (credentials) => credentials.expires > now() + REFRESH_SKEW_MS;
+    const ensureFreshToken = (provider) => {
+        const cached = cache.get(provider);
+        if (cached && isFresh(cached))
+            return Promise.resolve(cached.access);
+        const active = refreshes.get(provider);
+        if (active)
+            return active;
+        const pending = options.store
+            .withLock(provider, async (current) => {
+            if (!current)
+                return { result: undefined };
+            if (isFresh(current.credentials)) {
+                return { next: current, result: { credentials: current.credentials } };
+            }
+            let credentials;
+            try {
+                credentials = await refreshCredentials(provider, current.credentials);
+            }
+            catch (error) {
+                if (!isRefreshAuthFailure(error))
+                    throw error;
+                return {
+                    next: {
+                        ...current,
+                        eligibility: "unknown",
+                        eligibilityCheckedAt: now(),
+                    },
+                    result: { error },
+                };
+            }
+            const next = { ...current, credentials, lastRefreshAt: now() };
+            return { next, result: { credentials } };
+        })
+            .then((outcome) => {
+            if (!outcome) {
+                cache.delete(provider);
+                return undefined;
+            }
+            if ("error" in outcome)
+                throw outcome.error;
+            const credentials = outcome.credentials;
+            cache.set(provider, credentials);
+            return credentials.access;
+        })
+            .finally(() => {
+            if (refreshes.get(provider) === pending)
+                refreshes.delete(provider);
+        });
+        refreshes.set(provider, pending);
+        return pending;
+    };
+    return {
+        async loadSnapshot() {
+            bootConnections = await options.store.read();
+            cache.clear();
+            for (const connection of bootConnections) {
+                if (isFresh(connection.credentials))
+                    cache.set(connection.provider, connection.credentials);
+            }
+            return bootConnections;
+        },
+        async ensureFreshTokens() {
+            await Promise.all(bootConnections
+                .filter(({ eligibility }) => eligibility !== "plan_ineligible")
+                // A failed issuer refresh leaves this provider uncached. Synchronous
+                // model resolution then keeps the call on router order instead of
+                // making CLI turn startup fail before fallback can apply.
+                .map(({ provider }) => ensureFreshToken(provider).catch(() => undefined)));
+        },
+        ensureFreshToken,
+        apiKey(provider) {
+            const credentials = cache.get(provider);
+            if (!credentials || !isFresh(credentials))
+                return undefined;
+            return credentials.access;
+        },
+        refreshInBackground(provider) {
+            void ensureFreshToken(provider).catch(() => undefined);
+        },
+        credentials(provider) {
+            return cache.get(provider);
+        },
+    };
+}
+function isRefreshAuthFailure(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /\b401\b|\b403\b|unauthori[sz]ed|invalid.*(?:token|grant)|authentication/i.test(message);
+}
+const connectedStore = createConnectedProviderStore();
+const connectedTokens = createConnectedTokenManager({ store: connectedStore });
+/**
+ * Run the provider's OAuth model hook against a resolved spec. Copilot
+ * credentials rewrite the endpoint for Enterprise accounts and filter models
+ * the account cannot serve; returns undefined when the account filters the
+ * model out, and the unhooked spec when no credentials are loaded.
+ */
+export function applyConnectedModelHook(provider, model) {
+    const credentials = connectedTokens.credentials(provider);
+    if (!credentials)
+        return model;
+    const oauth = connectedProviders()
+        .find((entry) => entry.id === provider)
+        ?.oauth();
+    if (!oauth?.modifyModels)
+        return model;
+    const kept = oauth.modifyModels([model], credentials);
+    return kept.find((entry) => entry.id === model.id);
+}
+export function loadConnectedTokensSnapshot() {
+    return connectedTokens.loadSnapshot();
+}
+export function ensureFreshConnectedTokens() {
+    return connectedTokens.ensureFreshTokens();
+}
+export function connectedProviderApiKey(provider) {
+    return connectedTokens.apiKey(provider);
+}
+export function refreshConnectedTokenInBackground(provider) {
+    connectedTokens.refreshInBackground(provider);
+}
+/** Persist reconnect-needed eligibility without deleting or rewriting credentials. */
+export async function markConnectedProviderReconnectNeeded(provider) {
+    await connectedStore.withLock(provider, async (current) => ({
+        ...(current
+            ? {
+                next: {
+                    ...current,
+                    eligibility: "unknown",
+                    eligibilityCheckedAt: Date.now(),
+                },
+            }
+            : {}),
+        result: undefined,
+    }));
+}
+//# sourceMappingURL=tokens.js.map

package/dist/src/connected-providers/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/connected-providers/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,4BAA4B,GAK7B,MAAM,YAAY,CAAC;AAEpB,MAAM,eAAe,GAAG,MAAM,CAAC;AA+B/B,uEAAuE;AACvE,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,2BAA2B,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,IAAI,eAAe,GAAgC,EAAE,CAAC;IAEtD,MAAM,OAAO,GAAG,CAAC,WAA6B,EAAW,EAAE,CACzD,WAAW,CAAC,OAAO,GAAG,GAAG,EAAE,GAAG,eAAe,CAAC;IAEhD,MAAM,gBAAgB,GAAG,CAAC,QAA6B,EAA+B,EAAE;QACtF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK;aAC1B,QAAQ,CAAiB,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACzE,CAAC;YACD,IAAI,WAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC9C,OAAO;oBACL,IAAI,EAAE;wBACJ,GAAG,OAAO;wBACV,WAAW,EAAE,SAAS;wBACtB,oBAAoB,EAAE,GAAG,EAAE;qBAC5B;oBACD,MAAM,EAAE,EAAE,KAAK,EAAE;iBAClB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAqB,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;YACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;QAC3C,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACvB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC,KAAK,CAAC;YAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACjC,OAAO,WAAW,CAAC,MAAM,CAAC;QAC5B,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO;gBAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACL,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,eAAe,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;gBACzC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,iBAAiB;YACrB,MAAM,OAAO,CAAC,GAAG,CACf,eAAe;iBACZ,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,KAAK,iBAAiB,CAAC;gBAC/D,qEAAqE;gBACrE,kEAAkE;gBAClE,0DAA0D;iBACzD,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAC5E,CAAC;QACJ,CAAC;QACD,gBAAgB;QAChB,MAAM,CAAC,QAAQ;YACb,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC5D,OAAO,WAAW,CAAC,MAAM,CAAC;QAC5B,CAAC;QACD,mBAAmB,CAAC,QAAQ;YAC1B,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,WAAW,CAAC,QAAQ;YAClB,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,0EAA0E,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,cAAc,GAAG,4BAA4B,EAAE,CAAC;AACtD,MAAM,eAAe,GAAG,2BAA2B,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA6B,EAC7B,KAAQ;IAER,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,KAAK,GAAG,kBAAkB,EAAE;SAC/B,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC;QACvC,EAAE,KAAK,EAAE,CAAC;IACZ,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,KAAc,CAAC,EAAE,WAAW,CAAmB,CAAC;IACjF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,OAAO,eAAe,CAAC,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,eAAe,CAAC,iBAAiB,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAA6B;IACnE,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,QAA6B;IAC7E,eAAe,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,QAA6B;IAE7B,MAAM,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1D,GAAG,CAAC,OAAO;YACT,CAAC,CAAC;gBACE,IAAI,EAAE;oBACJ,GAAG,OAAO;oBACV,WAAW,EAAE,SAAkB;oBAC/B,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE;iBACjC;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/src/connected-providers/transport-preference.d.ts

@@ -0,0 +1,26 @@
+import { type RouterProviderName, type TransportName } from "../model-resolution/catalog.js";
+import { type ConnectionRecord } from "./store.js";
+export interface TransportSnapshot {
+    /** Connections present when the CLI process booted; later store edits apply on the next invocation. */
+    connections: readonly Pick<ConnectionRecord, "provider" | "eligibility">[];
+    /**
+     * Router providers with a configured credential. When present, router-order
+     * selection skips unconfigured routers so a fallback never lands on a
+     * backend that cannot authenticate. Absent means "assume all configured"
+     * (explicit pins bypass this check either way).
+     */
+    configuredRouters?: readonly RouterProviderName[];
+}
+export interface TransportChoice {
+    /** Backend selected to carry the requested model. */
+    transport: TransportName;
+    /** Provider-specific model id sent on the selected transport. */
+    modelId: string;
+    /** True when a connected subscription, rather than a metered router, carries the call. */
+    planCovered: boolean;
+    /** Rule that selected this transport. */
+    reason: "connected" | "router_order" | "explicit_pin";
+}
+/** Choose a transport from an immutable boot snapshot without reading env or disk. */
+export declare function chooseTransport(shorthand: string, snapshot: TransportSnapshot): TransportChoice;
+//# sourceMappingURL=transport-preference.d.ts.map

package/dist/src/connected-providers/transport-preference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-preference.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/transport-preference.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAmD,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpG,MAAM,WAAW,iBAAiB;IAChC,uGAAuG;IACvG,WAAW,EAAE,SAAS,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,aAAa,CAAC,EAAE,CAAC;IAC3E;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,SAAS,EAAE,aAAa,CAAC;IACzB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,WAAW,EAAE,OAAO,CAAC;IACrB,yCAAyC;IACzC,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;CACvD;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,eAAe,CAuC/F"}

package/dist/src/connected-providers/transport-preference.js

@@ -0,0 +1,42 @@
+import { PROVIDER_ORDER, transportModelId, } from "../model-resolution/catalog.js";
+import { CONNECTED_PROVIDER_ORDER, isConnectedProviderId } from "./store.js";
+/** Choose a transport from an immutable boot snapshot without reading env or disk. */
+export function chooseTransport(shorthand, snapshot) {
+    const separator = shorthand.indexOf(":");
+    if (separator !== -1) {
+        const transport = shorthand.slice(0, separator);
+        return {
+            transport,
+            modelId: shorthand.slice(separator + 1),
+            planCovered: isConnectedProviderId(transport),
+            reason: "explicit_pin",
+        };
+    }
+    for (const provider of CONNECTED_PROVIDER_ORDER) {
+        const connection = snapshot.connections.find((candidate) => candidate.provider === provider);
+        if (!connection || connection.eligibility === "plan_ineligible")
+            continue;
+        const modelId = transportModelId(provider, shorthand);
+        if (modelId) {
+            return { transport: provider, modelId, planCovered: true, reason: "connected" };
+        }
+    }
+    const routerConfigured = (provider) => snapshot.configuredRouters === undefined || snapshot.configuredRouters.includes(provider);
+    for (const { provider } of PROVIDER_ORDER) {
+        if (!routerConfigured(provider))
+            continue;
+        const modelId = transportModelId(provider, shorthand);
+        if (modelId) {
+            return { transport: provider, modelId, planCovered: false, reason: "router_order" };
+        }
+    }
+    // Unknown names retain resolver.ts's pass-through behavior until it can
+    // produce the existing user-facing "Unknown model shorthand" error.
+    return {
+        transport: PROVIDER_ORDER[0].provider,
+        modelId: shorthand,
+        planCovered: false,
+        reason: "router_order",
+    };
+}
+//# sourceMappingURL=transport-preference.js.map

package/dist/src/connected-providers/transport-preference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-preference.js","sourceRoot":"","sources":["../../../src/connected-providers/transport-preference.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,GAGjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAyB,MAAM,YAAY,CAAC;AAyBpG,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,QAA2B;IAC5E,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAkB,CAAC;QACjE,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACvC,WAAW,EAAE,qBAAqB,CAAC,SAAS,CAAC;YAC7C,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,wBAAwB,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC7F,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,KAAK,iBAAiB;YAAE,SAAS;QAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,QAA4B,EAAW,EAAE,CACjE,QAAQ,CAAC,iBAAiB,KAAK,SAAS,IAAI,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5F,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC1C,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,CAAC,CAAE,CAAC,QAAQ;QACtC,OAAO,EAAE,SAAS;QAClB,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC"}

package/dist/src/core/structured-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"structured-output.d.ts","sourceRoot":"","sources":["../../../src/core/structured-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EAEjB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,IAAI,EAET,KAAK,KAAK,EACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAI/C,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;AAEhF,MAAM,WAAW,uBAAuB,CAAC,YAAY,SAAS,OAAO;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,wBAAsB,wBAAwB,CAAC,YAAY,SAAS,OAAO,EACzE,OAAO,EAAE,uBAAuB,CAAC,YAAY,CAAC,GAC7C,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAuC/B"}
+{"version":3,"file":"structured-output.d.ts","sourceRoot":"","sources":["../../../src/core/structured-output.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,YAAY,EAEjB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,IAAI,EAET,KAAK,KAAK,EACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAK/C,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;AAEhF,MAAM,WAAW,uBAAuB,CAAC,YAAY,SAAS,OAAO;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,wBAAsB,wBAAwB,CAAC,YAAY,SAAS,OAAO,EACzE,OAAO,EAAE,uBAAuB,CAAC,YAAY,CAAC,GAC7C,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CA4C/B"}