@duetso/agent 0.3.0 → 0.3.1

package/dist/src/connected-providers/billing.d.ts

@@ -0,0 +1,6 @@
+import type { Usage } from "@earendil-works/pi-ai";
+import type { TransportName } from "../model-resolution/catalog.js";
+import type { TurnTokenUsage } from "../types/protocol.js";
+/** Return provider usage with subscription-covered prices forced to zero. */
+export declare function usageForTransport(usage: TurnTokenUsage | Usage, provider: TransportName): TurnTokenUsage | Usage;
+//# sourceMappingURL=billing.d.ts.map

package/dist/src/connected-providers/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/billing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAG3D,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,cAAc,GAAG,KAAK,EAC7B,QAAQ,EAAE,aAAa,GACtB,cAAc,GAAG,KAAK,CAMxB"}

package/dist/src/connected-providers/billing.js

@@ -0,0 +1,11 @@
+import { isConnectedProviderId } from "./store.js";
+/** Return provider usage with subscription-covered prices forced to zero. */
+export function usageForTransport(usage, provider) {
+    if (!isConnectedProviderId(provider))
+        return usage;
+    return {
+        ...usage,
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+    };
+}
+//# sourceMappingURL=billing.js.map

package/dist/src/connected-providers/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../../../src/connected-providers/billing.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAC/B,KAA6B,EAC7B,QAAuB;IAEvB,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;KACrE,CAAC;AACJ,CAAC"}

package/dist/src/connected-providers/capability-probe.d.ts

@@ -0,0 +1,17 @@
+import { type Api, type AssistantMessage, type Context, type Model, type ProviderStreamOptions } from "@earendil-works/pi-ai";
+import type { OAuthCredentials } from "@earendil-works/pi-ai/oauth";
+import type { ConnectedProviderId, ConnectionEligibility } from "./store.js";
+export interface CapabilityProbeResult {
+    /** Whether this account can serve plan-covered model traffic. */
+    eligibility: ConnectionEligibility;
+    /** Provider model ids available to the connected account. */
+    servedModelIds: string[];
+    /** Stable redacted reason when eligibility could not be confirmed. */
+    detail?: string;
+}
+export interface CapabilityProbeDependencies {
+    /** Completion edge replaced by deterministic HTTP-status fixtures in tests. */
+    complete?: (model: Model<Api>, context: Context, options?: ProviderStreamOptions) => Promise<AssistantMessage>;
+}
+export declare function probeConnectedProvider(id: ConnectedProviderId, credentials: OAuthCredentials, deps?: CapabilityProbeDependencies): Promise<CapabilityProbeResult>;
+//# sourceMappingURL=capability-probe.d.ts.map

package/dist/src/connected-providers/capability-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-probe.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/capability-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,GAAG,EACR,KAAK,gBAAgB,EACrB,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAK7E,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,WAAW,EAAE,qBAAqB,CAAC;IACnC,6DAA6D;IAC7D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,qBAAqB,KAC5B,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAED,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,mBAAmB,EACvB,WAAW,EAAE,gBAAgB,EAC7B,IAAI,GAAE,2BAAgC,GACrC,OAAO,CAAC,qBAAqB,CAAC,CA8ChC"}

package/dist/src/connected-providers/capability-probe.js

@@ -0,0 +1,92 @@
+import { complete, getModels, } from "@earendil-works/pi-ai";
+import { connectedProviders } from "./registry.js";
+const CHATGPT_SERVED_MODEL_IDS = ["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"];
+const CHATGPT_PROBE_MODEL_ID = "gpt-5.6-luna";
+export async function probeConnectedProvider(id, credentials, deps = {}) {
+    const provider = connectedProviders()
+        .find((entry) => entry.id === id)
+        ?.oauth();
+    if (!provider)
+        return unknown("Provider is not registered.");
+    const catalog = getModels(id);
+    const available = provider.modifyModels?.(catalog, credentials) ?? catalog;
+    const servedModelIds = id === "openai-codex" ? [...CHATGPT_SERVED_MODEL_IDS] : available.map((model) => model.id);
+    const copilotHasNoModels = id === "github-copilot" && hasEmptyAvailableModelIds(credentials);
+    // An ineligible Copilot account filters every model out. Probe a catalog donor
+    // anyway so connect still exercises the transport and observes its stop=error.
+    const model = selectProbeModel(id, available.length > 0 ? available : catalog);
+    if (!model)
+        return unknown("No probe model is available.");
+    let responseStatus;
+    try {
+        const message = await (deps.complete ?? complete)(model, {
+            systemPrompt: "Return one short token.",
+            messages: [{ role: "user", content: "ok", timestamp: Date.now() }],
+        }, {
+            apiKey: provider.getApiKey(credentials),
+            maxTokens: 1,
+            onResponse: (response) => {
+                responseStatus = response.status;
+            },
+        });
+        if (copilotHasNoModels) {
+            return {
+                eligibility: "plan_ineligible",
+                servedModelIds: [],
+                detail: "No models are available for this Copilot plan.",
+            };
+        }
+        // pi-ai transports surface HTTP failures as stopReason "error" instead of
+        // rejecting complete(), so billing classification must run here too.
+        if (message.stopReason === "error")
+            return classifyFailure(responseStatus);
+        return { eligibility: "eligible", servedModelIds };
+    }
+    catch (error) {
+        return classifyFailure(responseStatus ?? errorStatus(error));
+    }
+}
+/**
+ * Only a confirmed billing refusal may mark a plan ineligible; auth failures,
+ * server errors, and network outages stay "unknown" so a transient outage
+ * never persists a false eligibility verdict.
+ */
+function classifyFailure(responseStatus) {
+    if (responseStatus === 402) {
+        return {
+            eligibility: "plan_ineligible",
+            servedModelIds: [],
+            detail: "Provider plan does not cover the probe model.",
+        };
+    }
+    return unknown(responseStatus === undefined
+        ? "Capability probe request failed."
+        : `Capability probe failed with HTTP ${responseStatus}.`);
+}
+function errorStatus(error) {
+    if (error === null || typeof error !== "object" || !("status" in error))
+        return undefined;
+    return typeof error.status === "number" ? error.status : undefined;
+}
+function selectProbeModel(id, available) {
+    if (id === "openai-codex") {
+        const donor = available.find((model) => model.id === "gpt-5.4-mini") ?? available[0];
+        return donor
+            ? { ...donor, id: CHATGPT_PROBE_MODEL_ID, name: CHATGPT_PROBE_MODEL_ID }
+            : undefined;
+    }
+    return available.reduce((cheapest, model) => {
+        if (!cheapest)
+            return model;
+        return model.cost.input + model.cost.output < cheapest.cost.input + cheapest.cost.output
+            ? model
+            : cheapest;
+    }, undefined);
+}
+function hasEmptyAvailableModelIds(credentials) {
+    return Array.isArray(credentials.availableModelIds) && credentials.availableModelIds.length === 0;
+}
+function unknown(detail) {
+    return { eligibility: "unknown", servedModelIds: [], detail };
+}
+//# sourceMappingURL=capability-probe.js.map

package/dist/src/connected-providers/capability-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-probe.js","sourceRoot":"","sources":["../../../src/connected-providers/capability-probe.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,SAAS,GAMV,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,wBAAwB,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,cAAc,CAAU,CAAC;AAC3F,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAoB9C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAuB,EACvB,WAA6B,EAC7B,OAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,kBAAkB,EAAE;SAClC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;QACjC,EAAE,KAAK,EAAE,CAAC;IACZ,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,OAAO,CAAC;IAC3E,MAAM,cAAc,GAClB,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,kBAAkB,GAAG,EAAE,KAAK,gBAAgB,IAAI,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC7F,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAE3D,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAC/C,KAAK,EACL;YACE,YAAY,EAAE,yBAAyB;YACvC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SACnE,EACD;YACE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC;YACvC,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE;gBACvB,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC;YACnC,CAAC;SACF,CACF,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO;gBACL,WAAW,EAAE,iBAAiB;gBAC9B,cAAc,EAAE,EAAE;gBAClB,MAAM,EAAE,gDAAgD;aACzD,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,qEAAqE;QACrE,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO;YAAE,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC;QAC3E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,cAAc,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,cAAkC;IACzD,IAAI,cAAc,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO;YACL,WAAW,EAAE,iBAAiB;YAC9B,cAAc,EAAE,EAAE;YAClB,MAAM,EAAE,+CAA+C;SACxD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CACZ,cAAc,KAAK,SAAS;QAC1B,CAAC,CAAC,kCAAkC;QACpC,CAAC,CAAC,qCAAqC,cAAc,GAAG,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,OAAO,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAS,gBAAgB,CACvB,EAAuB,EACvB,SAAuB;IAEvB,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,cAAc,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;QACrF,OAAO,KAAK;YACV,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE;YACxE,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM;YACtF,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,QAAQ,CAAC;IACf,CAAC,EAAE,SAAS,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB,CAAC,WAA6B;IAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,WAAW,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AAChE,CAAC"}

package/dist/src/connected-providers/fake-issuer.d.ts

@@ -0,0 +1,61 @@
+export declare const FAKE_ISSUER_ENV = "DUET_CONNECT_FAKE_ISSUER_URL";
+/** Concrete RFC-8628 contract imported by both client and issuer conformance tests. */
+export declare const FAKE_ISSUER_WIRE_TABLE: {
+    readonly deviceCode: {
+        readonly method: "POST";
+        readonly path: "/device/code";
+        readonly request: {
+            readonly client_id: "duet-agent:openai-codex";
+            readonly scope: "openid profile email";
+        };
+        readonly response: {
+            readonly device_code: "fixture-device-code";
+            readonly user_code: "ABCD-EFGH";
+            readonly verification_uri: "https://issuer.test/device";
+            readonly interval: 1;
+            readonly expires_in: 600;
+        };
+    };
+    readonly pendingToken: {
+        readonly method: "POST";
+        readonly path: "/token";
+        readonly request: {
+            readonly device_code: "fixture-device-code";
+            readonly grant_type: "urn:ietf:params:oauth:grant-type:device_code";
+        };
+        readonly response: {
+            readonly status: "pending";
+        };
+    };
+    readonly approvedToken: {
+        readonly method: "POST";
+        readonly path: "/token";
+        readonly request: {
+            readonly device_code: "fixture-device-code";
+            readonly grant_type: "urn:ietf:params:oauth:grant-type:device_code";
+        };
+        readonly response: {
+            readonly access_token: "fixture-access-token";
+            readonly refresh_token: "fixture-refresh-token";
+            readonly expires_in: 3600;
+            readonly account_id: "fixture-account";
+        };
+    };
+    readonly refreshToken: {
+        readonly method: "POST";
+        readonly path: "/token";
+        readonly request: {
+            readonly refresh_token: "fixture-refresh-token";
+            readonly grant_type: "refresh_token";
+        };
+        readonly response: {
+            readonly access_token: "fixture-rotated-access-token";
+            readonly refresh_token: "fixture-rotated-refresh-token";
+            readonly expires_in: 3600;
+            readonly account_id: "fixture-account";
+        };
+    };
+};
+/** Registers fake providers through pi-ai only when explicitly enabled. */
+export declare function installFakeIssuerIfConfigured(env?: Record<string, string | undefined>): "installed" | "skipped";
+//# sourceMappingURL=fake-issuer.d.ts.map

package/dist/src/connected-providers/fake-issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-issuer.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/fake-issuer.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,eAAe,iCAAiC,CAAC;AAE9D,uFAAuF;AACvF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+CzB,CAAC;AAqBX,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAC3C,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,WAAW,GAAG,SAAS,CAazB"}

package/dist/src/connected-providers/fake-issuer.js

@@ -0,0 +1,161 @@
+import { pollOAuthDeviceCodeFlow, registerOAuthProvider, } from "@earendil-works/pi-ai/oauth";
+export const FAKE_ISSUER_ENV = "DUET_CONNECT_FAKE_ISSUER_URL";
+/** Concrete RFC-8628 contract imported by both client and issuer conformance tests. */
+export const FAKE_ISSUER_WIRE_TABLE = {
+    deviceCode: {
+        method: "POST",
+        path: "/device/code",
+        request: { client_id: "duet-agent:openai-codex", scope: "openid profile email" },
+        response: {
+            device_code: "fixture-device-code",
+            user_code: "ABCD-EFGH",
+            verification_uri: "https://issuer.test/device",
+            interval: 1,
+            expires_in: 600,
+        },
+    },
+    pendingToken: {
+        method: "POST",
+        path: "/token",
+        request: {
+            device_code: "fixture-device-code",
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        },
+        response: { status: "pending" },
+    },
+    approvedToken: {
+        method: "POST",
+        path: "/token",
+        request: {
+            device_code: "fixture-device-code",
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        },
+        response: {
+            access_token: "fixture-access-token",
+            refresh_token: "fixture-refresh-token",
+            expires_in: 3600,
+            account_id: "fixture-account",
+        },
+    },
+    refreshToken: {
+        method: "POST",
+        path: "/token",
+        request: { refresh_token: "fixture-refresh-token", grant_type: "refresh_token" },
+        response: {
+            access_token: "fixture-rotated-access-token",
+            refresh_token: "fixture-rotated-refresh-token",
+            expires_in: 3600,
+            account_id: "fixture-account",
+        },
+    },
+};
+let installedBaseUrl;
+let installedProviders;
+/** Registers fake providers through pi-ai only when explicitly enabled. */
+export function installFakeIssuerIfConfigured(env = process.env) {
+    const configured = env[FAKE_ISSUER_ENV]?.trim();
+    if (!configured)
+        return "skipped";
+    const baseUrl = configured.replace(/\/+$/, "");
+    if (installedBaseUrl !== baseUrl || !installedProviders) {
+        installedBaseUrl = baseUrl;
+        installedProviders = [
+            createFakeProvider("openai-codex", "ChatGPT", baseUrl),
+            createFakeProvider("github-copilot", "GitHub Copilot", baseUrl),
+        ];
+    }
+    for (const provider of installedProviders)
+        registerOAuthProvider(provider);
+    return "installed";
+}
+function createFakeProvider(id, name, baseUrl) {
+    return {
+        id,
+        name,
+        async login(callbacks) {
+            const device = await postJson(`${baseUrl}/device/code`, {
+                client_id: `duet-agent:${id}`,
+                scope: id === "openai-codex" ? "openid profile email" : "read:user",
+            });
+            callbacks.onDeviceCode({
+                userCode: device.user_code,
+                verificationUri: device.verification_uri,
+                intervalSeconds: device.interval,
+                expiresInSeconds: device.expires_in,
+            });
+            return pollOAuthDeviceCodeFlow({
+                intervalSeconds: device.interval,
+                expiresInSeconds: device.expires_in,
+                signal: callbacks.signal,
+                poll: async () => tokenPollResult(await postJson(`${baseUrl}/token`, {
+                    device_code: device.device_code,
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                })),
+            });
+        },
+        async refreshToken(credentials) {
+            const token = await postJson(`${baseUrl}/token`, {
+                refresh_token: credentials.refresh,
+                grant_type: "refresh_token",
+            });
+            return credentialsFromToken(token, credentials.refresh);
+        },
+        getApiKey(credentials) {
+            return credentials.access;
+        },
+        modifyModels(models) {
+            return models.map((model) => ({
+                ...model,
+                api: "openai-completions",
+                baseUrl,
+                compat: {
+                    ...model.compat,
+                    supportsStore: false,
+                    supportsDeveloperRole: false,
+                    supportsReasoningEffort: false,
+                },
+            }));
+        },
+    };
+}
+function tokenPollResult(response) {
+    if (response.status === "pending" || response.status === "slow_down") {
+        return { status: response.status };
+    }
+    if (response.status === "denied") {
+        return { status: "failed", message: "Device login denied." };
+    }
+    if (response.status === "expired") {
+        return { status: "failed", message: "Device login expired." };
+    }
+    try {
+        return { status: "complete", value: credentialsFromToken(response) };
+    }
+    catch {
+        return { status: "failed", message: "Device token response was malformed." };
+    }
+}
+function credentialsFromToken(response, previousRefresh) {
+    if (typeof response.access_token !== "string" ||
+        typeof response.expires_in !== "number" ||
+        (typeof response.refresh_token !== "string" && previousRefresh === undefined)) {
+        throw new Error("Device token response was malformed.");
+    }
+    return {
+        access: response.access_token,
+        refresh: response.refresh_token ?? previousRefresh,
+        expires: Date.now() + response.expires_in * 1000,
+        ...(response.account_id === undefined ? {} : { accountId: response.account_id }),
+    };
+}
+async function postJson(url, body) {
+    const response = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok)
+        throw new Error(`Fake issuer request failed (${response.status}).`);
+    return (await response.json());
+}
+//# sourceMappingURL=fake-issuer.js.map

package/dist/src/connected-providers/fake-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-issuer.js","sourceRoot":"","sources":["../../../src/connected-providers/fake-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GAGtB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,eAAe,GAAG,8BAA8B,CAAC;AAE9D,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU,EAAE;QACV,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE,SAAS,EAAE,yBAAyB,EAAE,KAAK,EAAE,sBAAsB,EAAE;QAChF,QAAQ,EAAE;YACR,WAAW,EAAE,qBAAqB;YAClC,SAAS,EAAE,WAAW;YACtB,gBAAgB,EAAE,4BAA4B;YAC9C,QAAQ,EAAE,CAAC;YACX,UAAU,EAAE,GAAG;SAChB;KACF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,WAAW,EAAE,qBAAqB;YAClC,UAAU,EAAE,8CAA8C;SAC3D;QACD,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;KAChC;IACD,aAAa,EAAE;QACb,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,WAAW,EAAE,qBAAqB;YAClC,UAAU,EAAE,8CAA8C;SAC3D;QACD,QAAQ,EAAE;YACR,YAAY,EAAE,sBAAsB;YACpC,aAAa,EAAE,uBAAuB;YACtC,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,iBAAiB;SAC9B;KACF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,uBAAuB,EAAE,UAAU,EAAE,eAAe,EAAE;QAChF,QAAQ,EAAE;YACR,YAAY,EAAE,8BAA8B;YAC5C,aAAa,EAAE,+BAA+B;YAC9C,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,iBAAiB;SAC9B;KACF;CACO,CAAC;AAkBX,IAAI,gBAAoC,CAAC;AACzC,IAAI,kBAAiE,CAAC;AAEtE,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B,CAC3C,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,gBAAgB,KAAK,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxD,gBAAgB,GAAG,OAAO,CAAC;QAC3B,kBAAkB,GAAG;YACnB,kBAAkB,CAAC,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC;YACtD,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,kBAAkB;QAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC3E,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CACzB,EAAuB,EACvB,IAAY,EACZ,OAAe;IAEf,OAAO;QACL,EAAE;QACF,IAAI;QACJ,KAAK,CAAC,KAAK,CAAC,SAAS;YACnB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAqB,GAAG,OAAO,cAAc,EAAE;gBAC1E,SAAS,EAAE,cAAc,EAAE,EAAE;gBAC7B,KAAK,EAAE,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,WAAW;aACpE,CAAC,CAAC;YACH,SAAS,CAAC,YAAY,CAAC;gBACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB;gBACxC,eAAe,EAAE,MAAM,CAAC,QAAQ;gBAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;aACpC,CAAC,CAAC;YACH,OAAO,uBAAuB,CAAC;gBAC7B,eAAe,EAAE,MAAM,CAAC,QAAQ;gBAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;gBACnC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,IAAI,EAAE,KAAK,IAAI,EAAE,CACf,eAAe,CACb,MAAM,QAAQ,CAAgB,GAAG,OAAO,QAAQ,EAAE;oBAChD,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,8CAA8C;iBAC3D,CAAC,CACH;aACJ,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,WAAW;YAC5B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAgB,GAAG,OAAO,QAAQ,EAAE;gBAC9D,aAAa,EAAE,WAAW,CAAC,OAAO;gBAClC,UAAU,EAAE,eAAe;aAC5B,CAAC,CAAC;YACH,OAAO,oBAAoB,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,SAAS,CAAC,WAAW;YACnB,OAAO,WAAW,CAAC,MAAM,CAAC;QAC5B,CAAC;QACD,YAAY,CAAC,MAAM;YACjB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC5B,GAAG,KAAK;gBACR,GAAG,EAAE,oBAAoB;gBACzB,OAAO;gBACP,MAAM,EAAE;oBACN,GAAG,KAAK,CAAC,MAAM;oBACf,aAAa,EAAE,KAAK;oBACpB,qBAAqB,EAAE,KAAK;oBAC5B,uBAAuB,EAAE,KAAK;iBAC/B;aACF,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,QAAuB;IAKvB,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAuB,EAAE,eAAwB;IAC7E,IACE,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;QACzC,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;QACvC,CAAC,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,eAAe,KAAK,SAAS,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,YAAY;QAC7B,OAAO,EAAE,QAAQ,CAAC,aAAa,IAAI,eAAgB;QACnD,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI;QAChD,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,GAAW,EAAE,IAA4B;IAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACtF,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACtC,CAAC"}

package/dist/src/connected-providers/fallback-notice.d.ts

@@ -0,0 +1,11 @@
+import type { TransportName } from "../model-resolution/catalog.js";
+import type { ConnectedProviderId } from "./store.js";
+export type TransportFallbackCause = "plan_exhausted" | "auth_failed" | "transport_error";
+/** Own the single user-visible sentence emitted when a connected call falls back. */
+export declare function transportFallbackNotice(input: {
+    provider: ConnectedProviderId;
+    modelName: string;
+    fallbackTransport: TransportName;
+    cause: TransportFallbackCause;
+}): string;
+//# sourceMappingURL=fallback-notice.d.ts.map

package/dist/src/connected-providers/fallback-notice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback-notice.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/fallback-notice.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,aAAa,GAAG,iBAAiB,CAAC;AAE1F,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,aAAa,CAAC;IACjC,KAAK,EAAE,sBAAsB,CAAC;CAC/B,GAAG,MAAM,CAST"}

package/dist/src/connected-providers/fallback-notice.js

@@ -0,0 +1,20 @@
+/** Own the single user-visible sentence emitted when a connected call falls back. */
+export function transportFallbackNotice(input) {
+    const provider = input.provider === "openai-codex" ? "ChatGPT" : "Copilot";
+    const reason = input.cause === "plan_exhausted"
+        ? "plan limit hit"
+        : input.cause === "auth_failed"
+            ? "connection needs attention"
+            : "plan transport unavailable";
+    return `${provider} ${reason} for ${input.modelName} — continuing on ${transportLabel(input.fallbackTransport)}.`;
+}
+function transportLabel(transport) {
+    if (transport === "duet-gateway")
+        return "Duet credits";
+    if (transport === "vercel-ai-gateway")
+        return "Vercel AI Gateway";
+    if (transport === "openrouter")
+        return "OpenRouter";
+    return transport === "openai-codex" ? "ChatGPT plan" : "Copilot plan";
+}
+//# sourceMappingURL=fallback-notice.js.map

package/dist/src/connected-providers/fallback-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback-notice.js","sourceRoot":"","sources":["../../../src/connected-providers/fallback-notice.ts"],"names":[],"mappings":"AAKA,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GACV,KAAK,CAAC,KAAK,KAAK,gBAAgB;QAC9B,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,aAAa;YAC7B,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,4BAA4B,CAAC;IACrC,OAAO,GAAG,QAAQ,IAAI,MAAM,QAAQ,KAAK,CAAC,SAAS,oBAAoB,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC;AACpH,CAAC;AAED,SAAS,cAAc,CAAC,SAAwB;IAC9C,IAAI,SAAS,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IACxD,IAAI,SAAS,KAAK,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IAClE,IAAI,SAAS,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IACpD,OAAO,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;AACxE,CAAC"}

package/dist/src/connected-providers/fallback.d.ts

@@ -0,0 +1,11 @@
+import type { AgentMessage } from "@earendil-works/pi-agent-core";
+import { type TransportChoice, type TransportSnapshot } from "./transport-preference.js";
+import { type ConnectedProviderId } from "./store.js";
+import type { TransportFallbackCause } from "./fallback-notice.js";
+/** Classify only failures eligible for cross-transport fallback. */
+export declare function connectedFallbackCause(message: AgentMessage | undefined): TransportFallbackCause | undefined;
+/** True when a connected failure must terminate because replay is no longer safe. */
+export declare function isPostOutputConnectedFailure(provider: string, message: AgentMessage | undefined, visibleOutput: boolean): boolean;
+/** Select the next transport after treating the failed connection as ineligible. */
+export declare function nextTransportAfterConnectedFailure(provider: ConnectedProviderId, modelId: string, snapshot: TransportSnapshot): TransportChoice | undefined;
+//# sourceMappingURL=fallback.d.ts.map

package/dist/src/connected-providers/fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/fallback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,oEAAoE;AACpE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,YAAY,GAAG,SAAS,GAChC,sBAAsB,GAAG,SAAS,CAWpC;AAED,qFAAqF;AACrF,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,aAAa,EAAE,OAAO,GACrB,OAAO,CAMT;AAED,oFAAoF;AACpF,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,eAAe,GAAG,SAAS,CAW7B"}

package/dist/src/connected-providers/fallback.js

@@ -0,0 +1,37 @@
+import { chooseTransport, } from "./transport-preference.js";
+import { shorthandForTransportModel } from "../model-resolution/catalog.js";
+import { isConnectedProviderId } from "./store.js";
+/** Classify only failures eligible for cross-transport fallback. */
+export function connectedFallbackCause(message) {
+    if (!message || message.role !== "assistant" || message.stopReason !== "error")
+        return undefined;
+    const error = message.errorMessage ?? "";
+    if (/context|prompt is too long|token.*maximum/i.test(error))
+        return undefined;
+    if (/\b401\b|\b403\b|unauthori[sz]ed|invalid.*(?:token|key)|authentication/i.test(error)) {
+        return "auth_failed";
+    }
+    if (/\b402\b|\b429\b|usage limit|plan limit|quota|exhausted|not included/i.test(error)) {
+        return "plan_exhausted";
+    }
+    return "transport_error";
+}
+/** True when a connected failure must terminate because replay is no longer safe. */
+export function isPostOutputConnectedFailure(provider, message, visibleOutput) {
+    return (visibleOutput &&
+        isConnectedProviderId(provider) &&
+        connectedFallbackCause(message) !== undefined);
+}
+/** Select the next transport after treating the failed connection as ineligible. */
+export function nextTransportAfterConnectedFailure(provider, modelId, snapshot) {
+    const shorthand = shorthandForTransportModel(provider, modelId);
+    if (!shorthand)
+        return undefined;
+    const connections = snapshot.connections.some((connection) => connection.provider === provider)
+        ? snapshot.connections.map((connection) => connection.provider === provider
+            ? { ...connection, eligibility: "plan_ineligible" }
+            : connection)
+        : [...snapshot.connections, { provider, eligibility: "plan_ineligible" }];
+    return chooseTransport(shorthand, { ...snapshot, connections });
+}
+//# sourceMappingURL=fallback.js.map

package/dist/src/connected-providers/fallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback.js","sourceRoot":"","sources":["../../../src/connected-providers/fallback.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,GAGhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAA4B,MAAM,YAAY,CAAC;AAG7E,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACjG,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IACzC,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,IAAI,wEAAwE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzF,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,sEAAsE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,OAAiC,EACjC,aAAsB;IAEtB,OAAO,CACL,aAAa;QACb,qBAAqB,CAAC,QAAQ,CAAC;QAC/B,sBAAsB,CAAC,OAAO,CAAC,KAAK,SAAS,CAC9C,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,kCAAkC,CAChD,QAA6B,EAC7B,OAAe,EACf,QAA2B;IAE3B,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC7F,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACtC,UAAU,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,iBAA0B,EAAE;YAC5D,CAAC,CAAC,UAAU,CACf;QACH,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAA0B,EAAE,CAAC,CAAC;IACrF,OAAO,eAAe,CAAC,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/src/connected-providers/refresh.d.ts

@@ -0,0 +1,12 @@
+import type { ConnectedProviderId, OAuthCredentials } from "./store.js";
+type FetchToken = (input: string, init: RequestInit) => Promise<Response>;
+/** Refresh one connected-provider credential using the provider's supported OAuth flow. */
+export declare function refreshConnectedCredentials(provider: ConnectedProviderId, credentials: OAuthCredentials): Promise<OAuthCredentials>;
+/**
+ * Refresh ChatGPT credentials with the scope pi-ai currently omits. OpenAI
+ * rotates refresh tokens, so the caller must replace the stored credential
+ * object with this complete result rather than patching only `access`.
+ */
+export declare function refreshOpenAICodexCredentials(refreshToken: string, fetchImpl?: FetchToken, now?: () => number): Promise<OAuthCredentials>;
+export {};
+//# sourceMappingURL=refresh.d.ts.map

package/dist/src/connected-providers/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/refresh.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAMxE,KAAK,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE1E,2FAA2F;AAC3F,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,gBAAgB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAK3B;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,UAAgD,EAC3D,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CA6B3B"}

package/dist/src/connected-providers/refresh.js

@@ -0,0 +1,72 @@
+import { githubCopilotOAuthProvider } from "@earendil-works/pi-ai/oauth";
+const OPENAI_TOKEN_URL = "https://auth.openai.com/oauth/token";
+const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const OPENAI_CODEX_SCOPE = "openid profile email";
+/** Refresh one connected-provider credential using the provider's supported OAuth flow. */
+export async function refreshConnectedCredentials(provider, credentials) {
+    if (provider === "github-copilot") {
+        return githubCopilotOAuthProvider.refreshToken(credentials);
+    }
+    return refreshOpenAICodexCredentials(credentials.refresh);
+}
+/**
+ * Refresh ChatGPT credentials with the scope pi-ai currently omits. OpenAI
+ * rotates refresh tokens, so the caller must replace the stored credential
+ * object with this complete result rather than patching only `access`.
+ */
+export async function refreshOpenAICodexCredentials(refreshToken, fetchImpl = (input, init) => fetch(input, init), now = Date.now) {
+    const response = await fetchImpl(OPENAI_TOKEN_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: OPENAI_CODEX_CLIENT_ID,
+            scope: OPENAI_CODEX_SCOPE,
+        }),
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => "");
+        throw new Error(`OpenAI Codex token refresh failed (${response.status}): ${detail || response.statusText}`);
+    }
+    const value = await response.json();
+    if (!isTokenResponse(value)) {
+        throw new Error("OpenAI Codex token refresh response missing required fields");
+    }
+    const accountId = accountIdFromAccessToken(value.access_token);
+    if (!accountId)
+        throw new Error("Failed to extract accountId from refreshed OpenAI Codex token");
+    return {
+        access: value.access_token,
+        refresh: value.refresh_token,
+        expires: now() + value.expires_in * 1_000,
+        accountId,
+    };
+}
+function isTokenResponse(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const token = value;
+    return (typeof token.access_token === "string" &&
+        typeof token.refresh_token === "string" &&
+        typeof token.expires_in === "number");
+}
+function accountIdFromAccessToken(accessToken) {
+    try {
+        const payload = accessToken.split(".")[1];
+        if (!payload)
+            return undefined;
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        if (decoded === null || typeof decoded !== "object")
+            return undefined;
+        const auth = decoded["https://api.openai.com/auth"];
+        if (auth === null || typeof auth !== "object")
+            return undefined;
+        const accountId = auth.chatgpt_account_id;
+        return typeof accountId === "string" && accountId ? accountId : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/src/connected-providers/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/connected-providers/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAGzE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAC9D,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAIlD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAA6B,EAC7B,WAA6B;IAE7B,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,0BAA0B,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,6BAA6B,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,YAAoB,EACpB,YAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAC3D,MAAoB,IAAI,CAAC,GAAG;IAE5B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,sBAAsB;YACjC,KAAK,EAAE,kBAAkB;SAC1B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,MAAM,MAAM,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACjG,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,YAAY;QAC1B,OAAO,EAAE,KAAK,CAAC,aAAa;QAC5B,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,KAAK;QACzC,SAAS;KACV,CAAC;AACJ,CAAC;AAQD,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACL,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CACrC,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,IAAI,GAAI,OAAmC,CAAC,6BAA6B,CAAC,CAAC;QACjF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChE,MAAM,SAAS,GAAI,IAAgC,CAAC,kBAAkB,CAAC;QACvE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/src/connected-providers/registry.d.ts

@@ -0,0 +1,17 @@
+import { type OAuthProviderInterface } from "@earendil-works/pi-ai/oauth";
+import type { ConnectedProviderId } from "./store.js";
+export interface ConnectedProviderEntry {
+    /** Stable transport id used by pi-ai and the credential store. */
+    id: ConnectedProviderId;
+    /** User-facing subscription name. */
+    label: string;
+    /** Short CLI value accepted by `duet connect`. */
+    alias: string;
+    /** Login modes this provider can run; only device code is valid in a VM. */
+    loginModes: readonly ("device_code" | "browser")[];
+    /** Resolve the active pi-ai implementation, including an env-gated fake issuer. */
+    oauth(): OAuthProviderInterface;
+}
+export declare function connectedProviders(): readonly ConnectedProviderEntry[];
+export declare function resolveConnectedProviderAlias(input: string): ConnectedProviderId | undefined;
+//# sourceMappingURL=registry.d.ts.map

package/dist/src/connected-providers/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/connected-providers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,sBAAsB;IACrC,kEAAkE;IAClE,EAAE,EAAE,mBAAmB,CAAC;IACxB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,UAAU,EAAE,SAAS,CAAC,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC;IACnD,mFAAmF;IACnF,KAAK,IAAI,sBAAsB,CAAC;CACjC;AAyBD,wBAAgB,kBAAkB,IAAI,SAAS,sBAAsB,EAAE,CAEtE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAE5F"}