@earendil-works/pi-ai 0.80.5 → 0.80.7

package/dist/utils/oauth/radius.js

@@ -0,0 +1,415 @@
+/**
+ * Radius gateway OAuth flow and model catalog loading.
+ *
+ * Radius is a pi-messages gateway. OAuth endpoints are discovered from the
+ * gateway (`/v1/oauth`); the model catalog comes from `/v1/config` and is
+ * cached on the stored credential (`gatewayConfig`) so models are available
+ * at startup and refreshed whenever the token refreshes.
+ *
+ * NOTE: This module uses node:http for the OAuth callback server.
+ * It is only intended for CLI use, not browser environments.
+ */
+// NEVER convert to top-level imports - breaks browser/Vite builds
+let _http = null;
+if (typeof process !== "undefined" && (process.versions?.node || process.versions?.bun)) {
+    import("node:http").then((m) => {
+        _http = m;
+    });
+}
+import { pollOAuthDeviceCodeFlow } from "./device-code.js";
+import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
+import { generatePKCE } from "./pkce.js";
+export const DEFAULT_RADIUS_GATEWAY = "https://radius.pi.dev";
+const CALLBACK_HOST = "127.0.0.1";
+const CALLBACK_PORT = 1456;
+const CALLBACK_PATH = "/oauth/callback";
+const REDIRECT_URI = `http://${CALLBACK_HOST}:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const TOKEN_EXPIRY_SKEW_MS = 60_000;
+const LOGIN_METHOD_BROWSER = "browser";
+const LOGIN_METHOD_DEVICE_CODE = "device-code";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeRadiusGatewayUrl(value) {
+    const withScheme = /^https?:\/\//iu.test(value) ? value : `https://${value}`;
+    return withScheme.replace(/\/+$/u, "");
+}
+// The gateway is a trusted first-party service. The shape checks below only
+// guard against version skew and stale credential caches: malformed entries
+// are dropped rather than failing the whole catalog, and nested fields (e.g.
+// `input` members, `cost` rates) are intentionally not validated in depth.
+// Do not turn this into strict validation.
+function isRadiusGatewayModel(value) {
+    if (!isRecord(value)) {
+        return false;
+    }
+    return (typeof value.id === "string" &&
+        typeof value.name === "string" &&
+        typeof value.reasoning === "boolean" &&
+        Array.isArray(value.input) &&
+        isRecord(value.cost) &&
+        typeof value.contextWindow === "number" &&
+        typeof value.maxTokens === "number");
+}
+function sanitizeRadiusGatewayConfig(config) {
+    if (!isRecord(config)) {
+        return undefined;
+    }
+    const baseUrl = config.baseUrl;
+    const models = config.models;
+    if (typeof baseUrl !== "string" || !Array.isArray(models)) {
+        return undefined;
+    }
+    return {
+        baseUrl,
+        models: models.filter(isRadiusGatewayModel).map((model) => ({ ...model })),
+    };
+}
+function getRadiusCredentialConfig(credentials) {
+    return sanitizeRadiusGatewayConfig(credentials?.gatewayConfig);
+}
+function truncateHttpBody(body) {
+    const trimmed = body.trim();
+    return trimmed.length > 512 ? `${trimmed.slice(0, 512)}…` : trimmed;
+}
+async function loadRadiusGatewayConfig(gateway, apiKey) {
+    const headers = { accept: "application/json" };
+    if (apiKey) {
+        headers.authorization = `Bearer ${apiKey}`;
+    }
+    const response = await fetch(new URL("/v1/config", gateway), { headers });
+    if (!response.ok) {
+        throw new Error(`Could not load Radius config from ${gateway}: ${response.status}: ${truncateHttpBody(await response.text())}`);
+    }
+    const config = sanitizeRadiusGatewayConfig(await response.json());
+    if (!config) {
+        throw new Error(`Invalid Radius config from ${gateway}`);
+    }
+    return config;
+}
+async function loadRadiusOAuthConfig(gateway) {
+    const response = await fetch(new URL("/v1/oauth", gateway), {
+        headers: { accept: "application/json" },
+    });
+    if (!response.ok) {
+        throw new Error(`Could not load Radius OAuth config from ${gateway}: ${response.status} ${await response.text()}`);
+    }
+    return (await response.json());
+}
+class OAuthResponseError extends Error {
+    status;
+    oauthError;
+    constructor(status, oauthError, description, message) {
+        const detail = oauthError
+            ? description
+                ? `${oauthError}: ${description}`
+                : oauthError
+            : description || String(status);
+        super(`${message}: ${detail}`);
+        this.status = status;
+        this.oauthError = oauthError;
+    }
+}
+async function readOAuthResponseError(response, message) {
+    const text = await response.text().catch(() => "");
+    let oauthError;
+    let description;
+    if (text) {
+        try {
+            const data = JSON.parse(text);
+            oauthError = typeof data.error === "string" ? data.error : undefined;
+            description = typeof data.error_description === "string" ? data.error_description : undefined;
+        }
+        catch {
+            description = text;
+        }
+    }
+    return new OAuthResponseError(response.status, oauthError, description, message);
+}
+async function requestOAuthToken(oauth, body, signal) {
+    let response;
+    try {
+        response = await fetch(oauth.tokenEndpoint, {
+            method: "POST",
+            headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+            body,
+            signal,
+        });
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            throw new Error("Login cancelled");
+        }
+        throw error;
+    }
+    if (!response.ok) {
+        throw await readOAuthResponseError(response, "Radius OAuth token request failed");
+    }
+    const data = (await response.json());
+    return {
+        access: data.access_token,
+        refresh: data.refresh_token,
+        expires: Date.now() + data.expires_in * 1000 - TOKEN_EXPIRY_SKEW_MS,
+        scope: data.scope,
+    };
+}
+function startOAuthCallbackServer(expectedState, signal) {
+    if (!_http) {
+        throw new Error("Radius OAuth is only available in Node.js environments");
+    }
+    let settle = () => { };
+    let settled = false;
+    const wait = new Promise((resolve) => {
+        settle = resolve;
+    });
+    const finish = (code) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        signal?.removeEventListener("abort", onAbort);
+        settle(code);
+    };
+    const onAbort = () => finish(null);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const sendPage = (response, status, html) => {
+        response.statusCode = status;
+        response.setHeader("content-type", "text/html; charset=utf-8");
+        response.end(html);
+    };
+    const server = _http.createServer((request, response) => {
+        const url = new URL(request.url ?? "/", REDIRECT_URI);
+        if (url.pathname !== CALLBACK_PATH) {
+            sendPage(response, 404, oauthErrorHtml("Callback route not found."));
+            return;
+        }
+        if (url.searchParams.get("state") !== expectedState) {
+            sendPage(response, 400, oauthErrorHtml("OAuth state mismatch."));
+            return;
+        }
+        const error = url.searchParams.get("error");
+        if (error) {
+            sendPage(response, 400, oauthErrorHtml(url.searchParams.get("error_description") ?? error));
+            finish(null);
+            return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code) {
+            sendPage(response, 400, oauthErrorHtml("Missing authorization code."));
+            return;
+        }
+        sendPage(response, 200, oauthSuccessHtml("Signed in to Radius. You may now close this page."));
+        finish(code);
+    });
+    return new Promise((resolve) => {
+        server
+            .listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+            resolve({
+                waitForCode: () => wait,
+                close: () => {
+                    finish(null);
+                    server.close();
+                },
+            });
+        })
+            .once("error", () => {
+            finish(null);
+            resolve({ waitForCode: async () => null, close: () => { } });
+        });
+    });
+}
+async function loginWithBrowser(oauth, callbacks) {
+    const { verifier, challenge } = await generatePKCE();
+    const state = crypto.randomUUID();
+    const authorizeUrl = new URL(oauth.authorizationEndpoint);
+    authorizeUrl.search = new URLSearchParams({
+        response_type: "code",
+        client_id: oauth.clientId,
+        redirect_uri: REDIRECT_URI,
+        scope: oauth.scope,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        handoff: "url",
+        state,
+    }).toString();
+    const callbackServer = await startOAuthCallbackServer(state, callbacks.signal);
+    callbacks.onProgress?.(`Listening for OAuth callback on ${REDIRECT_URI}`);
+    callbacks.onAuth({
+        url: authorizeUrl.toString(),
+        instructions: "Continue in your browser.",
+    });
+    try {
+        const code = await callbackServer.waitForCode();
+        if (!code) {
+            if (callbacks.signal?.aborted) {
+                throw new Error("Login cancelled");
+            }
+            throw new Error("OAuth callback did not complete.");
+        }
+        return await requestOAuthToken(oauth, new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: oauth.clientId,
+            redirect_uri: REDIRECT_URI,
+            code,
+            code_verifier: verifier,
+        }), callbacks.signal);
+    }
+    finally {
+        callbackServer.close();
+    }
+}
+async function requestDeviceAuthorization(oauth, signal) {
+    let response;
+    try {
+        response = await fetch(oauth.deviceAuthorizationEndpoint, {
+            method: "POST",
+            headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ client_id: oauth.clientId, scope: oauth.scope }),
+            signal,
+        });
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            throw new Error("Login cancelled");
+        }
+        throw error;
+    }
+    if (!response.ok) {
+        throw await readOAuthResponseError(response, "Radius OAuth device authorization failed");
+    }
+    const data = (await response.json());
+    if (!data.device_code || !data.user_code || !data.expires_in) {
+        throw new Error("Radius OAuth device authorization response is missing required fields");
+    }
+    return {
+        device_code: data.device_code,
+        user_code: data.user_code,
+        verification_uri: data.verification_uri,
+        verification_uri_complete: data.verification_uri_complete,
+        expires_in: data.expires_in,
+        interval: data.interval,
+    };
+}
+async function loginWithDeviceCode(oauth, callbacks) {
+    const device = await requestDeviceAuthorization(oauth, callbacks.signal);
+    callbacks.onDeviceCode({
+        userCode: device.user_code,
+        verificationUri: device.verification_uri || oauth.verificationEndpoint,
+        intervalSeconds: device.interval,
+        expiresInSeconds: device.expires_in,
+    });
+    return pollOAuthDeviceCodeFlow({
+        intervalSeconds: device.interval,
+        expiresInSeconds: device.expires_in,
+        signal: callbacks.signal,
+        poll: async () => {
+            try {
+                const credentials = await requestOAuthToken(oauth, new URLSearchParams({
+                    grant_type: oauth.deviceCodeGrantType,
+                    client_id: oauth.clientId,
+                    device_code: device.device_code,
+                }), callbacks.signal);
+                return { status: "complete", value: credentials };
+            }
+            catch (error) {
+                if (!(error instanceof OAuthResponseError)) {
+                    throw error;
+                }
+                switch (error.oauthError) {
+                    case "authorization_pending":
+                        return { status: "pending" };
+                    case "slow_down":
+                        return { status: "slow_down" };
+                    case "expired_token":
+                        return { status: "failed", message: "Device authorization expired." };
+                    case "access_denied":
+                        return { status: "failed", message: "Device authorization was denied." };
+                    default:
+                        throw error;
+                }
+            }
+        },
+    });
+}
+async function attachGatewayConfig(gateway, credentials, previous) {
+    try {
+        const config = await loadRadiusGatewayConfig(gateway, credentials.access);
+        return { ...credentials, gatewayConfig: config };
+    }
+    catch (error) {
+        // Keep the previous catalog so models do not vanish on transient
+        // config failures; the next token refresh retries.
+        const previousConfig = getRadiusCredentialConfig(previous);
+        if (previousConfig) {
+            return { ...credentials, gatewayConfig: previousConfig };
+        }
+        // No catalog to retain (e.g. initial login): fail loudly instead of
+        // completing a sign-in that would register no models.
+        throw error;
+    }
+}
+export function createRadiusOAuthProvider(options) {
+    const gateway = normalizeRadiusGatewayUrl(options.gateway);
+    return {
+        id: options.id,
+        name: options.name,
+        async login(callbacks) {
+            const oauth = await loadRadiusOAuthConfig(gateway);
+            const loginMethod = await callbacks.onSelect({
+                message: `Sign in to ${options.name}:`,
+                options: [
+                    { id: LOGIN_METHOD_BROWSER, label: "Sign in with browser (recommended)" },
+                    {
+                        id: LOGIN_METHOD_DEVICE_CODE,
+                        label: "Sign in with device code (when signing in from another device)",
+                    },
+                ],
+            });
+            if (!loginMethod) {
+                throw new Error("Login cancelled");
+            }
+            let credentials;
+            if (loginMethod === LOGIN_METHOD_DEVICE_CODE) {
+                credentials = await loginWithDeviceCode(oauth, callbacks);
+            }
+            else if (loginMethod === LOGIN_METHOD_BROWSER) {
+                credentials = await loginWithBrowser(oauth, callbacks);
+            }
+            else {
+                throw new Error(`Unknown ${options.name} sign-in method: ${loginMethod}`);
+            }
+            return attachGatewayConfig(gateway, credentials);
+        },
+        async refreshToken(credentials) {
+            const oauth = await loadRadiusOAuthConfig(gateway);
+            const refreshed = await requestOAuthToken(oauth, new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: oauth.clientId,
+                refresh_token: credentials.refresh,
+            }));
+            return attachGatewayConfig(gateway, refreshed, credentials);
+        },
+        getApiKey(credentials) {
+            return credentials.access;
+        },
+        modifyModels(models, credentials) {
+            const config = getRadiusCredentialConfig(credentials);
+            if (!config) {
+                return models;
+            }
+            // Keep models already registered for this provider (e.g. models.json
+            // custom entries) and add catalog models that are not present.
+            const existingIds = new Set(models.filter((model) => model.provider === options.id).map((model) => model.id));
+            const added = config.models
+                .filter((model) => !existingIds.has(model.id))
+                .map((model) => ({
+                ...model,
+                api: "pi-messages",
+                provider: options.id,
+                baseUrl: config.baseUrl,
+            }));
+            return [...models, ...added];
+        },
+    };
+}
+//# sourceMappingURL=radius.js.map

package/dist/utils/oauth/radius.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"radius.js","sourceRoot":"","sources":["../../../src/utils/oauth/radius.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kEAAkE;AAClE,IAAI,KAAK,GAAsC,IAAI,CAAC;AACpD,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;IACzF,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/B,KAAK,GAAG,CAAC,CAAC;IAAA,CACV,CAAC,CAAC;AACJ,CAAC;AAGD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAE9D,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,YAAY,GAAG,UAAU,aAAa,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;AAChF,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AA4C/C,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAU;IACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;IAC7E,OAAO,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAAA,CACvC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,2CAA2C;AAC3C,SAAS,oBAAoB,CAAC,KAAc,EAA+B;IAC1E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACN,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS;QACpC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACnC,CAAC;AAAA,CACF;AAED,SAAS,2BAA2B,CAAC,MAAe,EAAmC;IACtF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KAC1E,CAAC;AAAA,CACF;AAED,SAAS,yBAAyB,CAAC,WAAyC,EAAmC;IAC9G,OAAO,2BAA2B,CAAE,WAAkD,EAAE,aAAa,CAAC,CAAC;AAAA,CACvG;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAU;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AAAA,CACpE;AAED,KAAK,UAAU,uBAAuB,CAAC,OAAe,EAAE,MAAe,EAAgC;IACtG,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACvE,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,qCAAqC,OAAO,KAAK,QAAQ,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAC9G,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAA8B;IACjF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE;QAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,2CAA2C,OAAO,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CACjG,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;AAAA,CACpD;AAED,MAAM,kBAAmB,SAAQ,KAAK;IAC5B,MAAM,CAAS;IACf,UAAU,CAAU;IAE7B,YAAY,MAAc,EAAE,UAA8B,EAAE,WAA+B,EAAE,OAAe,EAAE;QAC7G,MAAM,MAAM,GAAG,UAAU;YACxB,CAAC,CAAC,WAAW;gBACZ,CAAC,CAAC,GAAG,UAAU,KAAK,WAAW,EAAE;gBACjC,CAAC,CAAC,UAAU;YACb,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAAA,CAC7B;CACD;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAkB,EAAE,OAAe,EAA+B;IACvG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,UAA8B,CAAC;IACnC,IAAI,WAA+B,CAAC;IAEpC,IAAI,IAAI,EAAE,CAAC;QACV,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqD,CAAC;YAClF,UAAU,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,WAAW,GAAG,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACR,WAAW,GAAG,IAAI,CAAC;QACpB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAAA,CACjF;AAED,KAAK,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,IAAqB,EACrB,MAAoB,EACQ;IAC5B,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,IAAI;YACJ,MAAM;SACN,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,sBAAsB,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;IAEF,OAAO;QACN,MAAM,EAAE,IAAI,CAAC,YAAY;QACzB,OAAO,EAAE,IAAI,CAAC,aAAa;QAC3B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,oBAAoB;QACnE,KAAK,EAAE,IAAI,CAAC,KAAK;KACjB,CAAC;AAAA,CACF;AAOD,SAAS,wBAAwB,CAChC,aAAqB,EACrB,MAA+B,EACA;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,MAAM,GAAkC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,MAAM,GAAG,OAAO,CAAC;IAAA,CACjB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACb,OAAO;QACR,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC;IAAA,CACb,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,CAAC,QAA4C,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE,CAAC;QAChG,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;QAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC/D,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAAA,CACnB,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACpC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACrE,OAAO;QACR,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,aAAa,EAAE,CAAC;YACrD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACjE,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;YAC5F,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO;QACR,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACvE,OAAO;QACR,CAAC;QAED,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC,CAAC;IAAA,CACb,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM;aACJ,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;YAC3C,OAAO,CAAC;gBACP,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI;gBACvB,KAAK,EAAE,GAAG,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,CAAC;oBACb,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAA,CACf;aACD,CAAC,CAAC;QAAA,CACH,CAAC;aACD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAC,CAAC,EAAE,CAAC,CAAC;QAAA,CAC5D,CAAC,CAAC;IAAA,CACJ,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAwB,EAAE,SAA8B,EAA6B;IACpH,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC1D,YAAY,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;QACzC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,YAAY,EAAE,YAAY;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,OAAO,EAAE,KAAK;QACd,KAAK;KACL,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/E,SAAS,CAAC,UAAU,EAAE,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAC;IAC1E,SAAS,CAAC,MAAM,CAAC;QAChB,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC5B,YAAY,EAAE,2BAA2B;KACzC,CAAC,CAAC;IAEH,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,iBAAiB,CAC7B,KAAK,EACL,IAAI,eAAe,CAAC;YACnB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,YAAY,EAAE,YAAY;YAC1B,IAAI;YACJ,aAAa,EAAE,QAAQ;SACvB,CAAC,EACF,SAAS,CAAC,MAAM,CAChB,CAAC;IACH,CAAC;YAAS,CAAC;QACV,cAAc,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AAAA,CACD;AAED,KAAK,UAAU,0BAA0B,CACxC,KAAwB,EACxB,MAA+B,EACQ;IACvC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,2BAA2B,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5E,MAAM;SACN,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,sBAAsB,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,yBAAyB,EAAE,IAAI,CAAC,yBAAyB;QACzD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACvB,CAAC;AAAA,CACF;AAED,KAAK,UAAU,mBAAmB,CACjC,KAAwB,EACxB,SAA8B,EACF;IAC5B,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,SAAS,CAAC,YAAY,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,oBAAoB;QACtE,eAAe,EAAE,MAAM,CAAC,QAAQ;QAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACnC,CAAC,CAAC;IAEH,OAAO,uBAAuB,CAAmB;QAChD,eAAe,EAAE,MAAM,CAAC,QAAQ;QAChC,gBAAgB,EAAE,MAAM,CAAC,UAAU;QACnC,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC;gBACJ,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAC1C,KAAK,EACL,IAAI,eAAe,CAAC;oBACnB,UAAU,EAAE,KAAK,CAAC,mBAAmB;oBACrC,SAAS,EAAE,KAAK,CAAC,QAAQ;oBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;iBAC/B,CAAC,EACF,SAAS,CAAC,MAAM,CAChB,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC,EAAE,CAAC;oBAC5C,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,QAAQ,KAAK,CAAC,UAAU,EAAE,CAAC;oBAC1B,KAAK,uBAAuB;wBAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBAC9B,KAAK,WAAW;wBACf,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;oBAChC,KAAK,eAAe;wBACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;oBACvE,KAAK,eAAe;wBACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;oBAC1E;wBACC,MAAM,KAAK,CAAC;gBACd,CAAC;YACF,CAAC;QAAA,CACD;KACD,CAAC,CAAC;AAAA,CACH;AAED,KAAK,UAAU,mBAAmB,CACjC,OAAe,EACf,WAA6B,EAC7B,QAA2B,EACO;IAClC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1E,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,iEAAiE;QACjE,mDAAmD;QACnD,MAAM,cAAc,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,GAAG,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;QAC1D,CAAC;QACD,oEAAoE;QACpE,sDAAsD;QACtD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAQD,MAAM,UAAU,yBAAyB,CAAC,OAAmC,EAA0B;IACtG,MAAM,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3D,OAAO;QACN,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAElB,KAAK,CAAC,KAAK,CAAC,SAA8B,EAA6B;YACtE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC;gBAC5C,OAAO,EAAE,cAAc,OAAO,CAAC,IAAI,GAAG;gBACtC,OAAO,EAAE;oBACR,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oCAAoC,EAAE;oBACzE;wBACC,EAAE,EAAE,wBAAwB;wBAC5B,KAAK,EAAE,gEAAgE;qBACvE;iBACD;aACD,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,WAA6B,CAAC;YAClC,IAAI,WAAW,KAAK,wBAAwB,EAAE,CAAC;gBAC9C,WAAW,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,WAAW,KAAK,oBAAoB,EAAE,CAAC;gBACjD,WAAW,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,IAAI,oBAAoB,WAAW,EAAE,CAAC,CAAC;YAC3E,CAAC;YAED,OAAO,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAAA,CACjD;QAED,KAAK,CAAC,YAAY,CAAC,WAA6B,EAA6B;YAC5E,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CACxC,KAAK,EACL,IAAI,eAAe,CAAC;gBACnB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,aAAa,EAAE,WAAW,CAAC,OAAO;aAClC,CAAC,CACF,CAAC;YACF,OAAO,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAAA,CAC5D;QAED,SAAS,CAAC,WAA6B,EAAU;YAChD,OAAO,WAAW,CAAC,MAAM,CAAC;QAAA,CAC1B;QAED,YAAY,CAAC,MAAoB,EAAE,WAA6B,EAAgB;YAC/E,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC;YACf,CAAC;YAED,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9G,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM;iBACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;iBAC7C,GAAG,CACH,CAAC,KAAK,EAAE,EAAE,CACT,CAAC;gBACA,GAAG,KAAK;gBACR,GAAG,EAAE,aAAa;gBAClB,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACpB,OAAO,EAAE,MAAM,CAAC,OAAO;aACvB,CAAe,CACjB,CAAC;YAEH,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;QAAA,CAC7B;KACD,CAAC;AAAA,CACF","sourcesContent":["/**\n * Radius gateway OAuth flow and model catalog loading.\n *\n * Radius is a pi-messages gateway. OAuth endpoints are discovered from the\n * gateway (`/v1/oauth`); the model catalog comes from `/v1/config` and is\n * cached on the stored credential (`gatewayConfig`) so models are available\n * at startup and refreshed whenever the token refreshes.\n *\n * NOTE: This module uses node:http for the OAuth callback server.\n * It is only intended for CLI use, not browser environments.\n */\n\n// NEVER convert to top-level imports - breaks browser/Vite builds\nlet _http: typeof import(\"node:http\") | null = null;\nif (typeof process !== \"undefined\" && (process.versions?.node || process.versions?.bun)) {\n\timport(\"node:http\").then((m) => {\n\t\t_http = m;\n\t});\n}\n\nimport type { Api, Model, ThinkingLevelMap } from \"../../types.ts\";\nimport { pollOAuthDeviceCodeFlow } from \"./device-code.ts\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"./oauth-page.ts\";\nimport { generatePKCE } from \"./pkce.ts\";\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from \"./types.ts\";\n\nexport const DEFAULT_RADIUS_GATEWAY = \"https://radius.pi.dev\";\n\nconst CALLBACK_HOST = \"127.0.0.1\";\nconst CALLBACK_PORT = 1456;\nconst CALLBACK_PATH = \"/oauth/callback\";\nconst REDIRECT_URI = `http://${CALLBACK_HOST}:${CALLBACK_PORT}${CALLBACK_PATH}`;\nconst TOKEN_EXPIRY_SKEW_MS = 60_000;\nconst LOGIN_METHOD_BROWSER = \"browser\";\nconst LOGIN_METHOD_DEVICE_CODE = \"device-code\";\n\n/** Model metadata served by the gateway config endpoint. */\nexport type RadiusGatewayModel = {\n\tid: string;\n\tname: string;\n\treasoning: boolean;\n\tthinkingLevelMap?: ThinkingLevelMap;\n\tinput: (\"text\" | \"image\")[];\n\tcost: Model<Api>[\"cost\"];\n\tcontextWindow: number;\n\tmaxTokens: number;\n};\n\nexport type RadiusGatewayConfig = {\n\tbaseUrl: string;\n\tmodels: RadiusGatewayModel[];\n};\n\nexport type RadiusOAuthCredentials = OAuthCredentials & {\n\tgatewayConfig?: RadiusGatewayConfig;\n};\n\ntype RadiusOAuthConfig = {\n\tissuer: string;\n\tauthorizationEndpoint: string;\n\ttokenEndpoint: string;\n\tdeviceAuthorizationEndpoint: string;\n\tdeviceAuthorizationEventsEndpoint: string;\n\tverificationEndpoint: string;\n\tclientId: string;\n\tscope: string;\n\tdeviceCodeGrantType: string;\n};\n\ntype DeviceAuthorizationResponse = {\n\tdevice_code: string;\n\tuser_code: string;\n\tverification_uri?: string;\n\tverification_uri_complete?: string;\n\texpires_in: number;\n\tinterval?: number;\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction normalizeRadiusGatewayUrl(value: string): string {\n\tconst withScheme = /^https?:\\/\\//iu.test(value) ? value : `https://${value}`;\n\treturn withScheme.replace(/\\/+$/u, \"\");\n}\n\n// The gateway is a trusted first-party service. The shape checks below only\n// guard against version skew and stale credential caches: malformed entries\n// are dropped rather than failing the whole catalog, and nested fields (e.g.\n// `input` members, `cost` rates) are intentionally not validated in depth.\n// Do not turn this into strict validation.\nfunction isRadiusGatewayModel(value: unknown): value is RadiusGatewayModel {\n\tif (!isRecord(value)) {\n\t\treturn false;\n\t}\n\treturn (\n\t\ttypeof value.id === \"string\" &&\n\t\ttypeof value.name === \"string\" &&\n\t\ttypeof value.reasoning === \"boolean\" &&\n\t\tArray.isArray(value.input) &&\n\t\tisRecord(value.cost) &&\n\t\ttypeof value.contextWindow === \"number\" &&\n\t\ttypeof value.maxTokens === \"number\"\n\t);\n}\n\nfunction sanitizeRadiusGatewayConfig(config: unknown): RadiusGatewayConfig | undefined {\n\tif (!isRecord(config)) {\n\t\treturn undefined;\n\t}\n\tconst baseUrl = config.baseUrl;\n\tconst models = config.models;\n\tif (typeof baseUrl !== \"string\" || !Array.isArray(models)) {\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\tbaseUrl,\n\t\tmodels: models.filter(isRadiusGatewayModel).map((model) => ({ ...model })),\n\t};\n}\n\nfunction getRadiusCredentialConfig(credentials: OAuthCredentials | undefined): RadiusGatewayConfig | undefined {\n\treturn sanitizeRadiusGatewayConfig((credentials as RadiusOAuthCredentials | undefined)?.gatewayConfig);\n}\n\nfunction truncateHttpBody(body: string): string {\n\tconst trimmed = body.trim();\n\treturn trimmed.length > 512 ? `${trimmed.slice(0, 512)}…` : trimmed;\n}\n\nasync function loadRadiusGatewayConfig(gateway: string, apiKey?: string): Promise<RadiusGatewayConfig> {\n\tconst headers: Record<string, string> = { accept: \"application/json\" };\n\tif (apiKey) {\n\t\theaders.authorization = `Bearer ${apiKey}`;\n\t}\n\n\tconst response = await fetch(new URL(\"/v1/config\", gateway), { headers });\n\tif (!response.ok) {\n\t\tthrow new Error(\n\t\t\t`Could not load Radius config from ${gateway}: ${response.status}: ${truncateHttpBody(await response.text())}`,\n\t\t);\n\t}\n\n\tconst config = sanitizeRadiusGatewayConfig(await response.json());\n\tif (!config) {\n\t\tthrow new Error(`Invalid Radius config from ${gateway}`);\n\t}\n\treturn config;\n}\n\nasync function loadRadiusOAuthConfig(gateway: string): Promise<RadiusOAuthConfig> {\n\tconst response = await fetch(new URL(\"/v1/oauth\", gateway), {\n\t\theaders: { accept: \"application/json\" },\n\t});\n\n\tif (!response.ok) {\n\t\tthrow new Error(\n\t\t\t`Could not load Radius OAuth config from ${gateway}: ${response.status} ${await response.text()}`,\n\t\t);\n\t}\n\n\treturn (await response.json()) as RadiusOAuthConfig;\n}\n\nclass OAuthResponseError extends Error {\n\treadonly status: number;\n\treadonly oauthError?: string;\n\n\tconstructor(status: number, oauthError: string | undefined, description: string | undefined, message: string) {\n\t\tconst detail = oauthError\n\t\t\t? description\n\t\t\t\t? `${oauthError}: ${description}`\n\t\t\t\t: oauthError\n\t\t\t: description || String(status);\n\t\tsuper(`${message}: ${detail}`);\n\t\tthis.status = status;\n\t\tthis.oauthError = oauthError;\n\t}\n}\n\nasync function readOAuthResponseError(response: Response, message: string): Promise<OAuthResponseError> {\n\tconst text = await response.text().catch(() => \"\");\n\tlet oauthError: string | undefined;\n\tlet description: string | undefined;\n\n\tif (text) {\n\t\ttry {\n\t\t\tconst data = JSON.parse(text) as { error?: unknown; error_description?: unknown };\n\t\t\toauthError = typeof data.error === \"string\" ? data.error : undefined;\n\t\t\tdescription = typeof data.error_description === \"string\" ? data.error_description : undefined;\n\t\t} catch {\n\t\t\tdescription = text;\n\t\t}\n\t}\n\n\treturn new OAuthResponseError(response.status, oauthError, description, message);\n}\n\nasync function requestOAuthToken(\n\toauth: RadiusOAuthConfig,\n\tbody: URLSearchParams,\n\tsignal?: AbortSignal,\n): Promise<OAuthCredentials> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(oauth.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { accept: \"application/json\", \"content-type\": \"application/x-www-form-urlencoded\" },\n\t\t\tbody,\n\t\t\tsignal,\n\t\t});\n\t} catch (error) {\n\t\tif (signal?.aborted) {\n\t\t\tthrow new Error(\"Login cancelled\");\n\t\t}\n\t\tthrow error;\n\t}\n\n\tif (!response.ok) {\n\t\tthrow await readOAuthResponseError(response, \"Radius OAuth token request failed\");\n\t}\n\n\tconst data = (await response.json()) as {\n\t\taccess_token: string;\n\t\trefresh_token: string;\n\t\texpires_in: number;\n\t\tscope?: string;\n\t};\n\n\treturn {\n\t\taccess: data.access_token,\n\t\trefresh: data.refresh_token,\n\t\texpires: Date.now() + data.expires_in * 1000 - TOKEN_EXPIRY_SKEW_MS,\n\t\tscope: data.scope,\n\t};\n}\n\ntype OAuthCallbackServer = {\n\twaitForCode(): Promise<string | null>;\n\tclose(): void;\n};\n\nfunction startOAuthCallbackServer(\n\texpectedState: string,\n\tsignal: AbortSignal | undefined,\n): Promise<OAuthCallbackServer> {\n\tif (!_http) {\n\t\tthrow new Error(\"Radius OAuth is only available in Node.js environments\");\n\t}\n\n\tlet settle: (code: string | null) => void = () => {};\n\tlet settled = false;\n\tconst wait = new Promise<string | null>((resolve) => {\n\t\tsettle = resolve;\n\t});\n\tconst finish = (code: string | null) => {\n\t\tif (settled) {\n\t\t\treturn;\n\t\t}\n\t\tsettled = true;\n\t\tsignal?.removeEventListener(\"abort\", onAbort);\n\t\tsettle(code);\n\t};\n\tconst onAbort = () => finish(null);\n\tsignal?.addEventListener(\"abort\", onAbort, { once: true });\n\n\tconst sendPage = (response: import(\"node:http\").ServerResponse, status: number, html: string) => {\n\t\tresponse.statusCode = status;\n\t\tresponse.setHeader(\"content-type\", \"text/html; charset=utf-8\");\n\t\tresponse.end(html);\n\t};\n\n\tconst server = _http.createServer((request, response) => {\n\t\tconst url = new URL(request.url ?? \"/\", REDIRECT_URI);\n\t\tif (url.pathname !== CALLBACK_PATH) {\n\t\t\tsendPage(response, 404, oauthErrorHtml(\"Callback route not found.\"));\n\t\t\treturn;\n\t\t}\n\t\tif (url.searchParams.get(\"state\") !== expectedState) {\n\t\t\tsendPage(response, 400, oauthErrorHtml(\"OAuth state mismatch.\"));\n\t\t\treturn;\n\t\t}\n\n\t\tconst error = url.searchParams.get(\"error\");\n\t\tif (error) {\n\t\t\tsendPage(response, 400, oauthErrorHtml(url.searchParams.get(\"error_description\") ?? error));\n\t\t\tfinish(null);\n\t\t\treturn;\n\t\t}\n\n\t\tconst code = url.searchParams.get(\"code\");\n\t\tif (!code) {\n\t\t\tsendPage(response, 400, oauthErrorHtml(\"Missing authorization code.\"));\n\t\t\treturn;\n\t\t}\n\n\t\tsendPage(response, 200, oauthSuccessHtml(\"Signed in to Radius. You may now close this page.\"));\n\t\tfinish(code);\n\t});\n\n\treturn new Promise((resolve) => {\n\t\tserver\n\t\t\t.listen(CALLBACK_PORT, CALLBACK_HOST, () => {\n\t\t\t\tresolve({\n\t\t\t\t\twaitForCode: () => wait,\n\t\t\t\t\tclose: () => {\n\t\t\t\t\t\tfinish(null);\n\t\t\t\t\t\tserver.close();\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t})\n\t\t\t.once(\"error\", () => {\n\t\t\t\tfinish(null);\n\t\t\t\tresolve({ waitForCode: async () => null, close: () => {} });\n\t\t\t});\n\t});\n}\n\nasync function loginWithBrowser(oauth: RadiusOAuthConfig, callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\tconst { verifier, challenge } = await generatePKCE();\n\tconst state = crypto.randomUUID();\n\tconst authorizeUrl = new URL(oauth.authorizationEndpoint);\n\tauthorizeUrl.search = new URLSearchParams({\n\t\tresponse_type: \"code\",\n\t\tclient_id: oauth.clientId,\n\t\tredirect_uri: REDIRECT_URI,\n\t\tscope: oauth.scope,\n\t\tcode_challenge: challenge,\n\t\tcode_challenge_method: \"S256\",\n\t\thandoff: \"url\",\n\t\tstate,\n\t}).toString();\n\n\tconst callbackServer = await startOAuthCallbackServer(state, callbacks.signal);\n\tcallbacks.onProgress?.(`Listening for OAuth callback on ${REDIRECT_URI}`);\n\tcallbacks.onAuth({\n\t\turl: authorizeUrl.toString(),\n\t\tinstructions: \"Continue in your browser.\",\n\t});\n\n\ttry {\n\t\tconst code = await callbackServer.waitForCode();\n\t\tif (!code) {\n\t\t\tif (callbacks.signal?.aborted) {\n\t\t\t\tthrow new Error(\"Login cancelled\");\n\t\t\t}\n\t\t\tthrow new Error(\"OAuth callback did not complete.\");\n\t\t}\n\t\treturn await requestOAuthToken(\n\t\t\toauth,\n\t\t\tnew URLSearchParams({\n\t\t\t\tgrant_type: \"authorization_code\",\n\t\t\t\tclient_id: oauth.clientId,\n\t\t\t\tredirect_uri: REDIRECT_URI,\n\t\t\t\tcode,\n\t\t\t\tcode_verifier: verifier,\n\t\t\t}),\n\t\t\tcallbacks.signal,\n\t\t);\n\t} finally {\n\t\tcallbackServer.close();\n\t}\n}\n\nasync function requestDeviceAuthorization(\n\toauth: RadiusOAuthConfig,\n\tsignal: AbortSignal | undefined,\n): Promise<DeviceAuthorizationResponse> {\n\tlet response: Response;\n\ttry {\n\t\tresponse = await fetch(oauth.deviceAuthorizationEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { accept: \"application/json\", \"content-type\": \"application/x-www-form-urlencoded\" },\n\t\t\tbody: new URLSearchParams({ client_id: oauth.clientId, scope: oauth.scope }),\n\t\t\tsignal,\n\t\t});\n\t} catch (error) {\n\t\tif (signal?.aborted) {\n\t\t\tthrow new Error(\"Login cancelled\");\n\t\t}\n\t\tthrow error;\n\t}\n\n\tif (!response.ok) {\n\t\tthrow await readOAuthResponseError(response, \"Radius OAuth device authorization failed\");\n\t}\n\n\tconst data = (await response.json()) as Partial<DeviceAuthorizationResponse>;\n\tif (!data.device_code || !data.user_code || !data.expires_in) {\n\t\tthrow new Error(\"Radius OAuth device authorization response is missing required fields\");\n\t}\n\n\treturn {\n\t\tdevice_code: data.device_code,\n\t\tuser_code: data.user_code,\n\t\tverification_uri: data.verification_uri,\n\t\tverification_uri_complete: data.verification_uri_complete,\n\t\texpires_in: data.expires_in,\n\t\tinterval: data.interval,\n\t};\n}\n\nasync function loginWithDeviceCode(\n\toauth: RadiusOAuthConfig,\n\tcallbacks: OAuthLoginCallbacks,\n): Promise<OAuthCredentials> {\n\tconst device = await requestDeviceAuthorization(oauth, callbacks.signal);\n\tcallbacks.onDeviceCode({\n\t\tuserCode: device.user_code,\n\t\tverificationUri: device.verification_uri || oauth.verificationEndpoint,\n\t\tintervalSeconds: device.interval,\n\t\texpiresInSeconds: device.expires_in,\n\t});\n\n\treturn pollOAuthDeviceCodeFlow<OAuthCredentials>({\n\t\tintervalSeconds: device.interval,\n\t\texpiresInSeconds: device.expires_in,\n\t\tsignal: callbacks.signal,\n\t\tpoll: async () => {\n\t\t\ttry {\n\t\t\t\tconst credentials = await requestOAuthToken(\n\t\t\t\t\toauth,\n\t\t\t\t\tnew URLSearchParams({\n\t\t\t\t\t\tgrant_type: oauth.deviceCodeGrantType,\n\t\t\t\t\t\tclient_id: oauth.clientId,\n\t\t\t\t\t\tdevice_code: device.device_code,\n\t\t\t\t\t}),\n\t\t\t\t\tcallbacks.signal,\n\t\t\t\t);\n\t\t\t\treturn { status: \"complete\", value: credentials };\n\t\t\t} catch (error) {\n\t\t\t\tif (!(error instanceof OAuthResponseError)) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tswitch (error.oauthError) {\n\t\t\t\t\tcase \"authorization_pending\":\n\t\t\t\t\t\treturn { status: \"pending\" };\n\t\t\t\t\tcase \"slow_down\":\n\t\t\t\t\t\treturn { status: \"slow_down\" };\n\t\t\t\t\tcase \"expired_token\":\n\t\t\t\t\t\treturn { status: \"failed\", message: \"Device authorization expired.\" };\n\t\t\t\t\tcase \"access_denied\":\n\t\t\t\t\t\treturn { status: \"failed\", message: \"Device authorization was denied.\" };\n\t\t\t\t\tdefault:\n\t\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t});\n}\n\nasync function attachGatewayConfig(\n\tgateway: string,\n\tcredentials: OAuthCredentials,\n\tprevious?: OAuthCredentials,\n): Promise<RadiusOAuthCredentials> {\n\ttry {\n\t\tconst config = await loadRadiusGatewayConfig(gateway, credentials.access);\n\t\treturn { ...credentials, gatewayConfig: config };\n\t} catch (error) {\n\t\t// Keep the previous catalog so models do not vanish on transient\n\t\t// config failures; the next token refresh retries.\n\t\tconst previousConfig = getRadiusCredentialConfig(previous);\n\t\tif (previousConfig) {\n\t\t\treturn { ...credentials, gatewayConfig: previousConfig };\n\t\t}\n\t\t// No catalog to retain (e.g. initial login): fail loudly instead of\n\t\t// completing a sign-in that would register no models.\n\t\tthrow error;\n\t}\n}\n\nexport interface RadiusOAuthProviderOptions {\n\tid: string;\n\tname: string;\n\tgateway: string;\n}\n\nexport function createRadiusOAuthProvider(options: RadiusOAuthProviderOptions): OAuthProviderInterface {\n\tconst gateway = normalizeRadiusGatewayUrl(options.gateway);\n\n\treturn {\n\t\tid: options.id,\n\t\tname: options.name,\n\n\t\tasync login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n\t\t\tconst oauth = await loadRadiusOAuthConfig(gateway);\n\t\t\tconst loginMethod = await callbacks.onSelect({\n\t\t\t\tmessage: `Sign in to ${options.name}:`,\n\t\t\t\toptions: [\n\t\t\t\t\t{ id: LOGIN_METHOD_BROWSER, label: \"Sign in with browser (recommended)\" },\n\t\t\t\t\t{\n\t\t\t\t\t\tid: LOGIN_METHOD_DEVICE_CODE,\n\t\t\t\t\t\tlabel: \"Sign in with device code (when signing in from another device)\",\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t});\n\t\t\tif (!loginMethod) {\n\t\t\t\tthrow new Error(\"Login cancelled\");\n\t\t\t}\n\n\t\t\tlet credentials: OAuthCredentials;\n\t\t\tif (loginMethod === LOGIN_METHOD_DEVICE_CODE) {\n\t\t\t\tcredentials = await loginWithDeviceCode(oauth, callbacks);\n\t\t\t} else if (loginMethod === LOGIN_METHOD_BROWSER) {\n\t\t\t\tcredentials = await loginWithBrowser(oauth, callbacks);\n\t\t\t} else {\n\t\t\t\tthrow new Error(`Unknown ${options.name} sign-in method: ${loginMethod}`);\n\t\t\t}\n\n\t\t\treturn attachGatewayConfig(gateway, credentials);\n\t\t},\n\n\t\tasync refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n\t\t\tconst oauth = await loadRadiusOAuthConfig(gateway);\n\t\t\tconst refreshed = await requestOAuthToken(\n\t\t\t\toauth,\n\t\t\t\tnew URLSearchParams({\n\t\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\t\tclient_id: oauth.clientId,\n\t\t\t\t\trefresh_token: credentials.refresh,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn attachGatewayConfig(gateway, refreshed, credentials);\n\t\t},\n\n\t\tgetApiKey(credentials: OAuthCredentials): string {\n\t\t\treturn credentials.access;\n\t\t},\n\n\t\tmodifyModels(models: Model<Api>[], credentials: OAuthCredentials): Model<Api>[] {\n\t\t\tconst config = getRadiusCredentialConfig(credentials);\n\t\t\tif (!config) {\n\t\t\t\treturn models;\n\t\t\t}\n\n\t\t\t// Keep models already registered for this provider (e.g. models.json\n\t\t\t// custom entries) and add catalog models that are not present.\n\t\t\tconst existingIds = new Set(models.filter((model) => model.provider === options.id).map((model) => model.id));\n\t\t\tconst added = config.models\n\t\t\t\t.filter((model) => !existingIds.has(model.id))\n\t\t\t\t.map(\n\t\t\t\t\t(model) =>\n\t\t\t\t\t\t({\n\t\t\t\t\t\t\t...model,\n\t\t\t\t\t\t\tapi: \"pi-messages\",\n\t\t\t\t\t\t\tprovider: options.id,\n\t\t\t\t\t\t\tbaseUrl: config.baseUrl,\n\t\t\t\t\t\t}) as Model<Api>,\n\t\t\t\t);\n\n\t\t\treturn [...models, ...added];\n\t\t},\n\t};\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@earendil-works/pi-ai",
-	"version": "0.80.5",
+	"version": "0.80.7",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"type": "module",
 	"main": "./dist/index.js",