@earendil-works/pi-coding-agent 0.84.0 → 0.84.2

package/dist/cli/auth-command.js

@@ -0,0 +1,103 @@
+import { APP_NAME } from "../config.js";
+export class AuthCommandError extends Error {
+}
+const AUTH_COMMAND_USAGE = {
+    check: `${APP_NAME} auth check --provider <provider> [--json] [--credentials] [--no-refresh]`,
+    api_key: `${APP_NAME} auth print-api-key --provider <provider> [--model <model>]`,
+    bearer_token: `${APP_NAME} auth print-bearer-token --provider <provider> [--model <model>] [--min-expiry <duration>]`,
+};
+export function getAuthCommandName(kind) {
+    return kind === "check" ? "auth check" : kind === "api_key" ? "auth print-api-key" : "auth print-bearer-token";
+}
+export function getAuthCommandUsage(kind) {
+    return AUTH_COMMAND_USAGE[kind];
+}
+export function isAuthCommandHelp(args) {
+    return (args[0] === "auth" &&
+        (args[1] === undefined || args[1] === "help" || args.includes("--help") || args.includes("-h")));
+}
+export function printAuthCommandHelp() {
+    console.log(`Usage:
+  pi auth print-api-key [--provider <provider>] [--model <model>]
+  pi auth print-bearer-token [--provider <provider>] [--model <model>] [--min-expiry <duration>]
+  pi auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]
+
+Auth commands require at least one of --provider or --model. Checks refresh expired OAuth credentials by default; --no-refresh prevents this. --credentials emits the credential, or includes it in JSON output.`);
+}
+export function parseAuthCommand(args) {
+    if (args[0] !== "auth")
+        return undefined;
+    const kind = args[1] === "check"
+        ? "check"
+        : args[1] === "print-api-key"
+            ? "api_key"
+            : args[1] === "print-bearer-token"
+                ? "bearer_token"
+                : undefined;
+    if (!kind) {
+        throw new AuthCommandError(`Unknown auth command "${args[1] ?? ""}". Use "${APP_NAME} auth print-api-key", "${APP_NAME} auth print-bearer-token", or "${APP_NAME} auth check".`);
+    }
+    const commandArgs = [];
+    let json = false;
+    let credentials = false;
+    let noRefresh = false;
+    let minExpiryMs;
+    for (let index = 2; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--min-expiry") {
+            if (kind !== "bearer_token")
+                throw new AuthCommandError("--min-expiry is only supported by print-bearer-token");
+            const value = args[++index];
+            const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
+            if (!match)
+                throw new AuthCommandError("--min-expiry must use a duration such as 30m or 1h");
+            const amount = Number(match[1]);
+            const unit = match[2];
+            minExpiryMs = amount * (unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000);
+            continue;
+        }
+        if (arg === "--json" || arg === "--credentials" || arg === "--no-refresh") {
+            if (kind !== "check")
+                throw new AuthCommandError(`${arg} is only supported by auth check`);
+            if (arg === "--json")
+                json = true;
+            else if (arg === "--credentials")
+                credentials = true;
+            else
+                noRefresh = true;
+            continue;
+        }
+        commandArgs.push(arg);
+    }
+    return minExpiryMs === undefined
+        ? { kind, args: commandArgs, json, credentials, noRefresh }
+        : { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };
+}
+export function validateAuthCommandArgs(args, kind) {
+    const provider = args.provider?.trim() || undefined;
+    const model = args.model?.trim() || undefined;
+    if (args.unknownFlags.size > 0) {
+        const option = args.unknownFlags.keys().next().value;
+        throw new AuthCommandError(`Unknown option --${option} for "${getAuthCommandName(kind)}".`);
+    }
+    if (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {
+        throw new AuthCommandError("Auth commands only accept --provider and --model");
+    }
+    if (kind === "check") {
+        if (!provider && !model) {
+            throw new AuthCommandError("Auth checks require --provider <provider> or --model <model>");
+        }
+        return { provider, model };
+    }
+    if (!provider && !model) {
+        throw new AuthCommandError("Credential printing requires --provider <provider> or --model <model>");
+    }
+    return { provider, model };
+}
+export function getAuthCredential(auth) {
+    if (auth?.auth.apiKey)
+        return auth.auth.apiKey;
+    const authorization = Object.entries(auth?.auth.headers ?? {}).find(([name]) => name.toLowerCase() === "authorization")?.[1];
+    return typeof authorization === "string" ? /^Bearer\s+(.+)$/iu.exec(authorization)?.[1] : undefined;
+}
+//# sourceMappingURL=auth-command.js.map

package/dist/cli/auth-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-command.js","sourceRoot":"","sources":["../../src/cli/auth-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAcxC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,MAAM,kBAAkB,GAAoC;IAC3D,KAAK,EAAE,GAAG,QAAQ,2EAA2E;IAC7F,OAAO,EAAE,GAAG,QAAQ,6DAA6D;IACjF,YAAY,EAAE,GAAG,QAAQ,4FAA4F;CACrH,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAqB,EAAU;IACjE,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAAA,CAC/G;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAqB,EAAU;IAClE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAAA,CAChC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAW;IAC1D,OAAO,CACN,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAClB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC/F,CAAC;AAAA,CACF;AAED,MAAM,UAAU,oBAAoB,GAAS;IAC5C,OAAO,CAAC,GAAG,CAAC;;;;;iNAKoM,CAAC,CAAC;AAAA,CAClN;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAA2B;IACzE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GACT,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAClB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB;gBACjC,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACzB,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,QAAQ,0BAA0B,QAAQ,kCAAkC,QAAQ,eAAe,CACpJ,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAA+B,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,cAAc;gBAC1B,MAAM,IAAI,gBAAgB,CAAC,sDAAsD,CAAC,CAAC;YACpF,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,gBAAgB,CAAC,oDAAoD,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtG,SAAS;QACV,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAC3E,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC;YAC3F,IAAI,GAAG,KAAK,QAAQ;gBAAE,IAAI,GAAG,IAAI,CAAC;iBAC7B,IAAI,GAAG,KAAK,eAAe;gBAAE,WAAW,GAAG,IAAI,CAAC;;gBAChD,SAAS,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;QAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAAA,CAC1E;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAU,EAAE,IAAqB,EAAyC;IACjH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,MAAM,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,kDAAkD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,uEAAuE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAAA,CAC3B;AAED,MAAM,UAAU,iBAAiB,CAAC,IAA4B,EAAsB;IACnF,IAAI,IAAI,EAAE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAClD,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACpG","sourcesContent":["import type { AuthResult } from \"@earendil-works/pi-ai\";\nimport { APP_NAME } from \"../config.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type AuthCommandKind = \"check\" | \"api_key\" | \"bearer_token\";\n\nexport interface AuthCommand {\n\tkind: AuthCommandKind;\n\targs: string[];\n\tjson: boolean;\n\tcredentials: boolean;\n\tnoRefresh: boolean;\n\tminExpiryMs?: number;\n}\n\nexport class AuthCommandError extends Error {}\n\nconst AUTH_COMMAND_USAGE: Record<AuthCommandKind, string> = {\n\tcheck: `${APP_NAME} auth check --provider <provider> [--json] [--credentials] [--no-refresh]`,\n\tapi_key: `${APP_NAME} auth print-api-key --provider <provider> [--model <model>]`,\n\tbearer_token: `${APP_NAME} auth print-bearer-token --provider <provider> [--model <model>] [--min-expiry <duration>]`,\n};\n\nexport function getAuthCommandName(kind: AuthCommandKind): string {\n\treturn kind === \"check\" ? \"auth check\" : kind === \"api_key\" ? \"auth print-api-key\" : \"auth print-bearer-token\";\n}\n\nexport function getAuthCommandUsage(kind: AuthCommandKind): string {\n\treturn AUTH_COMMAND_USAGE[kind];\n}\n\nexport function isAuthCommandHelp(args: string[]): boolean {\n\treturn (\n\t\targs[0] === \"auth\" &&\n\t\t(args[1] === undefined || args[1] === \"help\" || args.includes(\"--help\") || args.includes(\"-h\"))\n\t);\n}\n\nexport function printAuthCommandHelp(): void {\n\tconsole.log(`Usage:\n  pi auth print-api-key [--provider <provider>] [--model <model>]\n  pi auth print-bearer-token [--provider <provider>] [--model <model>] [--min-expiry <duration>]\n  pi auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]\n\nAuth commands require at least one of --provider or --model. Checks refresh expired OAuth credentials by default; --no-refresh prevents this. --credentials emits the credential, or includes it in JSON output.`);\n}\n\nexport function parseAuthCommand(args: string[]): AuthCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind =\n\t\targs[1] === \"check\"\n\t\t\t? \"check\"\n\t\t\t: args[1] === \"print-api-key\"\n\t\t\t\t? \"api_key\"\n\t\t\t\t: args[1] === \"print-bearer-token\"\n\t\t\t\t\t? \"bearer_token\"\n\t\t\t\t\t: undefined;\n\tif (!kind) {\n\t\tthrow new AuthCommandError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\", \"${APP_NAME} auth print-bearer-token\", or \"${APP_NAME} auth check\".`,\n\t\t);\n\t}\n\n\tconst commandArgs: string[] = [];\n\tlet json = false;\n\tlet credentials = false;\n\tlet noRefresh = false;\n\tlet minExpiryMs: number | undefined;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (arg === \"--min-expiry\") {\n\t\t\tif (kind !== \"bearer_token\")\n\t\t\t\tthrow new AuthCommandError(\"--min-expiry is only supported by print-bearer-token\");\n\t\t\tconst value = args[++index];\n\t\t\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\t\t\tif (!match) throw new AuthCommandError(\"--min-expiry must use a duration such as 30m or 1h\");\n\t\t\tconst amount = Number(match[1]);\n\t\t\tconst unit = match[2];\n\t\t\tminExpiryMs = amount * (unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000);\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg === \"--json\" || arg === \"--credentials\" || arg === \"--no-refresh\") {\n\t\t\tif (kind !== \"check\") throw new AuthCommandError(`${arg} is only supported by auth check`);\n\t\t\tif (arg === \"--json\") json = true;\n\t\t\telse if (arg === \"--credentials\") credentials = true;\n\t\t\telse noRefresh = true;\n\t\t\tcontinue;\n\t\t}\n\t\tcommandArgs.push(arg);\n\t}\n\n\treturn minExpiryMs === undefined\n\t\t? { kind, args: commandArgs, json, credentials, noRefresh }\n\t\t: { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };\n}\n\nexport function validateAuthCommandArgs(args: Args, kind: AuthCommandKind): { provider?: string; model?: string } {\n\tconst provider = args.provider?.trim() || undefined;\n\tconst model = args.model?.trim() || undefined;\n\tif (args.unknownFlags.size > 0) {\n\t\tconst option = args.unknownFlags.keys().next().value;\n\t\tthrow new AuthCommandError(`Unknown option --${option} for \"${getAuthCommandName(kind)}\".`);\n\t}\n\tif (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {\n\t\tthrow new AuthCommandError(\"Auth commands only accept --provider and --model\");\n\t}\n\tif (kind === \"check\") {\n\t\tif (!provider && !model) {\n\t\t\tthrow new AuthCommandError(\"Auth checks require --provider <provider> or --model <model>\");\n\t\t}\n\t\treturn { provider, model };\n\t}\n\tif (!provider && !model) {\n\t\tthrow new AuthCommandError(\"Credential printing requires --provider <provider> or --model <model>\");\n\t}\n\treturn { provider, model };\n}\n\nexport function getAuthCredential(auth: AuthResult | undefined): string | undefined {\n\tif (auth?.auth.apiKey) return auth.auth.apiKey;\n\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t)?.[1];\n\treturn typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n}\n"]}

package/dist/cli/credential-print.d.ts

@@ -1,23 +1,13 @@
 import type { ModelRuntime } from "../core/model-runtime.ts";
 import type { Args } from "./args.ts";
-export type CredentialPrintKind = "api_key" | "bearer_token";
-export interface CredentialPrintCommand {
-    kind: CredentialPrintKind;
-    args: string[];
-    minExpiryMs?: number;
-}
-export declare class CredentialPrintError extends Error {
-}
-export declare function isCredentialPrintHelp(args: string[]): boolean;
-export declare function printCredentialPrintHelp(): void;
-/** Parse the small, extensible `pi auth` command surface before normal startup. */
-export declare function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined;
-export declare function validateCredentialPrintArgs(args: Args): void;
+import { type AuthCommandKind } from "./auth-command.ts";
+type CredentialPrintKind = Exclude<AuthCommandKind, "check">;
 /**
- * Resolve one request credential for a specific provider/model pair.
+ * Resolve one configured provider credential.
  *
  * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists
  * OAuth credentials with less than five minutes remaining through the normal request-auth path.
  */
 export declare function resolveCredentialForPrint(args: Args, modelRuntime: ModelRuntime, kind: CredentialPrintKind, minExpiryMs?: number, signal?: AbortSignal): Promise<string>;
+export {};
 //# sourceMappingURL=credential-print.d.ts.map

package/dist/cli/credential-print.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,cAAc,CAAC;AAI7D,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAI7D;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAM/C;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,sBAAsB,GAAG,SAAS,CA+B9F;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAU5D;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CA6DjB","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type CredentialPrintKind = \"api_key\" | \"bearer_token\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\nexport interface CredentialPrintCommand {\n\tkind: CredentialPrintKind;\n\targs: string[];\n\tminExpiryMs?: number;\n}\n\nexport class CredentialPrintError extends Error {}\n\nexport function isCredentialPrintHelp(args: string[]): boolean {\n\treturn (\n\t\targs[0] === \"auth\" && (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\")\n\t);\n}\n\nexport function printCredentialPrintHelp(): void {\n\tconsole.log(`Usage:\n  pi auth print-api-key --model <model> [--provider <provider>]\n  pi auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n\nPrints the configured credential alone on stdout. Provider inference uses configured credentials; specify --provider to select explicitly. Bearer tokens have a 30-minute minimum expiry by default. --min-expiry accepts ms, s, m, or h (for example, 30m).`);\n}\n\n/** Parse the small, extensible `pi auth` command surface before normal startup. */\nexport function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind = args[1] === \"print-api-key\" ? \"api_key\" : args[1] === \"print-bearer-token\" ? \"bearer_token\" : undefined;\n\tif (!kind) {\n\t\tthrow new CredentialPrintError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"pi auth print-api-key\" or \"pi auth print-bearer-token\".`,\n\t\t);\n\t}\n\n\tconst commandArgs: string[] = [];\n\tlet minExpiryMs: number | undefined;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tif (args[index] !== \"--min-expiry\") {\n\t\t\tcommandArgs.push(args[index]);\n\t\t\tcontinue;\n\t\t}\n\t\tif (kind !== \"bearer_token\") {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry is only supported by print-bearer-token\");\n\t\t}\n\t\tconst value = args[++index];\n\t\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\t\tif (!match) {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry must use a duration such as 30m or 1h\");\n\t\t}\n\t\tconst amount = Number(match[1]);\n\t\tconst unit = match[2];\n\t\tminExpiryMs = amount * (unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000);\n\t}\n\n\treturn minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };\n}\n\nexport function validateCredentialPrintArgs(args: Args): void {\n\tif (!args.model?.trim()) {\n\t\tthrow new CredentialPrintError(\"Credential printing requires --model <model>\");\n\t}\n\tif (args.apiKey !== undefined) {\n\t\tthrow new CredentialPrintError(\"Credential printing reads configured credentials; --api-key is not supported\");\n\t}\n\tif (args.messages.length > 0 || args.fileArgs.length > 0 || args.unknownFlags.size > 0) {\n\t\tthrow new CredentialPrintError(\"Credential printing only accepts --provider and --model\");\n\t}\n}\n\n/**\n * Resolve one request credential for a specific provider/model pair.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n\tsignal?: AbortSignal,\n): Promise<string> {\n\tvalidateCredentialPrintArgs(args);\n\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst models: Model<Api>[] = [];\n\tif (args.provider) {\n\t\tconst resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new CredentialPrintError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t}\n\t\tmodels.push(resolved.model);\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tmodels.push(resolved.model);\n\t\t\t}\n\t\t}\n\t\tif (models.length === 0) {\n\t\t\tthrow new CredentialPrintError(`Model \"${args.model}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const model of models) {\n\t\tconst type = credentialTypes.get(model.provider);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\n\t\tconst auth = await modelRuntime.getAuth(model, {\n\t\t\t...(kind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),\n\t\t\tsignal,\n\t\t});\n\t\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t\t)?.[1];\n\t\tconst bearerToken = typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n\t\tconst value = kind === \"bearer_token\" ? (auth?.auth.apiKey ?? bearerToken) : auth?.auth.apiKey;\n\t\tif (value) credentials.push({ providerId: model.provider, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = models[0]?.provider;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (args.provider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (args.provider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`,\n\t\t);\n\t}\n\tthrow new CredentialPrintError(\n\t\t`Model \"${args.model}\" has multiple configured providers (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}
+{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAoB,KAAK,eAAe,EAA8C,MAAM,mBAAmB,CAAC;AAIvH,KAAK,mBAAmB,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAgEjB","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\nimport { AuthCommandError, type AuthCommandKind, getAuthCredential, validateAuthCommandArgs } from \"./auth-command.ts\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\ntype CredentialPrintKind = Exclude<AuthCommandKind, \"check\">;\n\n/**\n * Resolve one configured provider credential.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n\tsignal?: AbortSignal,\n): Promise<string> {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, kind);\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst providers: Array<{ id: string; model?: Model<Api> }> = [];\n\tif (cliProvider) {\n\t\tconst provider = modelRuntime.getProvider(cliProvider);\n\t\tif (!provider) {\n\t\t\tthrow new AuthCommandError(`Unknown provider \"${cliProvider}\". Use --list-models to see available providers.`);\n\t\t}\n\t\tif (cliModel) {\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel, modelRuntime });\n\t\t\tif (resolved.error || !resolved.model) {\n\t\t\t\tthrow new AuthCommandError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t\t}\n\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t} else {\n\t\t\tproviders.push({ id: provider.id });\n\t\t}\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: cliModel!, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t\t}\n\t\t}\n\t\tif (providers.length === 0) {\n\t\t\tthrow new AuthCommandError(`Model \"${cliModel}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const provider of providers) {\n\t\tconst type = credentialTypes.get(provider.id);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\t\tconst authOptions = {\n\t\t\t...(kind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),\n\t\t\tsignal,\n\t\t};\n\t\tconst auth = provider.model\n\t\t\t? await modelRuntime.getAuth(provider.model, authOptions)\n\t\t\t: await modelRuntime.getAuth(provider.id, authOptions);\n\t\tconst value = getAuthCredential(auth);\n\t\tif (value) credentials.push({ providerId: provider.id, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = providers[0]?.id;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (cliProvider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (cliProvider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new AuthCommandError(`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`);\n\t}\n\tthrow new AuthCommandError(\n\t\t`Multiple configured providers matched (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}

package/dist/cli/credential-print.js

@@ -1,117 +1,76 @@
 import { resolveCliModel } from "../core/model-resolver.js";
+import { AuthCommandError, getAuthCredential, validateAuthCommandArgs } from "./auth-command.js";
 const DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;
-export class CredentialPrintError extends Error {
-}
-export function isCredentialPrintHelp(args) {
-    return (args[0] === "auth" && (args[1] === undefined || args[1] === "help" || args[1] === "--help" || args[1] === "-h"));
-}
-export function printCredentialPrintHelp() {
-    console.log(`Usage:
-  pi auth print-api-key --model <model> [--provider <provider>]
-  pi auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]
-
-Prints the configured credential alone on stdout. Provider inference uses configured credentials; specify --provider to select explicitly. Bearer tokens have a 30-minute minimum expiry by default. --min-expiry accepts ms, s, m, or h (for example, 30m).`);
-}
-/** Parse the small, extensible `pi auth` command surface before normal startup. */
-export function parseCredentialPrintCommand(args) {
-    if (args[0] !== "auth")
-        return undefined;
-    const kind = args[1] === "print-api-key" ? "api_key" : args[1] === "print-bearer-token" ? "bearer_token" : undefined;
-    if (!kind) {
-        throw new CredentialPrintError(`Unknown auth command "${args[1] ?? ""}". Use "pi auth print-api-key" or "pi auth print-bearer-token".`);
-    }
-    const commandArgs = [];
-    let minExpiryMs;
-    for (let index = 2; index < args.length; index++) {
-        if (args[index] !== "--min-expiry") {
-            commandArgs.push(args[index]);
-            continue;
-        }
-        if (kind !== "bearer_token") {
-            throw new CredentialPrintError("--min-expiry is only supported by print-bearer-token");
-        }
-        const value = args[++index];
-        const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
-        if (!match) {
-            throw new CredentialPrintError("--min-expiry must use a duration such as 30m or 1h");
-        }
-        const amount = Number(match[1]);
-        const unit = match[2];
-        minExpiryMs = amount * (unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000);
-    }
-    return minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };
-}
-export function validateCredentialPrintArgs(args) {
-    if (!args.model?.trim()) {
-        throw new CredentialPrintError("Credential printing requires --model <model>");
-    }
-    if (args.apiKey !== undefined) {
-        throw new CredentialPrintError("Credential printing reads configured credentials; --api-key is not supported");
-    }
-    if (args.messages.length > 0 || args.fileArgs.length > 0 || args.unknownFlags.size > 0) {
-        throw new CredentialPrintError("Credential printing only accepts --provider and --model");
-    }
-}
 /**
- * Resolve one request credential for a specific provider/model pair.
+ * Resolve one configured provider credential.
  *
  * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists
  * OAuth credentials with less than five minutes remaining through the normal request-auth path.
  */
 export async function resolveCredentialForPrint(args, modelRuntime, kind, minExpiryMs, signal) {
-    validateCredentialPrintArgs(args);
+    const { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, kind);
     const credentialTypes = new Map((await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]));
-    const models = [];
-    if (args.provider) {
-        const resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });
-        if (resolved.error || !resolved.model) {
-            throw new CredentialPrintError(resolved.error ?? "Unable to resolve the requested provider/model");
+    const providers = [];
+    if (cliProvider) {
+        const provider = modelRuntime.getProvider(cliProvider);
+        if (!provider) {
+            throw new AuthCommandError(`Unknown provider "${cliProvider}". Use --list-models to see available providers.`);
+        }
+        if (cliModel) {
+            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel, modelRuntime });
+            if (resolved.error || !resolved.model) {
+                throw new AuthCommandError(resolved.error ?? "Unable to resolve the requested provider/model");
+            }
+            providers.push({ id: provider.id, model: resolved.model });
+        }
+        else {
+            providers.push({ id: provider.id });
         }
-        models.push(resolved.model);
     }
     else {
         for (const provider of modelRuntime.getProviders()) {
             if (!credentialTypes.has(provider.id))
                 continue;
-            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });
+            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel: cliModel, modelRuntime });
             if (resolved.model && !resolved.error && !resolved.warning?.includes("Using custom model id")) {
-                models.push(resolved.model);
+                providers.push({ id: provider.id, model: resolved.model });
             }
         }
-        if (models.length === 0) {
-            throw new CredentialPrintError(`Model "${args.model}" not found. Use --list-models to see available models.`);
+        if (providers.length === 0) {
+            throw new AuthCommandError(`Model "${cliModel}" not found. Use --list-models to see available models.`);
         }
     }
     const credentials = [];
-    for (const model of models) {
-        const type = credentialTypes.get(model.provider);
+    for (const provider of providers) {
+        const type = credentialTypes.get(provider.id);
         if (kind === "api_key" && type === "oauth")
             continue;
         if (kind === "bearer_token" && type !== "oauth")
             continue;
-        const auth = await modelRuntime.getAuth(model, {
+        const authOptions = {
             ...(kind === "bearer_token" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),
             signal,
-        });
-        const authorization = Object.entries(auth?.auth.headers ?? {}).find(([name]) => name.toLowerCase() === "authorization")?.[1];
-        const bearerToken = typeof authorization === "string" ? /^Bearer\s+(.+)$/iu.exec(authorization)?.[1] : undefined;
-        const value = kind === "bearer_token" ? (auth?.auth.apiKey ?? bearerToken) : auth?.auth.apiKey;
+        };
+        const auth = provider.model
+            ? await modelRuntime.getAuth(provider.model, authOptions)
+            : await modelRuntime.getAuth(provider.id, authOptions);
+        const value = getAuthCredential(auth);
         if (value)
-            credentials.push({ providerId: model.provider, value });
+            credentials.push({ providerId: provider.id, value });
     }
     if (credentials.length === 1)
         return credentials[0].value;
     if (credentials.length === 0) {
-        const providerId = models[0]?.provider;
+        const providerId = providers[0]?.id;
         const type = providerId ? credentialTypes.get(providerId) : undefined;
-        if (args.provider && kind === "api_key" && type === "oauth") {
-            throw new CredentialPrintError(`Provider "${providerId}" is configured with OAuth, not an API key`);
+        if (cliProvider && kind === "api_key" && type === "oauth") {
+            throw new AuthCommandError(`Provider "${providerId}" is configured with OAuth, not an API key`);
         }
-        if (args.provider && kind === "bearer_token" && type !== "oauth") {
-            throw new CredentialPrintError(`Provider "${providerId}" is not configured with an OAuth bearer token`);
+        if (cliProvider && kind === "bearer_token" && type !== "oauth") {
+            throw new AuthCommandError(`Provider "${providerId}" is not configured with an OAuth bearer token`);
         }
-        throw new CredentialPrintError(`No usable ${kind === "api_key" ? "API key" : "OAuth bearer token"} is configured`);
+        throw new AuthCommandError(`No usable ${kind === "api_key" ? "API key" : "OAuth bearer token"} is configured`);
     }
-    throw new CredentialPrintError(`Model "${args.model}" has multiple configured providers (${credentials.map(({ providerId }) => providerId).join(", ")}). Specify --provider.`);
+    throw new AuthCommandError(`Multiple configured providers matched (${credentials.map(({ providerId }) => providerId).join(", ")}). Specify --provider.`);
 }
 //# sourceMappingURL=credential-print.js.map

package/dist/cli/credential-print.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-print.js","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAM5D,MAAM,kCAAkC,GAAG,EAAE,GAAG,MAAM,CAAC;AAQvD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAW;IAC9D,OAAO,CACN,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC/G,CAAC;AAAA,CACF;AAED,MAAM,UAAU,wBAAwB,GAAS;IAChD,OAAO,CAAC,GAAG,CAAC;;;;6PAIgP,CAAC,CAAC;AAAA,CAC9P;AAED,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CAAC,IAAc,EAAsC;IAC/F,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAC7B,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,iEAAiE,CACvG,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,WAA+B,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,sDAAsD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,oBAAoB,CAAC,oDAAoD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAAA,CAC1G;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAU,EAAQ;IAC7D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,8CAA8C,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAAC,8EAA8E,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,oBAAoB,CAAC,yDAAyD,CAAC,CAAC;IAC3F,CAAC;AAAA,CACD;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAU,EACV,YAA0B,EAC1B,IAAyB,EACzB,WAAoB,EACpB,MAAoB,EACF;IAClB,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC9B,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAC9G,CAAC;IACF,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACnG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC,UAAU,IAAI,CAAC,KAAK,yDAAyD,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QACrD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QAE1D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;YAC9C,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,IAAI,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,MAAM;SACN,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAClD,EAAE,CAAC,CAAC,CAAC,CAAC;QACP,MAAM,WAAW,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjH,MAAM,KAAK,GAAG,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/F,IAAI,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAAC,aAAa,UAAU,4CAA4C,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAClE,MAAM,IAAI,oBAAoB,CAAC,aAAa,UAAU,gDAAgD,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,aAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,gBAAgB,CAClF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,oBAAoB,CAC7B,UAAU,IAAI,CAAC,KAAK,wCAAwC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC9I,CAAC;AAAA,CACF","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type CredentialPrintKind = \"api_key\" | \"bearer_token\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\nexport interface CredentialPrintCommand {\n\tkind: CredentialPrintKind;\n\targs: string[];\n\tminExpiryMs?: number;\n}\n\nexport class CredentialPrintError extends Error {}\n\nexport function isCredentialPrintHelp(args: string[]): boolean {\n\treturn (\n\t\targs[0] === \"auth\" && (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\")\n\t);\n}\n\nexport function printCredentialPrintHelp(): void {\n\tconsole.log(`Usage:\n  pi auth print-api-key --model <model> [--provider <provider>]\n  pi auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n\nPrints the configured credential alone on stdout. Provider inference uses configured credentials; specify --provider to select explicitly. Bearer tokens have a 30-minute minimum expiry by default. --min-expiry accepts ms, s, m, or h (for example, 30m).`);\n}\n\n/** Parse the small, extensible `pi auth` command surface before normal startup. */\nexport function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind = args[1] === \"print-api-key\" ? \"api_key\" : args[1] === \"print-bearer-token\" ? \"bearer_token\" : undefined;\n\tif (!kind) {\n\t\tthrow new CredentialPrintError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"pi auth print-api-key\" or \"pi auth print-bearer-token\".`,\n\t\t);\n\t}\n\n\tconst commandArgs: string[] = [];\n\tlet minExpiryMs: number | undefined;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tif (args[index] !== \"--min-expiry\") {\n\t\t\tcommandArgs.push(args[index]);\n\t\t\tcontinue;\n\t\t}\n\t\tif (kind !== \"bearer_token\") {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry is only supported by print-bearer-token\");\n\t\t}\n\t\tconst value = args[++index];\n\t\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\t\tif (!match) {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry must use a duration such as 30m or 1h\");\n\t\t}\n\t\tconst amount = Number(match[1]);\n\t\tconst unit = match[2];\n\t\tminExpiryMs = amount * (unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000);\n\t}\n\n\treturn minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };\n}\n\nexport function validateCredentialPrintArgs(args: Args): void {\n\tif (!args.model?.trim()) {\n\t\tthrow new CredentialPrintError(\"Credential printing requires --model <model>\");\n\t}\n\tif (args.apiKey !== undefined) {\n\t\tthrow new CredentialPrintError(\"Credential printing reads configured credentials; --api-key is not supported\");\n\t}\n\tif (args.messages.length > 0 || args.fileArgs.length > 0 || args.unknownFlags.size > 0) {\n\t\tthrow new CredentialPrintError(\"Credential printing only accepts --provider and --model\");\n\t}\n}\n\n/**\n * Resolve one request credential for a specific provider/model pair.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n\tsignal?: AbortSignal,\n): Promise<string> {\n\tvalidateCredentialPrintArgs(args);\n\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst models: Model<Api>[] = [];\n\tif (args.provider) {\n\t\tconst resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new CredentialPrintError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t}\n\t\tmodels.push(resolved.model);\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tmodels.push(resolved.model);\n\t\t\t}\n\t\t}\n\t\tif (models.length === 0) {\n\t\t\tthrow new CredentialPrintError(`Model \"${args.model}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const model of models) {\n\t\tconst type = credentialTypes.get(model.provider);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\n\t\tconst auth = await modelRuntime.getAuth(model, {\n\t\t\t...(kind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),\n\t\t\tsignal,\n\t\t});\n\t\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t\t)?.[1];\n\t\tconst bearerToken = typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n\t\tconst value = kind === \"bearer_token\" ? (auth?.auth.apiKey ?? bearerToken) : auth?.auth.apiKey;\n\t\tif (value) credentials.push({ providerId: model.provider, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = models[0]?.provider;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (args.provider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (args.provider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`,\n\t\t);\n\t}\n\tthrow new CredentialPrintError(\n\t\t`Model \"${args.model}\" has multiple configured providers (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}
+{"version":3,"file":"credential-print.js","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAwB,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEvH,MAAM,kCAAkC,GAAG,EAAE,GAAG,MAAM,CAAC;AAIvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAU,EACV,YAA0B,EAC1B,IAAyB,EACzB,WAAoB,EACpB,MAAoB,EACF;IAClB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,eAAe,GAAG,IAAI,GAAG,CAC9B,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAC9G,CAAC;IACF,MAAM,SAAS,GAA8C,EAAE,CAAC;IAChE,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,WAAW,kDAAkD,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YACvF,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACvC,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAAC,CAAC;YAChG,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAS,EAAE,YAAY,EAAE,CAAC,CAAC;YAClG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/F,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5D,CAAC;QACF,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,UAAU,QAAQ,yDAAyD,CAAC,CAAC;QACzG,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QACrD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QAC1D,MAAM,WAAW,GAAG;YACnB,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,IAAI,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,MAAM;SACN,CAAC;QACF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK;YAC1B,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;YACzD,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3D,MAAM,IAAI,gBAAgB,CAAC,aAAa,UAAU,4CAA4C,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,WAAW,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,aAAa,UAAU,gDAAgD,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,aAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,gBAAgB,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,IAAI,gBAAgB,CACzB,0CAA0C,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5H,CAAC;AAAA,CACF","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\nimport { AuthCommandError, type AuthCommandKind, getAuthCredential, validateAuthCommandArgs } from \"./auth-command.ts\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\ntype CredentialPrintKind = Exclude<AuthCommandKind, \"check\">;\n\n/**\n * Resolve one configured provider credential.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n\tsignal?: AbortSignal,\n): Promise<string> {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, kind);\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst providers: Array<{ id: string; model?: Model<Api> }> = [];\n\tif (cliProvider) {\n\t\tconst provider = modelRuntime.getProvider(cliProvider);\n\t\tif (!provider) {\n\t\t\tthrow new AuthCommandError(`Unknown provider \"${cliProvider}\". Use --list-models to see available providers.`);\n\t\t}\n\t\tif (cliModel) {\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel, modelRuntime });\n\t\t\tif (resolved.error || !resolved.model) {\n\t\t\t\tthrow new AuthCommandError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t\t}\n\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t} else {\n\t\t\tproviders.push({ id: provider.id });\n\t\t}\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: cliModel!, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t\t}\n\t\t}\n\t\tif (providers.length === 0) {\n\t\t\tthrow new AuthCommandError(`Model \"${cliModel}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const provider of providers) {\n\t\tconst type = credentialTypes.get(provider.id);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\t\tconst authOptions = {\n\t\t\t...(kind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),\n\t\t\tsignal,\n\t\t};\n\t\tconst auth = provider.model\n\t\t\t? await modelRuntime.getAuth(provider.model, authOptions)\n\t\t\t: await modelRuntime.getAuth(provider.id, authOptions);\n\t\tconst value = getAuthCredential(auth);\n\t\tif (value) credentials.push({ providerId: provider.id, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = providers[0]?.id;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (cliProvider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (cliProvider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new AuthCommandError(`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`);\n\t}\n\tthrow new AuthCommandError(\n\t\t`Multiple configured providers matched (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}

package/dist/core/agent-session.d.ts

@@ -152,7 +152,7 @@ export interface ExtensionBindings {
 }
 /** Options for AgentSession.prompt() */
 export interface PromptOptions {
-    /** Whether to expand file-based prompt templates (default: true) */
+    /** Whether to dispatch extension commands and expand skill commands and prompt templates (default: true) */
     expandPromptTemplates?: boolean;
     /** Image attachments */
     images?: ImageContent[];
@@ -405,9 +405,11 @@ export declare class AgentSession {
      *
      * @param content User message content (string or content array)
      * @param options.deliverAs Delivery mode when streaming: "steer" or "followUp"
+     * @param options.expandPromptTemplates Whether to dispatch extension commands and expand skill commands and prompt templates. Default: false.
      */
     sendUserMessage(content: string | (TextContent | ImageContent)[], options?: {
         deliverAs?: "steer" | "followUp";
+        expandPromptTemplates?: boolean;
     }): Promise<void>;
     /**
      * Clear all queued messages and return them.
@@ -615,9 +617,12 @@ export declare class AgentSession {
     /**
      * Export session to HTML.
      * @param outputPath Optional output path (defaults to session directory)
+     * @param options Optional export presentation settings
      * @returns Path to exported file
      */
-    exportToHtml(outputPath?: string): Promise<string>;
+    exportToHtml(outputPath?: string, options?: {
+        themeName?: string;
+    }): Promise<string>;
     /**
      * Export the current session branch to a JSONL file.
      * Writes the session header followed by all entries on the current branch path.