@evalops/maestro 0.10.8 → 0.10.11

package/dist/providers/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/providers/api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,mBAAmB,EAAE,CAAC,yBAAyB,CAAC;IAChD,oBAAoB,EAAE,CAAC,0BAA0B,CAAC;IAClD,OAAO,EAAE,CAAC,8BAA8B,CAAC;IACzC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,cAAc,EAAE,CAAC,sBAAsB,CAAC;IACxC,SAAS,EAAE,CAAC,uBAAuB,EAAE,mBAAmB,CAAC;IACzD,OAAO,EAAE;QACR,mBAAmB;QACnB,aAAa;QACb,sBAAsB;QACtB,6BAA6B;QAC7B,wCAAwC;KACxC;IACD,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,GAAG,EAAE,CAAC,aAAa,CAAC;IACpB,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,UAAU,EAAE,CAAC,oBAAoB,CAAC;IAClC,GAAG,EAAE,CAAC,aAAa,CAAC;IACpB,OAAO,EAAE,CAAC,iBAAiB,CAAC;CACyB,CAAC;AAIvD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC5C,OAAO,KAAK,IAAI,YAAY,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC5C,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAkBD,MAAM,UAAU,YAAY,CAC3B,QAAgB,EAChB,WAAoB;IAEpB,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO;YACN,QAAQ;YACR,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,UAAU;YAClB,cAAc;SACd,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACzB,OAAO;gBACN,QAAQ;gBACR,GAAG,EAAE,iBAAiB,EAAE,+CAA+C;gBACvE,MAAM,EAAE,KAAK;gBACb,cAAc;aACd,CAAC;QACH,CAAC;QACD,OAAO;YACN,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,cAAc;SACd,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACN,QAAQ;oBACR,GAAG,EAAE,QAAQ;oBACb,MAAM,EAAE,KAAK;oBACb,MAAM;oBACN,cAAc;iBACd,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACxB,OAAO;YACN,QAAQ;YACR,GAAG,EAAE,UAAU,CAAC,MAAM;YACtB,MAAM,EAAE,gBAAgB;YACxB,cAAc;YACd,kBAAkB,EAAE,UAAU,CAAC,IAAI;SACnC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;QAC3B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,cAAc,EAAE,CAAC;YACpB,OAAO;gBACN,QAAQ;gBACR,GAAG,EAAE,cAAc;gBACnB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,UAAU,CAAC,SAAS;gBAC5B,cAAc;gBACd,kBAAkB,EAAE,UAAU,CAAC,IAAI;aACnC,CAAC;QACH,CAAC;QACD,OAAO;YACN,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,UAAU,CAAC,SAAS;YAC5B,cAAc;YACd,kBAAkB,EAAE,UAAU,CAAC,IAAI;SACnC,CAAC;IACH,CAAC;IAED,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,SAAS;QACjB,cAAc;KACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACrD,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * API Key Lookup - Environment Variable and Custom Provider Resolution\n *\n * This module handles API key discovery from environment variables and\n * custom provider configurations. It provides a consistent interface\n * for looking up credentials across all supported AI providers.\n *\n * ## Known Providers and Environment Variables\n *\n * | Provider   | Environment Variables                     |\n * |------------|-------------------------------------------|\n * | google     | GEMINI_API_KEY                            |\n * | google-gemini-cli | GOOGLE_GEMINI_CLI_TOKEN (JSON token + projectId) |\n * | google-antigravity | GOOGLE_ANTIGRAVITY_TOKEN (JSON token + projectId) |\n * | openai     | OPENAI_API_KEY                            |\n * | azure-openai | AZURE_OPENAI_API_KEY                    |\n * | anthropic  | ANTHROPIC_OAUTH_TOKEN, ANTHROPIC_API_KEY  |\n * | bedrock    | AWS_ACCESS_KEY_ID, AWS_PROFILE, etc.      |\n * | writer     | WRITER_API_KEY                            |\n * | xai        | XAI_API_KEY                               |\n * | groq       | GROQ_API_KEY                              |\n * | cerebras   | CEREBRAS_API_KEY                          |\n * | openrouter | OPENROUTER_API_KEY                        |\n * | zai        | ZAI_API_KEY                               |\n * | mistral    | MISTRAL_API_KEY                           |\n *\n * ## Key Sources\n *\n * | Source        | Description                               |\n * |---------------|-------------------------------------------|\n * | explicit      | Passed directly to lookup function        |\n * | env           | Found in environment variable             |\n * | custom_literal| Hardcoded in custom provider config       |\n * | custom_env    | Custom env var from provider config       |\n * | missing       | No key found                              |\n *\n * ## Custom Providers\n *\n * Custom providers can be defined in the models registry with either:\n * - `apiKey`: A literal API key value\n * - `apiKeyEnv`: An environment variable name to read from\n *\n * ## Example\n *\n * ```typescript\n * const result = lookupApiKey('anthropic');\n *\n * if (result.key) {\n *   console.log(`Found key from ${result.source}`);\n *   if (result.envVar) {\n *     console.log(`Environment variable: ${result.envVar}`);\n *   }\n * } else {\n *   console.log(`Checked: ${result.checkedEnvVars.join(', ')}`);\n * }\n * ```\n *\n * @module providers/api-keys\n */\n\nimport { getCustomProviderMetadata } from \"../models/registry.js\";\nimport { hasAwsCredentials } from \"./aws-auth.js\";\nimport { isEvalOpsManagedProvider } from \"./evalops-managed.js\";\n\nexport const envApiKeyMap = {\n\tgoogle: [\"GEMINI_API_KEY\"],\n\t\"google-gemini-cli\": [\"GOOGLE_GEMINI_CLI_TOKEN\"],\n\t\"google-antigravity\": [\"GOOGLE_ANTIGRAVITY_TOKEN\"],\n\tevalops: [\"MAESTRO_EVALOPS_ACCESS_TOKEN\"],\n\topenai: [\"OPENAI_API_KEY\"],\n\t\"azure-openai\": [\"AZURE_OPENAI_API_KEY\"],\n\tanthropic: [\"ANTHROPIC_OAUTH_TOKEN\", \"ANTHROPIC_API_KEY\"],\n\tbedrock: [\n\t\t\"AWS_ACCESS_KEY_ID\",\n\t\t\"AWS_PROFILE\",\n\t\t\"AWS_SSO_SESSION_NAME\",\n\t\t\"AWS_WEB_IDENTITY_TOKEN_FILE\",\n\t\t\"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\",\n\t],\n\twriter: [\"WRITER_API_KEY\"],\n\txai: [\"XAI_API_KEY\"],\n\tgroq: [\"GROQ_API_KEY\"],\n\tcerebras: [\"CEREBRAS_API_KEY\"],\n\topenrouter: [\"OPENROUTER_API_KEY\"],\n\tzai: [\"ZAI_API_KEY\"],\n\tmistral: [\"MISTRAL_API_KEY\"],\n} as const satisfies Record<string, readonly string[]>;\n\nexport type KnownProvider = keyof typeof envApiKeyMap;\n\nexport function isKnownProvider(value: string): value is KnownProvider {\n\treturn value in envApiKeyMap;\n}\n\nfunction getKnownProviderKey(provider: string): KnownProvider | undefined {\n\tif (isKnownProvider(provider)) {\n\t\treturn provider;\n\t}\n\tif (isEvalOpsManagedProvider(provider)) {\n\t\treturn \"evalops\";\n\t}\n\treturn undefined;\n}\n\nexport type ApiKeySource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"missing\";\n\nexport interface ApiKeyLookupResult {\n\tprovider: string;\n\tkey?: string;\n\tsource: ApiKeySource;\n\tenvVar?: string;\n\tcheckedEnvVars: string[];\n\tcustomProviderName?: string;\n}\n\nexport function lookupApiKey(\n\tprovider: string,\n\texplicitKey?: string,\n): ApiKeyLookupResult {\n\tconst checkedEnvVars: string[] = [];\n\n\tif (explicitKey) {\n\t\treturn {\n\t\t\tprovider,\n\t\t\tkey: explicitKey,\n\t\t\tsource: \"explicit\",\n\t\t\tcheckedEnvVars,\n\t\t};\n\t}\n\n\t// Special handling for Bedrock - uses AWS credential chain, not API key\n\tif (provider === \"bedrock\") {\n\t\tcheckedEnvVars.push(...envApiKeyMap.bedrock);\n\t\tif (hasAwsCredentials()) {\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\tkey: \"aws-credentials\", // Placeholder - SDK handles actual credentials\n\t\t\t\tsource: \"env\",\n\t\t\t\tcheckedEnvVars,\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tprovider,\n\t\t\tsource: \"missing\",\n\t\t\tcheckedEnvVars,\n\t\t};\n\t}\n\n\tconst providerKey = getKnownProviderKey(provider);\n\tif (providerKey) {\n\t\tfor (const envVar of envApiKeyMap[providerKey]) {\n\t\t\tcheckedEnvVars.push(envVar);\n\t\t\tconst envValue = process.env[envVar];\n\t\t\tif (envValue) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\tkey: envValue,\n\t\t\t\t\tsource: \"env\",\n\t\t\t\t\tenvVar,\n\t\t\t\t\tcheckedEnvVars,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\tconst customMeta = getCustomProviderMetadata(provider);\n\tif (customMeta?.apiKey) {\n\t\treturn {\n\t\t\tprovider,\n\t\t\tkey: customMeta.apiKey,\n\t\t\tsource: \"custom_literal\",\n\t\t\tcheckedEnvVars,\n\t\t\tcustomProviderName: customMeta.name,\n\t\t};\n\t}\n\tif (customMeta?.apiKeyEnv) {\n\t\tcheckedEnvVars.push(customMeta.apiKeyEnv);\n\t\tconst customEnvValue = process.env[customMeta.apiKeyEnv];\n\t\tif (customEnvValue) {\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\tkey: customEnvValue,\n\t\t\t\tsource: \"custom_env\",\n\t\t\t\tenvVar: customMeta.apiKeyEnv,\n\t\t\t\tcheckedEnvVars,\n\t\t\t\tcustomProviderName: customMeta.name,\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tprovider,\n\t\t\tsource: \"missing\",\n\t\t\tenvVar: customMeta.apiKeyEnv,\n\t\t\tcheckedEnvVars,\n\t\t\tcustomProviderName: customMeta.name,\n\t\t};\n\t}\n\n\treturn {\n\t\tprovider,\n\t\tsource: \"missing\",\n\t\tcheckedEnvVars,\n\t};\n}\n\nexport function getEnvVarsForProvider(provider: string): string[] {\n\tconst providerKey = getKnownProviderKey(provider);\n\tif (providerKey) {\n\t\treturn [...envApiKeyMap[providerKey]];\n\t}\n\tconst customMeta = getCustomProviderMetadata(provider);\n\treturn customMeta?.apiKeyEnv ? [customMeta.apiKeyEnv] : [];\n}\n"]}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/providers/api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,mBAAmB,EAAE,CAAC,yBAAyB,CAAC;IAChD,oBAAoB,EAAE,CAAC,0BAA0B,CAAC;IAClD,OAAO,EAAE,CAAC,8BAA8B,CAAC;IACzC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,cAAc,EAAE;QACf,oBAAoB;QACpB,2BAA2B;QAC3B,eAAe;KACf;IACD,cAAc,EAAE,CAAC,sBAAsB,CAAC;IACxC,SAAS,EAAE,CAAC,uBAAuB,EAAE,mBAAmB,CAAC;IACzD,OAAO,EAAE;QACR,mBAAmB;QACnB,aAAa;QACb,sBAAsB;QACtB,6BAA6B;QAC7B,wCAAwC;KACxC;IACD,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,GAAG,EAAE,CAAC,aAAa,CAAC;IACpB,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,UAAU,EAAE,CAAC,oBAAoB,CAAC;IAClC,GAAG,EAAE,CAAC,aAAa,CAAC;IACpB,OAAO,EAAE,CAAC,iBAAiB,CAAC;CACyB,CAAC;AAIvD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC5C,OAAO,KAAK,IAAI,YAAY,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC5C,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAkBD,MAAM,UAAU,YAAY,CAC3B,QAAgB,EAChB,WAAoB;IAEpB,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO;YACN,QAAQ;YACR,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,UAAU;YAClB,cAAc;SACd,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,iBAAiB,EAAE,EAAE,CAAC;YACzB,OAAO;gBACN,QAAQ;gBACR,GAAG,EAAE,iBAAiB,EAAE,+CAA+C;gBACvE,MAAM,EAAE,KAAK;gBACb,cAAc;aACd,CAAC;QACH,CAAC;QACD,OAAO;YACN,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,cAAc;SACd,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACN,QAAQ;oBACR,GAAG,EAAE,QAAQ;oBACb,MAAM,EAAE,KAAK;oBACb,MAAM;oBACN,cAAc;iBACd,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACxB,OAAO;YACN,QAAQ;YACR,GAAG,EAAE,UAAU,CAAC,MAAM;YACtB,MAAM,EAAE,gBAAgB;YACxB,cAAc;YACd,kBAAkB,EAAE,UAAU,CAAC,IAAI;SACnC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;QAC3B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,cAAc,EAAE,CAAC;YACpB,OAAO;gBACN,QAAQ;gBACR,GAAG,EAAE,cAAc;gBACnB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,UAAU,CAAC,SAAS;gBAC5B,cAAc;gBACd,kBAAkB,EAAE,UAAU,CAAC,IAAI;aACnC,CAAC;QACH,CAAC;QACD,OAAO;YACN,QAAQ;YACR,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,UAAU,CAAC,SAAS;YAC5B,cAAc;YACd,kBAAkB,EAAE,UAAU,CAAC,IAAI;SACnC,CAAC;IACH,CAAC;IAED,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,SAAS;QACjB,cAAc;KACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACrD,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,UAAU,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC","sourcesContent":["/**\n * API Key Lookup - Environment Variable and Custom Provider Resolution\n *\n * This module handles API key discovery from environment variables and\n * custom provider configurations. It provides a consistent interface\n * for looking up credentials across all supported AI providers.\n *\n * ## Known Providers and Environment Variables\n *\n * | Provider   | Environment Variables                     |\n * |------------|-------------------------------------------|\n * | google     | GEMINI_API_KEY                            |\n * | google-gemini-cli | GOOGLE_GEMINI_CLI_TOKEN (JSON token + projectId) |\n * | google-antigravity | GOOGLE_ANTIGRAVITY_TOKEN (JSON token + projectId) |\n * | openai     | OPENAI_API_KEY                            |\n * | azure-openai | AZURE_OPENAI_API_KEY                    |\n * | anthropic  | ANTHROPIC_OAUTH_TOKEN, ANTHROPIC_API_KEY  |\n * | bedrock    | AWS_ACCESS_KEY_ID, AWS_PROFILE, etc.      |\n * | writer     | WRITER_API_KEY                            |\n * | xai        | XAI_API_KEY                               |\n * | groq       | GROQ_API_KEY                              |\n * | cerebras   | CEREBRAS_API_KEY                          |\n * | openrouter | OPENROUTER_API_KEY                        |\n * | zai        | ZAI_API_KEY                               |\n * | mistral    | MISTRAL_API_KEY                           |\n *\n * ## Key Sources\n *\n * | Source        | Description                               |\n * |---------------|-------------------------------------------|\n * | explicit      | Passed directly to lookup function        |\n * | env           | Found in environment variable             |\n * | custom_literal| Hardcoded in custom provider config       |\n * | custom_env    | Custom env var from provider config       |\n * | missing       | No key found                              |\n *\n * ## Custom Providers\n *\n * Custom providers can be defined in the models registry with either:\n * - `apiKey`: A literal API key value\n * - `apiKeyEnv`: An environment variable name to read from\n *\n * ## Example\n *\n * ```typescript\n * const result = lookupApiKey('anthropic');\n *\n * if (result.key) {\n *   console.log(`Found key from ${result.source}`);\n *   if (result.envVar) {\n *     console.log(`Environment variable: ${result.envVar}`);\n *   }\n * } else {\n *   console.log(`Checked: ${result.checkedEnvVars.join(', ')}`);\n * }\n * ```\n *\n * @module providers/api-keys\n */\n\nimport { getCustomProviderMetadata } from \"../models/registry.js\";\nimport { hasAwsCredentials } from \"./aws-auth.js\";\nimport { isEvalOpsManagedProvider } from \"./evalops-managed.js\";\n\nexport const envApiKeyMap = {\n\tgoogle: [\"GEMINI_API_KEY\"],\n\t\"google-gemini-cli\": [\"GOOGLE_GEMINI_CLI_TOKEN\"],\n\t\"google-antigravity\": [\"GOOGLE_ANTIGRAVITY_TOKEN\"],\n\tevalops: [\"MAESTRO_EVALOPS_ACCESS_TOKEN\"],\n\topenai: [\"OPENAI_API_KEY\"],\n\t\"openai-codex\": [\n\t\t\"OPENAI_CODEX_TOKEN\",\n\t\t\"OPENAI_CODEX_ACCESS_TOKEN\",\n\t\t\"CODEX_API_KEY\",\n\t],\n\t\"azure-openai\": [\"AZURE_OPENAI_API_KEY\"],\n\tanthropic: [\"ANTHROPIC_OAUTH_TOKEN\", \"ANTHROPIC_API_KEY\"],\n\tbedrock: [\n\t\t\"AWS_ACCESS_KEY_ID\",\n\t\t\"AWS_PROFILE\",\n\t\t\"AWS_SSO_SESSION_NAME\",\n\t\t\"AWS_WEB_IDENTITY_TOKEN_FILE\",\n\t\t\"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\",\n\t],\n\twriter: [\"WRITER_API_KEY\"],\n\txai: [\"XAI_API_KEY\"],\n\tgroq: [\"GROQ_API_KEY\"],\n\tcerebras: [\"CEREBRAS_API_KEY\"],\n\topenrouter: [\"OPENROUTER_API_KEY\"],\n\tzai: [\"ZAI_API_KEY\"],\n\tmistral: [\"MISTRAL_API_KEY\"],\n} as const satisfies Record<string, readonly string[]>;\n\nexport type KnownProvider = keyof typeof envApiKeyMap;\n\nexport function isKnownProvider(value: string): value is KnownProvider {\n\treturn value in envApiKeyMap;\n}\n\nfunction getKnownProviderKey(provider: string): KnownProvider | undefined {\n\tif (isKnownProvider(provider)) {\n\t\treturn provider;\n\t}\n\tif (isEvalOpsManagedProvider(provider)) {\n\t\treturn \"evalops\";\n\t}\n\treturn undefined;\n}\n\nexport type ApiKeySource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"missing\";\n\nexport interface ApiKeyLookupResult {\n\tprovider: string;\n\tkey?: string;\n\tsource: ApiKeySource;\n\tenvVar?: string;\n\tcheckedEnvVars: string[];\n\tcustomProviderName?: string;\n}\n\nexport function lookupApiKey(\n\tprovider: string,\n\texplicitKey?: string,\n): ApiKeyLookupResult {\n\tconst checkedEnvVars: string[] = [];\n\n\tif (explicitKey) {\n\t\treturn {\n\t\t\tprovider,\n\t\t\tkey: explicitKey,\n\t\t\tsource: \"explicit\",\n\t\t\tcheckedEnvVars,\n\t\t};\n\t}\n\n\t// Special handling for Bedrock - uses AWS credential chain, not API key\n\tif (provider === \"bedrock\") {\n\t\tcheckedEnvVars.push(...envApiKeyMap.bedrock);\n\t\tif (hasAwsCredentials()) {\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\tkey: \"aws-credentials\", // Placeholder - SDK handles actual credentials\n\t\t\t\tsource: \"env\",\n\t\t\t\tcheckedEnvVars,\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tprovider,\n\t\t\tsource: \"missing\",\n\t\t\tcheckedEnvVars,\n\t\t};\n\t}\n\n\tconst providerKey = getKnownProviderKey(provider);\n\tif (providerKey) {\n\t\tfor (const envVar of envApiKeyMap[providerKey]) {\n\t\t\tcheckedEnvVars.push(envVar);\n\t\t\tconst envValue = process.env[envVar];\n\t\t\tif (envValue) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\tkey: envValue,\n\t\t\t\t\tsource: \"env\",\n\t\t\t\t\tenvVar,\n\t\t\t\t\tcheckedEnvVars,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\t}\n\n\tconst customMeta = getCustomProviderMetadata(provider);\n\tif (customMeta?.apiKey) {\n\t\treturn {\n\t\t\tprovider,\n\t\t\tkey: customMeta.apiKey,\n\t\t\tsource: \"custom_literal\",\n\t\t\tcheckedEnvVars,\n\t\t\tcustomProviderName: customMeta.name,\n\t\t};\n\t}\n\tif (customMeta?.apiKeyEnv) {\n\t\tcheckedEnvVars.push(customMeta.apiKeyEnv);\n\t\tconst customEnvValue = process.env[customMeta.apiKeyEnv];\n\t\tif (customEnvValue) {\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\tkey: customEnvValue,\n\t\t\t\tsource: \"custom_env\",\n\t\t\t\tenvVar: customMeta.apiKeyEnv,\n\t\t\t\tcheckedEnvVars,\n\t\t\t\tcustomProviderName: customMeta.name,\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\tprovider,\n\t\t\tsource: \"missing\",\n\t\t\tenvVar: customMeta.apiKeyEnv,\n\t\t\tcheckedEnvVars,\n\t\t\tcustomProviderName: customMeta.name,\n\t\t};\n\t}\n\n\treturn {\n\t\tprovider,\n\t\tsource: \"missing\",\n\t\tcheckedEnvVars,\n\t};\n}\n\nexport function getEnvVarsForProvider(provider: string): string[] {\n\tconst providerKey = getKnownProviderKey(provider);\n\tif (providerKey) {\n\t\treturn [...envApiKeyMap[providerKey]];\n\t}\n\tconst customMeta = getCustomProviderMetadata(provider);\n\treturn customMeta?.apiKeyEnv ? [customMeta.apiKeyEnv] : [];\n}\n"]}

package/dist/providers/auth.d.ts

@@ -33,6 +33,7 @@
  * | anthropic_oauth_file| Anthropic OAuth from stored credentials  |
  * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |
  * | openai_oauth_file   | OpenAI OAuth from stored credentials     |
+ * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |
  * | google_oauth_file   | Google OAuth from stored credentials     |
  *
  * ## Example
@@ -51,7 +52,7 @@
  */
 export type AuthMode = "auto" | "api-key" | "claude";
 export type AuthCredentialType = "api-key" | "anthropic-oauth";
-export type AuthCredentialSource = "explicit" | "env" | "custom_literal" | "custom_env" | "anthropic_oauth_env" | "anthropic_oauth_file" | "evalops_oauth_file" | "openai_oauth_file" | "google_oauth_file" | "github_copilot_oauth_file";
+export type AuthCredentialSource = "explicit" | "env" | "custom_literal" | "custom_env" | "anthropic_oauth_env" | "anthropic_oauth_file" | "evalops_oauth_file" | "openai_oauth_file" | "openai_codex_oauth_file" | "google_oauth_file" | "github_copilot_oauth_file";
 export interface AuthCredential {
     provider: string;
     token: string;

package/dist/providers/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAaH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAC7B,UAAU,GACV,KAAK,GACL,gBAAgB,GAChB,YAAY,GACZ,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,2BAA2B,CAAC;AAE/B,MAAM,WAAW,cAAc;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,KAAK,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;AAmK9E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAsJ7E"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAaH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,iBAAiB,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAC7B,UAAU,GACV,KAAK,GACL,gBAAgB,GAChB,YAAY,GACZ,qBAAqB,GACrB,sBAAsB,GACtB,oBAAoB,GACpB,mBAAmB,GACnB,yBAAyB,GACzB,mBAAmB,GACnB,2BAA2B,CAAC;AAE/B,MAAM,WAAW,cAAc;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,KAAK,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;AAyK9E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAyK7E"}

package/dist/providers/auth.js

@@ -33,6 +33,7 @@
  * | anthropic_oauth_file| Anthropic OAuth from stored credentials  |
  * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |
  * | openai_oauth_file   | OpenAI OAuth from stored credentials     |
+ * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |
  * | google_oauth_file   | Google OAuth from stored credentials     |
  *
  * ## Example
@@ -61,9 +62,14 @@ const ANTHROPIC_OAUTH_ENV_VARS = [
 ];
 function isOpenAIProvider(provider) {
     const normalized = provider.toLowerCase();
-    return (normalized === "openai" ||
-        normalized.startsWith("openai/") ||
-        normalized.includes("openai-"));
+    return (normalized !== "openai-codex" &&
+        (normalized === "openai" ||
+            normalized.startsWith("openai/") ||
+            normalized.includes("openai-")));
+}
+function isOpenAICodexProvider(provider) {
+    const normalized = provider.toLowerCase();
+    return normalized === "openai-codex";
 }
 function isGoogleGeminiCliProvider(provider) {
     const normalized = provider.toLowerCase();
@@ -199,6 +205,23 @@ export function createAuthResolver(options) {
                 return buildEvalOpsCredential(provider, oauthToken, "evalops_oauth_file", credentials?.metadata);
             }
         }
+        if (isOpenAICodexProvider(provider) && options.mode !== "api-key") {
+            const oauthToken = await getOAuthToken("openai-codex");
+            if (oauthToken) {
+                const credentials = loadOAuthCredentials("openai-codex");
+                const accountId = typeof credentials?.metadata?.accountId === "string"
+                    ? credentials.metadata.accountId
+                    : undefined;
+                return {
+                    provider,
+                    token: oauthToken,
+                    type: "api-key",
+                    source: "openai_codex_oauth_file",
+                    headers: accountId ? { "chatgpt-account-id": accountId } : undefined,
+                    metadata: credentials?.metadata,
+                };
+            }
+        }
         // Handle OpenAI Auth
         if (isOpenAIProvider(provider) && options.mode !== "api-key") {
             // OpenAI OAuth

package/dist/providers/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACN,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAoCjE,MAAM,wBAAwB,GAAG;IAChC,mBAAmB;IACnB,uBAAuB;IACvB,wBAAwB;CACxB,CAAC;AAEF,SAAS,gBAAgB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,QAAQ;QACvB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAChC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9B,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,oBAAoB,CACzE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACrD,OAAO,mCAAmC,CAAC,QAAQ,CAAC,EAAE,kBAAkB;QACvE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,MAAM,IAAI;QACpB,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,EAAE,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CACjC,QAAgB,EAChB,QAAkC;IAElC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,UAAU,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,kBAAkB,GACvB,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,gBAAgB,GACrB,CAAC,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,SAAS;QACzC,CAAC,CAAC,UAAU,CAAC,mBAAmB;QAChC,CAAC,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,kBAAkB;QAClB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,CAAC;IACV,MAAM,WAAW,GAChB,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,MAAM,CAAC;IACR,MAAM,cAAc,GACnB,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GACX,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO;QACN,QAAQ,EAAE,gBAAgB;QAC1B,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACrC,QAAkC;IAElC,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC;QACd,QAAQ,EACP,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;YAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACrC,MAAM,EACL,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC;YAClC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;QAC3C,UAAU,EACT,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC;YACtC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACvC,OAAO,EACN,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;YACnC,SAAS;KACV,CAAC,CAAC,MAAM,CACR,CAAC,KAAK,EAA6B,EAAE,CACpC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3D,CACD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAAgB,EAChB,KAAa,EACb,MAA4B,EAC5B,QAAkC,EAClC,MAAe;IAEf,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,QAAQ;QACR,KAAK;QACL,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACR,mBAAmB,EAAE,cAAc;SACnC;QACD,QAAQ;QACR,WAAW,EAAE;YACZ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ,CAAC;YACjD,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAC3D;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,KAAK,EAAE,QAAgB,EAAuC,EAAE;QACtE,IACC,6BAA6B,CAAC,QAAQ,CAAC;YACvC,CAAC,8BAA8B,EAAE,EAChC,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBACpD,OAAO,sBAAsB,CAC5B,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,WAAW,EAAE,QAAQ,CACrB,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9D,eAAe;YACf,MAAM,SAAS,GAAG,MAAM,6BAA6B,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAClC,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,2BAA2B;oBACnC,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,aAAa,GAClB,kBAAkB,KAAK,oBAAoB;gBAC1C,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,mBAAmB,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,SAAS,EAAE,CAAC;oBACf,OAAO;wBACN,QAAQ;wBACR,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;wBACvD,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;qBAC/B,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,oBAAoB,GACzB,kBAAkB,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAElE,IAAI,oBAAoB,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM;gBACN,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;aAClC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,aAAa,EAAE,KAAK,EAAE,CAAC;gBAC1B,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;iBAC5B,CAAC;YACH,CAAC;YAED,gCAAgC;YAChC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBACtD,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,sBAAsB;oBAC9B,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAC5B,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,EACb,SAAS,EACT,MAAM,CAAC,MAAM,CACb,CAAC;YACH,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Authentication Resolver - Unified Credential Resolution\n *\n * This module provides a unified authentication resolver that handles\n * multiple credential sources and authentication modes for all supported\n * AI providers. It abstracts the complexity of OAuth, API keys, and\n * environment variables into a single interface.\n *\n * ## Authentication Modes\n *\n * | Mode     | Description                                    |\n * |----------|------------------------------------------------|\n * | auto     | Try OAuth first, fallback to API keys (default)|\n * | api-key  | Only use API keys, skip OAuth                  |\n * | claude   | Only use Anthropic OAuth, fail if unavailable  |\n *\n * ## Credential Resolution Order\n *\n * 1. **Explicit API key**: Passed directly via options\n * 2. **OAuth tokens**: Provider-specific OAuth flows (if mode allows)\n * 3. **Environment variables**: Standard env var lookup\n * 4. **Custom providers**: From models registry configuration\n *\n * ## Credential Sources\n *\n * | Source              | Description                              |\n * |---------------------|------------------------------------------|\n * | explicit            | Passed directly to resolver              |\n * | env                 | From environment variable                |\n * | custom_literal      | Hardcoded in custom provider config      |\n * | custom_env          | Env var from custom provider config      |\n * | anthropic_oauth_env | Anthropic OAuth token from env           |\n * | anthropic_oauth_file| Anthropic OAuth from stored credentials  |\n * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |\n * | openai_oauth_file   | OpenAI OAuth from stored credentials     |\n * | google_oauth_file   | Google OAuth from stored credentials     |\n *\n * ## Example\n *\n * ```typescript\n * const resolver = createAuthResolver({ mode: 'auto' });\n * const credential = await resolver('anthropic');\n *\n * if (credential) {\n *   console.log(`Using ${credential.type} from ${credential.source}`);\n *   // Use credential.token for API requests\n * }\n * ```\n *\n * @module providers/auth\n */\n\nimport { getOAuthToken } from \"../oauth/index.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { lookupApiKey } from \"./api-keys.js\";\nimport {\n\tgetEvalOpsManagedProviderDefinition,\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"./evalops-managed.js\";\nimport { getFreshOpenAIOAuthCredential } from \"./openai-auth.js\";\n\nexport type AuthMode = \"auto\" | \"api-key\" | \"claude\";\n\nexport type AuthCredentialType = \"api-key\" | \"anthropic-oauth\";\n\nexport type AuthCredentialSource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"anthropic_oauth_env\"\n\t| \"anthropic_oauth_file\"\n\t| \"evalops_oauth_file\"\n\t| \"openai_oauth_file\"\n\t| \"google_oauth_file\"\n\t| \"github_copilot_oauth_file\";\n\nexport interface AuthCredential {\n\tprovider: string;\n\ttoken: string;\n\ttype: AuthCredentialType;\n\tsource: AuthCredentialSource;\n\tenvVar?: string;\n\theaders?: Record<string, string>;\n\tmetadata?: Record<string, unknown>;\n\trequestBody?: Record<string, unknown>;\n}\n\nexport interface AuthResolverOptions {\n\tmode: AuthMode;\n\texplicitApiKey?: string;\n}\n\ntype AuthResolver = (provider: string) => Promise<AuthCredential | undefined>;\n\nconst ANTHROPIC_OAUTH_ENV_VARS = [\n\t\"CLAUDE_CODE_TOKEN\",\n\t\"ANTHROPIC_OAUTH_TOKEN\",\n\t\"ANTHROPIC_ACCESS_TOKEN\",\n];\n\nfunction isOpenAIProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized === \"openai\" ||\n\t\tnormalized.startsWith(\"openai/\") ||\n\t\tnormalized.includes(\"openai-\")\n\t);\n}\n\nfunction isGoogleGeminiCliProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized === \"google-gemini-cli\" || normalized === \"google-antigravity\"\n\t);\n}\n\nfunction isGitHubCopilotProvider(provider: string): boolean {\n\treturn provider.toLowerCase() === \"github-copilot\";\n}\n\nfunction resolveEvalOpsCredentialType(provider: string): AuthCredentialType {\n\treturn getEvalOpsManagedProviderDefinition(provider)?.usesAnthropicOAuth\n\t\t? \"anthropic-oauth\"\n\t\t: \"api-key\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getNonEmptyString(value: unknown): string | undefined {\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction resolveEvalOpsOrganizationId(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst candidate = getNonEmptyString(metadata?.organizationId);\n\tif (candidate && candidate.trim().length > 0) {\n\t\treturn candidate.trim();\n\t}\n\tfor (const envVar of [\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]) {\n\t\tconst value = process.env[envVar]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction resolveEvalOpsProviderRef(\n\tprovider: string,\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: null;\n\tconst definition = getEvalOpsManagedProviderDefinition(provider);\n\tconst metadataProvider = getNonEmptyString(providerRef?.provider);\n\tconst configuredProvider =\n\t\tprocess.env.MAESTRO_EVALOPS_PROVIDER?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_PROVIDER?.trim();\n\tconst resolvedProvider =\n\t\t(definition && definition.id !== \"evalops\"\n\t\t\t? definition.providerRefProvider\n\t\t\t: undefined) ??\n\t\tmetadataProvider ??\n\t\tconfiguredProvider ??\n\t\tdefinition?.providerRefProvider ??\n\t\t\"openai\";\n\tconst environment =\n\t\tgetNonEmptyString(providerRef?.environment) ??\n\t\tprocess.env.MAESTRO_EVALOPS_ENVIRONMENT?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_ENVIRONMENT?.trim() ??\n\t\t\"prod\";\n\tconst credentialName =\n\t\tgetNonEmptyString(providerRef?.credential_name) ??\n\t\tprocess.env.MAESTRO_EVALOPS_CREDENTIAL_NAME?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME?.trim();\n\tconst teamId =\n\t\tgetNonEmptyString(providerRef?.team_id) ??\n\t\tprocess.env.MAESTRO_EVALOPS_TEAM_ID?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_TEAM_ID?.trim();\n\treturn {\n\t\tprovider: resolvedProvider,\n\t\tenvironment,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamId ? { team_id: teamId } : {}),\n\t};\n}\n\nfunction resolveEvalOpsRequestMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries({\n\t\t\tagent_id:\n\t\t\t\tgetNonEmptyString(metadata?.agentId) ??\n\t\t\t\tgetNonEmptyString(metadata?.agent_id) ??\n\t\t\t\tprocess.env.MAESTRO_EVALOPS_AGENT_ID?.trim() ??\n\t\t\t\tprocess.env.MAESTRO_AGENT_ID?.trim(),\n\t\t\trun_id:\n\t\t\t\tgetNonEmptyString(metadata?.runId) ??\n\t\t\t\tgetNonEmptyString(metadata?.run_id) ??\n\t\t\t\tprocess.env.MAESTRO_EVALOPS_RUN_ID?.trim(),\n\t\t\tsession_id:\n\t\t\t\tgetNonEmptyString(metadata?.sessionId) ??\n\t\t\t\tgetNonEmptyString(metadata?.session_id) ??\n\t\t\t\tprocess.env.MAESTRO_SESSION_ID?.trim(),\n\t\t\tsurface:\n\t\t\t\tgetNonEmptyString(metadata?.surface) ??\n\t\t\t\tprocess.env.MAESTRO_EVALOPS_SURFACE?.trim() ??\n\t\t\t\tprocess.env.MAESTRO_SURFACE?.trim() ??\n\t\t\t\t\"maestro\",\n\t\t}).filter(\n\t\t\t(entry): entry is [string, string] =>\n\t\t\t\ttypeof entry[1] === \"string\" && entry[1].trim().length > 0,\n\t\t),\n\t);\n}\n\nfunction buildEvalOpsCredential(\n\tprovider: string,\n\ttoken: string,\n\tsource: AuthCredentialSource,\n\tmetadata?: Record<string, unknown>,\n\tenvVar?: string,\n): AuthCredential | undefined {\n\tconst organizationId = resolveEvalOpsOrganizationId(metadata);\n\tif (!organizationId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tprovider,\n\t\ttoken,\n\t\ttype: resolveEvalOpsCredentialType(provider),\n\t\tsource,\n\t\tenvVar,\n\t\theaders: {\n\t\t\t\"X-Organization-ID\": organizationId,\n\t\t},\n\t\tmetadata,\n\t\trequestBody: {\n\t\t\tmetadata: resolveEvalOpsRequestMetadata(metadata),\n\t\t\tprovider_ref: resolveEvalOpsProviderRef(provider, metadata),\n\t\t},\n\t};\n}\n\nexport function createAuthResolver(options: AuthResolverOptions): AuthResolver {\n\tconst explicitKey = options.explicitApiKey?.trim();\n\treturn async (provider: string): Promise<AuthCredential | undefined> => {\n\t\tif (\n\t\t\tisKnownEvalOpsManagedProvider(provider) &&\n\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst normalizedProvider = provider.toLowerCase();\n\n\t\tif (explicitKey) {\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(provider, explicitKey, \"explicit\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: explicitKey,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: \"explicit\",\n\t\t\t};\n\t\t}\n\n\t\tif (isEvalOpsManagedProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"evalops\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"evalops\");\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\toauthToken,\n\t\t\t\t\t\"evalops_oauth_file\",\n\t\t\t\t\tcredentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Handle OpenAI Auth\n\t\tif (isOpenAIProvider(provider) && options.mode !== \"api-key\") {\n\t\t\t// OpenAI OAuth\n\t\t\tconst oauthCred = await getFreshOpenAIOAuthCredential();\n\t\t\tif (oauthCred?.apiKey) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthCred.apiKey,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_oauth_file\",\n\t\t\t\t\tmetadata: { mode: oauthCred.mode },\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGitHubCopilotProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"github-copilot\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"github-copilot\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"github_copilot_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGoogleGeminiCliProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthProvider =\n\t\t\t\tnormalizedProvider === \"google-antigravity\"\n\t\t\t\t\t? \"google-antigravity\"\n\t\t\t\t\t: \"google-gemini-cli\";\n\t\t\tconst oauthToken = await getOAuthToken(oauthProvider);\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(oauthProvider);\n\t\t\t\tconst projectId =\n\t\t\t\t\ttypeof credentials?.metadata?.projectId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.projectId\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (projectId) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken: JSON.stringify({ token: oauthToken, projectId }),\n\t\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\t\tsource: \"google_oauth_file\",\n\t\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst preferAnthropicOAuth =\n\t\t\tnormalizedProvider === \"anthropic\" && options.mode !== \"api-key\";\n\n\t\tif (preferAnthropicOAuth) {\n\t\t\tconst envTokenEntry = ANTHROPIC_OAUTH_ENV_VARS.map((envVar) => ({\n\t\t\t\tenvVar,\n\t\t\t\ttoken: process.env[envVar]?.trim(),\n\t\t\t})).find((entry) => entry.token);\n\t\t\tif (envTokenEntry?.token) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: envTokenEntry.token,\n\t\t\t\t\ttype: \"anthropic-oauth\",\n\t\t\t\t\tsource: \"anthropic_oauth_env\",\n\t\t\t\t\tenvVar: envTokenEntry.envVar,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Try OAuth system (oauth.json)\n\t\t\tconst oauthToken = await getOAuthToken(\"anthropic\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"anthropic\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"anthropic-oauth\",\n\t\t\t\t\tsource: \"anthropic_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (options.mode === \"claude\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tconst lookup = lookupApiKey(provider, explicitKey);\n\t\tif (lookup.key) {\n\t\t\tif (lookup.source === \"missing\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tlookup.key,\n\t\t\t\t\tlookup.source,\n\t\t\t\t\tundefined,\n\t\t\t\t\tlookup.envVar,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: lookup.key,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: lookup.source,\n\t\t\t\tenvVar: lookup.envVar,\n\t\t\t};\n\t\t}\n\t\treturn undefined;\n\t};\n}\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACN,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAqCjE,MAAM,wBAAwB,GAAG;IAChC,mBAAmB;IACnB,uBAAuB;IACvB,wBAAwB;CACxB,CAAC;AAEF,SAAS,gBAAgB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,cAAc;QAC7B,CAAC,UAAU,KAAK,QAAQ;YACvB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAChC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,UAAU,KAAK,cAAc,CAAC;AACtC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,oBAAoB,CACzE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACrD,OAAO,mCAAmC,CAAC,QAAQ,CAAC,EAAE,kBAAkB;QACvE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,KAAK,MAAM,MAAM,IAAI;QACpB,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,EAAE,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CACjC,QAAgB,EAChB,QAAkC;IAElC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,UAAU,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,kBAAkB,GACvB,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,gBAAgB,GACrB,CAAC,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,SAAS;QACzC,CAAC,CAAC,UAAU,CAAC,mBAAmB;QAChC,CAAC,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,kBAAkB;QAClB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,CAAC;IACV,MAAM,WAAW,GAChB,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,MAAM,CAAC;IACR,MAAM,cAAc,GACnB,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GACX,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO;QACN,QAAQ,EAAE,gBAAgB;QAC1B,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACrC,QAAkC;IAElC,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC;QACd,QAAQ,EACP,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;YAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE;QACrC,MAAM,EACL,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC;YAClC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;QAC3C,UAAU,EACT,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC;YACtC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE;QACvC,OAAO,EACN,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;YACnC,SAAS;KACV,CAAC,CAAC,MAAM,CACR,CAAC,KAAK,EAA6B,EAAE,CACpC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3D,CACD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAAgB,EAChB,KAAa,EACb,MAA4B,EAC5B,QAAkC,EAClC,MAAe;IAEf,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,QAAQ;QACR,KAAK;QACL,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACR,mBAAmB,EAAE,cAAc;SACnC;QACD,QAAQ;QACR,WAAW,EAAE;YACZ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ,CAAC;YACjD,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAC3D;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,KAAK,EAAE,QAAgB,EAAuC,EAAE;QACtE,IACC,6BAA6B,CAAC,QAAQ,CAAC;YACvC,CAAC,8BAA8B,EAAE,EAChC,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBACpD,OAAO,sBAAsB,CAC5B,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,WAAW,EAAE,QAAQ,CACrB,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACzD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;oBACpE,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9D,eAAe;YACf,MAAM,SAAS,GAAG,MAAM,6BAA6B,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAClC,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,2BAA2B;oBACnC,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,aAAa,GAClB,kBAAkB,KAAK,oBAAoB;gBAC1C,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,mBAAmB,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,SAAS,EAAE,CAAC;oBACf,OAAO;wBACN,QAAQ;wBACR,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;wBACvD,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;qBAC/B,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,oBAAoB,GACzB,kBAAkB,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAElE,IAAI,oBAAoB,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM;gBACN,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;aAClC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,aAAa,EAAE,KAAK,EAAE,CAAC;gBAC1B,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;iBAC5B,CAAC;YACH,CAAC;YAED,gCAAgC;YAChC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBACtD,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,sBAAsB;oBAC9B,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAC5B,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,EACb,SAAS,EACT,MAAM,CAAC,MAAM,CACb,CAAC;YACH,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Authentication Resolver - Unified Credential Resolution\n *\n * This module provides a unified authentication resolver that handles\n * multiple credential sources and authentication modes for all supported\n * AI providers. It abstracts the complexity of OAuth, API keys, and\n * environment variables into a single interface.\n *\n * ## Authentication Modes\n *\n * | Mode     | Description                                    |\n * |----------|------------------------------------------------|\n * | auto     | Try OAuth first, fallback to API keys (default)|\n * | api-key  | Only use API keys, skip OAuth                  |\n * | claude   | Only use Anthropic OAuth, fail if unavailable  |\n *\n * ## Credential Resolution Order\n *\n * 1. **Explicit API key**: Passed directly via options\n * 2. **OAuth tokens**: Provider-specific OAuth flows (if mode allows)\n * 3. **Environment variables**: Standard env var lookup\n * 4. **Custom providers**: From models registry configuration\n *\n * ## Credential Sources\n *\n * | Source              | Description                              |\n * |---------------------|------------------------------------------|\n * | explicit            | Passed directly to resolver              |\n * | env                 | From environment variable                |\n * | custom_literal      | Hardcoded in custom provider config      |\n * | custom_env          | Env var from custom provider config      |\n * | anthropic_oauth_env | Anthropic OAuth token from env           |\n * | anthropic_oauth_file| Anthropic OAuth from stored credentials  |\n * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |\n * | openai_oauth_file   | OpenAI OAuth from stored credentials     |\n * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |\n * | google_oauth_file   | Google OAuth from stored credentials     |\n *\n * ## Example\n *\n * ```typescript\n * const resolver = createAuthResolver({ mode: 'auto' });\n * const credential = await resolver('anthropic');\n *\n * if (credential) {\n *   console.log(`Using ${credential.type} from ${credential.source}`);\n *   // Use credential.token for API requests\n * }\n * ```\n *\n * @module providers/auth\n */\n\nimport { getOAuthToken } from \"../oauth/index.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { lookupApiKey } from \"./api-keys.js\";\nimport {\n\tgetEvalOpsManagedProviderDefinition,\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"./evalops-managed.js\";\nimport { getFreshOpenAIOAuthCredential } from \"./openai-auth.js\";\n\nexport type AuthMode = \"auto\" | \"api-key\" | \"claude\";\n\nexport type AuthCredentialType = \"api-key\" | \"anthropic-oauth\";\n\nexport type AuthCredentialSource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"anthropic_oauth_env\"\n\t| \"anthropic_oauth_file\"\n\t| \"evalops_oauth_file\"\n\t| \"openai_oauth_file\"\n\t| \"openai_codex_oauth_file\"\n\t| \"google_oauth_file\"\n\t| \"github_copilot_oauth_file\";\n\nexport interface AuthCredential {\n\tprovider: string;\n\ttoken: string;\n\ttype: AuthCredentialType;\n\tsource: AuthCredentialSource;\n\tenvVar?: string;\n\theaders?: Record<string, string>;\n\tmetadata?: Record<string, unknown>;\n\trequestBody?: Record<string, unknown>;\n}\n\nexport interface AuthResolverOptions {\n\tmode: AuthMode;\n\texplicitApiKey?: string;\n}\n\ntype AuthResolver = (provider: string) => Promise<AuthCredential | undefined>;\n\nconst ANTHROPIC_OAUTH_ENV_VARS = [\n\t\"CLAUDE_CODE_TOKEN\",\n\t\"ANTHROPIC_OAUTH_TOKEN\",\n\t\"ANTHROPIC_ACCESS_TOKEN\",\n];\n\nfunction isOpenAIProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized !== \"openai-codex\" &&\n\t\t(normalized === \"openai\" ||\n\t\t\tnormalized.startsWith(\"openai/\") ||\n\t\t\tnormalized.includes(\"openai-\"))\n\t);\n}\n\nfunction isOpenAICodexProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn normalized === \"openai-codex\";\n}\n\nfunction isGoogleGeminiCliProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized === \"google-gemini-cli\" || normalized === \"google-antigravity\"\n\t);\n}\n\nfunction isGitHubCopilotProvider(provider: string): boolean {\n\treturn provider.toLowerCase() === \"github-copilot\";\n}\n\nfunction resolveEvalOpsCredentialType(provider: string): AuthCredentialType {\n\treturn getEvalOpsManagedProviderDefinition(provider)?.usesAnthropicOAuth\n\t\t? \"anthropic-oauth\"\n\t\t: \"api-key\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getNonEmptyString(value: unknown): string | undefined {\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction resolveEvalOpsOrganizationId(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst candidate = getNonEmptyString(metadata?.organizationId);\n\tif (candidate && candidate.trim().length > 0) {\n\t\treturn candidate.trim();\n\t}\n\tfor (const envVar of [\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]) {\n\t\tconst value = process.env[envVar]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction resolveEvalOpsProviderRef(\n\tprovider: string,\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: null;\n\tconst definition = getEvalOpsManagedProviderDefinition(provider);\n\tconst metadataProvider = getNonEmptyString(providerRef?.provider);\n\tconst configuredProvider =\n\t\tprocess.env.MAESTRO_EVALOPS_PROVIDER?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_PROVIDER?.trim();\n\tconst resolvedProvider =\n\t\t(definition && definition.id !== \"evalops\"\n\t\t\t? definition.providerRefProvider\n\t\t\t: undefined) ??\n\t\tmetadataProvider ??\n\t\tconfiguredProvider ??\n\t\tdefinition?.providerRefProvider ??\n\t\t\"openai\";\n\tconst environment =\n\t\tgetNonEmptyString(providerRef?.environment) ??\n\t\tprocess.env.MAESTRO_EVALOPS_ENVIRONMENT?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_ENVIRONMENT?.trim() ??\n\t\t\"prod\";\n\tconst credentialName =\n\t\tgetNonEmptyString(providerRef?.credential_name) ??\n\t\tprocess.env.MAESTRO_EVALOPS_CREDENTIAL_NAME?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME?.trim();\n\tconst teamId =\n\t\tgetNonEmptyString(providerRef?.team_id) ??\n\t\tprocess.env.MAESTRO_EVALOPS_TEAM_ID?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_TEAM_ID?.trim();\n\treturn {\n\t\tprovider: resolvedProvider,\n\t\tenvironment,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamId ? { team_id: teamId } : {}),\n\t};\n}\n\nfunction resolveEvalOpsRequestMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries({\n\t\t\tagent_id:\n\t\t\t\tgetNonEmptyString(metadata?.agentId) ??\n\t\t\t\tgetNonEmptyString(metadata?.agent_id) ??\n\t\t\t\tprocess.env.MAESTRO_EVALOPS_AGENT_ID?.trim() ??\n\t\t\t\tprocess.env.MAESTRO_AGENT_ID?.trim(),\n\t\t\trun_id:\n\t\t\t\tgetNonEmptyString(metadata?.runId) ??\n\t\t\t\tgetNonEmptyString(metadata?.run_id) ??\n\t\t\t\tprocess.env.MAESTRO_EVALOPS_RUN_ID?.trim(),\n\t\t\tsession_id:\n\t\t\t\tgetNonEmptyString(metadata?.sessionId) ??\n\t\t\t\tgetNonEmptyString(metadata?.session_id) ??\n\t\t\t\tprocess.env.MAESTRO_SESSION_ID?.trim(),\n\t\t\tsurface:\n\t\t\t\tgetNonEmptyString(metadata?.surface) ??\n\t\t\t\tprocess.env.MAESTRO_EVALOPS_SURFACE?.trim() ??\n\t\t\t\tprocess.env.MAESTRO_SURFACE?.trim() ??\n\t\t\t\t\"maestro\",\n\t\t}).filter(\n\t\t\t(entry): entry is [string, string] =>\n\t\t\t\ttypeof entry[1] === \"string\" && entry[1].trim().length > 0,\n\t\t),\n\t);\n}\n\nfunction buildEvalOpsCredential(\n\tprovider: string,\n\ttoken: string,\n\tsource: AuthCredentialSource,\n\tmetadata?: Record<string, unknown>,\n\tenvVar?: string,\n): AuthCredential | undefined {\n\tconst organizationId = resolveEvalOpsOrganizationId(metadata);\n\tif (!organizationId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tprovider,\n\t\ttoken,\n\t\ttype: resolveEvalOpsCredentialType(provider),\n\t\tsource,\n\t\tenvVar,\n\t\theaders: {\n\t\t\t\"X-Organization-ID\": organizationId,\n\t\t},\n\t\tmetadata,\n\t\trequestBody: {\n\t\t\tmetadata: resolveEvalOpsRequestMetadata(metadata),\n\t\t\tprovider_ref: resolveEvalOpsProviderRef(provider, metadata),\n\t\t},\n\t};\n}\n\nexport function createAuthResolver(options: AuthResolverOptions): AuthResolver {\n\tconst explicitKey = options.explicitApiKey?.trim();\n\treturn async (provider: string): Promise<AuthCredential | undefined> => {\n\t\tif (\n\t\t\tisKnownEvalOpsManagedProvider(provider) &&\n\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst normalizedProvider = provider.toLowerCase();\n\n\t\tif (explicitKey) {\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(provider, explicitKey, \"explicit\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: explicitKey,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: \"explicit\",\n\t\t\t};\n\t\t}\n\n\t\tif (isEvalOpsManagedProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"evalops\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"evalops\");\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\toauthToken,\n\t\t\t\t\t\"evalops_oauth_file\",\n\t\t\t\t\tcredentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (isOpenAICodexProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"openai-codex\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"openai-codex\");\n\t\t\t\tconst accountId =\n\t\t\t\t\ttypeof credentials?.metadata?.accountId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.accountId\n\t\t\t\t\t\t: undefined;\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_codex_oauth_file\",\n\t\t\t\t\theaders: accountId ? { \"chatgpt-account-id\": accountId } : undefined,\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Handle OpenAI Auth\n\t\tif (isOpenAIProvider(provider) && options.mode !== \"api-key\") {\n\t\t\t// OpenAI OAuth\n\t\t\tconst oauthCred = await getFreshOpenAIOAuthCredential();\n\t\t\tif (oauthCred?.apiKey) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthCred.apiKey,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_oauth_file\",\n\t\t\t\t\tmetadata: { mode: oauthCred.mode },\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGitHubCopilotProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"github-copilot\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"github-copilot\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"github_copilot_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGoogleGeminiCliProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthProvider =\n\t\t\t\tnormalizedProvider === \"google-antigravity\"\n\t\t\t\t\t? \"google-antigravity\"\n\t\t\t\t\t: \"google-gemini-cli\";\n\t\t\tconst oauthToken = await getOAuthToken(oauthProvider);\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(oauthProvider);\n\t\t\t\tconst projectId =\n\t\t\t\t\ttypeof credentials?.metadata?.projectId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.projectId\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (projectId) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken: JSON.stringify({ token: oauthToken, projectId }),\n\t\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\t\tsource: \"google_oauth_file\",\n\t\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst preferAnthropicOAuth =\n\t\t\tnormalizedProvider === \"anthropic\" && options.mode !== \"api-key\";\n\n\t\tif (preferAnthropicOAuth) {\n\t\t\tconst envTokenEntry = ANTHROPIC_OAUTH_ENV_VARS.map((envVar) => ({\n\t\t\t\tenvVar,\n\t\t\t\ttoken: process.env[envVar]?.trim(),\n\t\t\t})).find((entry) => entry.token);\n\t\t\tif (envTokenEntry?.token) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: envTokenEntry.token,\n\t\t\t\t\ttype: \"anthropic-oauth\",\n\t\t\t\t\tsource: \"anthropic_oauth_env\",\n\t\t\t\t\tenvVar: envTokenEntry.envVar,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Try OAuth system (oauth.json)\n\t\t\tconst oauthToken = await getOAuthToken(\"anthropic\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"anthropic\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"anthropic-oauth\",\n\t\t\t\t\tsource: \"anthropic_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (options.mode === \"claude\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tconst lookup = lookupApiKey(provider, explicitKey);\n\t\tif (lookup.key) {\n\t\t\tif (lookup.source === \"missing\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tlookup.key,\n\t\t\t\t\tlookup.source,\n\t\t\t\t\tundefined,\n\t\t\t\t\tlookup.envVar,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: lookup.key,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: lookup.source,\n\t\t\t\tenvVar: lookup.envVar,\n\t\t\t};\n\t\t}\n\t\treturn undefined;\n\t};\n}\n"]}

package/dist/remote-runner/attach-client.d.ts

@@ -0,0 +1,41 @@
+import type { Readable, Writable } from "node:stream";
+import { type HeadlessRuntimeState } from "../cli/headless-protocol.js";
+export interface RemoteRunnerAttachConnection {
+    sessionId: string;
+    connectionId: string;
+    subscriptionId: string;
+    heartbeatIntervalMs: number;
+    role: "viewer" | "controller";
+    state: HeadlessRuntimeState;
+}
+export interface RemoteRunnerAttachConnectInput {
+    gatewayBaseUrl: string;
+    sessionId: string;
+    tokenId: string;
+    tokenSecret: string;
+    role: "viewer" | "controller";
+    clientName?: string;
+    clientVersion?: string;
+    protocolVersion?: string;
+    takeControl?: boolean;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}
+export interface RemoteRunnerAttachInput extends RemoteRunnerAttachConnectInput {
+    stdin?: Readable;
+    stdout?: Writable & {
+        isTTY?: boolean;
+    };
+    stderr?: Writable & {
+        isTTY?: boolean;
+    };
+}
+export declare function connectToRemoteRunnerSession(input: RemoteRunnerAttachConnectInput): Promise<RemoteRunnerAttachConnection>;
+export declare function shouldUseInteractiveRemoteAttach(input: {
+    json: boolean;
+    printEnv: boolean;
+    stdinIsTTY: boolean;
+    stdoutIsTTY: boolean;
+}): boolean;
+export declare function attachToRemoteRunnerSession(input: RemoteRunnerAttachInput): Promise<void>;
+//# sourceMappingURL=attach-client.d.ts.map

package/dist/remote-runner/attach-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach-client.d.ts","sourceRoot":"","sources":["../../src/remote-runner/attach-client.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAStD,OAAO,EAIN,KAAK,oBAAoB,EAMzB,MAAM,6BAA6B,CAAC;AAKrC,MAAM,WAAW,4BAA4B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9B,KAAK,EAAE,oBAAoB,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACzB;AAED,MAAM,WAAW,uBAChB,SAAQ,8BAA8B;IACtC,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACxC,MAAM,CAAC,EAAE,QAAQ,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACxC;AA4TD,wBAAsB,4BAA4B,CACjD,KAAK,EAAE,8BAA8B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CAyEvC;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACvD,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACrB,GAAG,OAAO,CAIV;AAmFD,wBAAsB,2BAA2B,CAChD,KAAK,EAAE,uBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CA6Yf"}