@f5-sales-demo/pi-ai 20.5.0 → 20.6.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "20.5.0",
+	"version": "20.6.0",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "^0.115",
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
-		"@f5-sales-demo/pi-utils": "20.5.0",
+		"@f5-sales-demo/pi-utils": "20.6.0",
 		"@google/genai": "^2.15",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",

package/src/auth-storage.ts

@@ -60,7 +60,14 @@ import { loginQwenPortal } from "./utils/oauth/qwen-portal";
 import { loginSynthetic } from "./utils/oauth/synthetic";
 import { loginTavily } from "./utils/oauth/tavily";
 import { loginTogether } from "./utils/oauth/together";
-import type { OAuthController, OAuthCredentials, OAuthProvider, OAuthProviderId } from "./utils/oauth/types";
+import type {
+	OAuthController,
+	OAuthCredentials,
+	OAuthPrompt,
+	OAuthProvider,
+	OAuthProviderId,
+} from "./utils/oauth/types";
+import { canonicalizeOAuthProviderId } from "./utils/oauth/types";
 import { loginVenice } from "./utils/oauth/venice";
 import { loginVercelAiGateway } from "./utils/oauth/vercel-ai-gateway";
 import { loginVllm } from "./utils/oauth/vllm";
@@ -337,14 +344,14 @@ export class AuthStorage {
 	 * Used for CLI --api-key flag.
 	 */
 	setRuntimeApiKey(provider: string, apiKey: string): void {
-		this.#runtimeOverrides.set(provider, apiKey);
+		this.#runtimeOverrides.set(canonicalizeOAuthProviderId(provider), apiKey);
 	}
 
 	/**
 	 * Remove a runtime API key override.
 	 */
 	removeRuntimeApiKey(provider: string): void {
-		this.#runtimeOverrides.delete(provider);
+		this.#runtimeOverrides.delete(canonicalizeOAuthProviderId(provider));
 	}
 
 	/**
@@ -640,13 +647,14 @@ export class AuthStorage {
 	 * Get credential for a provider (first entry if multiple).
 	 */
 	get(provider: string): AuthCredential | undefined {
-		return this.#getCredentialsForProvider(provider)[0];
+		return this.#getCredentialsForProvider(canonicalizeOAuthProviderId(provider))[0];
 	}
 
 	/**
 	 * Set credential for a provider.
 	 */
 	async set(provider: string, credential: AuthCredentialEntry): Promise<void> {
+		provider = canonicalizeOAuthProviderId(provider);
 		const normalized = Array.isArray(credential) ? credential : [credential];
 		const deduped = this.#dedupeOAuthCredentials(provider, normalized);
 		const stored = this.#store.replaceAuthCredentialsForProvider(provider, deduped);
@@ -670,6 +678,7 @@ export class AuthStorage {
 	 * Remove credential for a provider.
 	 */
 	async remove(provider: string): Promise<void> {
+		provider = canonicalizeOAuthProviderId(provider);
 		this.#store.deleteAuthCredentialsForProvider(provider, "deleted by user");
 		this.#data.delete(provider);
 		this.#resetProviderAssignments(provider);
@@ -686,7 +695,7 @@ export class AuthStorage {
 	 * Check if credentials exist for a provider in storage.
 	 */
 	has(provider: string): boolean {
-		return this.#getCredentialsForProvider(provider).length > 0;
+		return this.#getCredentialsForProvider(canonicalizeOAuthProviderId(provider)).length > 0;
 	}
 
 	/**
@@ -694,6 +703,7 @@ export class AuthStorage {
 	 * Unlike getApiKey(), this doesn't refresh OAuth tokens.
 	 */
 	hasAuth(provider: string): boolean {
+		provider = canonicalizeOAuthProviderId(provider);
 		if (this.#runtimeOverrides.has(provider)) return true;
 		if (this.#getCredentialsForProvider(provider).length > 0) return true;
 		if (getEnvApiKey(provider)) return true;
@@ -705,14 +715,16 @@ export class AuthStorage {
 	 * Check if OAuth credentials are configured for a provider.
 	 */
 	hasOAuth(provider: string): boolean {
-		return this.#getCredentialsForProvider(provider).some(credential => credential.type === "oauth");
+		return this.#getCredentialsForProvider(canonicalizeOAuthProviderId(provider)).some(
+			credential => credential.type === "oauth",
+		);
 	}
 
 	/**
 	 * Get OAuth credentials for a provider.
 	 */
 	getOAuthCredential(provider: string): OAuthCredential | undefined {
-		return this.#getCredentialsForProvider(provider).find(
+		return this.#getCredentialsForProvider(canonicalizeOAuthProviderId(provider)).find(
 			(credential): credential is OAuthCredential => credential.type === "oauth",
 		);
 	}
@@ -742,13 +754,14 @@ export class AuthStorage {
 			/** onAuth is required by auth-storage but optional in OAuthController */
 			onAuth: (info: { url: string; instructions?: string }) => void;
 			/** onPrompt is required for some providers (github-copilot, openai-codex) */
-			onPrompt: (prompt: { message: string; placeholder?: string }) => Promise<string>;
+			onPrompt: (prompt: OAuthPrompt) => Promise<string>;
 		},
 	): Promise<void> {
 		let credentials: OAuthCredentials;
+		const credentialProvider = canonicalizeOAuthProviderId(provider);
 		const saveApiKeyCredential = async (apiKey: string): Promise<void> => {
 			const newCredential: ApiKeyCredential = { type: "api_key", key: apiKey };
-			await this.set(provider, newCredential);
+			await this.set(credentialProvider, newCredential);
 		};
 		const manualCodeInput = () => ctrl.onPrompt({ message: "Paste the authorization code (or full redirect URL):" });
 		switch (provider) {
@@ -783,6 +796,22 @@ export class AuthStorage {
 					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
 				});
 				break;
+			case "google-antigravity-enterprise":
+				credentials = await loginAntigravity(
+					{
+						...ctrl,
+						onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
+					},
+					{
+						enterpriseRequired: true,
+						projectSources: {
+							environment: {},
+							readAntigravityProjectId: async () => undefined,
+							readGcloudProjectId: async () => undefined,
+						},
+					},
+				);
+				break;
 			case "openai-codex":
 				credentials = await loginOpenAICodex({
 					...ctrl,
@@ -960,7 +989,7 @@ export class AuthStorage {
 			}
 		}
 		const newCredential: OAuthCredential = { type: "oauth", ...credentials };
-		await this.#upsertOAuthCredential(provider, newCredential);
+		await this.#upsertOAuthCredential(credentialProvider, newCredential);
 	}
 
 	/**
@@ -983,6 +1012,7 @@ export class AuthStorage {
 			expiresAt: credential.expires,
 			accountId: credential.accountId,
 			projectId: credential.projectId,
+			tierId: credential.tierId,
 			email: credential.email,
 			enterpriseUrl: credential.enterpriseUrl,
 		};
@@ -1057,6 +1087,7 @@ export class AuthStorage {
 			expires: credential.expiresAt,
 			accountId: credential.accountId,
 			projectId: credential.projectId,
+			tierId: credential.tierId,
 			email: credential.email,
 			enterpriseUrl: credential.enterpriseUrl,
 		};
@@ -1070,6 +1101,7 @@ export class AuthStorage {
 			expiresAt: refreshed.expires,
 			accountId: refreshed.accountId ?? credential.accountId,
 			projectId: refreshed.projectId ?? credential.projectId,
+			tierId: refreshed.tierId ?? credential.tierId,
 			email: refreshed.email ?? credential.email,
 			enterpriseUrl: refreshed.enterpriseUrl ?? credential.enterpriseUrl,
 		};
@@ -1097,6 +1129,7 @@ export class AuthStorage {
 			expires: next.expiresAt ?? existing.expires,
 			accountId: next.accountId,
 			projectId: next.projectId,
+			tierId: next.tierId ?? existing.tierId,
 			email: next.email,
 			enterpriseUrl: next.enterpriseUrl,
 		});
@@ -1826,6 +1859,7 @@ export class AuthStorage {
 				accountId: result.newCredentials.accountId ?? selection.credential.accountId,
 				email: result.newCredentials.email ?? selection.credential.email,
 				projectId: result.newCredentials.projectId ?? selection.credential.projectId,
+				tierId: result.newCredentials.tierId ?? selection.credential.tierId,
 				enterpriseUrl: result.newCredentials.enterpriseUrl ?? selection.credential.enterpriseUrl,
 			};
 			this.#replaceCredentialAt(provider, selection.index, updated);
@@ -1886,6 +1920,7 @@ export class AuthStorage {
 	 * routing metadata so discovery can hit the correct host.
 	 */
 	async peekApiKey(provider: string): Promise<string | undefined> {
+		provider = canonicalizeOAuthProviderId(provider);
 		const runtimeKey = this.#runtimeOverrides.get(provider);
 		if (runtimeKey) {
 			return runtimeKey;
@@ -1927,6 +1962,7 @@ export class AuthStorage {
 	 * 5. Fallback resolver (models.json custom providers)
 	 */
 	async getApiKey(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined> {
+		provider = canonicalizeOAuthProviderId(provider);
 		// Runtime override takes highest priority
 		const runtimeKey = this.#runtimeOverrides.get(provider);
 		if (runtimeKey) {

package/src/usage.ts

@@ -87,6 +87,7 @@ export interface UsageCredential {
 	expiresAt?: number;
 	accountId?: string;
 	projectId?: string;
+	tierId?: string;
 	email?: string;
 	enterpriseUrl?: string;
 	metadata?: Record<string, unknown>;

package/src/utils/oauth/google-antigravity.ts

@@ -81,6 +81,11 @@ export interface AntigravityProjectSources {
 
 export interface AntigravityLoginOptions {
 	projectSources?: AntigravityProjectSources;
+	enterpriseRequired?: boolean;
+}
+
+export interface AntigravityProjectPolicy {
+	enterpriseRequired?: boolean;
 }
 
 function normalizeProjectId(value: unknown): string | undefined {
@@ -134,6 +139,7 @@ async function readExternalProjectId(source: () => Promise<string | undefined>):
 export async function resolveAntigravityProjectId(
 	ctrl: OAuthController,
 	sources: AntigravityProjectSources = {},
+	policy: AntigravityProjectPolicy = {},
 ): Promise<string | undefined> {
 	const environment = sources.environment ?? {
 		GOOGLE_CLOUD_PROJECT: $env.GOOGLE_CLOUD_PROJECT,
@@ -160,13 +166,22 @@ export async function resolveAntigravityProjectId(
 		return gcloudProjectId;
 	}
 
-	if (!ctrl.onPrompt) return undefined;
+	const enterpriseError = "Enterprise authentication requires an explicit Google Cloud project";
+	if (!ctrl.onPrompt) {
+		if (policy.enterpriseRequired) throw new Error(enterpriseError);
+		return undefined;
+	}
 	const input = await ctrl.onPrompt({
-		message: "Google Cloud project ID (leave blank to use individual-tier discovery):",
+		message: policy.enterpriseRequired
+			? "Enterprise Google Cloud project ID (required; individual/free tier is disabled):"
+			: "Google Cloud project ID (leave blank to use individual-tier discovery):",
 		placeholder: "my-enterprise-project",
-		allowEmpty: true,
+		allowEmpty: !policy.enterpriseRequired,
 	});
-	if (!input.trim()) return undefined;
+	if (!input.trim()) {
+		if (policy.enterpriseRequired) throw new Error(enterpriseError);
+		return undefined;
+	}
 	const promptedProjectId = normalizeProjectId(input);
 	if (!promptedProjectId) {
 		throw new Error(
@@ -404,6 +419,7 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
 			access: tokenData.access_token,
 			expires: Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000,
 			projectId,
+			...(this.#configuredProjectId ? { tierId: TIER_STANDARD } : {}),
 			email,
 		};
 	}
@@ -416,7 +432,9 @@ export async function loginAntigravity(
 	ctrl: OAuthController,
 	options: AntigravityLoginOptions = {},
 ): Promise<OAuthCredentials> {
-	const configuredProjectId = await resolveAntigravityProjectId(ctrl, options.projectSources);
+	const configuredProjectId = await resolveAntigravityProjectId(ctrl, options.projectSources, {
+		enterpriseRequired: options.enterpriseRequired,
+	});
 	const flow = new AntigravityOAuthFlow(ctrl, configuredProjectId);
 	return flow.login();
 }

package/src/utils/oauth/index.ts

@@ -186,6 +186,13 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "Antigravity (Gemini 3, Claude, GPT-OSS)",
 		available: true,
 	},
+	{
+		id: "google-antigravity-enterprise",
+		name: "Google Antigravity Enterprise (Gemini 3.6 Flash High)",
+		available: true,
+		canonicalId: "google-antigravity",
+		loginOnly: true,
+	},
 	{
 		id: "cursor",
 		name: "Cursor (Claude, GPT, etc.)",

package/src/utils/oauth/litellm.ts

@@ -68,6 +68,7 @@ export async function loginLiteLLM(options: LiteLLMLoginOptions): Promise<LiteLL
 	const rawKey = await options.onPrompt({
 		message: `LiteLLM API Key${defaultKeyHint}`,
 		placeholder: "sk-...",
+		secret: true,
 	});
 
 	if (options.signal?.aborted) throw new Error("Login cancelled");

package/src/utils/oauth/types.ts

@@ -4,6 +4,8 @@ export type OAuthCredentials = {
 	expires: number;
 	enterpriseUrl?: string;
 	projectId?: string;
+	/** Durable entitlement certified during enterprise project discovery. */
+	tierId?: string;
 	email?: string;
 	accountId?: string;
 };
@@ -17,6 +19,7 @@ export type OAuthProvider =
 	| "github-copilot"
 	| "google-gemini-cli"
 	| "google-antigravity"
+	| "google-antigravity-enterprise"
 	| "gitlab-duo"
 	| "huggingface"
 	| "kimi-code"
@@ -53,6 +56,8 @@ export type OAuthPrompt = {
 	message: string;
 	placeholder?: string;
 	allowEmpty?: boolean;
+	/** Render this prompt with obscured input because it collects a credential. */
+	secret?: boolean;
 };
 
 export type OAuthAuthInfo = {
@@ -64,6 +69,15 @@ export interface OAuthProviderInfo {
 	id: OAuthProviderId;
 	name: string;
 	available: boolean;
+	/** Provider ID used for persisted credentials and model routing. */
+	canonicalId?: OAuthProvider;
+	/** Entry is offered for login but omitted from logout to avoid alias duplicates. */
+	loginOnly?: boolean;
+}
+
+/** Resolve login-only aliases to the provider ID used by credentials and models. */
+export function canonicalizeOAuthProviderId(provider: string): string {
+	return provider === "google-antigravity-enterprise" ? "google-antigravity" : provider;
 }
 
 export interface OAuthController {