@geminixiang/mikan 1.0.0-beta.6 → 1.0.0-beta.60

package/dist/harness/models.js

@@ -2,7 +2,7 @@
  * Model catalog for the mikan harness.
  *
  * Wraps pi-ai's `Models` collection: all built-in providers are registered
- * with credentials resolved through mikan's auth.json, and custom providers
+ * with credentials resolved from provider env vars, and custom providers
  * or overrides can be added via a `models.json` file
  * (`~/.mikan/models.json` by default).
  *
@@ -14,7 +14,7 @@
  *     "my-provider": {
  *       "api": "openai-completions",     // required when models are listed
  *       "baseUrl": "http://host/v1",
- *       "apiKey": "literal-key",          // optional; auth.json / MY_PROVIDER_API_KEY otherwise
+ *       "apiKey": "literal-key",          // optional; MY_PROVIDER_API_KEY env var otherwise
  *       "headers": { },
  *       "compat": { },
  *       "models": [{ "id": "m", "name": "M", "input": ["text"], "reasoning": false }]
@@ -24,9 +24,8 @@
  * }
  * ```
  */
-import { existsSync, readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { createProvider, } from "@earendil-works/pi-ai";
 import { builtinModels } from "@earendil-works/pi-ai/providers/all";
 import { anthropicMessagesApi } from "@earendil-works/pi-ai/api/anthropic-messages.lazy";
@@ -35,7 +34,7 @@ import { googleGenerativeAIApi } from "@earendil-works/pi-ai/api/google-generati
 import { mistralConversationsApi } from "@earendil-works/pi-ai/api/mistral-conversations.lazy";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { openAIResponsesApi } from "@earendil-works/pi-ai/api/openai-responses.lazy";
-import { defaultAuthPath, FileCredentialStore } from "./auth.js";
+import { readJsonFileIfExists } from "../file-guards.js";
 const CUSTOM_API_STREAMS = {
     "anthropic-messages": anthropicMessagesApi,
     "azure-openai-responses": azureOpenAIResponsesApi,
@@ -51,14 +50,13 @@ const DEFAULT_MAX_TOKENS = 16384;
 export function defaultModelsJsonPath() {
     return join(homedir(), ".mikan", "models.json");
 }
-function parseModelsJson(path) {
-    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+function isModelsJsonConfig(parsed) {
     if (!parsed || typeof parsed !== "object") {
         throw new Error("models.json must be a JSON object");
     }
     const providers = parsed.providers;
     if (providers === undefined)
-        return undefined;
+        return true;
     if (!providers || typeof providers !== "object" || Array.isArray(providers)) {
         throw new Error('models.json "providers" must be an object');
     }
@@ -82,11 +80,37 @@ function parseModelsJson(path) {
             }
         }
     }
-    return parsed;
+    return true;
 }
 function envVarNameFor(providerName) {
     return `${providerName.replace(/[^a-zA-Z0-9]+/g, "_").toUpperCase()}_API_KEY`;
 }
+/**
+ * Register models.json providers on top of the built-ins: a provider with its
+ * own model list replaces wholesale; a bare baseUrl/compat entry overrides a
+ * matching built-in in place. Returns a user-facing load error, if any —
+ * built-in models stay available either way.
+ */
+function applyModelsJson(models, modelsJsonPath) {
+    try {
+        const config = readJsonFileIfExists(modelsJsonPath, isModelsJsonConfig, (detail) => `models.json is invalid: ${detail}`);
+        for (const [providerName, providerConfig] of Object.entries(config?.providers ?? {})) {
+            if (providerConfig.models && providerConfig.models.length > 0) {
+                models.setProvider(buildCustomProvider(providerName, providerConfig));
+            }
+            else if (providerConfig.baseUrl || providerConfig.compat) {
+                const builtin = models.getProvider(providerName);
+                if (builtin) {
+                    models.setProvider(overrideBuiltinProvider(builtin, providerConfig));
+                }
+            }
+        }
+        return undefined;
+    }
+    catch (err) {
+        return `Failed to load ${modelsJsonPath}: ${err instanceof Error ? err.message : String(err)}`;
+    }
+}
 function buildCustomProvider(providerName, config) {
     const api = config.api;
     const displayName = config.name ?? providerName;
@@ -128,11 +152,7 @@ function buildCustomProvider(providerName, config) {
                         (await ctx.env(envVar));
                     if (!key)
                         return undefined;
-                    const source = credential?.type === "api_key" && credential.key
-                        ? "auth.json"
-                        : config.apiKey
-                            ? "models.json"
-                            : envVar;
+                    const source = config.apiKey ? "models.json" : envVar;
                     return { auth: { apiKey: key }, source };
                 },
             },
@@ -166,29 +186,9 @@ export class MikanModels {
         this.loadError = loadError;
     }
     static create(options = {}) {
-        const authPath = options.authPath ?? defaultAuthPath();
         const modelsJsonPath = options.modelsJsonPath ?? defaultModelsJsonPath();
-        const models = builtinModels({ credentials: new FileCredentialStore(authPath) });
-        let loadError;
-        if (existsSync(modelsJsonPath)) {
-            try {
-                const config = parseModelsJson(modelsJsonPath);
-                for (const [providerName, providerConfig] of Object.entries(config?.providers ?? {})) {
-                    if (providerConfig.models && providerConfig.models.length > 0) {
-                        models.setProvider(buildCustomProvider(providerName, providerConfig));
-                    }
-                    else if (providerConfig.baseUrl || providerConfig.compat) {
-                        const builtin = models.getProvider(providerName);
-                        if (builtin) {
-                            models.setProvider(overrideBuiltinProvider(builtin, providerConfig));
-                        }
-                    }
-                }
-            }
-            catch (err) {
-                loadError = `Failed to load ${modelsJsonPath}: ${err instanceof Error ? err.message : String(err)}`;
-            }
-        }
+        const models = builtinModels();
+        const loadError = applyModelsJson(models, modelsJsonPath);
         return new MikanModels(models, loadError);
     }
     /** Error from loading models.json, if any. Built-in models stay available. */
@@ -203,26 +203,28 @@ export class MikanModels {
     find(provider, modelId) {
         return this.models.getModel(provider, modelId);
     }
+    /**
+     * Find a model by provider and id, or throw a user-facing configuration error.
+     * Prefer this at runtime entry points over raw `find` + ad-hoc throws.
+     */
+    resolve(provider, modelId) {
+        const model = this.find(provider, modelId);
+        if (model)
+            return model;
+        throw new Error(`Unknown model "${provider}/${modelId}". Configure it in pi models.json or choose a registered model.`);
+    }
     /** Models whose provider auth currently resolves (API key, OAuth, or ambient). */
     async getAvailable() {
-        const byProvider = new Map();
-        for (const model of this.models.getModels()) {
-            const group = byProvider.get(model.provider) ?? [];
-            group.push(model);
-            byProvider.set(model.provider, group);
-        }
-        const available = [];
-        for (const group of byProvider.values()) {
+        const available = await Promise.all(this.models.getProviders().map(async (provider) => {
             try {
-                const auth = await this.models.getAuth(group[0]);
-                if (auth)
-                    available.push(...group);
+                return await this.models.getAvailable(provider.id);
             }
             catch {
-                // Auth resolution failure (e.g. expired OAuth) — treat as unavailable.
+                // One provider's auth failure must not hide models from other providers.
+                return [];
             }
-        }
-        return available;
+        }));
+        return available.flat();
     }
     /** Resolve request auth for a model. Undefined when unconfigured. */
     getAuth(model) {
@@ -233,11 +235,8 @@ export class MikanModels {
      * need a bearer key (for example pi-agent-core's compat stream function).
      */
     async getApiKeyForProvider(provider) {
-        const model = this.models.getModels(provider)[0];
-        if (!model)
-            return undefined;
         try {
-            const auth = await this.models.getAuth(model);
+            const auth = await this.models.getAuth(provider);
             return auth?.auth.apiKey;
         }
         catch {

package/dist/harness/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/harness/models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,cAAc,GAQf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mDAAmD,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,mDAAmD,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,kBAAkB,GAA0C;IAChE,oBAAoB,EAAE,oBAAoB;IAC1C,wBAAwB,EAAE,uBAAuB;IACjD,sBAAsB,EAAE,qBAAqB;IAC7C,uBAAuB,EAAE,uBAAuB;IAChD,oBAAoB,EAAE,oBAAoB;IAC1C,kBAAkB,EAAE,kBAAkB;CACvC,CAAC;AAEF,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC1E,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAiCjC,+CAA+C;AAC/C,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAAI,MAAkC,CAAC,SAAS,CAAC;IAChE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qBAAqB,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,2BAA2B,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,GAAG,GAAI,MAA+B,CAAC,GAAG,CAAC;YACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,wBAAwB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClG,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACxE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qCAAqC,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAA0B,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB;IACzC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC;AAChF,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAoB,EAAE,MAA4B;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAI,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAc,EAAE;QACnE,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE;YACxC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,IAAI,GAAG,CAAQ;YACpC,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;YACpD,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,KAAK;YACzC,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;YACpC,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,YAAY;YACtC,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI,sBAAsB;YAClE,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,eAAe,IAAI,kBAAkB;SACtF,CAAC;QACF,IAAI,WAAW,CAAC,gBAAgB;YAAE,KAAK,CAAC,gBAAgB,GAAG,WAAW,CAAC,gBAAgB,CAAC;QACxF,IAAI,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QACnD,IAAI,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,MAA8B,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;QACpB,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,GAAG,WAAW,UAAU;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;oBACrC,MAAM,GAAG,GACP,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC7D,MAAM,CAAC,MAAM;wBACb,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC1B,IAAI,CAAC,GAAG;wBAAE,OAAO,SAAS,CAAC;oBAC3B,MAAM,MAAM,GACV,UAAU,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG;wBAC9C,CAAC,CAAC,WAAW;wBACb,CAAC,CAAC,MAAM,CAAC,MAAM;4BACb,CAAC,CAAC,aAAa;4BACf,CAAC,CAAC,MAAM,CAAC;oBACf,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;gBAC3C,CAAC;aACF;SACF;QACD,MAAM;QACN,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAAC,QAAkB,EAAE,MAA4B;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAc,EAAE;QAC5D,MAAM,UAAU,GAAe,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,OAAO;YAAE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAA8B,CAAC;QAC7E,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAOD;;;GAGG;AACH,MAAM,OAAO,WAAW;IAKtB,YAAoB,MAAqB,EAAE,SAA6B;QACtE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,OAAO,GAA6B,EAAE;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,WAAW,EAAE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEjF,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;gBAC/C,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;oBACrF,IAAI,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9D,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;oBACxE,CAAC;yBAAM,IAAI,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;wBAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;wBACjD,IAAI,OAAO,EAAE,CAAC;4BACZ,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;wBACvE,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,kBAAkB,cAAc,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtG,CAAC;QACH,CAAC;QACD,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,8EAA8E;IAC9E,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+CAA+C;IAC/C,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,QAAgB,EAAE,OAAe;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,YAAY;QAChB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,SAAS,GAAiB,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,IAAI,IAAI;oBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,OAAO,CAAC,KAAiB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * Model catalog for the mikan harness.\n *\n * Wraps pi-ai's `Models` collection: all built-in providers are registered\n * with credentials resolved through mikan's auth.json, and custom providers\n * or overrides can be added via a `models.json` file\n * (`~/.mikan/models.json` by default).\n *\n * models.json subset supported by mikan:\n *\n * ```jsonc\n * {\n *   \"providers\": {\n *     \"my-provider\": {\n *       \"api\": \"openai-completions\",     // required when models are listed\n *       \"baseUrl\": \"http://host/v1\",\n *       \"apiKey\": \"literal-key\",          // optional; auth.json / MY_PROVIDER_API_KEY otherwise\n *       \"headers\": { },\n *       \"compat\": { },\n *       \"models\": [{ \"id\": \"m\", \"name\": \"M\", \"input\": [\"text\"], \"reasoning\": false }]\n *     },\n *     \"anthropic\": { \"baseUrl\": \"https://proxy.example/v1\" }  // override built-in provider\n *   }\n * }\n * ```\n */\nimport { existsSync, readFileSync } from \"fs\";\nimport { homedir } from \"os\";\nimport { join } from \"path\";\nimport {\n  createProvider,\n  type Api,\n  type AuthResult,\n  type Model,\n  type Models,\n  type MutableModels,\n  type Provider,\n  type ProviderStreams,\n} from \"@earendil-works/pi-ai\";\nimport { builtinModels } from \"@earendil-works/pi-ai/providers/all\";\nimport { anthropicMessagesApi } from \"@earendil-works/pi-ai/api/anthropic-messages.lazy\";\nimport { azureOpenAIResponsesApi } from \"@earendil-works/pi-ai/api/azure-openai-responses.lazy\";\nimport { googleGenerativeAIApi } from \"@earendil-works/pi-ai/api/google-generative-ai.lazy\";\nimport { mistralConversationsApi } from \"@earendil-works/pi-ai/api/mistral-conversations.lazy\";\nimport { openAICompletionsApi } from \"@earendil-works/pi-ai/api/openai-completions.lazy\";\nimport { openAIResponsesApi } from \"@earendil-works/pi-ai/api/openai-responses.lazy\";\nimport { defaultAuthPath, FileCredentialStore } from \"./auth.js\";\n\nconst CUSTOM_API_STREAMS: Record<string, () => ProviderStreams> = {\n  \"anthropic-messages\": anthropicMessagesApi,\n  \"azure-openai-responses\": azureOpenAIResponsesApi,\n  \"google-generative-ai\": googleGenerativeAIApi,\n  \"mistral-conversations\": mistralConversationsApi,\n  \"openai-completions\": openAICompletionsApi,\n  \"openai-responses\": openAIResponsesApi,\n};\n\nconst DEFAULT_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };\nconst DEFAULT_CONTEXT_WINDOW = 128000;\nconst DEFAULT_MAX_TOKENS = 16384;\n\ninterface CustomModelConfig {\n  id: string;\n  name?: string;\n  api?: string;\n  baseUrl?: string;\n  reasoning?: boolean;\n  input?: (\"text\" | \"image\")[];\n  cost?: { input: number; output: number; cacheRead: number; cacheWrite: number };\n  contextWindow?: number;\n  maxTokens?: number;\n  /** Accepted alias for `maxTokens` (used by existing deployments). */\n  maxOutputTokens?: number;\n  thinkingLevelMap?: Model<Api>[\"thinkingLevelMap\"];\n  headers?: Record<string, string>;\n  compat?: unknown;\n}\n\ninterface CustomProviderConfig {\n  name?: string;\n  api?: string;\n  baseUrl?: string;\n  apiKey?: string;\n  headers?: Record<string, string>;\n  compat?: unknown;\n  models?: CustomModelConfig[];\n}\n\ninterface ModelsJsonConfig {\n  providers: Record<string, CustomProviderConfig>;\n}\n\n/** Default location of mikan's models.json. */\nexport function defaultModelsJsonPath(): string {\n  return join(homedir(), \".mikan\", \"models.json\");\n}\n\nfunction parseModelsJson(path: string): ModelsJsonConfig | undefined {\n  const parsed: unknown = JSON.parse(readFileSync(path, \"utf-8\"));\n  if (!parsed || typeof parsed !== \"object\") {\n    throw new Error(\"models.json must be a JSON object\");\n  }\n  const providers = (parsed as { providers?: unknown }).providers;\n  if (providers === undefined) return undefined;\n  if (!providers || typeof providers !== \"object\" || Array.isArray(providers)) {\n    throw new Error('models.json \"providers\" must be an object');\n  }\n  for (const [name, config] of Object.entries(providers)) {\n    if (!config || typeof config !== \"object\") {\n      throw new Error(`models.json provider \"${name}\" must be an object`);\n    }\n    const models = (config as CustomProviderConfig).models;\n    if (models !== undefined) {\n      if (!Array.isArray(models)) {\n        throw new Error(`models.json provider \"${name}\" models must be an array`);\n      }\n      const api = (config as CustomProviderConfig).api;\n      if (typeof api !== \"string\" || !(api in CUSTOM_API_STREAMS)) {\n        throw new Error(\n          `models.json provider \"${name}\" needs an \"api\" of: ${Object.keys(CUSTOM_API_STREAMS).join(\", \")}`,\n        );\n      }\n      for (const model of models) {\n        if (!model || typeof model !== \"object\" || typeof model.id !== \"string\") {\n          throw new Error(`models.json provider \"${name}\" has a model without a string \"id\"`);\n        }\n      }\n    }\n  }\n  return parsed as ModelsJsonConfig;\n}\n\nfunction envVarNameFor(providerName: string): string {\n  return `${providerName.replace(/[^a-zA-Z0-9]+/g, \"_\").toUpperCase()}_API_KEY`;\n}\n\nfunction buildCustomProvider(providerName: string, config: CustomProviderConfig): Provider {\n  const api = config.api!;\n  const displayName = config.name ?? providerName;\n  const envVar = envVarNameFor(providerName);\n  const models = (config.models ?? []).map((modelConfig): Model<Api> => {\n    const model: Model<Api> = {\n      id: modelConfig.id,\n      name: modelConfig.name ?? modelConfig.id,\n      api: (modelConfig.api ?? api) as Api,\n      provider: providerName,\n      baseUrl: modelConfig.baseUrl ?? config.baseUrl ?? \"\",\n      reasoning: modelConfig.reasoning ?? false,\n      input: modelConfig.input ?? [\"text\"],\n      cost: modelConfig.cost ?? DEFAULT_COST,\n      contextWindow: modelConfig.contextWindow ?? DEFAULT_CONTEXT_WINDOW,\n      maxTokens: modelConfig.maxTokens ?? modelConfig.maxOutputTokens ?? DEFAULT_MAX_TOKENS,\n    };\n    if (modelConfig.thinkingLevelMap) model.thinkingLevelMap = modelConfig.thinkingLevelMap;\n    if (modelConfig.headers ?? config.headers) {\n      model.headers = { ...config.headers, ...modelConfig.headers };\n    }\n    const compat = modelConfig.compat ?? config.compat;\n    if (compat) model.compat = compat as Model<Api>[\"compat\"];\n    return model;\n  });\n\n  return createProvider({\n    id: providerName,\n    name: displayName,\n    baseUrl: config.baseUrl,\n    headers: config.headers,\n    auth: {\n      apiKey: {\n        name: `${displayName} API key`,\n        resolve: async ({ ctx, credential }) => {\n          const key =\n            (credential?.type === \"api_key\" ? credential.key : undefined) ??\n            config.apiKey ??\n            (await ctx.env(envVar));\n          if (!key) return undefined;\n          const source =\n            credential?.type === \"api_key\" && credential.key\n              ? \"auth.json\"\n              : config.apiKey\n                ? \"models.json\"\n                : envVar;\n          return { auth: { apiKey: key }, source };\n        },\n      },\n    },\n    models,\n    api: CUSTOM_API_STREAMS[api](),\n  });\n}\n\n/** Rebuild a built-in provider with overridden model base URLs / compat. */\nfunction overrideBuiltinProvider(provider: Provider, config: CustomProviderConfig): Provider {\n  const models = provider.getModels().map((model): Model<Api> => {\n    const overridden: Model<Api> = Object.assign({}, model);\n    if (config.baseUrl) overridden.baseUrl = config.baseUrl;\n    if (config.compat) overridden.compat = config.compat as Model<Api>[\"compat\"];\n    return overridden;\n  });\n  return {\n    ...provider,\n    getModels: () => models,\n  };\n}\n\nexport interface CreateMikanModelsOptions {\n  authPath?: string;\n  modelsJsonPath?: string;\n}\n\n/**\n * Model catalog backed by pi-ai's `Models`. Exposes the lookup and auth\n * operations mikan needs; streaming goes through {@link MikanModels.models}.\n */\nexport class MikanModels {\n  /** Underlying pi-ai collection, for streaming/completion calls. */\n  readonly models: Models;\n  private loadError: string | undefined;\n\n  private constructor(models: MutableModels, loadError: string | undefined) {\n    this.models = models;\n    this.loadError = loadError;\n  }\n\n  static create(options: CreateMikanModelsOptions = {}): MikanModels {\n    const authPath = options.authPath ?? defaultAuthPath();\n    const modelsJsonPath = options.modelsJsonPath ?? defaultModelsJsonPath();\n    const models = builtinModels({ credentials: new FileCredentialStore(authPath) });\n\n    let loadError: string | undefined;\n    if (existsSync(modelsJsonPath)) {\n      try {\n        const config = parseModelsJson(modelsJsonPath);\n        for (const [providerName, providerConfig] of Object.entries(config?.providers ?? {})) {\n          if (providerConfig.models && providerConfig.models.length > 0) {\n            models.setProvider(buildCustomProvider(providerName, providerConfig));\n          } else if (providerConfig.baseUrl || providerConfig.compat) {\n            const builtin = models.getProvider(providerName);\n            if (builtin) {\n              models.setProvider(overrideBuiltinProvider(builtin, providerConfig));\n            }\n          }\n        }\n      } catch (err) {\n        loadError = `Failed to load ${modelsJsonPath}: ${err instanceof Error ? err.message : String(err)}`;\n      }\n    }\n    return new MikanModels(models, loadError);\n  }\n\n  /** Error from loading models.json, if any. Built-in models stay available. */\n  getError(): string | undefined {\n    return this.loadError;\n  }\n\n  /** All known models (built-in plus custom). */\n  getAll(): Model<Api>[] {\n    return [...this.models.getModels()];\n  }\n\n  /** Find a model by provider and id. */\n  find(provider: string, modelId: string): Model<Api> | undefined {\n    return this.models.getModel(provider, modelId);\n  }\n\n  /** Models whose provider auth currently resolves (API key, OAuth, or ambient). */\n  async getAvailable(): Promise<Model<Api>[]> {\n    const byProvider = new Map<string, Model<Api>[]>();\n    for (const model of this.models.getModels()) {\n      const group = byProvider.get(model.provider) ?? [];\n      group.push(model);\n      byProvider.set(model.provider, group);\n    }\n\n    const available: Model<Api>[] = [];\n    for (const group of byProvider.values()) {\n      try {\n        const auth = await this.models.getAuth(group[0]);\n        if (auth) available.push(...group);\n      } catch {\n        // Auth resolution failure (e.g. expired OAuth) — treat as unavailable.\n      }\n    }\n    return available;\n  }\n\n  /** Resolve request auth for a model. Undefined when unconfigured. */\n  getAuth(model: Model<Api>): Promise<AuthResult | undefined> {\n    return this.models.getAuth(model);\n  }\n\n  /**\n   * Resolve an API key for a provider. Convenience for call sites that only\n   * need a bearer key (for example pi-agent-core's compat stream function).\n   */\n  async getApiKeyForProvider(provider: string): Promise<string | undefined> {\n    const model = this.models.getModels(provider)[0];\n    if (!model) return undefined;\n    try {\n      const auth = await this.models.getAuth(model);\n      return auth?.auth.apiKey;\n    } catch {\n      return undefined;\n    }\n  }\n}\n"]}
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/harness/models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,cAAc,GAQf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mDAAmD,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qDAAqD,CAAC;AAC5F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,mDAAmD,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAKzD,MAAM,kBAAkB,GAA0C;IAChE,oBAAoB,EAAE,oBAAoB;IAC1C,wBAAwB,EAAE,uBAAuB;IACjD,sBAAsB,EAAE,qBAAqB;IAC7C,uBAAuB,EAAE,uBAAuB;IAChD,oBAAoB,EAAE,oBAAoB;IAC1C,kBAAkB,EAAE,kBAAkB;CACvC,CAAC;AAEF,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC1E,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAiCjC,+CAA+C;AAC/C,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAAI,MAAkC,CAAC,SAAS,CAAC;IAChE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qBAAqB,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,2BAA2B,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,GAAG,GAAI,MAA+B,CAAC,GAAG,CAAC;YACjD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,wBAAwB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClG,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACxE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qCAAqC,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,YAAoB;IACzC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CACtB,MAAwC,EACxC,cAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CACjC,cAAc,EACd,kBAAkB,EAClB,CAAC,MAAM,EAAE,EAAE,CAAC,2BAA2B,MAAM,EAAE,CAChD,CAAC;QACF,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrF,IAAI,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBACjD,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,kBAAkB,cAAc,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACjG,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAoB,EAAE,MAA4B;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAI,CAAC;IACxB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAc,EAAE;QACnE,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE;YACxC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,IAAI,GAAG,CAAQ;YACpC,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;YACpD,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,KAAK;YACzC,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;YACpC,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,YAAY;YACtC,aAAa,EAAE,WAAW,CAAC,aAAa,IAAI,sBAAsB;YAClE,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,eAAe,IAAI,kBAAkB;SACtF,CAAC;QACF,IAAI,WAAW,CAAC,gBAAgB;YAAE,KAAK,CAAC,gBAAgB,GAAG,WAAW,CAAC,gBAAgB,CAAC;QACxF,IAAI,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QACnD,IAAI,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,MAA8B,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;QACpB,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,GAAG,WAAW,UAAU;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;oBACrC,MAAM,GAAG,GACP,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC7D,MAAM,CAAC,MAAM;wBACb,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC1B,IAAI,CAAC,GAAG;wBAAE,OAAO,SAAS,CAAC;oBAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;oBACtD,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;gBAC3C,CAAC;aACF;SACF;QACD,MAAM;QACN,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAE,EAAE;KAChC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAAC,QAAkB,EAAE,MAA4B;IAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAc,EAAE;QAC5D,MAAM,UAAU,GAAe,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,OAAO;YAAE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAA8B,CAAC;QAC7E,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,WAAW;IAKtB,YAAoB,MAAqB,EAAE,SAA6B;QACtE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,OAAO,GAA6B,EAAE;QAClD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC1D,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,8EAA8E;IAC9E,QAAQ;QACN,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+CAA+C;IAC/C,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,QAAgB,EAAE,OAAe;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB,EAAE,OAAe;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,IAAI,OAAO,iEAAiE,CACvG,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,YAAY;QAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,qEAAqE;IACrE,OAAO,CAAC,KAAiB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF","sourcesContent":["/**\n * Model catalog for the mikan harness.\n *\n * Wraps pi-ai's `Models` collection: all built-in providers are registered\n * with credentials resolved from provider env vars, and custom providers\n * or overrides can be added via a `models.json` file\n * (`~/.mikan/models.json` by default).\n *\n * models.json subset supported by mikan:\n *\n * ```jsonc\n * {\n *   \"providers\": {\n *     \"my-provider\": {\n *       \"api\": \"openai-completions\",     // required when models are listed\n *       \"baseUrl\": \"http://host/v1\",\n *       \"apiKey\": \"literal-key\",          // optional; MY_PROVIDER_API_KEY env var otherwise\n *       \"headers\": { },\n *       \"compat\": { },\n *       \"models\": [{ \"id\": \"m\", \"name\": \"M\", \"input\": [\"text\"], \"reasoning\": false }]\n *     },\n *     \"anthropic\": { \"baseUrl\": \"https://proxy.example/v1\" }  // override built-in provider\n *   }\n * }\n * ```\n */\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport {\n  createProvider,\n  type Api,\n  type AuthResult,\n  type Model,\n  type Models,\n  type MutableModels,\n  type Provider,\n  type ProviderStreams,\n} from \"@earendil-works/pi-ai\";\nimport { builtinModels } from \"@earendil-works/pi-ai/providers/all\";\nimport { anthropicMessagesApi } from \"@earendil-works/pi-ai/api/anthropic-messages.lazy\";\nimport { azureOpenAIResponsesApi } from \"@earendil-works/pi-ai/api/azure-openai-responses.lazy\";\nimport { googleGenerativeAIApi } from \"@earendil-works/pi-ai/api/google-generative-ai.lazy\";\nimport { mistralConversationsApi } from \"@earendil-works/pi-ai/api/mistral-conversations.lazy\";\nimport { openAICompletionsApi } from \"@earendil-works/pi-ai/api/openai-completions.lazy\";\nimport { openAIResponsesApi } from \"@earendil-works/pi-ai/api/openai-responses.lazy\";\nimport { readJsonFileIfExists } from \"../file-guards.js\";\nimport type { CreateMikanModelsOptions } from \"./types.js\";\n\nexport type { CreateMikanModelsOptions } from \"./types.js\";\n\nconst CUSTOM_API_STREAMS: Record<string, () => ProviderStreams> = {\n  \"anthropic-messages\": anthropicMessagesApi,\n  \"azure-openai-responses\": azureOpenAIResponsesApi,\n  \"google-generative-ai\": googleGenerativeAIApi,\n  \"mistral-conversations\": mistralConversationsApi,\n  \"openai-completions\": openAICompletionsApi,\n  \"openai-responses\": openAIResponsesApi,\n};\n\nconst DEFAULT_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };\nconst DEFAULT_CONTEXT_WINDOW = 128000;\nconst DEFAULT_MAX_TOKENS = 16384;\n\ninterface CustomModelConfig {\n  id: string;\n  name?: string;\n  api?: string;\n  baseUrl?: string;\n  reasoning?: boolean;\n  input?: (\"text\" | \"image\")[];\n  cost?: { input: number; output: number; cacheRead: number; cacheWrite: number };\n  contextWindow?: number;\n  maxTokens?: number;\n  /** Accepted alias for `maxTokens` (used by existing deployments). */\n  maxOutputTokens?: number;\n  thinkingLevelMap?: Model<Api>[\"thinkingLevelMap\"];\n  headers?: Record<string, string>;\n  compat?: unknown;\n}\n\ninterface CustomProviderConfig {\n  name?: string;\n  api?: string;\n  baseUrl?: string;\n  apiKey?: string;\n  headers?: Record<string, string>;\n  compat?: unknown;\n  models?: CustomModelConfig[];\n}\n\ninterface ModelsJsonConfig {\n  providers?: Record<string, CustomProviderConfig>;\n}\n\n/** Default location of mikan's models.json. */\nexport function defaultModelsJsonPath(): string {\n  return join(homedir(), \".mikan\", \"models.json\");\n}\n\nfunction isModelsJsonConfig(parsed: unknown): parsed is ModelsJsonConfig {\n  if (!parsed || typeof parsed !== \"object\") {\n    throw new Error(\"models.json must be a JSON object\");\n  }\n  const providers = (parsed as { providers?: unknown }).providers;\n  if (providers === undefined) return true;\n  if (!providers || typeof providers !== \"object\" || Array.isArray(providers)) {\n    throw new Error('models.json \"providers\" must be an object');\n  }\n  for (const [name, config] of Object.entries(providers)) {\n    if (!config || typeof config !== \"object\") {\n      throw new Error(`models.json provider \"${name}\" must be an object`);\n    }\n    const models = (config as CustomProviderConfig).models;\n    if (models !== undefined) {\n      if (!Array.isArray(models)) {\n        throw new Error(`models.json provider \"${name}\" models must be an array`);\n      }\n      const api = (config as CustomProviderConfig).api;\n      if (typeof api !== \"string\" || !(api in CUSTOM_API_STREAMS)) {\n        throw new Error(\n          `models.json provider \"${name}\" needs an \"api\" of: ${Object.keys(CUSTOM_API_STREAMS).join(\", \")}`,\n        );\n      }\n      for (const model of models) {\n        if (!model || typeof model !== \"object\" || typeof model.id !== \"string\") {\n          throw new Error(`models.json provider \"${name}\" has a model without a string \"id\"`);\n        }\n      }\n    }\n  }\n  return true;\n}\n\nfunction envVarNameFor(providerName: string): string {\n  return `${providerName.replace(/[^a-zA-Z0-9]+/g, \"_\").toUpperCase()}_API_KEY`;\n}\n\n/**\n * Register models.json providers on top of the built-ins: a provider with its\n * own model list replaces wholesale; a bare baseUrl/compat entry overrides a\n * matching built-in in place. Returns a user-facing load error, if any —\n * built-in models stay available either way.\n */\nfunction applyModelsJson(\n  models: ReturnType<typeof builtinModels>,\n  modelsJsonPath: string,\n): string | undefined {\n  try {\n    const config = readJsonFileIfExists(\n      modelsJsonPath,\n      isModelsJsonConfig,\n      (detail) => `models.json is invalid: ${detail}`,\n    );\n    for (const [providerName, providerConfig] of Object.entries(config?.providers ?? {})) {\n      if (providerConfig.models && providerConfig.models.length > 0) {\n        models.setProvider(buildCustomProvider(providerName, providerConfig));\n      } else if (providerConfig.baseUrl || providerConfig.compat) {\n        const builtin = models.getProvider(providerName);\n        if (builtin) {\n          models.setProvider(overrideBuiltinProvider(builtin, providerConfig));\n        }\n      }\n    }\n    return undefined;\n  } catch (err) {\n    return `Failed to load ${modelsJsonPath}: ${err instanceof Error ? err.message : String(err)}`;\n  }\n}\n\nfunction buildCustomProvider(providerName: string, config: CustomProviderConfig): Provider {\n  const api = config.api!;\n  const displayName = config.name ?? providerName;\n  const envVar = envVarNameFor(providerName);\n  const models = (config.models ?? []).map((modelConfig): Model<Api> => {\n    const model: Model<Api> = {\n      id: modelConfig.id,\n      name: modelConfig.name ?? modelConfig.id,\n      api: (modelConfig.api ?? api) as Api,\n      provider: providerName,\n      baseUrl: modelConfig.baseUrl ?? config.baseUrl ?? \"\",\n      reasoning: modelConfig.reasoning ?? false,\n      input: modelConfig.input ?? [\"text\"],\n      cost: modelConfig.cost ?? DEFAULT_COST,\n      contextWindow: modelConfig.contextWindow ?? DEFAULT_CONTEXT_WINDOW,\n      maxTokens: modelConfig.maxTokens ?? modelConfig.maxOutputTokens ?? DEFAULT_MAX_TOKENS,\n    };\n    if (modelConfig.thinkingLevelMap) model.thinkingLevelMap = modelConfig.thinkingLevelMap;\n    if (modelConfig.headers ?? config.headers) {\n      model.headers = { ...config.headers, ...modelConfig.headers };\n    }\n    const compat = modelConfig.compat ?? config.compat;\n    if (compat) model.compat = compat as Model<Api>[\"compat\"];\n    return model;\n  });\n\n  return createProvider({\n    id: providerName,\n    name: displayName,\n    baseUrl: config.baseUrl,\n    headers: config.headers,\n    auth: {\n      apiKey: {\n        name: `${displayName} API key`,\n        resolve: async ({ ctx, credential }) => {\n          const key =\n            (credential?.type === \"api_key\" ? credential.key : undefined) ??\n            config.apiKey ??\n            (await ctx.env(envVar));\n          if (!key) return undefined;\n          const source = config.apiKey ? \"models.json\" : envVar;\n          return { auth: { apiKey: key }, source };\n        },\n      },\n    },\n    models,\n    api: CUSTOM_API_STREAMS[api]!(),\n  });\n}\n\n/** Rebuild a built-in provider with overridden model base URLs / compat. */\nfunction overrideBuiltinProvider(provider: Provider, config: CustomProviderConfig): Provider {\n  const models = provider.getModels().map((model): Model<Api> => {\n    const overridden: Model<Api> = Object.assign({}, model);\n    if (config.baseUrl) overridden.baseUrl = config.baseUrl;\n    if (config.compat) overridden.compat = config.compat as Model<Api>[\"compat\"];\n    return overridden;\n  });\n  return {\n    ...provider,\n    getModels: () => models,\n  };\n}\n\n/**\n * Model catalog backed by pi-ai's `Models`. Exposes the lookup and auth\n * operations mikan needs; streaming goes through {@link MikanModels.models}.\n */\nexport class MikanModels {\n  /** Underlying pi-ai collection, for streaming/completion calls. */\n  readonly models: Models;\n  private loadError: string | undefined;\n\n  private constructor(models: MutableModels, loadError: string | undefined) {\n    this.models = models;\n    this.loadError = loadError;\n  }\n\n  static create(options: CreateMikanModelsOptions = {}): MikanModels {\n    const modelsJsonPath = options.modelsJsonPath ?? defaultModelsJsonPath();\n    const models = builtinModels();\n    const loadError = applyModelsJson(models, modelsJsonPath);\n    return new MikanModels(models, loadError);\n  }\n\n  /** Error from loading models.json, if any. Built-in models stay available. */\n  getError(): string | undefined {\n    return this.loadError;\n  }\n\n  /** All known models (built-in plus custom). */\n  getAll(): Model<Api>[] {\n    return [...this.models.getModels()];\n  }\n\n  /** Find a model by provider and id. */\n  find(provider: string, modelId: string): Model<Api> | undefined {\n    return this.models.getModel(provider, modelId);\n  }\n\n  /**\n   * Find a model by provider and id, or throw a user-facing configuration error.\n   * Prefer this at runtime entry points over raw `find` + ad-hoc throws.\n   */\n  resolve(provider: string, modelId: string): Model<Api> {\n    const model = this.find(provider, modelId);\n    if (model) return model;\n    throw new Error(\n      `Unknown model \"${provider}/${modelId}\". Configure it in pi models.json or choose a registered model.`,\n    );\n  }\n\n  /** Models whose provider auth currently resolves (API key, OAuth, or ambient). */\n  async getAvailable(): Promise<Model<Api>[]> {\n    const available = await Promise.all(\n      this.models.getProviders().map(async (provider) => {\n        try {\n          return await this.models.getAvailable(provider.id);\n        } catch {\n          // One provider's auth failure must not hide models from other providers.\n          return [];\n        }\n      }),\n    );\n    return available.flat();\n  }\n\n  /** Resolve request auth for a model. Undefined when unconfigured. */\n  getAuth(model: Model<Api>): Promise<AuthResult | undefined> {\n    return this.models.getAuth(model);\n  }\n\n  /**\n   * Resolve an API key for a provider. Convenience for call sites that only\n   * need a bearer key (for example pi-agent-core's compat stream function).\n   */\n  async getApiKeyForProvider(provider: string): Promise<string | undefined> {\n    try {\n      const auth = await this.models.getAuth(provider);\n      return auth?.auth.apiKey;\n    } catch {\n      return undefined;\n    }\n  }\n}\n"]}

package/dist/harness/open-connector.d.ts

@@ -0,0 +1,14 @@
+import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { Office } from "../office/index.js";
+import type { McpServerConfig } from "./types.js";
+/** Fill an omitted connection only when OpenConnector reports exactly one
+ * candidate for the action's service. Multiple-account selection remains an
+ * explicit agent decision. */
+export declare function prepareOpenConnectorToolArguments(client: Pick<Client, "callTool">, serverName: string, toolName: string, params: Record<string, unknown>, signal?: AbortSignal): Promise<Record<string, unknown>>;
+/**
+ * Replace the deployment-wide OpenConnector bearer token with one scoped to
+ * this Slack Conversation office. The privileged admin token is read only at
+ * this host boundary and is never written into settings, Vault, or a sandbox.
+ */
+export declare function provisionOfficeOpenConnectorToken(office: Office, platformWorkspaceId: string | undefined, servers: Record<string, McpServerConfig> | undefined, openConnector: McpServerConfig | undefined, signal?: AbortSignal): Promise<Record<string, McpServerConfig>>;
+//# sourceMappingURL=open-connector.d.ts.map

package/dist/harness/open-connector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-connector.d.ts","sourceRoot":"","sources":["../../src/harness/open-connector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAOjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA4DlD;;8BAE8B;AAC9B,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAkBlC;AAkID;;;;GAIG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,MAAM,EACd,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,SAAS,EACpD,aAAa,EAAE,eAAe,GAAG,SAAS,EAC1C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CA6C1C"}

package/dist/harness/open-connector.js

@@ -0,0 +1,204 @@
+import { Type } from "@sinclair/typebox";
+import { join } from "node:path";
+import { readEnv } from "../env-manifest.js";
+import * as log from "../log.js";
+import { atomicWritePrivateFile, ensureDirExists, isRecord, readJsonSchemaFileIfExists, } from "../file-guards.js";
+const OPEN_CONNECTOR_SERVER = "open-connector";
+const TOKEN_STATE_FILE = "open-connector-runtime-token.json";
+const REQUEST_TIMEOUT_MS = 10_000;
+const pendingTokens = new Map();
+const CONNECTION_AWARE_TOOLS = new Set(["get_action_guide", "execute_action"]);
+const RuntimeTokenStateSchema = Type.Object({
+    version: Type.Literal(1),
+    origin: Type.String(),
+    name: Type.String(),
+    id: Type.String(),
+    token: Type.String(),
+}, { additionalProperties: false });
+function readRuntimeTokenState(path) {
+    return readJsonSchemaFileIfExists(path, RuntimeTokenStateSchema, (detail) => `Malformed OpenConnector runtime token state at ${path}: ${detail}`);
+}
+function readUniqueConnectionName(result, service) {
+    if (!isRecord(result) || !Array.isArray(result.content))
+        return undefined;
+    const text = result.content.find((part) => isRecord(part) && part.type === "text" && typeof part.text === "string")?.text;
+    if (!text)
+        return undefined;
+    try {
+        const payload = JSON.parse(text);
+        if (!isRecord(payload))
+            return undefined;
+        const connections = Array.isArray(payload.data)
+            ? payload.data
+            : Array.isArray(payload.connections)
+                ? payload.connections
+                : undefined;
+        if (!connections)
+            return undefined;
+        const names = new Set(connections.flatMap((connection) => isRecord(connection) &&
+            connection.service === service &&
+            typeof connection.connectionName === "string"
+            ? [connection.connectionName]
+            : []));
+        return names.size === 1 ? names.values().next().value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Fill an omitted connection only when OpenConnector reports exactly one
+ * candidate for the action's service. Multiple-account selection remains an
+ * explicit agent decision. */
+export async function prepareOpenConnectorToolArguments(client, serverName, toolName, params, signal) {
+    if (serverName !== OPEN_CONNECTOR_SERVER ||
+        !CONNECTION_AWARE_TOOLS.has(toolName) ||
+        typeof params.connectionName === "string" ||
+        typeof params.actionId !== "string") {
+        return params;
+    }
+    const service = params.actionId.split(".", 1)[0];
+    if (!service)
+        return params;
+    const result = await client.callTool({ name: "list_connections", arguments: { service } }, undefined, { timeout: REQUEST_TIMEOUT_MS, ...(signal ? { signal } : {}) });
+    const connectionName = readUniqueConnectionName(result, service);
+    return connectionName ? { ...params, connectionName } : params;
+}
+function stringArray(value, field) {
+    if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+        throw new Error(`OpenConnector returned an invalid ${field}`);
+    }
+    return value;
+}
+async function readJson(response, operation) {
+    if (!response.ok) {
+        throw new Error(`OpenConnector ${operation} failed with HTTP ${response.status}`);
+    }
+    try {
+        return await response.json();
+    }
+    catch (error) {
+        throw new Error(`OpenConnector ${operation} returned invalid JSON`, { cause: error });
+    }
+}
+function requestSignal(signal) {
+    const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+async function createRuntimeToken(origin, adminToken, name, signal) {
+    const headers = { Authorization: `Bearer ${adminToken}` };
+    const policyValue = await readJson(await fetch(new URL("/api/runtime-policy", origin), {
+        headers,
+        signal: requestSignal(signal),
+    }), "runtime policy request");
+    if (!isRecord(policyValue) || !isRecord(policyValue.deployment)) {
+        throw new Error("OpenConnector returned an invalid runtime policy");
+    }
+    const deployment = policyValue.deployment;
+    const responseValue = await readJson(await fetch(new URL("/api/runtime-tokens", origin), {
+        method: "POST",
+        headers: { ...headers, "Content-Type": "application/json" },
+        body: JSON.stringify({
+            name,
+            allowedActions: stringArray(deployment.allowedActions, "allowedActions policy"),
+            blockedActions: stringArray(deployment.blockedActions, "blockedActions policy"),
+            allowedProxies: stringArray(deployment.allowedProxies, "allowedProxies policy"),
+        }),
+        signal: requestSignal(signal),
+    }), "runtime token creation");
+    if (!isRecord(responseValue) ||
+        typeof responseValue.token !== "string" ||
+        !responseValue.token.startsWith("oct_") ||
+        !isRecord(responseValue.record) ||
+        typeof responseValue.record.id !== "string" ||
+        responseValue.record.name !== name) {
+        throw new Error("OpenConnector returned an invalid runtime token");
+    }
+    return {
+        version: 1,
+        origin,
+        name,
+        id: responseValue.record.id,
+        token: responseValue.token,
+    };
+}
+function withoutReservedServer(servers) {
+    if (!servers)
+        return {};
+    const { [OPEN_CONNECTOR_SERVER]: _reserved, ...settingsServers } = servers;
+    return settingsServers;
+}
+function disabledServer(servers, config) {
+    return { ...servers, [OPEN_CONNECTOR_SERVER]: { ...config, disabled: true } };
+}
+async function loadOrCreateRuntimeToken(office, origin, adminToken, name, signal) {
+    const statePath = join(office.stateDir, TOKEN_STATE_FILE);
+    const state = readRuntimeTokenState(statePath);
+    if (state) {
+        if (state.origin !== origin || state.name !== name) {
+            throw new Error(`OpenConnector runtime token state does not match ${name}`);
+        }
+        return state;
+    }
+    const key = `${origin}:${office.key}`;
+    const pending = pendingTokens.get(key);
+    if (pending)
+        return pending;
+    const creation = (async () => {
+        const current = readRuntimeTokenState(statePath);
+        if (current)
+            return current;
+        const created = await createRuntimeToken(origin, adminToken, name, signal);
+        ensureDirExists(office.stateDir);
+        atomicWritePrivateFile(statePath, `${JSON.stringify(created, null, 2)}\n`);
+        log.logInfo(`[${office.address.conversationId}] Created OpenConnector runtime token ${created.id}`);
+        return created;
+    })();
+    pendingTokens.set(key, creation);
+    try {
+        return await creation;
+    }
+    finally {
+        pendingTokens.delete(key);
+    }
+}
+/**
+ * Replace the deployment-wide OpenConnector bearer token with one scoped to
+ * this Slack Conversation office. The privileged admin token is read only at
+ * this host boundary and is never written into settings, Vault, or a sandbox.
+ */
+export async function provisionOfficeOpenConnectorToken(office, platformWorkspaceId, servers, openConnector, signal) {
+    const settingsServers = withoutReservedServer(servers);
+    const adminToken = readEnv("OPENCONNECTOR_ADMIN_TOKEN");
+    if (!openConnector ||
+        openConnector.disabled ||
+        !adminToken ||
+        office.address.platform !== "slack") {
+        return settingsServers;
+    }
+    if (!platformWorkspaceId) {
+        log.logWarning(`[${office.address.conversationId}] OpenConnector token provisioning skipped`, "Slack workspace ID is unavailable");
+        return disabledServer(settingsServers, openConnector);
+    }
+    if (!openConnector.url) {
+        log.logWarning(`[${office.address.conversationId}] OpenConnector token provisioning skipped`, "the startup OpenConnector configuration is not configured for HTTP");
+        return disabledServer(settingsServers, openConnector);
+    }
+    try {
+        const endpoint = new URL(openConnector.url);
+        const origin = endpoint.origin;
+        const name = `mikan:slack:${platformWorkspaceId}:${office.address.conversationId}`;
+        const state = await loadOrCreateRuntimeToken(office, origin, adminToken, name, signal);
+        return {
+            ...settingsServers,
+            [OPEN_CONNECTOR_SERVER]: {
+                ...openConnector,
+                headers: { ...openConnector.headers, Authorization: `Bearer ${state.token}` },
+            },
+        };
+    }
+    catch (error) {
+        log.logWarning(`[${office.address.conversationId}] OpenConnector token provisioning failed`, error instanceof Error ? error.message : String(error));
+        return disabledServer(settingsServers, openConnector);
+    }
+}
+//# sourceMappingURL=open-connector.js.map

package/dist/harness/open-connector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-connector.js","sourceRoot":"","sources":["../../src/harness/open-connector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,QAAQ,EACR,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAG3B,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAC/C,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsC,CAAC;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE/E,MAAM,uBAAuB,GAAG,IAAI,CAAC,MAAM,CACzC;IACE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;IACnB,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;CACrB,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAIF,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,0BAA0B,CAC/B,IAAI,EACJ,uBAAuB,EACvB,CAAC,MAAM,EAAE,EAAE,CAAC,kDAAkD,IAAI,KAAK,MAAM,EAAE,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAe,EAAE,OAAe;IAChE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAC9B,CAAC,IAAI,EAA0C,EAAE,CAC/C,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAC1E,EAAE,IAAI,CAAC;IACR,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC7C,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;gBAClC,CAAC,CAAC,OAAO,CAAC,WAAW;gBACrB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CACjC,QAAQ,CAAC,UAAU,CAAC;YACpB,UAAU,CAAC,OAAO,KAAK,OAAO;YAC9B,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ;YAC3C,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;YAC7B,CAAC,CAAC,EAAE,CACP,CACF,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;8BAE8B;AAC9B,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAgC,EAChC,UAAkB,EAClB,QAAgB,EAChB,MAA+B,EAC/B,MAAoB;IAEpB,IACE,UAAU,KAAK,qBAAqB;QACpC,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;QACzC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EACnC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAClC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,EACpD,SAAS,EACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC/D,CAAC;IACF,MAAM,cAAc,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,SAAiB;IAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,UAAkB,EAClB,IAAY,EACZ,MAAoB;IAEpB,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,QAAQ,CAChC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE;QAClD,OAAO;QACP,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC9B,CAAC,EACF,wBAAwB,CACzB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAC1C,MAAM,aAAa,GAAG,MAAM,QAAQ,CAClC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI;YACJ,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAC/E,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;YAC/E,cAAc,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,uBAAuB,CAAC;SAChF,CAAC;QACF,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC9B,CAAC,EACF,wBAAwB,CACzB,CAAC;IACF,IACE,CAAC,QAAQ,CAAC,aAAa,CAAC;QACxB,OAAO,aAAa,CAAC,KAAK,KAAK,QAAQ;QACvC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QACvC,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;QAC/B,OAAO,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ;QAC3C,aAAa,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM;QACN,IAAI;QACJ,EAAE,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;QAC3B,KAAK,EAAE,aAAa,CAAC,KAAK;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAoD;IAEpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC;IAC3E,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,cAAc,CACrB,OAAwC,EACxC,MAAuB;IAEvB,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAc,EACd,MAAc,EACd,UAAkB,EAClB,IAAY,EACZ,MAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3E,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,sBAAsB,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3E,GAAG,CAAC,OAAO,CACT,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,yCAAyC,OAAO,CAAC,EAAE,EAAE,CACvF,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,EAAE,CAAC;IACL,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAc,EACd,mBAAuC,EACvC,OAAoD,EACpD,aAA0C,EAC1C,MAAoB;IAEpB,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxD,IACE,CAAC,aAAa;QACd,aAAa,CAAC,QAAQ;QACtB,CAAC,UAAU;QACX,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,EACnC,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,GAAG,CAAC,UAAU,CACZ,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,4CAA4C,EAC7E,mCAAmC,CACpC,CAAC;QACF,OAAO,cAAc,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;QACvB,GAAG,CAAC,UAAU,CACZ,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,4CAA4C,EAC7E,oEAAoE,CACrE,CAAC;QACF,OAAO,cAAc,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,MAAM,IAAI,GAAG,eAAe,mBAAmB,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,OAAO;YACL,GAAG,eAAe;YAClB,CAAC,qBAAqB,CAAC,EAAE;gBACvB,GAAG,aAAa;gBAChB,OAAO,EAAE,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,UAAU,CACZ,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,2CAA2C,EAC5E,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,cAAc,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACxD,CAAC;AACH,CAAC","sourcesContent":["import type { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { Type, type Static } from \"@sinclair/typebox\";\nimport { join } from \"node:path\";\nimport { readEnv } from \"../env-manifest.js\";\nimport * as log from \"../log.js\";\nimport type { Office } from \"../office/index.js\";\nimport {\n  atomicWritePrivateFile,\n  ensureDirExists,\n  isRecord,\n  readJsonSchemaFileIfExists,\n} from \"../file-guards.js\";\nimport type { McpServerConfig } from \"./types.js\";\n\nconst OPEN_CONNECTOR_SERVER = \"open-connector\";\nconst TOKEN_STATE_FILE = \"open-connector-runtime-token.json\";\nconst REQUEST_TIMEOUT_MS = 10_000;\nconst pendingTokens = new Map<string, Promise<RuntimeTokenState>>();\nconst CONNECTION_AWARE_TOOLS = new Set([\"get_action_guide\", \"execute_action\"]);\n\nconst RuntimeTokenStateSchema = Type.Object(\n  {\n    version: Type.Literal(1),\n    origin: Type.String(),\n    name: Type.String(),\n    id: Type.String(),\n    token: Type.String(),\n  },\n  { additionalProperties: false },\n);\n\ntype RuntimeTokenState = Static<typeof RuntimeTokenStateSchema>;\n\nfunction readRuntimeTokenState(path: string) {\n  return readJsonSchemaFileIfExists(\n    path,\n    RuntimeTokenStateSchema,\n    (detail) => `Malformed OpenConnector runtime token state at ${path}: ${detail}`,\n  );\n}\n\nfunction readUniqueConnectionName(result: unknown, service: string) {\n  if (!isRecord(result) || !Array.isArray(result.content)) return undefined;\n  const text = result.content.find(\n    (part): part is { type: \"text\"; text: string } =>\n      isRecord(part) && part.type === \"text\" && typeof part.text === \"string\",\n  )?.text;\n  if (!text) return undefined;\n  try {\n    const payload: unknown = JSON.parse(text);\n    if (!isRecord(payload)) return undefined;\n    const connections = Array.isArray(payload.data)\n      ? payload.data\n      : Array.isArray(payload.connections)\n        ? payload.connections\n        : undefined;\n    if (!connections) return undefined;\n    const names = new Set(\n      connections.flatMap((connection) =>\n        isRecord(connection) &&\n        connection.service === service &&\n        typeof connection.connectionName === \"string\"\n          ? [connection.connectionName]\n          : [],\n      ),\n    );\n    return names.size === 1 ? names.values().next().value : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Fill an omitted connection only when OpenConnector reports exactly one\n * candidate for the action's service. Multiple-account selection remains an\n * explicit agent decision. */\nexport async function prepareOpenConnectorToolArguments(\n  client: Pick<Client, \"callTool\">,\n  serverName: string,\n  toolName: string,\n  params: Record<string, unknown>,\n  signal?: AbortSignal,\n): Promise<Record<string, unknown>> {\n  if (\n    serverName !== OPEN_CONNECTOR_SERVER ||\n    !CONNECTION_AWARE_TOOLS.has(toolName) ||\n    typeof params.connectionName === \"string\" ||\n    typeof params.actionId !== \"string\"\n  ) {\n    return params;\n  }\n  const service = params.actionId.split(\".\", 1)[0];\n  if (!service) return params;\n  const result = await client.callTool(\n    { name: \"list_connections\", arguments: { service } },\n    undefined,\n    { timeout: REQUEST_TIMEOUT_MS, ...(signal ? { signal } : {}) },\n  );\n  const connectionName = readUniqueConnectionName(result, service);\n  return connectionName ? { ...params, connectionName } : params;\n}\n\nfunction stringArray(value: unknown, field: string): string[] {\n  if (!Array.isArray(value) || !value.every((item) => typeof item === \"string\")) {\n    throw new Error(`OpenConnector returned an invalid ${field}`);\n  }\n  return value;\n}\n\nasync function readJson(response: Response, operation: string): Promise<unknown> {\n  if (!response.ok) {\n    throw new Error(`OpenConnector ${operation} failed with HTTP ${response.status}`);\n  }\n  try {\n    return await response.json();\n  } catch (error) {\n    throw new Error(`OpenConnector ${operation} returned invalid JSON`, { cause: error });\n  }\n}\n\nfunction requestSignal(signal?: AbortSignal): AbortSignal {\n  const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);\n  return signal ? AbortSignal.any([signal, timeout]) : timeout;\n}\n\nasync function createRuntimeToken(\n  origin: string,\n  adminToken: string,\n  name: string,\n  signal?: AbortSignal,\n): Promise<RuntimeTokenState> {\n  const headers = { Authorization: `Bearer ${adminToken}` };\n  const policyValue = await readJson(\n    await fetch(new URL(\"/api/runtime-policy\", origin), {\n      headers,\n      signal: requestSignal(signal),\n    }),\n    \"runtime policy request\",\n  );\n  if (!isRecord(policyValue) || !isRecord(policyValue.deployment)) {\n    throw new Error(\"OpenConnector returned an invalid runtime policy\");\n  }\n  const deployment = policyValue.deployment;\n  const responseValue = await readJson(\n    await fetch(new URL(\"/api/runtime-tokens\", origin), {\n      method: \"POST\",\n      headers: { ...headers, \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({\n        name,\n        allowedActions: stringArray(deployment.allowedActions, \"allowedActions policy\"),\n        blockedActions: stringArray(deployment.blockedActions, \"blockedActions policy\"),\n        allowedProxies: stringArray(deployment.allowedProxies, \"allowedProxies policy\"),\n      }),\n      signal: requestSignal(signal),\n    }),\n    \"runtime token creation\",\n  );\n  if (\n    !isRecord(responseValue) ||\n    typeof responseValue.token !== \"string\" ||\n    !responseValue.token.startsWith(\"oct_\") ||\n    !isRecord(responseValue.record) ||\n    typeof responseValue.record.id !== \"string\" ||\n    responseValue.record.name !== name\n  ) {\n    throw new Error(\"OpenConnector returned an invalid runtime token\");\n  }\n  return {\n    version: 1,\n    origin,\n    name,\n    id: responseValue.record.id,\n    token: responseValue.token,\n  };\n}\n\nfunction withoutReservedServer(\n  servers: Record<string, McpServerConfig> | undefined,\n): Record<string, McpServerConfig> {\n  if (!servers) return {};\n  const { [OPEN_CONNECTOR_SERVER]: _reserved, ...settingsServers } = servers;\n  return settingsServers;\n}\n\nfunction disabledServer(\n  servers: Record<string, McpServerConfig>,\n  config: McpServerConfig,\n): Record<string, McpServerConfig> {\n  return { ...servers, [OPEN_CONNECTOR_SERVER]: { ...config, disabled: true } };\n}\n\nasync function loadOrCreateRuntimeToken(\n  office: Office,\n  origin: string,\n  adminToken: string,\n  name: string,\n  signal?: AbortSignal,\n): Promise<RuntimeTokenState> {\n  const statePath = join(office.stateDir, TOKEN_STATE_FILE);\n  const state = readRuntimeTokenState(statePath);\n  if (state) {\n    if (state.origin !== origin || state.name !== name) {\n      throw new Error(`OpenConnector runtime token state does not match ${name}`);\n    }\n    return state;\n  }\n\n  const key = `${origin}:${office.key}`;\n  const pending = pendingTokens.get(key);\n  if (pending) return pending;\n\n  const creation = (async () => {\n    const current = readRuntimeTokenState(statePath);\n    if (current) return current;\n    const created = await createRuntimeToken(origin, adminToken, name, signal);\n    ensureDirExists(office.stateDir);\n    atomicWritePrivateFile(statePath, `${JSON.stringify(created, null, 2)}\\n`);\n    log.logInfo(\n      `[${office.address.conversationId}] Created OpenConnector runtime token ${created.id}`,\n    );\n    return created;\n  })();\n  pendingTokens.set(key, creation);\n  try {\n    return await creation;\n  } finally {\n    pendingTokens.delete(key);\n  }\n}\n\n/**\n * Replace the deployment-wide OpenConnector bearer token with one scoped to\n * this Slack Conversation office. The privileged admin token is read only at\n * this host boundary and is never written into settings, Vault, or a sandbox.\n */\nexport async function provisionOfficeOpenConnectorToken(\n  office: Office,\n  platformWorkspaceId: string | undefined,\n  servers: Record<string, McpServerConfig> | undefined,\n  openConnector: McpServerConfig | undefined,\n  signal?: AbortSignal,\n): Promise<Record<string, McpServerConfig>> {\n  const settingsServers = withoutReservedServer(servers);\n  const adminToken = readEnv(\"OPENCONNECTOR_ADMIN_TOKEN\");\n  if (\n    !openConnector ||\n    openConnector.disabled ||\n    !adminToken ||\n    office.address.platform !== \"slack\"\n  ) {\n    return settingsServers;\n  }\n  if (!platformWorkspaceId) {\n    log.logWarning(\n      `[${office.address.conversationId}] OpenConnector token provisioning skipped`,\n      \"Slack workspace ID is unavailable\",\n    );\n    return disabledServer(settingsServers, openConnector);\n  }\n  if (!openConnector.url) {\n    log.logWarning(\n      `[${office.address.conversationId}] OpenConnector token provisioning skipped`,\n      \"the startup OpenConnector configuration is not configured for HTTP\",\n    );\n    return disabledServer(settingsServers, openConnector);\n  }\n\n  try {\n    const endpoint = new URL(openConnector.url);\n    const origin = endpoint.origin;\n    const name = `mikan:slack:${platformWorkspaceId}:${office.address.conversationId}`;\n    const state = await loadOrCreateRuntimeToken(office, origin, adminToken, name, signal);\n    return {\n      ...settingsServers,\n      [OPEN_CONNECTOR_SERVER]: {\n        ...openConnector,\n        headers: { ...openConnector.headers, Authorization: `Bearer ${state.token}` },\n      },\n    };\n  } catch (error) {\n    log.logWarning(\n      `[${office.address.conversationId}] OpenConnector token provisioning failed`,\n      error instanceof Error ? error.message : String(error),\n    );\n    return disabledServer(settingsServers, openConnector);\n  }\n}\n"]}

package/dist/harness/presenter.d.ts

@@ -0,0 +1,30 @@
+import { type Api, type Model } from "@earendil-works/pi-ai";
+import type { RunPresentation, RunnerSessionState, UsageReportContext } from "./types.js";
+import type { MikanAgentSession } from "./session.js";
+import type { ConversationResponder } from "../adapter.js";
+import type { resolveConversationSettings } from "../config.js";
+export declare function createRunState(): RunnerSessionState;
+export declare function activateRunPresentation(runState: RunnerSessionState, context: {
+    responder: ConversationResponder;
+    sessionConversation: string;
+    userName: string | undefined;
+    sessionUuid: string;
+    triggerAttribution: string | undefined;
+}): RunPresentation;
+export declare function isEventTriggerAttribution(triggerAttribution: string | undefined): boolean;
+export declare function finalizeRunResponse(responder: ConversationResponder, session: MikanAgentSession, runState: RunnerSessionState, options?: {
+    triggerSessionLink?: string;
+    createOverflowLink?: () => string;
+    platform?: string;
+    model?: Model<Api>;
+    sessionConversation?: string;
+    sessionUuid?: string;
+}): Promise<void>;
+export declare function reportUsageSummary(ctx: UsageReportContext): Promise<void>;
+export declare function attachSessionEventHandlers(params: {
+    session: MikanAgentSession;
+    runState: RunnerSessionState;
+    model: Model<Api>;
+    agentConfig: ReturnType<typeof resolveConversationSettings>;
+}): void;
+//# sourceMappingURL=presenter.d.ts.map

package/dist/harness/presenter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presenter.d.ts","sourceRoot":"","sources":["../../src/harness/presenter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,GAAG,EAAE,KAAK,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAEV,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAOtD,OAAO,KAAK,EAAE,qBAAqB,EAA4B,MAAM,eAAe,CAAC;AACrF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AA+DhE,wBAAgB,cAAc,IAAI,kBAAkB,CAkCnD;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IACP,SAAS,EAAE,qBAAqB,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,GACA,eAAe,CAsEjB;AAOD,wBAAgB,yBAAyB,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEzF;AAmKD,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,CAAC,EAAE;IACR,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,IAAI,CAAC,CAiBf;AA4DD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2F/E;AAubD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,WAAW,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,CAAC;CAC7D,GAAG,IAAI,CAiBP"}