@humain/terminal 0.0.2 → 0.0.3-beta.1

package/dist/cli/auth-command.js

@@ -0,0 +1,103 @@
+import { APP_NAME } from "../config.js";
+export class AuthCommandError extends Error {
+}
+const AUTH_COMMAND_USAGE = {
+    check: `${APP_NAME} auth check --provider <provider> [--json] [--credentials] [--no-refresh]`,
+    api_key: `${APP_NAME} auth print-api-key --provider <provider> [--model <model>]`,
+    bearer_token: `${APP_NAME} auth print-bearer-token --provider <provider> [--model <model>] [--min-expiry <duration>]`,
+};
+export function getAuthCommandName(kind) {
+    return kind === "check" ? "auth check" : kind === "api_key" ? "auth print-api-key" : "auth print-bearer-token";
+}
+export function getAuthCommandUsage(kind) {
+    return AUTH_COMMAND_USAGE[kind];
+}
+export function isAuthCommandHelp(args) {
+    return (args[0] === "auth" &&
+        (args[1] === undefined || args[1] === "help" || args.includes("--help") || args.includes("-h")));
+}
+export function printAuthCommandHelp() {
+    console.log(`Usage:
+  ${APP_NAME} auth print-api-key [--provider <provider>] [--model <model>]
+  ${APP_NAME} auth print-bearer-token [--provider <provider>] [--model <model>] [--min-expiry <duration>]
+  ${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]
+
+Auth commands require at least one of --provider or --model. Checks refresh expired OAuth credentials by default; --no-refresh prevents this. --credentials emits the credential, or includes it in JSON output.`);
+}
+export function parseAuthCommand(args) {
+    if (args[0] !== "auth")
+        return undefined;
+    const kind = args[1] === "check"
+        ? "check"
+        : args[1] === "print-api-key"
+            ? "api_key"
+            : args[1] === "print-bearer-token"
+                ? "bearer_token"
+                : undefined;
+    if (!kind) {
+        throw new AuthCommandError(`Unknown auth command "${args[1] ?? ""}". Use "${APP_NAME} auth print-api-key", "${APP_NAME} auth print-bearer-token", or "${APP_NAME} auth check".`);
+    }
+    const commandArgs = [];
+    let json = false;
+    let credentials = false;
+    let noRefresh = false;
+    let minExpiryMs;
+    for (let index = 2; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--min-expiry") {
+            if (kind !== "bearer_token")
+                throw new AuthCommandError("--min-expiry is only supported by print-bearer-token");
+            const value = args[++index];
+            const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
+            if (!match)
+                throw new AuthCommandError("--min-expiry must use a duration such as 30m or 1h");
+            const amount = Number(match[1]);
+            const unit = match[2];
+            minExpiryMs = amount * (unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000);
+            continue;
+        }
+        if (arg === "--json" || arg === "--credentials" || arg === "--no-refresh") {
+            if (kind !== "check")
+                throw new AuthCommandError(`${arg} is only supported by auth check`);
+            if (arg === "--json")
+                json = true;
+            else if (arg === "--credentials")
+                credentials = true;
+            else
+                noRefresh = true;
+            continue;
+        }
+        commandArgs.push(arg);
+    }
+    return minExpiryMs === undefined
+        ? { kind, args: commandArgs, json, credentials, noRefresh }
+        : { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };
+}
+export function validateAuthCommandArgs(args, kind) {
+    const provider = args.provider?.trim() || undefined;
+    const model = args.model?.trim() || undefined;
+    if (args.unknownFlags.size > 0) {
+        const option = args.unknownFlags.keys().next().value;
+        throw new AuthCommandError(`Unknown option --${option} for "${getAuthCommandName(kind)}".`);
+    }
+    if (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {
+        throw new AuthCommandError("Auth commands only accept --provider and --model");
+    }
+    if (kind === "check") {
+        if (!provider && !model) {
+            throw new AuthCommandError("Auth checks require --provider <provider> or --model <model>");
+        }
+        return { provider, model };
+    }
+    if (!provider && !model) {
+        throw new AuthCommandError("Credential printing requires --provider <provider> or --model <model>");
+    }
+    return { provider, model };
+}
+export function getAuthCredential(auth) {
+    if (auth?.auth.apiKey)
+        return auth.auth.apiKey;
+    const authorization = Object.entries(auth?.auth.headers ?? {}).find(([name]) => name.toLowerCase() === "authorization")?.[1];
+    return typeof authorization === "string" ? /^Bearer\s+(.+)$/iu.exec(authorization)?.[1] : undefined;
+}
+//# sourceMappingURL=auth-command.js.map

package/dist/cli/auth-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-command.js","sourceRoot":"","sources":["../../src/cli/auth-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAcxC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,MAAM,kBAAkB,GAAoC;IAC3D,KAAK,EAAE,GAAG,QAAQ,2EAA2E;IAC7F,OAAO,EAAE,GAAG,QAAQ,6DAA6D;IACjF,YAAY,EAAE,GAAG,QAAQ,4FAA4F;CACrH,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAqB,EAAU;IACjE,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAAA,CAC/G;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAqB,EAAU;IAClE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAAA,CAChC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAW;IAC1D,OAAO,CACN,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAClB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC/F,CAAC;AAAA,CACF;AAED,MAAM,UAAU,oBAAoB,GAAS;IAC5C,OAAO,CAAC,GAAG,CAAC;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;;iNAEqM,CAAC,CAAC;AAAA,CAClN;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAc,EAA2B;IACzE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GACT,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAClB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB;gBACjC,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACzB,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,QAAQ,0BAA0B,QAAQ,kCAAkC,QAAQ,eAAe,CACpJ,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAA+B,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,cAAc;gBAC1B,MAAM,IAAI,gBAAgB,CAAC,sDAAsD,CAAC,CAAC;YACpF,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,gBAAgB,CAAC,oDAAoD,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtG,SAAS;QACV,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;YAC3E,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC;YAC3F,IAAI,GAAG,KAAK,QAAQ;gBAAE,IAAI,GAAG,IAAI,CAAC;iBAC7B,IAAI,GAAG,KAAK,eAAe;gBAAE,WAAW,GAAG,IAAI,CAAC;;gBAChD,SAAS,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;QAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAAA,CAC1E;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAU,EAAE,IAAqB,EAAyC;IACjH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,MAAM,SAAS,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,kDAAkD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,uEAAuE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAAA,CAC3B;AAED,MAAM,UAAU,iBAAiB,CAAC,IAA4B,EAAsB;IACnF,IAAI,IAAI,EAAE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAClD,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,OAAO,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACpG","sourcesContent":["import type { AuthResult } from \"@earendil-works/pi-ai\";\nimport { APP_NAME } from \"../config.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type AuthCommandKind = \"check\" | \"api_key\" | \"bearer_token\";\n\nexport interface AuthCommand {\n\tkind: AuthCommandKind;\n\targs: string[];\n\tjson: boolean;\n\tcredentials: boolean;\n\tnoRefresh: boolean;\n\tminExpiryMs?: number;\n}\n\nexport class AuthCommandError extends Error {}\n\nconst AUTH_COMMAND_USAGE: Record<AuthCommandKind, string> = {\n\tcheck: `${APP_NAME} auth check --provider <provider> [--json] [--credentials] [--no-refresh]`,\n\tapi_key: `${APP_NAME} auth print-api-key --provider <provider> [--model <model>]`,\n\tbearer_token: `${APP_NAME} auth print-bearer-token --provider <provider> [--model <model>] [--min-expiry <duration>]`,\n};\n\nexport function getAuthCommandName(kind: AuthCommandKind): string {\n\treturn kind === \"check\" ? \"auth check\" : kind === \"api_key\" ? \"auth print-api-key\" : \"auth print-bearer-token\";\n}\n\nexport function getAuthCommandUsage(kind: AuthCommandKind): string {\n\treturn AUTH_COMMAND_USAGE[kind];\n}\n\nexport function isAuthCommandHelp(args: string[]): boolean {\n\treturn (\n\t\targs[0] === \"auth\" &&\n\t\t(args[1] === undefined || args[1] === \"help\" || args.includes(\"--help\") || args.includes(\"-h\"))\n\t);\n}\n\nexport function printAuthCommandHelp(): void {\n\tconsole.log(`Usage:\n  ${APP_NAME} auth print-api-key [--provider <provider>] [--model <model>]\n  ${APP_NAME} auth print-bearer-token [--provider <provider>] [--model <model>] [--min-expiry <duration>]\n  ${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]\n\nAuth commands require at least one of --provider or --model. Checks refresh expired OAuth credentials by default; --no-refresh prevents this. --credentials emits the credential, or includes it in JSON output.`);\n}\n\nexport function parseAuthCommand(args: string[]): AuthCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind =\n\t\targs[1] === \"check\"\n\t\t\t? \"check\"\n\t\t\t: args[1] === \"print-api-key\"\n\t\t\t\t? \"api_key\"\n\t\t\t\t: args[1] === \"print-bearer-token\"\n\t\t\t\t\t? \"bearer_token\"\n\t\t\t\t\t: undefined;\n\tif (!kind) {\n\t\tthrow new AuthCommandError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\", \"${APP_NAME} auth print-bearer-token\", or \"${APP_NAME} auth check\".`,\n\t\t);\n\t}\n\n\tconst commandArgs: string[] = [];\n\tlet json = false;\n\tlet credentials = false;\n\tlet noRefresh = false;\n\tlet minExpiryMs: number | undefined;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (arg === \"--min-expiry\") {\n\t\t\tif (kind !== \"bearer_token\")\n\t\t\t\tthrow new AuthCommandError(\"--min-expiry is only supported by print-bearer-token\");\n\t\t\tconst value = args[++index];\n\t\t\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\t\t\tif (!match) throw new AuthCommandError(\"--min-expiry must use a duration such as 30m or 1h\");\n\t\t\tconst amount = Number(match[1]);\n\t\t\tconst unit = match[2];\n\t\t\tminExpiryMs = amount * (unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000);\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg === \"--json\" || arg === \"--credentials\" || arg === \"--no-refresh\") {\n\t\t\tif (kind !== \"check\") throw new AuthCommandError(`${arg} is only supported by auth check`);\n\t\t\tif (arg === \"--json\") json = true;\n\t\t\telse if (arg === \"--credentials\") credentials = true;\n\t\t\telse noRefresh = true;\n\t\t\tcontinue;\n\t\t}\n\t\tcommandArgs.push(arg);\n\t}\n\n\treturn minExpiryMs === undefined\n\t\t? { kind, args: commandArgs, json, credentials, noRefresh }\n\t\t: { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };\n}\n\nexport function validateAuthCommandArgs(args: Args, kind: AuthCommandKind): { provider?: string; model?: string } {\n\tconst provider = args.provider?.trim() || undefined;\n\tconst model = args.model?.trim() || undefined;\n\tif (args.unknownFlags.size > 0) {\n\t\tconst option = args.unknownFlags.keys().next().value;\n\t\tthrow new AuthCommandError(`Unknown option --${option} for \"${getAuthCommandName(kind)}\".`);\n\t}\n\tif (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {\n\t\tthrow new AuthCommandError(\"Auth commands only accept --provider and --model\");\n\t}\n\tif (kind === \"check\") {\n\t\tif (!provider && !model) {\n\t\t\tthrow new AuthCommandError(\"Auth checks require --provider <provider> or --model <model>\");\n\t\t}\n\t\treturn { provider, model };\n\t}\n\tif (!provider && !model) {\n\t\tthrow new AuthCommandError(\"Credential printing requires --provider <provider> or --model <model>\");\n\t}\n\treturn { provider, model };\n}\n\nexport function getAuthCredential(auth: AuthResult | undefined): string | undefined {\n\tif (auth?.auth.apiKey) return auth.auth.apiKey;\n\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t)?.[1];\n\treturn typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n}\n"]}

package/dist/cli/config-selector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-selector.d.ts","sourceRoot":"","sources":["../../src/cli/config-selector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAGvH,MAAM,WAAW,qBAAqB;IACrC,aAAa,EAAE,mBAAmB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IACjC,oBAAoB,EAAE,OAAO,CAAC;CAC9B;AAED,sDAAsD;AACtD,wBAAsB,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoChF","sourcesContent":["/**\n * TUI config selector for `pi config` command\n */\n\nimport { ProcessTerminal, TUI } from \"@earendil-works/pi-tui\";\nimport type { SettingsManager } from \"../core/settings-manager.ts\";\nimport { ConfigSelectorComponent, type ScopedResolvedPaths } from \"../modes/interactive/components/config-selector.ts\";\nimport { initTheme, stopThemeWatcher } from \"../modes/interactive/theme/theme.ts\";\n\nexport interface ConfigSelectorOptions {\n\tresolvedPaths: ScopedResolvedPaths;\n\tsettingsManager: SettingsManager;\n\tcwd: string;\n\tagentDir: string;\n\twriteScope: \"global\" | \"project\";\n\tprojectModeAvailable: boolean;\n}\n\n/** Show TUI config selector and return when closed */\nexport async function selectConfig(options: ConfigSelectorOptions): Promise<void> {\n\t// Initialize theme before showing TUI\n\tinitTheme(options.settingsManager.getTheme(), true);\n\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TUI(new ProcessTerminal(), undefined, options.agentDir);\n\t\tlet resolved = false;\n\n\t\tconst selector = new ConfigSelectorComponent(\n\t\t\toptions.resolvedPaths,\n\t\t\toptions.settingsManager,\n\t\t\toptions.cwd,\n\t\t\toptions.agentDir,\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tstopThemeWatcher();\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tstopThemeWatcher();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\tui.terminal.rows,\n\t\t\toptions.writeScope,\n\t\t\toptions.projectModeAvailable,\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getResourceList());\n\t\tui.start();\n\t});\n}\n"]}
+{"version":3,"file":"config-selector.d.ts","sourceRoot":"","sources":["../../src/cli/config-selector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AAGvH,MAAM,WAAW,qBAAqB;IACrC,aAAa,EAAE,mBAAmB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IACjC,oBAAoB,EAAE,OAAO,CAAC;CAC9B;AAED,sDAAsD;AACtD,wBAAsB,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoChF","sourcesContent":["/**\n * TUI config selector for `pi config` command\n */\n\nimport { ProcessTerminal, type TUI, TuiMainScreen } from \"@earendil-works/pi-tui\";\nimport type { SettingsManager } from \"../core/settings-manager.ts\";\nimport { ConfigSelectorComponent, type ScopedResolvedPaths } from \"../modes/interactive/components/config-selector.ts\";\nimport { initTheme, stopThemeWatcher } from \"../modes/interactive/theme/theme.ts\";\n\nexport interface ConfigSelectorOptions {\n\tresolvedPaths: ScopedResolvedPaths;\n\tsettingsManager: SettingsManager;\n\tcwd: string;\n\tagentDir: string;\n\twriteScope: \"global\" | \"project\";\n\tprojectModeAvailable: boolean;\n}\n\n/** Show TUI config selector and return when closed */\nexport async function selectConfig(options: ConfigSelectorOptions): Promise<void> {\n\t// Initialize theme before showing TUI\n\tinitTheme(options.settingsManager.getTheme(), true);\n\n\treturn new Promise((resolve) => {\n\t\tconst ui: TUI = new TuiMainScreen(new ProcessTerminal(), undefined, options.agentDir);\n\t\tlet resolved = false;\n\n\t\tconst selector = new ConfigSelectorComponent(\n\t\t\toptions.resolvedPaths,\n\t\t\toptions.settingsManager,\n\t\t\toptions.cwd,\n\t\t\toptions.agentDir,\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tstopThemeWatcher();\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tstopThemeWatcher();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\tui.terminal.rows,\n\t\t\toptions.writeScope,\n\t\t\toptions.projectModeAvailable,\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getResourceList());\n\t\tui.start();\n\t});\n}\n"]}

package/dist/cli/config-selector.js

@@ -1,7 +1,7 @@
 /**
  * TUI config selector for `pi config` command
  */
-import { ProcessTerminal, TUI } from "@earendil-works/pi-tui";
+import { ProcessTerminal, TuiMainScreen } from "@earendil-works/pi-tui";
 import { ConfigSelectorComponent } from "../modes/interactive/components/config-selector.js";
 import { initTheme, stopThemeWatcher } from "../modes/interactive/theme/theme.js";
 /** Show TUI config selector and return when closed */
@@ -9,7 +9,7 @@ export async function selectConfig(options) {
     // Initialize theme before showing TUI
     initTheme(options.settingsManager.getTheme(), true);
     return new Promise((resolve) => {
-        const ui = new TUI(new ProcessTerminal(), undefined, options.agentDir);
+        const ui = new TuiMainScreen(new ProcessTerminal(), undefined, options.agentDir);
         let resolved = false;
         const selector = new ConfigSelectorComponent(options.resolvedPaths, options.settingsManager, options.cwd, options.agentDir, () => {
             if (!resolved) {

package/dist/cli/config-selector.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-selector.js","sourceRoot":"","sources":["../../src/cli/config-selector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAA4B,MAAM,oDAAoD,CAAC;AACvH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAWlF,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA8B,EAAiB;IACjF,sCAAsC;IACtC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IAEpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,eAAe,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,QAAQ,GAAG,IAAI,uBAAuB,CAC3C,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,QAAQ,EAChB,GAAG,EAAE,CAAC;YACL,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,gBAAgB,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;YACX,CAAC;QAAA,CACD,EACD,GAAG,EAAE,CAAC;YACL,EAAE,CAAC,IAAI,EAAE,CAAC;YACV,gBAAgB,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,CAChB,EACD,GAAG,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EACxB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAChB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,oBAAoB,CAC5B,CAAC;QAEF,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAA,CACX,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * TUI config selector for `pi config` command\n */\n\nimport { ProcessTerminal, TUI } from \"@earendil-works/pi-tui\";\nimport type { SettingsManager } from \"../core/settings-manager.ts\";\nimport { ConfigSelectorComponent, type ScopedResolvedPaths } from \"../modes/interactive/components/config-selector.ts\";\nimport { initTheme, stopThemeWatcher } from \"../modes/interactive/theme/theme.ts\";\n\nexport interface ConfigSelectorOptions {\n\tresolvedPaths: ScopedResolvedPaths;\n\tsettingsManager: SettingsManager;\n\tcwd: string;\n\tagentDir: string;\n\twriteScope: \"global\" | \"project\";\n\tprojectModeAvailable: boolean;\n}\n\n/** Show TUI config selector and return when closed */\nexport async function selectConfig(options: ConfigSelectorOptions): Promise<void> {\n\t// Initialize theme before showing TUI\n\tinitTheme(options.settingsManager.getTheme(), true);\n\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TUI(new ProcessTerminal(), undefined, options.agentDir);\n\t\tlet resolved = false;\n\n\t\tconst selector = new ConfigSelectorComponent(\n\t\t\toptions.resolvedPaths,\n\t\t\toptions.settingsManager,\n\t\t\toptions.cwd,\n\t\t\toptions.agentDir,\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tstopThemeWatcher();\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tstopThemeWatcher();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\tui.terminal.rows,\n\t\t\toptions.writeScope,\n\t\t\toptions.projectModeAvailable,\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getResourceList());\n\t\tui.start();\n\t});\n}\n"]}
+{"version":3,"file":"config-selector.js","sourceRoot":"","sources":["../../src/cli/config-selector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAY,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,EAAE,uBAAuB,EAA4B,MAAM,oDAAoD,CAAC;AACvH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAWlF,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA8B,EAAiB;IACjF,sCAAsC;IACtC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IAEpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAQ,IAAI,aAAa,CAAC,IAAI,eAAe,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtF,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,QAAQ,GAAG,IAAI,uBAAuB,CAC3C,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,QAAQ,EAChB,GAAG,EAAE,CAAC;YACL,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,gBAAgB,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;YACX,CAAC;QAAA,CACD,EACD,GAAG,EAAE,CAAC;YACL,EAAE,CAAC,IAAI,EAAE,CAAC;YACV,gBAAgB,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAA,CAChB,EACD,GAAG,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EACxB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAChB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,oBAAoB,CAC5B,CAAC;QAEF,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAA,CACX,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * TUI config selector for `pi config` command\n */\n\nimport { ProcessTerminal, type TUI, TuiMainScreen } from \"@earendil-works/pi-tui\";\nimport type { SettingsManager } from \"../core/settings-manager.ts\";\nimport { ConfigSelectorComponent, type ScopedResolvedPaths } from \"../modes/interactive/components/config-selector.ts\";\nimport { initTheme, stopThemeWatcher } from \"../modes/interactive/theme/theme.ts\";\n\nexport interface ConfigSelectorOptions {\n\tresolvedPaths: ScopedResolvedPaths;\n\tsettingsManager: SettingsManager;\n\tcwd: string;\n\tagentDir: string;\n\twriteScope: \"global\" | \"project\";\n\tprojectModeAvailable: boolean;\n}\n\n/** Show TUI config selector and return when closed */\nexport async function selectConfig(options: ConfigSelectorOptions): Promise<void> {\n\t// Initialize theme before showing TUI\n\tinitTheme(options.settingsManager.getTheme(), true);\n\n\treturn new Promise((resolve) => {\n\t\tconst ui: TUI = new TuiMainScreen(new ProcessTerminal(), undefined, options.agentDir);\n\t\tlet resolved = false;\n\n\t\tconst selector = new ConfigSelectorComponent(\n\t\t\toptions.resolvedPaths,\n\t\t\toptions.settingsManager,\n\t\t\toptions.cwd,\n\t\t\toptions.agentDir,\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tstopThemeWatcher();\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tstopThemeWatcher();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\tui.terminal.rows,\n\t\t\toptions.writeScope,\n\t\t\toptions.projectModeAvailable,\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getResourceList());\n\t\tui.start();\n\t});\n}\n"]}

package/dist/cli/credential-print.d.ts

@@ -1,23 +1,13 @@
 import type { ModelRuntime } from "../core/model-runtime.ts";
 import type { Args } from "./args.ts";
-export type CredentialPrintKind = "api_key" | "bearer_token";
-export interface CredentialPrintCommand {
-    kind: CredentialPrintKind;
-    args: string[];
-    minExpiryMs?: number;
-}
-export declare class CredentialPrintError extends Error {
-}
-export declare function isCredentialPrintHelp(args: string[]): boolean;
-export declare function printCredentialPrintHelp(): void;
-/** Parse the small, extensible `pi auth` command surface before normal startup. */
-export declare function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined;
-export declare function validateCredentialPrintArgs(args: Args): void;
+import { type AuthCommandKind } from "./auth-command.ts";
+type CredentialPrintKind = Exclude<AuthCommandKind, "check">;
 /**
- * Resolve one request credential for a specific provider/model pair.
+ * Resolve one configured provider credential.
  *
  * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists
  * OAuth credentials with less than five minutes remaining through the normal request-auth path.
  */
-export declare function resolveCredentialForPrint(args: Args, modelRuntime: ModelRuntime, kind: CredentialPrintKind, minExpiryMs?: number): Promise<string>;
+export declare function resolveCredentialForPrint(args: Args, modelRuntime: ModelRuntime, kind: CredentialPrintKind, minExpiryMs?: number, signal?: AbortSignal): Promise<string>;
+export {};
 //# sourceMappingURL=credential-print.d.ts.map

package/dist/cli/credential-print.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,cAAc,CAAC;AAI7D,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAI7D;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CAM/C;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,sBAAsB,GAAG,SAAS,CA+B9F;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAU5D;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CA+DjB","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { APP_NAME } from \"../config.ts\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type CredentialPrintKind = \"api_key\" | \"bearer_token\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\nexport interface CredentialPrintCommand {\n\tkind: CredentialPrintKind;\n\targs: string[];\n\tminExpiryMs?: number;\n}\n\nexport class CredentialPrintError extends Error {}\n\nexport function isCredentialPrintHelp(args: string[]): boolean {\n\treturn (\n\t\targs[0] === \"auth\" && (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\")\n\t);\n}\n\nexport function printCredentialPrintHelp(): void {\n\tconsole.log(`Usage:\n  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]\n  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n\nPrints the configured credential alone on stdout. Provider inference uses configured credentials; specify --provider to select explicitly. Bearer tokens have a 30-minute minimum expiry by default. --min-expiry accepts ms, s, m, or h (for example, 30m).`);\n}\n\n/** Parse the small, extensible `pi auth` command surface before normal startup. */\nexport function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind = args[1] === \"print-api-key\" ? \"api_key\" : args[1] === \"print-bearer-token\" ? \"bearer_token\" : undefined;\n\tif (!kind) {\n\t\tthrow new CredentialPrintError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\" or \"${APP_NAME} auth print-bearer-token\".`,\n\t\t);\n\t}\n\n\tconst commandArgs: string[] = [];\n\tlet minExpiryMs: number | undefined;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tif (args[index] !== \"--min-expiry\") {\n\t\t\tcommandArgs.push(args[index]);\n\t\t\tcontinue;\n\t\t}\n\t\tif (kind !== \"bearer_token\") {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry is only supported by print-bearer-token\");\n\t\t}\n\t\tconst value = args[++index];\n\t\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\t\tif (!match) {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry must use a duration such as 30m or 1h\");\n\t\t}\n\t\tconst amount = Number(match[1]);\n\t\tconst unit = match[2];\n\t\tminExpiryMs = amount * (unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000);\n\t}\n\n\treturn minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };\n}\n\nexport function validateCredentialPrintArgs(args: Args): void {\n\tif (!args.model?.trim()) {\n\t\tthrow new CredentialPrintError(\"Credential printing requires --model <model>\");\n\t}\n\tif (args.apiKey !== undefined) {\n\t\tthrow new CredentialPrintError(\"Credential printing reads configured credentials; --api-key is not supported\");\n\t}\n\tif (args.messages.length > 0 || args.fileArgs.length > 0 || args.unknownFlags.size > 0) {\n\t\tthrow new CredentialPrintError(\"Credential printing only accepts --provider and --model\");\n\t}\n}\n\n/**\n * Resolve one request credential for a specific provider/model pair.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n): Promise<string> {\n\tvalidateCredentialPrintArgs(args);\n\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials()).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst models: Model<Api>[] = [];\n\tif (args.provider) {\n\t\tconst resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new CredentialPrintError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t}\n\t\tmodels.push(resolved.model);\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tmodels.push(resolved.model);\n\t\t\t}\n\t\t}\n\t\tif (models.length === 0) {\n\t\t\tthrow new CredentialPrintError(`Model \"${args.model}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const model of models) {\n\t\tconst type = credentialTypes.get(model.provider);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\n\t\tconst auth = await modelRuntime.getAuth(\n\t\t\tmodel,\n\t\t\tkind === \"bearer_token\"\n\t\t\t\t? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS }\n\t\t\t\t: undefined,\n\t\t);\n\t\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t\t)?.[1];\n\t\tconst bearerToken = typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n\t\tconst value = kind === \"bearer_token\" ? (auth?.auth.apiKey ?? bearerToken) : auth?.auth.apiKey;\n\t\tif (value) credentials.push({ providerId: model.provider, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = models[0]?.provider;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (args.provider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (args.provider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`,\n\t\t);\n\t}\n\tthrow new CredentialPrintError(\n\t\t`Model \"${args.model}\" has multiple configured providers (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}
+{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAoB,KAAK,eAAe,EAA8C,MAAM,mBAAmB,CAAC;AAIvH,KAAK,mBAAmB,GAAG,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAgEjB","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\nimport { AuthCommandError, type AuthCommandKind, getAuthCredential, validateAuthCommandArgs } from \"./auth-command.ts\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\ntype CredentialPrintKind = Exclude<AuthCommandKind, \"check\">;\n\n/**\n * Resolve one configured provider credential.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n\tsignal?: AbortSignal,\n): Promise<string> {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, kind);\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst providers: Array<{ id: string; model?: Model<Api> }> = [];\n\tif (cliProvider) {\n\t\tconst provider = modelRuntime.getProvider(cliProvider);\n\t\tif (!provider) {\n\t\t\tthrow new AuthCommandError(`Unknown provider \"${cliProvider}\". Use --list-models to see available providers.`);\n\t\t}\n\t\tif (cliModel) {\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel, modelRuntime });\n\t\t\tif (resolved.error || !resolved.model) {\n\t\t\t\tthrow new AuthCommandError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t\t}\n\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t} else {\n\t\t\tproviders.push({ id: provider.id });\n\t\t}\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: cliModel!, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t\t}\n\t\t}\n\t\tif (providers.length === 0) {\n\t\t\tthrow new AuthCommandError(`Model \"${cliModel}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const provider of providers) {\n\t\tconst type = credentialTypes.get(provider.id);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\t\tconst authOptions = {\n\t\t\t...(kind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),\n\t\t\tsignal,\n\t\t};\n\t\tconst auth = provider.model\n\t\t\t? await modelRuntime.getAuth(provider.model, authOptions)\n\t\t\t: await modelRuntime.getAuth(provider.id, authOptions);\n\t\tconst value = getAuthCredential(auth);\n\t\tif (value) credentials.push({ providerId: provider.id, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = providers[0]?.id;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (cliProvider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (cliProvider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new AuthCommandError(`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`);\n\t}\n\tthrow new AuthCommandError(\n\t\t`Multiple configured providers matched (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}

package/dist/cli/credential-print.js

@@ -1,117 +1,76 @@
-import { APP_NAME } from "../config.js";
 import { resolveCliModel } from "../core/model-resolver.js";
+import { AuthCommandError, getAuthCredential, validateAuthCommandArgs } from "./auth-command.js";
 const DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;
-export class CredentialPrintError extends Error {
-}
-export function isCredentialPrintHelp(args) {
-    return (args[0] === "auth" && (args[1] === undefined || args[1] === "help" || args[1] === "--help" || args[1] === "-h"));
-}
-export function printCredentialPrintHelp() {
-    console.log(`Usage:
-  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]
-  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]
-
-Prints the configured credential alone on stdout. Provider inference uses configured credentials; specify --provider to select explicitly. Bearer tokens have a 30-minute minimum expiry by default. --min-expiry accepts ms, s, m, or h (for example, 30m).`);
-}
-/** Parse the small, extensible `pi auth` command surface before normal startup. */
-export function parseCredentialPrintCommand(args) {
-    if (args[0] !== "auth")
-        return undefined;
-    const kind = args[1] === "print-api-key" ? "api_key" : args[1] === "print-bearer-token" ? "bearer_token" : undefined;
-    if (!kind) {
-        throw new CredentialPrintError(`Unknown auth command "${args[1] ?? ""}". Use "${APP_NAME} auth print-api-key" or "${APP_NAME} auth print-bearer-token".`);
-    }
-    const commandArgs = [];
-    let minExpiryMs;
-    for (let index = 2; index < args.length; index++) {
-        if (args[index] !== "--min-expiry") {
-            commandArgs.push(args[index]);
-            continue;
-        }
-        if (kind !== "bearer_token") {
-            throw new CredentialPrintError("--min-expiry is only supported by print-bearer-token");
-        }
-        const value = args[++index];
-        const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
-        if (!match) {
-            throw new CredentialPrintError("--min-expiry must use a duration such as 30m or 1h");
-        }
-        const amount = Number(match[1]);
-        const unit = match[2];
-        minExpiryMs = amount * (unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000);
-    }
-    return minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };
-}
-export function validateCredentialPrintArgs(args) {
-    if (!args.model?.trim()) {
-        throw new CredentialPrintError("Credential printing requires --model <model>");
-    }
-    if (args.apiKey !== undefined) {
-        throw new CredentialPrintError("Credential printing reads configured credentials; --api-key is not supported");
-    }
-    if (args.messages.length > 0 || args.fileArgs.length > 0 || args.unknownFlags.size > 0) {
-        throw new CredentialPrintError("Credential printing only accepts --provider and --model");
-    }
-}
 /**
- * Resolve one request credential for a specific provider/model pair.
+ * Resolve one configured provider credential.
  *
  * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists
  * OAuth credentials with less than five minutes remaining through the normal request-auth path.
  */
-export async function resolveCredentialForPrint(args, modelRuntime, kind, minExpiryMs) {
-    validateCredentialPrintArgs(args);
-    const credentialTypes = new Map((await modelRuntime.listCredentials()).map((credential) => [credential.providerId, credential.type]));
-    const models = [];
-    if (args.provider) {
-        const resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });
-        if (resolved.error || !resolved.model) {
-            throw new CredentialPrintError(resolved.error ?? "Unable to resolve the requested provider/model");
+export async function resolveCredentialForPrint(args, modelRuntime, kind, minExpiryMs, signal) {
+    const { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, kind);
+    const credentialTypes = new Map((await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]));
+    const providers = [];
+    if (cliProvider) {
+        const provider = modelRuntime.getProvider(cliProvider);
+        if (!provider) {
+            throw new AuthCommandError(`Unknown provider "${cliProvider}". Use --list-models to see available providers.`);
+        }
+        if (cliModel) {
+            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel, modelRuntime });
+            if (resolved.error || !resolved.model) {
+                throw new AuthCommandError(resolved.error ?? "Unable to resolve the requested provider/model");
+            }
+            providers.push({ id: provider.id, model: resolved.model });
+        }
+        else {
+            providers.push({ id: provider.id });
         }
-        models.push(resolved.model);
     }
     else {
         for (const provider of modelRuntime.getProviders()) {
             if (!credentialTypes.has(provider.id))
                 continue;
-            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });
+            const resolved = resolveCliModel({ cliProvider: provider.id, cliModel: cliModel, modelRuntime });
             if (resolved.model && !resolved.error && !resolved.warning?.includes("Using custom model id")) {
-                models.push(resolved.model);
+                providers.push({ id: provider.id, model: resolved.model });
             }
         }
-        if (models.length === 0) {
-            throw new CredentialPrintError(`Model "${args.model}" not found. Use --list-models to see available models.`);
+        if (providers.length === 0) {
+            throw new AuthCommandError(`Model "${cliModel}" not found. Use --list-models to see available models.`);
         }
     }
     const credentials = [];
-    for (const model of models) {
-        const type = credentialTypes.get(model.provider);
+    for (const provider of providers) {
+        const type = credentialTypes.get(provider.id);
         if (kind === "api_key" && type === "oauth")
             continue;
         if (kind === "bearer_token" && type !== "oauth")
             continue;
-        const auth = await modelRuntime.getAuth(model, kind === "bearer_token"
-            ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS }
-            : undefined);
-        const authorization = Object.entries(auth?.auth.headers ?? {}).find(([name]) => name.toLowerCase() === "authorization")?.[1];
-        const bearerToken = typeof authorization === "string" ? /^Bearer\s+(.+)$/iu.exec(authorization)?.[1] : undefined;
-        const value = kind === "bearer_token" ? (auth?.auth.apiKey ?? bearerToken) : auth?.auth.apiKey;
+        const authOptions = {
+            ...(kind === "bearer_token" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),
+            signal,
+        };
+        const auth = provider.model
+            ? await modelRuntime.getAuth(provider.model, authOptions)
+            : await modelRuntime.getAuth(provider.id, authOptions);
+        const value = getAuthCredential(auth);
         if (value)
-            credentials.push({ providerId: model.provider, value });
+            credentials.push({ providerId: provider.id, value });
     }
     if (credentials.length === 1)
         return credentials[0].value;
     if (credentials.length === 0) {
-        const providerId = models[0]?.provider;
+        const providerId = providers[0]?.id;
         const type = providerId ? credentialTypes.get(providerId) : undefined;
-        if (args.provider && kind === "api_key" && type === "oauth") {
-            throw new CredentialPrintError(`Provider "${providerId}" is configured with OAuth, not an API key`);
+        if (cliProvider && kind === "api_key" && type === "oauth") {
+            throw new AuthCommandError(`Provider "${providerId}" is configured with OAuth, not an API key`);
         }
-        if (args.provider && kind === "bearer_token" && type !== "oauth") {
-            throw new CredentialPrintError(`Provider "${providerId}" is not configured with an OAuth bearer token`);
+        if (cliProvider && kind === "bearer_token" && type !== "oauth") {
+            throw new AuthCommandError(`Provider "${providerId}" is not configured with an OAuth bearer token`);
         }
-        throw new CredentialPrintError(`No usable ${kind === "api_key" ? "API key" : "OAuth bearer token"} is configured`);
+        throw new AuthCommandError(`No usable ${kind === "api_key" ? "API key" : "OAuth bearer token"} is configured`);
     }
-    throw new CredentialPrintError(`Model "${args.model}" has multiple configured providers (${credentials.map(({ providerId }) => providerId).join(", ")}). Specify --provider.`);
+    throw new AuthCommandError(`Multiple configured providers matched (${credentials.map(({ providerId }) => providerId).join(", ")}). Specify --provider.`);
 }
 //# sourceMappingURL=credential-print.js.map

package/dist/cli/credential-print.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-print.js","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAM5D,MAAM,kCAAkC,GAAG,EAAE,GAAG,MAAM,CAAC;AAQvD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAW;IAC9D,OAAO,CACN,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC/G,CAAC;AAAA,CACF;AAED,MAAM,UAAU,wBAAwB,GAAS;IAChD,OAAO,CAAC,GAAG,CAAC;IACT,QAAQ;IACR,QAAQ;;6PAEiP,CAAC,CAAC;AAAA,CAC9P;AAED,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CAAC,IAAc,EAAsC;IAC/F,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACrH,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,oBAAoB,CAC7B,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,QAAQ,4BAA4B,QAAQ,4BAA4B,CACzH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,WAA+B,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,sDAAsD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,oBAAoB,CAAC,oDAAoD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvG,CAAC;IAED,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AAAA,CAC1G;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAU,EAAQ;IAC7D,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAAC,8CAA8C,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAAC,8EAA8E,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,oBAAoB,CAAC,yDAAyD,CAAC,CAAC;IAC3F,CAAC;AAAA,CACD;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAU,EACV,YAA0B,EAC1B,IAAyB,EACzB,WAAoB,EACF;IAClB,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC9B,CAAC,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CACpG,CAAC;IACF,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACrG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,oBAAoB,CAAC,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACnG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAAC,UAAU,IAAI,CAAC,KAAK,yDAAyD,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QACrD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QAE1D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CACtC,KAAK,EACL,IAAI,KAAK,cAAc;YACtB,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,IAAI,kCAAkC,EAAE;YAC3E,CAAC,CAAC,SAAS,CACZ,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAClE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAClD,EAAE,CAAC,CAAC,CAAC,CAAC;QACP,MAAM,WAAW,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjH,MAAM,KAAK,GAAG,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/F,IAAI,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAAC,aAAa,UAAU,4CAA4C,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAClE,MAAM,IAAI,oBAAoB,CAAC,aAAa,UAAU,gDAAgD,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC7B,aAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,gBAAgB,CAClF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,oBAAoB,CAC7B,UAAU,IAAI,CAAC,KAAK,wCAAwC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC9I,CAAC;AAAA,CACF","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { APP_NAME } from \"../config.ts\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type CredentialPrintKind = \"api_key\" | \"bearer_token\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\nexport interface CredentialPrintCommand {\n\tkind: CredentialPrintKind;\n\targs: string[];\n\tminExpiryMs?: number;\n}\n\nexport class CredentialPrintError extends Error {}\n\nexport function isCredentialPrintHelp(args: string[]): boolean {\n\treturn (\n\t\targs[0] === \"auth\" && (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\")\n\t);\n}\n\nexport function printCredentialPrintHelp(): void {\n\tconsole.log(`Usage:\n  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]\n  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n\nPrints the configured credential alone on stdout. Provider inference uses configured credentials; specify --provider to select explicitly. Bearer tokens have a 30-minute minimum expiry by default. --min-expiry accepts ms, s, m, or h (for example, 30m).`);\n}\n\n/** Parse the small, extensible `pi auth` command surface before normal startup. */\nexport function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind = args[1] === \"print-api-key\" ? \"api_key\" : args[1] === \"print-bearer-token\" ? \"bearer_token\" : undefined;\n\tif (!kind) {\n\t\tthrow new CredentialPrintError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\" or \"${APP_NAME} auth print-bearer-token\".`,\n\t\t);\n\t}\n\n\tconst commandArgs: string[] = [];\n\tlet minExpiryMs: number | undefined;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tif (args[index] !== \"--min-expiry\") {\n\t\t\tcommandArgs.push(args[index]);\n\t\t\tcontinue;\n\t\t}\n\t\tif (kind !== \"bearer_token\") {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry is only supported by print-bearer-token\");\n\t\t}\n\t\tconst value = args[++index];\n\t\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\t\tif (!match) {\n\t\t\tthrow new CredentialPrintError(\"--min-expiry must use a duration such as 30m or 1h\");\n\t\t}\n\t\tconst amount = Number(match[1]);\n\t\tconst unit = match[2];\n\t\tminExpiryMs = amount * (unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000);\n\t}\n\n\treturn minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };\n}\n\nexport function validateCredentialPrintArgs(args: Args): void {\n\tif (!args.model?.trim()) {\n\t\tthrow new CredentialPrintError(\"Credential printing requires --model <model>\");\n\t}\n\tif (args.apiKey !== undefined) {\n\t\tthrow new CredentialPrintError(\"Credential printing reads configured credentials; --api-key is not supported\");\n\t}\n\tif (args.messages.length > 0 || args.fileArgs.length > 0 || args.unknownFlags.size > 0) {\n\t\tthrow new CredentialPrintError(\"Credential printing only accepts --provider and --model\");\n\t}\n}\n\n/**\n * Resolve one request credential for a specific provider/model pair.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n): Promise<string> {\n\tvalidateCredentialPrintArgs(args);\n\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials()).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst models: Model<Api>[] = [];\n\tif (args.provider) {\n\t\tconst resolved = resolveCliModel({ cliProvider: args.provider, cliModel: args.model, modelRuntime });\n\t\tif (resolved.error || !resolved.model) {\n\t\t\tthrow new CredentialPrintError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t}\n\t\tmodels.push(resolved.model);\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: args.model, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tmodels.push(resolved.model);\n\t\t\t}\n\t\t}\n\t\tif (models.length === 0) {\n\t\t\tthrow new CredentialPrintError(`Model \"${args.model}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const model of models) {\n\t\tconst type = credentialTypes.get(model.provider);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\n\t\tconst auth = await modelRuntime.getAuth(\n\t\t\tmodel,\n\t\t\tkind === \"bearer_token\"\n\t\t\t\t? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS }\n\t\t\t\t: undefined,\n\t\t);\n\t\tconst authorization = Object.entries(auth?.auth.headers ?? {}).find(\n\t\t\t([name]) => name.toLowerCase() === \"authorization\",\n\t\t)?.[1];\n\t\tconst bearerToken = typeof authorization === \"string\" ? /^Bearer\\s+(.+)$/iu.exec(authorization)?.[1] : undefined;\n\t\tconst value = kind === \"bearer_token\" ? (auth?.auth.apiKey ?? bearerToken) : auth?.auth.apiKey;\n\t\tif (value) credentials.push({ providerId: model.provider, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = models[0]?.provider;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (args.provider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (args.provider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new CredentialPrintError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new CredentialPrintError(\n\t\t\t`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`,\n\t\t);\n\t}\n\tthrow new CredentialPrintError(\n\t\t`Model \"${args.model}\" has multiple configured providers (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}
+{"version":3,"file":"credential-print.js","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAwB,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEvH,MAAM,kCAAkC,GAAG,EAAE,GAAG,MAAM,CAAC;AAIvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAU,EACV,YAA0B,EAC1B,IAAyB,EACzB,WAAoB,EACpB,MAAoB,EACF;IAClB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,eAAe,GAAG,IAAI,GAAG,CAC9B,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAC9G,CAAC;IACF,MAAM,SAAS,GAA8C,EAAE,CAAC;IAChE,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,WAAW,kDAAkD,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YACvF,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACvC,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,KAAK,IAAI,gDAAgD,CAAC,CAAC;YAChG,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;SAAM,CAAC;QACP,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChD,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAS,EAAE,YAAY,EAAE,CAAC,CAAC;YAClG,IAAI,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/F,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5D,CAAC;QACF,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,UAAU,QAAQ,yDAAyD,CAAC,CAAC;QACzG,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAiD,EAAE,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QACrD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO;YAAE,SAAS;QAC1D,MAAM,WAAW,GAAG;YACnB,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,WAAW,IAAI,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,MAAM;SACN,CAAC;QACF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK;YAC1B,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;YACzD,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3D,MAAM,IAAI,gBAAgB,CAAC,aAAa,UAAU,4CAA4C,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,WAAW,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAChE,MAAM,IAAI,gBAAgB,CAAC,aAAa,UAAU,gDAAgD,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,aAAa,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,gBAAgB,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,IAAI,gBAAgB,CACzB,0CAA0C,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5H,CAAC;AAAA,CACF","sourcesContent":["import type { Api, CredentialInfo, Model } from \"@earendil-works/pi-ai\";\nimport { resolveCliModel } from \"../core/model-resolver.ts\";\nimport type { ModelRuntime } from \"../core/model-runtime.ts\";\nimport type { Args } from \"./args.ts\";\nimport { AuthCommandError, type AuthCommandKind, getAuthCredential, validateAuthCommandArgs } from \"./auth-command.ts\";\n\nconst DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS = 30 * 60_000;\n\ntype CredentialPrintKind = Exclude<AuthCommandKind, \"check\">;\n\n/**\n * Resolve one configured provider credential.\n *\n * This intentionally calls ModelRuntime.getAuth(), which refreshes and persists\n * OAuth credentials with less than five minutes remaining through the normal request-auth path.\n */\nexport async function resolveCredentialForPrint(\n\targs: Args,\n\tmodelRuntime: ModelRuntime,\n\tkind: CredentialPrintKind,\n\tminExpiryMs?: number,\n\tsignal?: AbortSignal,\n): Promise<string> {\n\tconst { provider: cliProvider, model: cliModel } = validateAuthCommandArgs(args, kind);\n\tconst credentialTypes = new Map<string, CredentialInfo[\"type\"]>(\n\t\t(await modelRuntime.listCredentials({ signal })).map((credential) => [credential.providerId, credential.type]),\n\t);\n\tconst providers: Array<{ id: string; model?: Model<Api> }> = [];\n\tif (cliProvider) {\n\t\tconst provider = modelRuntime.getProvider(cliProvider);\n\t\tif (!provider) {\n\t\t\tthrow new AuthCommandError(`Unknown provider \"${cliProvider}\". Use --list-models to see available providers.`);\n\t\t}\n\t\tif (cliModel) {\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel, modelRuntime });\n\t\t\tif (resolved.error || !resolved.model) {\n\t\t\t\tthrow new AuthCommandError(resolved.error ?? \"Unable to resolve the requested provider/model\");\n\t\t\t}\n\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t} else {\n\t\t\tproviders.push({ id: provider.id });\n\t\t}\n\t} else {\n\t\tfor (const provider of modelRuntime.getProviders()) {\n\t\t\tif (!credentialTypes.has(provider.id)) continue;\n\t\t\tconst resolved = resolveCliModel({ cliProvider: provider.id, cliModel: cliModel!, modelRuntime });\n\t\t\tif (resolved.model && !resolved.error && !resolved.warning?.includes(\"Using custom model id\")) {\n\t\t\t\tproviders.push({ id: provider.id, model: resolved.model });\n\t\t\t}\n\t\t}\n\t\tif (providers.length === 0) {\n\t\t\tthrow new AuthCommandError(`Model \"${cliModel}\" not found. Use --list-models to see available models.`);\n\t\t}\n\t}\n\n\tconst credentials: Array<{ providerId: string; value: string }> = [];\n\tfor (const provider of providers) {\n\t\tconst type = credentialTypes.get(provider.id);\n\t\tif (kind === \"api_key\" && type === \"oauth\") continue;\n\t\tif (kind === \"bearer_token\" && type !== \"oauth\") continue;\n\t\tconst authOptions = {\n\t\t\t...(kind === \"bearer_token\" ? { minOAuthValidityMs: minExpiryMs ?? DEFAULT_BEARER_TOKEN_MIN_EXPIRY_MS } : {}),\n\t\t\tsignal,\n\t\t};\n\t\tconst auth = provider.model\n\t\t\t? await modelRuntime.getAuth(provider.model, authOptions)\n\t\t\t: await modelRuntime.getAuth(provider.id, authOptions);\n\t\tconst value = getAuthCredential(auth);\n\t\tif (value) credentials.push({ providerId: provider.id, value });\n\t}\n\n\tif (credentials.length === 1) return credentials[0].value;\n\tif (credentials.length === 0) {\n\t\tconst providerId = providers[0]?.id;\n\t\tconst type = providerId ? credentialTypes.get(providerId) : undefined;\n\t\tif (cliProvider && kind === \"api_key\" && type === \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is configured with OAuth, not an API key`);\n\t\t}\n\t\tif (cliProvider && kind === \"bearer_token\" && type !== \"oauth\") {\n\t\t\tthrow new AuthCommandError(`Provider \"${providerId}\" is not configured with an OAuth bearer token`);\n\t\t}\n\t\tthrow new AuthCommandError(`No usable ${kind === \"api_key\" ? \"API key\" : \"OAuth bearer token\"} is configured`);\n\t}\n\tthrow new AuthCommandError(\n\t\t`Multiple configured providers matched (${credentials.map(({ providerId }) => providerId).join(\", \")}). Specify --provider.`,\n\t);\n}\n"]}

package/dist/cli/experimental/auth.d.ts

@@ -0,0 +1,16 @@
+export type AuthInput = {
+    readonly type: "token";
+    readonly token: string;
+} | {
+    readonly type: "file";
+    readonly path: string;
+};
+export interface RawAuthOptions {
+    readonly authToken?: string;
+    readonly authTokenFile?: string;
+}
+export declare function parseAuthInput(options: RawAuthOptions): {
+    auth?: AuthInput;
+    errors: string[];
+};
+//# sourceMappingURL=auth.d.ts.map

package/dist/cli/experimental/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/experimental/auth.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAW9F","sourcesContent":["export type AuthInput =\n\t| { readonly type: \"token\"; readonly token: string }\n\t| { readonly type: \"file\"; readonly path: string };\n\nexport interface RawAuthOptions {\n\treadonly authToken?: string;\n\treadonly authTokenFile?: string;\n}\n\nexport function parseAuthInput(options: RawAuthOptions): { auth?: AuthInput; errors: string[] } {\n\tif (options.authToken !== undefined && options.authTokenFile !== undefined) {\n\t\treturn { errors: [\"--auth-token and --auth-token-file are mutually exclusive\"] };\n\t}\n\tif (options.authToken !== undefined) {\n\t\treturn { auth: { type: \"token\", token: options.authToken }, errors: [] };\n\t}\n\tif (options.authTokenFile !== undefined) {\n\t\treturn { auth: { type: \"file\", path: options.authTokenFile }, errors: [] };\n\t}\n\treturn { errors: [] };\n}\n"]}

package/dist/cli/experimental/auth.js

@@ -0,0 +1,13 @@
+export function parseAuthInput(options) {
+    if (options.authToken !== undefined && options.authTokenFile !== undefined) {
+        return { errors: ["--auth-token and --auth-token-file are mutually exclusive"] };
+    }
+    if (options.authToken !== undefined) {
+        return { auth: { type: "token", token: options.authToken }, errors: [] };
+    }
+    if (options.authTokenFile !== undefined) {
+        return { auth: { type: "file", path: options.authTokenFile }, errors: [] };
+    }
+    return { errors: [] };
+}
+//# sourceMappingURL=auth.js.map

package/dist/cli/experimental/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/experimental/auth.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,cAAc,CAAC,OAAuB,EAA0C;IAC/F,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,EAAE,CAAC,2DAA2D,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAAA,CACtB","sourcesContent":["export type AuthInput =\n\t| { readonly type: \"token\"; readonly token: string }\n\t| { readonly type: \"file\"; readonly path: string };\n\nexport interface RawAuthOptions {\n\treadonly authToken?: string;\n\treadonly authTokenFile?: string;\n}\n\nexport function parseAuthInput(options: RawAuthOptions): { auth?: AuthInput; errors: string[] } {\n\tif (options.authToken !== undefined && options.authTokenFile !== undefined) {\n\t\treturn { errors: [\"--auth-token and --auth-token-file are mutually exclusive\"] };\n\t}\n\tif (options.authToken !== undefined) {\n\t\treturn { auth: { type: \"token\", token: options.authToken }, errors: [] };\n\t}\n\tif (options.authTokenFile !== undefined) {\n\t\treturn { auth: { type: \"file\", path: options.authTokenFile }, errors: [] };\n\t}\n\treturn { errors: [] };\n}\n"]}

package/dist/cli/experimental/cli.d.ts

@@ -0,0 +1,6 @@
+import { type ClientCommandContext } from "./commands/client.ts";
+import { type PiCommandContext } from "./commands/pi.ts";
+import { type ServerCommandContext } from "./commands/server.ts";
+export type ExperimentalCliContext = PiCommandContext & ServerCommandContext & ClientCommandContext;
+export declare const experimentalCli: import("./command.ts").Command<import("./commands/pi.ts").PiCommand, PiCommandContext & ServerCommandContext & ClientCommandContext, import("./commands/client.ts").ClientCommand | import("./commands/pi.ts").PiCommand | import("./commands/server.ts").ServerCommand>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli/experimental/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../src/cli/experimental/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,KAAK,gBAAgB,EAAa,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,sBAAsB,CAAC;AAEhF,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,oBAAoB,CAAC;AAEpG,eAAO,MAAM,eAAe,0QAA0D,CAAC","sourcesContent":["import { type ClientCommandContext, clientCommand } from \"./commands/client.ts\";\nimport { type PiCommandContext, piCommand } from \"./commands/pi.ts\";\nimport { type ServerCommandContext, serverCommand } from \"./commands/server.ts\";\n\nexport type ExperimentalCliContext = PiCommandContext & ServerCommandContext & ClientCommandContext;\n\nexport const experimentalCli = piCommand.command(serverCommand).command(clientCommand);\n"]}

package/dist/cli/experimental/cli.js

@@ -0,0 +1,5 @@
+import { clientCommand } from "./commands/client.js";
+import { piCommand } from "./commands/pi.js";
+import { serverCommand } from "./commands/server.js";
+export const experimentalCli = piCommand.command(serverCommand).command(clientCommand);
+//# sourceMappingURL=cli.js.map

package/dist/cli/experimental/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/cli/experimental/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAyB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAA6B,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIhF,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC","sourcesContent":["import { type ClientCommandContext, clientCommand } from \"./commands/client.ts\";\nimport { type PiCommandContext, piCommand } from \"./commands/pi.ts\";\nimport { type ServerCommandContext, serverCommand } from \"./commands/server.ts\";\n\nexport type ExperimentalCliContext = PiCommandContext & ServerCommandContext & ClientCommandContext;\n\nexport const experimentalCli = piCommand.command(serverCommand).command(clientCommand);\n"]}

package/dist/cli/experimental/command-options.d.ts

@@ -0,0 +1,17 @@
+import { type Args } from "../args.ts";
+import { type AuthInput } from "./auth.ts";
+import { type CommandOption, type ParsedCommandInput } from "./command.ts";
+import { type TransportAddress } from "./transport-address.ts";
+export declare const authTokenOption: CommandOption<string>;
+export declare const authTokenFileOption: CommandOption<string>;
+export declare function transportOption(name: "--listen" | "--connect"): CommandOption<TransportAddress>;
+export declare function parseAuth(input: ParsedCommandInput): {
+    auth?: AuthInput;
+    errors: string[];
+};
+export declare function parseLegacyOptions(input: ParsedCommandInput): {
+    options: Args;
+    errors: string[];
+};
+export declare function unsupportedLegacyOptions(command: string, input: ParsedCommandInput): string[];
+//# sourceMappingURL=command-options.d.ts.map

package/dist/cli/experimental/command-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-options.d.ts","sourceRoot":"","sources":["../../../src/cli/experimental/command-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,EAAa,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,KAAK,SAAS,EAAkB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAA6B,MAAM,cAAc,CAAC;AACtG,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,eAAO,MAAM,eAAe,uBAA+B,CAAC;AAC5D,eAAO,MAAM,mBAAmB,uBAAoC,CAAC;AAErE,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAO/F;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAK3F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAQjG;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAG7F","sourcesContent":["import { type Args, parseArgs } from \"../args.ts\";\nimport { type AuthInput, parseAuthInput } from \"./auth.ts\";\nimport { type CommandOption, type ParsedCommandInput, stringOption, valueOption } from \"./command.ts\";\nimport { parseTransportAddress, type TransportAddress } from \"./transport-address.ts\";\n\nexport const authTokenOption = stringOption(\"--auth-token\");\nexport const authTokenFileOption = stringOption(\"--auth-token-file\");\n\nexport function transportOption(name: \"--listen\" | \"--connect\"): CommandOption<TransportAddress> {\n\treturn valueOption(name, (value) => {\n\t\tconst result = parseTransportAddress(value, name);\n\t\treturn result.address\n\t\t\t? { ok: true, value: result.address }\n\t\t\t: { ok: false, error: result.error ?? `Invalid ${name} address \"${value}\"` };\n\t});\n}\n\nexport function parseAuth(input: ParsedCommandInput): { auth?: AuthInput; errors: string[] } {\n\treturn parseAuthInput({\n\t\tauthToken: input.value(authTokenOption),\n\t\tauthTokenFile: input.value(authTokenFileOption),\n\t});\n}\n\nexport function parseLegacyOptions(input: ParsedCommandInput): { options: Args; errors: string[] } {\n\tconst options = parseArgs([...input.remainingArgs]);\n\treturn {\n\t\toptions,\n\t\terrors: options.diagnostics\n\t\t\t.filter((diagnostic) => diagnostic.type === \"error\")\n\t\t\t.map((diagnostic) => diagnostic.message),\n\t};\n}\n\nexport function unsupportedLegacyOptions(command: string, input: ParsedCommandInput): string[] {\n\tif (input.remainingArgs.length === 0) return [];\n\treturn [`The experimental ${command} command does not support existing CLI options yet`];\n}\n"]}

package/dist/cli/experimental/command-options.js

@@ -0,0 +1,35 @@
+import { parseArgs } from "../args.js";
+import { parseAuthInput } from "./auth.js";
+import { stringOption, valueOption } from "./command.js";
+import { parseTransportAddress } from "./transport-address.js";
+export const authTokenOption = stringOption("--auth-token");
+export const authTokenFileOption = stringOption("--auth-token-file");
+export function transportOption(name) {
+    return valueOption(name, (value) => {
+        const result = parseTransportAddress(value, name);
+        return result.address
+            ? { ok: true, value: result.address }
+            : { ok: false, error: result.error ?? `Invalid ${name} address "${value}"` };
+    });
+}
+export function parseAuth(input) {
+    return parseAuthInput({
+        authToken: input.value(authTokenOption),
+        authTokenFile: input.value(authTokenFileOption),
+    });
+}
+export function parseLegacyOptions(input) {
+    const options = parseArgs([...input.remainingArgs]);
+    return {
+        options,
+        errors: options.diagnostics
+            .filter((diagnostic) => diagnostic.type === "error")
+            .map((diagnostic) => diagnostic.message),
+    };
+}
+export function unsupportedLegacyOptions(command, input) {
+    if (input.remainingArgs.length === 0)
+        return [];
+    return [`The experimental ${command} command does not support existing CLI options yet`];
+}
+//# sourceMappingURL=command-options.js.map

package/dist/cli/experimental/command-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-options.js","sourceRoot":"","sources":["../../../src/cli/experimental/command-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,SAAS,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAkB,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAA+C,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAyB,MAAM,wBAAwB,CAAC;AAEtF,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAC;AAErE,MAAM,UAAU,eAAe,CAAC,IAA8B,EAAmC;IAChG,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,OAAO;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE;YACrC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,WAAW,IAAI,aAAa,KAAK,GAAG,EAAE,CAAC;IAAA,CAC9E,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,SAAS,CAAC,KAAyB,EAA0C;IAC5F,OAAO,cAAc,CAAC;QACrB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC;QACvC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;KAC/C,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAyB,EAAuC;IAClG,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,OAAO;QACN,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,WAAW;aACzB,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC;aACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;KACzC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAyB,EAAY;IAC9F,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO,CAAC,oBAAoB,OAAO,oDAAoD,CAAC,CAAC;AAAA,CACzF","sourcesContent":["import { type Args, parseArgs } from \"../args.ts\";\nimport { type AuthInput, parseAuthInput } from \"./auth.ts\";\nimport { type CommandOption, type ParsedCommandInput, stringOption, valueOption } from \"./command.ts\";\nimport { parseTransportAddress, type TransportAddress } from \"./transport-address.ts\";\n\nexport const authTokenOption = stringOption(\"--auth-token\");\nexport const authTokenFileOption = stringOption(\"--auth-token-file\");\n\nexport function transportOption(name: \"--listen\" | \"--connect\"): CommandOption<TransportAddress> {\n\treturn valueOption(name, (value) => {\n\t\tconst result = parseTransportAddress(value, name);\n\t\treturn result.address\n\t\t\t? { ok: true, value: result.address }\n\t\t\t: { ok: false, error: result.error ?? `Invalid ${name} address \"${value}\"` };\n\t});\n}\n\nexport function parseAuth(input: ParsedCommandInput): { auth?: AuthInput; errors: string[] } {\n\treturn parseAuthInput({\n\t\tauthToken: input.value(authTokenOption),\n\t\tauthTokenFile: input.value(authTokenFileOption),\n\t});\n}\n\nexport function parseLegacyOptions(input: ParsedCommandInput): { options: Args; errors: string[] } {\n\tconst options = parseArgs([...input.remainingArgs]);\n\treturn {\n\t\toptions,\n\t\terrors: options.diagnostics\n\t\t\t.filter((diagnostic) => diagnostic.type === \"error\")\n\t\t\t.map((diagnostic) => diagnostic.message),\n\t};\n}\n\nexport function unsupportedLegacyOptions(command: string, input: ParsedCommandInput): string[] {\n\tif (input.remainingArgs.length === 0) return [];\n\treturn [`The experimental ${command} command does not support existing CLI options yet`];\n}\n"]}