@iowarp/clio-coder 0.3.0 → 0.3.1

package/dist/chunk-5LDRNKX2.js

@@ -1,1063 +0,0 @@
-import {
-  safeResourceWrite
-} from "./chunk-VPAWTYLY.js";
-import {
-  clioConfigDir
-} from "./chunk-X3NE4WVW.js";
-
-// src/engine/oauth.ts
-import { findEnvKeys as piFindEnvKeys, getEnvApiKey as piGetEnvApiKey } from "@earendil-works/pi-ai/compat";
-import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
-import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
-import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
-
-// src/engine/alcf-oauth.ts
-var AUTH_CLIENT_ID = "58fdd3bc-e1c3-4ce5-80ea-8d6b87cfb944";
-var GATEWAY_CLIENT_ID = "681c10cc-f684-4540-bcd7-0b4df3bc26ef";
-var GATEWAY_SCOPE = `https://auth.globus.org/scopes/${GATEWAY_CLIENT_ID}/action_all`;
-var ALLOWED_DOMAINS = "anl.gov,alcf.anl.gov";
-var AUTHORIZE_URL = "https://auth.globus.org/v2/oauth2/authorize";
-var TOKEN_URL = "https://auth.globus.org/v2/oauth2/token";
-var REDIRECT_URI = "https://auth.globus.org/v2/web/auth-code";
-var EXPIRY_SKEW_MS = 5 * 60 * 1e3;
-function base64Url(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-async function generatePkce() {
-  const verifierBytes = new Uint8Array(32);
-  crypto.getRandomValues(verifierBytes);
-  const verifier = base64Url(verifierBytes);
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-  return { verifier, challenge: base64Url(new Uint8Array(digest)) };
-}
-function randomState() {
-  const bytes = new Uint8Array(16);
-  crypto.getRandomValues(bytes);
-  return base64Url(bytes);
-}
-function buildAuthorizeUrl(params) {
-  const query = new URLSearchParams({
-    client_id: AUTH_CLIENT_ID,
-    response_type: "code",
-    redirect_uri: REDIRECT_URI,
-    scope: GATEWAY_SCOPE,
-    state: params.state,
-    code_challenge: params.challenge,
-    code_challenge_method: "S256",
-    access_type: "offline",
-    session_required_single_domain: ALLOWED_DOMAINS
-  });
-  return `${AUTHORIZE_URL}?${query.toString()}`;
-}
-function parseAuthorizationInput(input) {
-  const value = input.trim();
-  if (!value) return "";
-  try {
-    const url = new URL(value);
-    const code = url.searchParams.get("code");
-    if (code) return code;
-  } catch {
-  }
-  if (value.includes("code=")) {
-    const params = new URLSearchParams(value.includes("?") ? value.slice(value.indexOf("?") + 1) : value);
-    const code = params.get("code");
-    if (code) return code;
-  }
-  return value;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function selectGatewayGrant(payload) {
-  const grants = [payload, ...Array.isArray(payload.other_tokens) ? payload.other_tokens : []];
-  const byResourceServer = grants.find((grant) => grant.resource_server === GATEWAY_CLIENT_ID);
-  if (byResourceServer) return byResourceServer;
-  const byScope = grants.find(
-    (grant) => typeof grant.scope === "string" && (grant.scope.includes("action_all") || grant.scope === GATEWAY_SCOPE)
-  );
-  if (byScope) return byScope;
-  if (grants.length === 1 && typeof payload.access_token === "string") return payload;
-  throw new Error(
-    `Globus token response did not include a grant for the ALCF gateway (resource_server=${GATEWAY_CLIENT_ID}).`
-  );
-}
-function grantToCredentials(grant, previousRefresh) {
-  const access = grant.access_token;
-  if (typeof access !== "string" || access.length === 0) {
-    throw new Error("Globus token response is missing an access token for the ALCF gateway.");
-  }
-  const refresh = typeof grant.refresh_token === "string" && grant.refresh_token.length > 0 ? grant.refresh_token : previousRefresh;
-  if (typeof refresh !== "string" || refresh.length === 0) {
-    throw new Error("Globus token response is missing a refresh token; cannot persist a renewable session.");
-  }
-  const expiresInSeconds = typeof grant.expires_in === "number" && grant.expires_in > 0 ? grant.expires_in : 0;
-  return {
-    access,
-    refresh,
-    expires: Date.now() + expiresInSeconds * 1e3 - EXPIRY_SKEW_MS
-  };
-}
-async function postForm(body) {
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(body).toString(),
-    signal: AbortSignal.timeout(3e4)
-  });
-  const text = await response.text();
-  if (!response.ok) {
-    throw new Error(`Globus token endpoint failed (HTTP ${response.status}): ${text.slice(0, 300)}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (err) {
-    throw new Error(`Globus token endpoint returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  if (!isRecord(parsed)) throw new Error("Globus token endpoint returned a non-object response.");
-  return parsed;
-}
-async function exchangeCode(code, verifier) {
-  const payload = await postForm({
-    grant_type: "authorization_code",
-    client_id: AUTH_CLIENT_ID,
-    code,
-    code_verifier: verifier,
-    redirect_uri: REDIRECT_URI
-  });
-  return grantToCredentials(selectGatewayGrant(payload));
-}
-async function refreshGatewayToken(refreshToken) {
-  const payload = await postForm({
-    grant_type: "refresh_token",
-    client_id: AUTH_CLIENT_ID,
-    refresh_token: refreshToken
-  });
-  return grantToCredentials(selectGatewayGrant(payload), refreshToken);
-}
-async function loginAlcf(callbacks) {
-  const { verifier, challenge } = await generatePkce();
-  const url = buildAuthorizeUrl({ challenge, state: randomState() });
-  callbacks.onAuth({
-    url,
-    instructions: "Log in with your ALCF / anl.gov identity. Globus will show an authorization code; copy it and paste it here."
-  });
-  const pasted = callbacks.onManualCodeInput ? await callbacks.onManualCodeInput() : await callbacks.onPrompt({ message: "Paste the authorization code from Globus", placeholder: "code" });
-  const code = parseAuthorizationInput(pasted);
-  if (!code) throw new Error("No authorization code was provided.");
-  callbacks.onProgress?.("Exchanging authorization code for an ALCF access token...");
-  return exchangeCode(code, verifier);
-}
-var alcfOAuthProvider = {
-  id: "alcf",
-  name: "ALCF Inference (Globus)",
-  usesCallbackServer: false,
-  login(callbacks) {
-    return loginAlcf(callbacks);
-  },
-  refreshToken(credentials) {
-    return refreshGatewayToken(credentials.refresh);
-  },
-  async getApiKey(credentials) {
-    return credentials.access;
-  }
-};
-
-// src/engine/oauth.ts
-function interactionFromLoginCallbacks(callbacks) {
-  const interaction = {
-    notify(event) {
-      switch (event.type) {
-        case "auth_url":
-          callbacks.onAuth({
-            url: event.url,
-            ...event.instructions === void 0 ? {} : { instructions: event.instructions }
-          });
-          return;
-        case "device_code":
-          callbacks.onDeviceCode({
-            userCode: event.userCode,
-            verificationUri: event.verificationUri,
-            ...event.intervalSeconds === void 0 ? {} : { intervalSeconds: event.intervalSeconds },
-            ...event.expiresInSeconds === void 0 ? {} : { expiresInSeconds: event.expiresInSeconds }
-          });
-          return;
-        case "progress":
-        case "info":
-          callbacks.onProgress?.(event.message);
-          return;
-      }
-    },
-    async prompt(prompt) {
-      switch (prompt.type) {
-        case "select": {
-          const selection = await callbacks.onSelect({
-            message: prompt.message,
-            options: prompt.options.map((option) => ({ id: option.id, label: option.label }))
-          });
-          if (selection === void 0) throw new Error("login cancelled");
-          return selection;
-        }
-        case "manual_code":
-          if (callbacks.onManualCodeInput) return callbacks.onManualCodeInput();
-          return callbacks.onPrompt({
-            message: prompt.message,
-            ...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
-          });
-        default:
-          return callbacks.onPrompt({
-            message: prompt.message,
-            ...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
-          });
-      }
-    }
-  };
-  if (callbacks.signal) interaction.signal = callbacks.signal;
-  return interaction;
-}
-function fromOAuthAuth(id, auth, usesCallbackServer) {
-  if (!auth) throw new Error(`pi-ai provider "${id}" no longer exposes an OAuth flow`);
-  return {
-    id,
-    name: auth.name,
-    usesCallbackServer,
-    async login(callbacks) {
-      return auth.login(interactionFromLoginCallbacks(callbacks));
-    },
-    async refreshToken(credentials) {
-      return auth.refresh({ ...credentials, type: "oauth" });
-    },
-    async getApiKey(credentials) {
-      const resolved = await auth.toAuth({ ...credentials, type: "oauth" });
-      if (!resolved.apiKey) {
-        throw new Error(`OAuth provider "${id}" resolved no API key from the stored credential`);
-      }
-      return resolved.apiKey;
-    }
-  };
-}
-var providers = null;
-function builtinProviders() {
-  return [
-    fromOAuthAuth("anthropic", anthropicProvider().auth.oauth, true),
-    fromOAuthAuth("openai-codex", openaiCodexProvider().auth.oauth, true),
-    fromOAuthAuth("github-copilot", githubCopilotProvider().auth.oauth, false)
-  ];
-}
-function registry() {
-  if (!providers) {
-    providers = new Map(builtinProviders().map((provider) => [provider.id, provider]));
-  }
-  return providers;
-}
-function getEngineEnvApiKey(providerId) {
-  try {
-    return piGetEnvApiKey(providerId);
-  } catch {
-    return void 0;
-  }
-}
-function findEngineEnvKeys(providerId) {
-  try {
-    return piFindEnvKeys(providerId);
-  } catch {
-    return void 0;
-  }
-}
-function getEngineOAuthProvider(providerId) {
-  return registry().get(providerId);
-}
-function listEngineOAuthProviders() {
-  return [...registry().values()];
-}
-function registerEngineOAuthProvider(provider) {
-  registry().set(provider.id, provider);
-}
-var clioOAuthProvidersRegistered = false;
-function registerClioOAuthProviders() {
-  if (clioOAuthProvidersRegistered) return;
-  clioOAuthProvidersRegistered = true;
-  registerEngineOAuthProvider(alcfOAuthProvider);
-}
-async function loginWithEngineOAuthProvider(providerId, callbacks) {
-  const provider = registry().get(providerId);
-  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
-  return provider.login(callbacks);
-}
-async function refreshEngineOAuthCredentials(providerId, credentials) {
-  const provider = registry().get(providerId);
-  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
-  return provider.refreshToken(credentials);
-}
-async function getEngineOAuthApiKey(providerId, credentials) {
-  const provider = registry().get(providerId);
-  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
-  return provider.getApiKey(credentials);
-}
-
-// src/domains/providers/auth/storage.ts
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-
-// src/core/resolve-config-value.ts
-import { spawnSync } from "node:child_process";
-import { homedir } from "node:os";
-import { join, resolve, sep } from "node:path";
-var commandResultCache = /* @__PURE__ */ new Map();
-function env(options) {
-  return options?.env ?? process.env;
-}
-function shellCommand(command) {
-  const isWindows = process.platform === "win32";
-  const shell = isWindows ? process.env.ComSpec || "cmd.exe" : process.env.SHELL || "/bin/sh";
-  const args = isWindows ? ["/d", "/s", "/c", command] : ["-lc", command];
-  const result = spawnSync(shell, args, {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: 1e4,
-    windowsHide: true
-  });
-  if (result.error || result.status !== 0) return void 0;
-  const value = result.stdout.trim();
-  return value.length > 0 ? value : void 0;
-}
-function executeCommand(commandConfig) {
-  if (commandResultCache.has(commandConfig)) return commandResultCache.get(commandConfig);
-  const value = shellCommand(commandConfig.slice(1));
-  commandResultCache.set(commandConfig, value);
-  return value;
-}
-function warnStaticCommand(config, options) {
-  options?.onWarning?.({
-    code: "dynamic-command-in-static-resolution",
-    message: "bang-prefixed config command left literal by static config value resolver",
-    command: config.slice(1)
-  });
-}
-function expandConfigValue(value, options) {
-  const sourceEnv = env(options);
-  return value.replace(/\$(\w+)|\$\{([^}]+)\}/g, (match, bare, braced) => {
-    const key = bare ?? braced;
-    if (!key) return match;
-    return sourceEnv[key] ?? "";
-  });
-}
-function expandConfigPath(value, options) {
-  const cwd = options?.cwd ?? process.cwd();
-  const expandedEnv = expandConfigValue(value.trim(), options);
-  let expanded = expandedEnv;
-  if (expanded === "~") {
-    expanded = homedir();
-  } else if (expanded.startsWith(`~${sep}`) || expanded.startsWith("~/")) {
-    expanded = `${homedir()}${expanded.slice(1)}`;
-  } else if (expanded.startsWith("~")) {
-    expanded = join(homedir(), expanded.slice(1));
-  }
-  return resolve(cwd, expanded);
-}
-function resolveStaticConfigValue(config, options) {
-  if (config.startsWith("!")) warnStaticCommand(config, options);
-  const sourceEnv = env(options);
-  const envValue = sourceEnv[config];
-  if (envValue !== void 0 && envValue.length > 0) return envValue;
-  const expanded = expandConfigValue(config, options);
-  return expanded.length > 0 ? expanded : void 0;
-}
-function resolveDynamicConfigValue(config, options) {
-  if (config.startsWith("!")) return executeCommand(config);
-  return resolveStaticConfigValue(config, options);
-}
-
-// src/domains/providers/auth/api-key.ts
-function resolveStoredApiKey(key, providerId = "stored-api-key") {
-  const trimmed = key.trim();
-  if (trimmed.length === 0) return void 0;
-  return resolveProviderDynamicSecret(trimmed, { providerId, field: "apiKey" });
-}
-function normalizeStoredApiKeyRef(key) {
-  const trimmed = key.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-function resolveProviderDynamicSecret(value, context, options) {
-  void context;
-  return resolveDynamicConfigValue(value, options);
-}
-function resolveEnvironmentApiKey(providerId, explicitEnvVar) {
-  if (explicitEnvVar) {
-    const fromExplicit = process.env[explicitEnvVar]?.trim();
-    if (fromExplicit && fromExplicit.length > 0) {
-      return { apiKey: fromExplicit, source: explicitEnvVar };
-    }
-  }
-  for (const envVar of findEngineEnvKeys(providerId) ?? []) {
-    const fromKnownEnv = process.env[envVar]?.trim();
-    if (fromKnownEnv && fromKnownEnv.length > 0) {
-      return { apiKey: fromKnownEnv, source: envVar };
-    }
-  }
-  const fromKnownProvider = getEngineEnvApiKey(providerId)?.trim();
-  if (fromKnownProvider && fromKnownProvider.length > 0) {
-    return { apiKey: fromKnownProvider, source: null };
-  }
-  return { apiKey: void 0, source: explicitEnvVar ?? null };
-}
-
-// src/domains/providers/auth/oauth.ts
-function getOAuthProvider(providerId) {
-  return getEngineOAuthProvider(providerId);
-}
-function listOAuthProviders() {
-  return listEngineOAuthProviders();
-}
-async function loginWithOAuthProvider(providerId, callbacks) {
-  return loginWithEngineOAuthProvider(providerId, callbacks);
-}
-async function refreshOAuthCredentials(providerId, credentials) {
-  return refreshEngineOAuthCredentials(providerId, credentials);
-}
-function getOAuthApiKey(providerId, credentials) {
-  return getEngineOAuthApiKey(providerId, credentials);
-}
-
-// src/domains/providers/auth/storage.ts
-var AuthStorageDamagedError = class extends Error {
-  constructor(damage, path) {
-    super(
-      [
-        `refusing to write credentials: ${damage}.`,
-        path ? `File: ${path}` : null,
-        "Writing would replace the whole file and lose whatever is stored there.",
-        "Move the file aside once you have recovered anything you need, then log in again."
-      ].filter((line) => line !== null).join(" ")
-    );
-    this.damage = damage;
-    this.path = path;
-    this.name = "AuthStorageDamagedError";
-  }
-  damage;
-  path;
-};
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function emptyData() {
-  return {};
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null;
-}
-function toApiKeyCredential(raw) {
-  if (!isRecord2(raw)) return null;
-  if (raw.type === "api_key" && typeof raw.key === "string" && raw.key.trim().length > 0) {
-    return {
-      type: "api_key",
-      key: raw.key,
-      updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.length > 0 ? raw.updatedAt : nowIso()
-    };
-  }
-  return null;
-}
-function toOAuthCredential(raw) {
-  if (!isRecord2(raw)) return null;
-  if (raw.type === "oauth" && typeof raw.access === "string" && typeof raw.refresh === "string" && typeof raw.expires === "number") {
-    return {
-      ...raw,
-      type: "oauth",
-      access: raw.access,
-      refresh: raw.refresh,
-      expires: raw.expires,
-      updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.length > 0 ? raw.updatedAt : nowIso()
-    };
-  }
-  return null;
-}
-function readStorageData(content) {
-  if (!content || content.trim().length === 0) return { data: emptyData(), damage: null };
-  let parsed;
-  try {
-    parsed = parseYaml(content);
-  } catch (error) {
-    const raw = error instanceof Error ? error.message : String(error);
-    const detail = (raw.split("\n")[0] ?? raw).trim().replace(/:$/u, "");
-    return { data: emptyData(), damage: `it is not valid YAML: ${detail}` };
-  }
-  if (parsed === null || parsed === void 0) return { data: emptyData(), damage: null };
-  if (!isRecord2(parsed)) return { data: emptyData(), damage: "its top level is not a mapping" };
-  if (Object.keys(parsed).length === 0) return { data: emptyData(), damage: null };
-  if (!("entries" in parsed) && !("version" in parsed)) {
-    return { data: emptyData(), damage: "it has neither a version nor an entries mapping" };
-  }
-  const entries = isRecord2(parsed.entries) ? parsed.entries : null;
-  if (!entries) return { data: emptyData(), damage: null };
-  const data = {};
-  const unread = [];
-  const version = parsed.version;
-  if (version === 1 || version === void 0 && Object.values(entries).every((value) => isRecord2(value) && "key" in value)) {
-    for (const [providerId, value] of Object.entries(entries ?? {})) {
-      if (!value || typeof value.key !== "string" || value.key.trim().length === 0) {
-        unread.push(providerId);
-        continue;
-      }
-      data[providerId] = {
-        type: "api_key",
-        key: value.key,
-        updatedAt: typeof value.updatedAt === "string" && value.updatedAt.length > 0 ? value.updatedAt : nowIso()
-      };
-    }
-    return { data, damage: unreadDamage(unread) };
-  }
-  for (const [providerId, value] of Object.entries(entries ?? {})) {
-    const apiKey = toApiKeyCredential(value);
-    if (apiKey) {
-      data[providerId] = apiKey;
-      continue;
-    }
-    const oauth = toOAuthCredential(value);
-    if (oauth) {
-      data[providerId] = oauth;
-      continue;
-    }
-    unread.push(providerId);
-  }
-  return { data, damage: unreadDamage(unread) };
-}
-function unreadDamage(unread) {
-  if (unread.length === 0) return null;
-  return `these entries are stored in a shape this version cannot read: ${[...unread].sort().join(", ")}`;
-}
-function serializeStorageData(data) {
-  return stringifyYaml({
-    version: 2,
-    entries: data
-  });
-}
-function resolveAuthTarget(target, runtime) {
-  const providerId = target.auth?.oauthProfile?.trim() || target.auth?.apiKeyRef?.trim() || runtime.oauthProviderId || runtime.id;
-  const authTarget = {
-    providerId,
-    targetId: target.id,
-    runtimeAuth: runtime.auth
-  };
-  const explicitEnvVar = target.auth?.apiKeyEnvVar ?? runtime.credentialsEnvVar;
-  if (explicitEnvVar) authTarget.explicitEnvVar = explicitEnvVar;
-  return authTarget;
-}
-function resolveRuntimeAuthTarget(runtime) {
-  const target = {
-    providerId: runtime.oauthProviderId ?? runtime.id,
-    runtimeAuth: runtime.auth
-  };
-  if (runtime.credentialsEnvVar) target.explicitEnvVar = runtime.credentialsEnvVar;
-  return target;
-}
-function targetRequiresAuth(target, runtime) {
-  if (runtime.auth === "oauth") return true;
-  if (runtime.auth !== "api-key") return false;
-  if (target.auth?.apiKeyEnvVar || target.auth?.apiKeyRef || target.auth?.oauthProfile) return true;
-  return runtime.tier === "cloud" || Boolean(runtime.credentialsEnvVar);
-}
-function authNotRequiredStatus(providerId) {
-  return {
-    providerId,
-    available: true,
-    credentialType: null,
-    source: "not-required",
-    detail: null
-  };
-}
-var AuthStorage = class {
-  constructor(backend) {
-    this.backend = backend;
-    this.reload();
-  }
-  backend;
-  data = {};
-  damage = null;
-  runtimeOverrides = /* @__PURE__ */ new Map();
-  fallbackResolver;
-  reload() {
-    try {
-      let content;
-      this.backend.withLock((current) => {
-        content = current;
-        return { result: void 0 };
-      });
-      const read = readStorageData(content);
-      this.data = read.data;
-      this.damage = read.damage;
-    } catch (error) {
-      this.data = emptyData();
-      this.damage = error instanceof Error ? `it could not be read: ${error.message}` : "it could not be read";
-    }
-  }
-  /**
-   * Why the store on disk could not be fully read, or why the last write to it
-   * did not land, or null when it is clean. Callers that report connection
-   * state must consult this, because a damaged store reads as zero credentials
-   * and is otherwise indistinguishable from having never logged in, and a
-   * refused write leaves memory claiming a credential that disk does not hold.
-   */
-  damageReason() {
-    return this.damage;
-  }
-  persist(providerId, credential) {
-    try {
-      this.backend.withLock((current) => {
-        const read = readStorageData(current);
-        if (read.damage !== null) {
-          this.damage = read.damage;
-          throw new AuthStorageDamagedError(read.damage, this.backend.describe?.());
-        }
-        const merged = read.data;
-        if (credential) merged[providerId] = credential;
-        else delete merged[providerId];
-        this.data = merged;
-        this.damage = null;
-        return { result: void 0, next: serializeStorageData(merged) };
-      });
-    } catch (error) {
-      if (error instanceof AuthStorageDamagedError) throw error;
-      this.damage = error instanceof Error ? `it could not be written: ${error.message}` : "it could not be written";
-    }
-  }
-  get(providerId) {
-    return this.data[providerId];
-  }
-  // persist() adopts the merged view on success, so it runs first: assigning
-  // in-memory ahead of it would leave a credential that reads back as stored
-  // while the disk write was refused.
-  set(providerId, credential) {
-    this.persist(providerId, credential);
-    this.data[providerId] = credential;
-  }
-  setApiKey(providerId, key) {
-    const resolved = normalizeStoredApiKeyRef(key);
-    if (!resolved) throw new Error(`auth.setApiKey: empty key for provider=${providerId}`);
-    this.set(providerId, { type: "api_key", key: resolved, updatedAt: nowIso() });
-  }
-  remove(providerId) {
-    this.persist(providerId, void 0);
-    delete this.data[providerId];
-  }
-  listStored() {
-    return Object.entries(this.data).map(([providerId, credential]) => ({
-      providerId,
-      type: credential.type,
-      updatedAt: credential.updatedAt
-    })).sort((a, b) => a.providerId.localeCompare(b.providerId));
-  }
-  hasStored(providerId) {
-    return providerId in this.data;
-  }
-  /**
-   * Install a process-lifetime API key override scoped to a specific target.
-   * Overrides are keyed by `targetId` (not providerId) so two targets
-   * sharing a runtime do not share the override. `clio-coder --api-key <key>`
-   * applies only to the active target, not every target on that provider.
-   */
-  setRuntimeOverride(targetId, apiKey) {
-    if (targetId.length === 0) {
-      throw new Error("auth.setRuntimeOverride: empty targetId");
-    }
-    const resolved = normalizeStoredApiKeyRef(apiKey);
-    if (!resolved) throw new Error(`auth.setRuntimeOverride: empty key for target=${targetId}`);
-    this.runtimeOverrides.set(targetId, resolved);
-  }
-  clearRuntimeOverride(targetId) {
-    if (targetId.length === 0) return;
-    this.runtimeOverrides.delete(targetId);
-  }
-  setFallbackResolver(resolver) {
-    this.fallbackResolver = resolver;
-  }
-  status(providerId, opts) {
-    if (opts?.targetId && this.runtimeOverrides.has(opts.targetId)) {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "runtime-override",
-        detail: providerId
-      };
-    }
-    const stored = this.data[providerId];
-    if (stored?.type === "api_key") {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "stored-api-key",
-        detail: providerId
-      };
-    }
-    if (stored?.type === "oauth") {
-      return {
-        providerId,
-        available: true,
-        credentialType: "oauth",
-        source: "stored-oauth",
-        detail: providerId
-      };
-    }
-    const env2 = resolveEnvironmentApiKey(providerId, opts?.explicitEnvVar);
-    if (env2.apiKey) {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "environment",
-        detail: env2.source ?? providerId
-      };
-    }
-    if (opts?.includeFallback !== false) {
-      const fallback = this.fallbackResolver?.(providerId)?.trim();
-      if (fallback && fallback.length > 0) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "api_key",
-          source: "fallback",
-          detail: providerId
-        };
-      }
-    }
-    return {
-      providerId,
-      available: false,
-      credentialType: null,
-      source: "none",
-      detail: null
-    };
-  }
-  statusForTarget(target, opts) {
-    const args = {};
-    if (opts?.includeFallback !== void 0) args.includeFallback = opts.includeFallback;
-    if (target.explicitEnvVar) args.explicitEnvVar = target.explicitEnvVar;
-    if (target.targetId) args.targetId = target.targetId;
-    return this.status(target.providerId, args);
-  }
-  async refreshOAuthCredentialWithLock(providerId) {
-    return this.backend.withLockAsync(async (current) => {
-      const read = readStorageData(current);
-      if (read.damage !== null) {
-        this.damage = read.damage;
-        throw new AuthStorageDamagedError(read.damage, this.backend.describe?.());
-      }
-      const currentData = read.data;
-      this.data = currentData;
-      this.damage = null;
-      const stored = currentData[providerId];
-      if (stored?.type !== "oauth") {
-        return { result: null };
-      }
-      if (Date.now() < stored.expires) {
-        return { result: { apiKey: await getOAuthApiKey(providerId, stored), credential: stored } };
-      }
-      const refreshed = await refreshOAuthCredentials(providerId, stored);
-      const next = {
-        type: "oauth",
-        ...refreshed,
-        updatedAt: nowIso()
-      };
-      const merged = { ...currentData, [providerId]: next };
-      this.data = merged;
-      return {
-        result: { apiKey: await getOAuthApiKey(providerId, next), credential: next },
-        next: serializeStorageData(merged)
-      };
-    });
-  }
-  async resolveApiKey(providerId, opts) {
-    if (opts?.targetId) {
-      const override = this.runtimeOverrides.get(opts.targetId);
-      if (override) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "api_key",
-          source: "runtime-override",
-          detail: providerId,
-          apiKey: override
-        };
-      }
-    }
-    const stored = this.data[providerId];
-    if (stored?.type === "api_key") {
-      const apiKey = resolveStoredApiKey(stored.key, providerId);
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "stored-api-key",
-        detail: providerId,
-        ...apiKey ? { apiKey } : {}
-      };
-    }
-    if (stored?.type === "oauth") {
-      const provider = getOAuthProvider(providerId);
-      if (!provider) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "oauth",
-          source: "stored-oauth",
-          detail: providerId
-        };
-      }
-      if (Date.now() < stored.expires) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "oauth",
-          source: "stored-oauth",
-          detail: providerId,
-          apiKey: await getOAuthApiKey(providerId, stored)
-        };
-      }
-      try {
-        const refreshed = await this.refreshOAuthCredentialWithLock(providerId);
-        if (refreshed) {
-          return {
-            providerId,
-            available: true,
-            credentialType: "oauth",
-            source: "stored-oauth",
-            detail: providerId,
-            apiKey: refreshed.apiKey
-          };
-        }
-      } catch {
-        this.reload();
-        const updated = this.data[providerId];
-        if (updated?.type === "oauth" && Date.now() < updated.expires) {
-          return {
-            providerId,
-            available: true,
-            credentialType: "oauth",
-            source: "stored-oauth",
-            detail: providerId,
-            apiKey: await getOAuthApiKey(providerId, updated)
-          };
-        }
-      }
-      return {
-        providerId,
-        available: true,
-        credentialType: "oauth",
-        source: "stored-oauth",
-        detail: providerId
-      };
-    }
-    const env2 = resolveEnvironmentApiKey(providerId, opts?.explicitEnvVar);
-    if (env2.apiKey) {
-      return {
-        providerId,
-        available: true,
-        credentialType: "api_key",
-        source: "environment",
-        detail: env2.source ?? providerId,
-        apiKey: env2.apiKey
-      };
-    }
-    if (opts?.includeFallback !== false) {
-      const fallback = this.fallbackResolver?.(providerId)?.trim();
-      if (fallback && fallback.length > 0) {
-        return {
-          providerId,
-          available: true,
-          credentialType: "api_key",
-          source: "fallback",
-          detail: providerId,
-          apiKey: fallback
-        };
-      }
-    }
-    return {
-      providerId,
-      available: false,
-      credentialType: null,
-      source: "none",
-      detail: null
-    };
-  }
-  resolveForTarget(target, opts) {
-    const args = {};
-    if (opts?.includeFallback !== void 0) args.includeFallback = opts.includeFallback;
-    if (target.explicitEnvVar) args.explicitEnvVar = target.explicitEnvVar;
-    if (target.targetId) args.targetId = target.targetId;
-    return this.resolveApiKey(target.providerId, args);
-  }
-  async login(providerId, callbacks) {
-    const credentials = await loginWithOAuthProvider(providerId, callbacks);
-    this.set(providerId, { type: "oauth", ...credentials, updatedAt: nowIso() });
-  }
-  logout(providerId) {
-    this.remove(providerId);
-  }
-  getOAuthProviders() {
-    return listOAuthProviders().map((provider) => ({ id: provider.id, name: provider.name })).sort((a, b) => a.id.localeCompare(b.id));
-  }
-};
-
-// src/domains/providers/auth/backend-file.ts
-import { chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync } from "node:fs";
-import { open, readFile, stat, unlink } from "node:fs/promises";
-import { dirname, join as join2 } from "node:path";
-var DEFAULT_LOCK_RETRY_MS = 50;
-var DEFAULT_LOCK_STALE_MS = 3e4;
-var DEFAULT_LOCK_ATTEMPTS = 200;
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function atomicWriteSecret(absPath, contents) {
-  safeResourceWrite(absPath, contents, { encoding: "utf8", mode: 384 });
-  chmodSync(absPath, 384);
-}
-function staleLock(path) {
-  try {
-    return Date.now() - statSync(path).mtimeMs > DEFAULT_LOCK_STALE_MS;
-  } catch {
-    return false;
-  }
-}
-async function staleLockAsync(path) {
-  try {
-    const info = await stat(path);
-    return Date.now() - info.mtimeMs > DEFAULT_LOCK_STALE_MS;
-  } catch {
-    return false;
-  }
-}
-function authStoragePath() {
-  return join2(clioConfigDir(), "credentials.yaml");
-}
-var FileAuthStorageBackend = class {
-  constructor(path = authStoragePath()) {
-    this.path = path;
-  }
-  path;
-  describe() {
-    return this.path;
-  }
-  get lockPath() {
-    return `${this.path}.lock`;
-  }
-  ensureParentDir() {
-    mkdirSync(dirname(this.path), { recursive: true, mode: 448 });
-  }
-  ensureFileExists() {
-    if (existsSync(this.path)) return;
-    const fd = openSync(this.path, "a", 384);
-    closeSync(fd);
-    chmodSync(this.path, 384);
-  }
-  releaseSync(fd) {
-    try {
-      closeSync(fd);
-    } finally {
-      try {
-        unlinkSync(this.lockPath);
-      } catch {
-      }
-    }
-  }
-  async releaseAsync(handle) {
-    try {
-      await handle.close();
-    } finally {
-      try {
-        await unlink(this.lockPath);
-      } catch {
-      }
-    }
-  }
-  acquireLockSync() {
-    for (let attempt = 0; attempt < DEFAULT_LOCK_ATTEMPTS; attempt += 1) {
-      try {
-        return openSync(this.lockPath, "wx", 384);
-      } catch (error) {
-        const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
-        if (code !== "EEXIST") throw error;
-        if (staleLock(this.lockPath)) {
-          try {
-            unlinkSync(this.lockPath);
-            continue;
-          } catch {
-          }
-        }
-        sleepSync(DEFAULT_LOCK_RETRY_MS);
-      }
-    }
-    throw new Error(`auth backend: failed to acquire lock for ${this.path}`);
-  }
-  async acquireLockAsync() {
-    for (let attempt = 0; attempt < DEFAULT_LOCK_ATTEMPTS; attempt += 1) {
-      try {
-        return await open(this.lockPath, "wx", 384);
-      } catch (error) {
-        const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
-        if (code !== "EEXIST") throw error;
-        if (await staleLockAsync(this.lockPath)) {
-          try {
-            await unlink(this.lockPath);
-            continue;
-          } catch {
-          }
-        }
-        await new Promise((resolve2) => setTimeout(resolve2, DEFAULT_LOCK_RETRY_MS));
-      }
-    }
-    throw new Error(`auth backend: failed to acquire lock for ${this.path}`);
-  }
-  withLock(fn) {
-    this.ensureParentDir();
-    this.ensureFileExists();
-    const fd = this.acquireLockSync();
-    try {
-      const current = existsSync(this.path) ? readFileSync(this.path, "utf8") : void 0;
-      const { result, next } = fn(current);
-      if (next !== void 0) {
-        atomicWriteSecret(this.path, next);
-      }
-      return result;
-    } finally {
-      this.releaseSync(fd);
-    }
-  }
-  async withLockAsync(fn) {
-    this.ensureParentDir();
-    this.ensureFileExists();
-    const handle = await this.acquireLockAsync();
-    try {
-      const current = existsSync(this.path) ? await readFile(this.path, "utf8") : void 0;
-      const { result, next } = await fn(current);
-      if (next !== void 0) {
-        atomicWriteSecret(this.path, next);
-      }
-      return result;
-    } finally {
-      await this.releaseAsync(handle);
-    }
-  }
-};
-
-// src/domains/providers/auth/index.ts
-function openAuthStorage(path) {
-  return new AuthStorage(new FileAuthStorageBackend(path));
-}
-
-export {
-  expandConfigPath,
-  registerClioOAuthProviders,
-  authStoragePath,
-  resolveAuthTarget,
-  resolveRuntimeAuthTarget,
-  targetRequiresAuth,
-  authNotRequiredStatus,
-  openAuthStorage
-};
-//# sourceMappingURL=chunk-5LDRNKX2.js.map