@iowarp/clio-coder 0.4.9 → 0.5.0

package/dist/chunk-Z4GLJ6J4.js

@@ -0,0 +1,1035 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  resolveDynamicConfigValue
+} from "./chunk-VNBICSS2.js";
+import {
+  findEngineEnvKeys,
+  getEngineEnvApiKey
+} from "./chunk-ALJWT6O6.js";
+import {
+  require_dist
+} from "./chunk-B5GGDIHT.js";
+import {
+  withStateFileLock,
+  withStateFileLockSync
+} from "./chunk-DVJL77SO.js";
+import {
+  resolveClioDirs
+} from "./chunk-CTTI7G3T.js";
+import {
+  safeResourceWrite
+} from "./chunk-ZZFWWYLX.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/engine/oauth.ts
+init_esm_shims();
+import { anthropicProvider } from "@earendil-works/pi-ai/providers/anthropic";
+import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
+import { openaiCodexProvider } from "@earendil-works/pi-ai/providers/openai-codex";
+
+// src/engine/alcf-oauth.ts
+init_esm_shims();
+var AUTH_CLIENT_ID = "58fdd3bc-e1c3-4ce5-80ea-8d6b87cfb944";
+var GATEWAY_CLIENT_ID = "681c10cc-f684-4540-bcd7-0b4df3bc26ef";
+var GATEWAY_SCOPE = `https://auth.globus.org/scopes/${GATEWAY_CLIENT_ID}/action_all`;
+var ALLOWED_DOMAINS = "anl.gov,alcf.anl.gov";
+var AUTHORIZE_URL = "https://auth.globus.org/v2/oauth2/authorize";
+var TOKEN_URL = "https://auth.globus.org/v2/oauth2/token";
+var REDIRECT_URI = "https://auth.globus.org/v2/web/auth-code";
+var EXPIRY_SKEW_MS = 5 * 60 * 1e3;
+function base64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generatePkce() {
+  const verifierBytes = new Uint8Array(32);
+  crypto.getRandomValues(verifierBytes);
+  const verifier = base64Url(verifierBytes);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: base64Url(new Uint8Array(digest)) };
+}
+function randomState() {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return base64Url(bytes);
+}
+function buildAuthorizeUrl(params) {
+  const query = new URLSearchParams({
+    client_id: AUTH_CLIENT_ID,
+    response_type: "code",
+    redirect_uri: REDIRECT_URI,
+    scope: GATEWAY_SCOPE,
+    state: params.state,
+    code_challenge: params.challenge,
+    code_challenge_method: "S256",
+    access_type: "offline",
+    session_required_single_domain: ALLOWED_DOMAINS
+  });
+  return `${AUTHORIZE_URL}?${query.toString()}`;
+}
+function parseAuthorizationInput(input) {
+  const value = input.trim();
+  if (!value) return "";
+  try {
+    const url = new URL(value);
+    const code = url.searchParams.get("code");
+    if (code) return code;
+  } catch {
+  }
+  if (value.includes("code=")) {
+    const params = new URLSearchParams(value.includes("?") ? value.slice(value.indexOf("?") + 1) : value);
+    const code = params.get("code");
+    if (code) return code;
+  }
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function selectGatewayGrant(payload) {
+  const grants = [payload, ...Array.isArray(payload.other_tokens) ? payload.other_tokens : []];
+  const byResourceServer = grants.find((grant) => grant.resource_server === GATEWAY_CLIENT_ID);
+  if (byResourceServer) return byResourceServer;
+  const byScope = grants.find(
+    (grant) => typeof grant.scope === "string" && (grant.scope.includes("action_all") || grant.scope === GATEWAY_SCOPE)
+  );
+  if (byScope) return byScope;
+  if (grants.length === 1 && typeof payload.access_token === "string") return payload;
+  throw new Error(
+    `Globus token response did not include a grant for the ALCF gateway (resource_server=${GATEWAY_CLIENT_ID}).`
+  );
+}
+function grantToCredentials(grant, previousRefresh) {
+  const access = grant.access_token;
+  if (typeof access !== "string" || access.length === 0) {
+    throw new Error("Globus token response is missing an access token for the ALCF gateway.");
+  }
+  const refresh = typeof grant.refresh_token === "string" && grant.refresh_token.length > 0 ? grant.refresh_token : previousRefresh;
+  if (typeof refresh !== "string" || refresh.length === 0) {
+    throw new Error("Globus token response is missing a refresh token; cannot persist a renewable session.");
+  }
+  const expiresInSeconds = typeof grant.expires_in === "number" && grant.expires_in > 0 ? grant.expires_in : 0;
+  return {
+    access,
+    refresh,
+    expires: Date.now() + expiresInSeconds * 1e3 - EXPIRY_SKEW_MS
+  };
+}
+async function postForm(body, signal) {
+  const requestSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(3e4)]) : AbortSignal.timeout(3e4);
+  const response = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(body).toString(),
+    signal: requestSignal
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(`Globus token endpoint failed (HTTP ${response.status}): ${text.slice(0, 300)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw new Error(`Globus token endpoint returned invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!isRecord(parsed)) throw new Error("Globus token endpoint returned a non-object response.");
+  return parsed;
+}
+async function exchangeCode(code, verifier, signal) {
+  const payload = await postForm(
+    {
+      grant_type: "authorization_code",
+      client_id: AUTH_CLIENT_ID,
+      code,
+      code_verifier: verifier,
+      redirect_uri: REDIRECT_URI
+    },
+    signal
+  );
+  return grantToCredentials(selectGatewayGrant(payload));
+}
+async function refreshGatewayToken(refreshToken, signal) {
+  const payload = await postForm(
+    {
+      grant_type: "refresh_token",
+      client_id: AUTH_CLIENT_ID,
+      refresh_token: refreshToken
+    },
+    signal
+  );
+  return grantToCredentials(selectGatewayGrant(payload), refreshToken);
+}
+async function loginAlcf(callbacks) {
+  const { verifier, challenge } = await generatePkce();
+  const url = buildAuthorizeUrl({ challenge, state: randomState() });
+  callbacks.onAuth({
+    url,
+    instructions: "Log in with your ALCF / anl.gov identity. Globus will show an authorization code; copy it and paste it here."
+  });
+  const pasted = callbacks.onManualCodeInput ? await callbacks.onManualCodeInput() : await callbacks.onPrompt({ message: "Paste the authorization code from Globus", placeholder: "code" });
+  const code = parseAuthorizationInput(pasted);
+  if (!code) throw new Error("No authorization code was provided.");
+  callbacks.onProgress?.("Exchanging authorization code for an ALCF access token...");
+  return exchangeCode(code, verifier, callbacks.signal);
+}
+var alcfOAuthProvider = {
+  id: "alcf",
+  name: "ALCF Inference (Globus)",
+  usesCallbackServer: false,
+  login(callbacks) {
+    return loginAlcf(callbacks);
+  },
+  refreshToken(credentials, signal) {
+    return refreshGatewayToken(credentials.refresh, signal);
+  },
+  async getApiKey(credentials) {
+    return credentials.access;
+  }
+};
+
+// src/engine/oauth.ts
+function interactionFromLoginCallbacks(callbacks) {
+  const interaction = {
+    signal: callbacks.signal ?? new AbortController().signal,
+    notify(event) {
+      switch (event.type) {
+        case "auth_url":
+          callbacks.onAuth({
+            url: event.url,
+            ...event.instructions === void 0 ? {} : { instructions: event.instructions }
+          });
+          return;
+        case "device_code":
+          callbacks.onDeviceCode({
+            userCode: event.userCode,
+            verificationUri: event.verificationUri,
+            ...event.intervalSeconds === void 0 ? {} : { intervalSeconds: event.intervalSeconds },
+            ...event.expiresInSeconds === void 0 ? {} : { expiresInSeconds: event.expiresInSeconds }
+          });
+          return;
+        case "progress":
+        case "info":
+          callbacks.onProgress?.(event.message);
+          return;
+      }
+    },
+    async prompt(prompt) {
+      switch (prompt.type) {
+        case "select": {
+          const selection = await callbacks.onSelect({
+            message: prompt.message,
+            options: prompt.options.map((option) => ({ id: option.id, label: option.label }))
+          });
+          if (selection === void 0) throw new Error("login cancelled");
+          return selection;
+        }
+        case "manual_code":
+          if (callbacks.onManualCodeInput) return callbacks.onManualCodeInput();
+          return callbacks.onPrompt({
+            message: prompt.message,
+            ...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
+          });
+        default:
+          return callbacks.onPrompt({
+            message: prompt.message,
+            ...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
+          });
+      }
+    }
+  };
+  return interaction;
+}
+function fromOAuthAuth(id, auth, usesCallbackServer) {
+  if (!auth) throw new Error(`provider "${id}" does not expose an OAuth flow`);
+  return {
+    id,
+    name: auth.name,
+    usesCallbackServer,
+    async login(callbacks) {
+      return auth.login(interactionFromLoginCallbacks(callbacks));
+    },
+    async refreshToken(credentials, signal) {
+      return auth.refresh({ ...credentials, type: "oauth" }, signal);
+    },
+    async getApiKey(credentials) {
+      const resolved = await auth.toAuth({ ...credentials, type: "oauth" });
+      if (!resolved.apiKey) {
+        throw new Error(`OAuth provider "${id}" resolved no API key from the stored credential`);
+      }
+      return resolved.apiKey;
+    }
+  };
+}
+var providers = null;
+function builtinProviders() {
+  return [
+    fromOAuthAuth("anthropic", anthropicProvider().auth.oauth, true),
+    fromOAuthAuth("openai-codex", openaiCodexProvider().auth.oauth, true),
+    fromOAuthAuth("github-copilot", githubCopilotProvider().auth.oauth, false)
+  ];
+}
+function registry() {
+  if (!providers) {
+    providers = new Map(builtinProviders().map((provider) => [provider.id, provider]));
+  }
+  return providers;
+}
+function getEngineOAuthProvider(providerId) {
+  return registry().get(providerId);
+}
+function listEngineOAuthProviders() {
+  return [...registry().values()];
+}
+function registerEngineOAuthProvider(provider) {
+  registry().set(provider.id, provider);
+}
+var clioOAuthProvidersRegistered = false;
+function registerClioOAuthProviders() {
+  if (clioOAuthProvidersRegistered) return;
+  clioOAuthProvidersRegistered = true;
+  registerEngineOAuthProvider(alcfOAuthProvider);
+}
+async function loginWithEngineOAuthProvider(providerId, callbacks) {
+  const provider = registry().get(providerId);
+  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
+  return provider.login(callbacks);
+}
+async function refreshEngineOAuthCredentials(providerId, credentials, signal) {
+  const provider = registry().get(providerId);
+  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
+  return provider.refreshToken(credentials, signal);
+}
+async function getEngineOAuthApiKey(providerId, credentials) {
+  const provider = registry().get(providerId);
+  if (!provider) throw new Error(`unknown OAuth provider: ${providerId}`);
+  return provider.getApiKey(credentials);
+}
+
+// src/domains/providers/auth/storage.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+
+// src/domains/providers/auth/api-key.ts
+init_esm_shims();
+function resolveStoredApiKey(key, providerId = "stored-api-key") {
+  const trimmed = key.trim();
+  if (trimmed.length === 0) return void 0;
+  return resolveProviderDynamicSecret(trimmed, { providerId, field: "apiKey" });
+}
+function normalizeStoredApiKeyRef(key) {
+  const trimmed = key.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function resolveProviderDynamicSecret(value, context, options) {
+  void context;
+  return resolveDynamicConfigValue(value, options);
+}
+function resolveEnvironmentApiKey(providerId, explicitEnvVar) {
+  if (explicitEnvVar) {
+    const fromExplicit = process.env[explicitEnvVar]?.trim();
+    if (fromExplicit && fromExplicit.length > 0) {
+      return { apiKey: fromExplicit, source: explicitEnvVar };
+    }
+  }
+  for (const envVar of findEngineEnvKeys(providerId) ?? []) {
+    const fromKnownEnv = process.env[envVar]?.trim();
+    if (fromKnownEnv && fromKnownEnv.length > 0) {
+      return { apiKey: fromKnownEnv, source: envVar };
+    }
+  }
+  const fromKnownProvider = getEngineEnvApiKey(providerId)?.trim();
+  if (fromKnownProvider && fromKnownProvider.length > 0) {
+    return { apiKey: fromKnownProvider, source: null };
+  }
+  return { apiKey: void 0, source: explicitEnvVar ?? null };
+}
+
+// src/domains/providers/auth/oauth.ts
+init_esm_shims();
+function getOAuthProvider(providerId) {
+  return getEngineOAuthProvider(providerId);
+}
+function listOAuthProviders() {
+  return listEngineOAuthProviders();
+}
+async function loginWithOAuthProvider(providerId, callbacks) {
+  return loginWithEngineOAuthProvider(providerId, callbacks);
+}
+async function refreshOAuthCredentials(providerId, credentials, signal) {
+  return refreshEngineOAuthCredentials(providerId, credentials, signal);
+}
+function getOAuthApiKey(providerId, credentials) {
+  return getEngineOAuthApiKey(providerId, credentials);
+}
+
+// src/domains/providers/auth/storage.ts
+var AuthStorageDamagedError = class extends Error {
+  constructor(damage, path) {
+    super(
+      [
+        `refusing to write credentials: ${damage}.`,
+        path ? `File: ${path}` : null,
+        "Writing would replace the whole file and lose whatever is stored there.",
+        "Move the file aside once you have recovered anything you need, then log in again."
+      ].filter((line) => line !== null).join(" ")
+    );
+    this.damage = damage;
+    this.path = path;
+    this.name = "AuthStorageDamagedError";
+  }
+  damage;
+  path;
+};
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function emptyData() {
+  return {};
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null;
+}
+function toApiKeyCredential(raw) {
+  if (!isRecord2(raw)) return null;
+  if (raw.type === "api_key" && typeof raw.key === "string" && raw.key.trim().length > 0) {
+    return {
+      type: "api_key",
+      key: raw.key,
+      updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.length > 0 ? raw.updatedAt : nowIso()
+    };
+  }
+  return null;
+}
+function toOAuthCredential(raw) {
+  if (!isRecord2(raw)) return null;
+  if (raw.type === "oauth" && typeof raw.access === "string" && typeof raw.refresh === "string" && typeof raw.expires === "number") {
+    return {
+      ...raw,
+      type: "oauth",
+      access: raw.access,
+      refresh: raw.refresh,
+      expires: raw.expires,
+      updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.length > 0 ? raw.updatedAt : nowIso()
+    };
+  }
+  return null;
+}
+function readStorageData(content) {
+  if (!content || content.trim().length === 0) return { data: emptyData(), damage: null };
+  let parsed;
+  try {
+    parsed = (0, import_yaml.parse)(content);
+  } catch (error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    const detail = (raw.split("\n")[0] ?? raw).trim().replace(/:$/u, "");
+    return { data: emptyData(), damage: `it is not valid YAML: ${detail}` };
+  }
+  if (parsed === null || parsed === void 0) return { data: emptyData(), damage: null };
+  if (!isRecord2(parsed)) return { data: emptyData(), damage: "its top level is not a mapping" };
+  if (Object.keys(parsed).length === 0) return { data: emptyData(), damage: null };
+  if (!("entries" in parsed) && !("version" in parsed)) {
+    return { data: emptyData(), damage: "it has neither a version nor an entries mapping" };
+  }
+  const entries = isRecord2(parsed.entries) ? parsed.entries : null;
+  if (!entries) return { data: emptyData(), damage: null };
+  const data = {};
+  const unread = [];
+  const version = parsed.version;
+  if (version === 1 || version === void 0 && Object.values(entries).every((value) => isRecord2(value) && "key" in value)) {
+    for (const [providerId, value] of Object.entries(entries ?? {})) {
+      if (!value || typeof value.key !== "string" || value.key.trim().length === 0) {
+        unread.push(providerId);
+        continue;
+      }
+      data[providerId] = {
+        type: "api_key",
+        key: value.key,
+        updatedAt: typeof value.updatedAt === "string" && value.updatedAt.length > 0 ? value.updatedAt : nowIso()
+      };
+    }
+    return { data, damage: unreadDamage(unread) };
+  }
+  for (const [providerId, value] of Object.entries(entries ?? {})) {
+    const apiKey = toApiKeyCredential(value);
+    if (apiKey) {
+      data[providerId] = apiKey;
+      continue;
+    }
+    const oauth = toOAuthCredential(value);
+    if (oauth) {
+      data[providerId] = oauth;
+      continue;
+    }
+    unread.push(providerId);
+  }
+  return { data, damage: unreadDamage(unread) };
+}
+function unreadDamage(unread) {
+  if (unread.length === 0) return null;
+  return `these entries are stored in a shape this version cannot read: ${[...unread].sort().join(", ")}`;
+}
+function serializeStorageData(data) {
+  return (0, import_yaml.stringify)({
+    version: 2,
+    entries: data
+  });
+}
+function resolveAuthTarget(target, runtime) {
+  const providerId = target.auth?.oauthProfile?.trim() || target.auth?.apiKeyRef?.trim() || runtime.oauthProviderId || runtime.id;
+  const authTarget = {
+    providerId,
+    targetId: target.id,
+    runtimeAuth: runtime.auth
+  };
+  const explicitEnvVar = target.auth?.apiKeyEnvVar ?? runtime.credentialsEnvVar;
+  if (explicitEnvVar) authTarget.explicitEnvVar = explicitEnvVar;
+  return authTarget;
+}
+function resolveRuntimeAuthTarget(runtime) {
+  const target = {
+    providerId: runtime.oauthProviderId ?? runtime.id,
+    runtimeAuth: runtime.auth
+  };
+  if (runtime.credentialsEnvVar) target.explicitEnvVar = runtime.credentialsEnvVar;
+  return target;
+}
+function targetRequiresAuth(target, runtime) {
+  if (runtime.auth === "oauth") return true;
+  if (runtime.auth !== "api-key") return false;
+  if (target.auth?.apiKeyEnvVar || target.auth?.apiKeyRef || target.auth?.oauthProfile) return true;
+  return runtime.tier === "cloud" || Boolean(runtime.credentialsEnvVar);
+}
+function authNotRequiredStatus(providerId) {
+  return {
+    providerId,
+    available: true,
+    credentialType: null,
+    source: "not-required",
+    detail: null
+  };
+}
+var AuthStorage = class {
+  constructor(backend) {
+    this.backend = backend;
+    this.reload();
+  }
+  backend;
+  data = {};
+  damage = null;
+  runtimeOverrides = /* @__PURE__ */ new Map();
+  fallbackResolver;
+  reload() {
+    try {
+      const content = this.backend.read ? this.backend.read() : this.backend.withLock((current) => ({ result: current }));
+      const read = readStorageData(content);
+      this.data = read.data;
+      this.damage = read.damage;
+    } catch (error) {
+      this.data = emptyData();
+      this.damage = error instanceof Error ? `it could not be read: ${error.message}` : "it could not be read";
+    }
+  }
+  /**
+   * Why the store on disk could not be fully read, or why the last write to it
+   * did not land, or null when it is clean. Callers that report connection
+   * state must consult this, because a damaged store reads as zero credentials
+   * and is otherwise indistinguishable from having never logged in, and a
+   * refused write leaves memory claiming a credential that disk does not hold.
+   */
+  damageReason() {
+    return this.damage;
+  }
+  persist(providerId, credential) {
+    try {
+      this.backend.withLock((current) => {
+        const read = readStorageData(current);
+        if (read.damage !== null) {
+          this.damage = read.damage;
+          throw new AuthStorageDamagedError(read.damage, this.backend.describe?.());
+        }
+        const merged = read.data;
+        if (credential) merged[providerId] = credential;
+        else delete merged[providerId];
+        this.data = merged;
+        this.damage = null;
+        return { result: void 0, next: serializeStorageData(merged) };
+      });
+    } catch (error) {
+      if (error instanceof AuthStorageDamagedError) throw error;
+      this.damage = error instanceof Error ? `it could not be written: ${error.message}` : "it could not be written";
+    }
+  }
+  get(providerId) {
+    return this.data[providerId];
+  }
+  // persist() adopts the merged view on success, so it runs first: assigning
+  // in-memory ahead of it would leave a credential that reads back as stored
+  // while the disk write was refused.
+  set(providerId, credential) {
+    this.persist(providerId, credential);
+    this.data[providerId] = credential;
+  }
+  setApiKey(providerId, key) {
+    const resolved = normalizeStoredApiKeyRef(key);
+    if (!resolved) throw new Error(`auth.setApiKey: empty key for provider=${providerId}`);
+    this.set(providerId, { type: "api_key", key: resolved, updatedAt: nowIso() });
+  }
+  remove(providerId) {
+    this.persist(providerId, void 0);
+    delete this.data[providerId];
+  }
+  renameProvider(fromProviderId, toProviderId, options = {}) {
+    this.backend.withLock((current) => {
+      const read = readStorageData(current);
+      const source = read.data[fromProviderId];
+      if (!source) {
+        if (read.damage === null) this.data = read.data;
+        return { result: void 0 };
+      }
+      if (read.damage !== null) throw new AuthStorageDamagedError(read.damage, this.backend.describe?.());
+      if (!read.data[toProviderId]) read.data[toProviderId] = source;
+      if (options.keepSource !== true) delete read.data[fromProviderId];
+      this.data = read.data;
+      this.damage = null;
+      return { result: void 0, next: serializeStorageData(read.data) };
+    });
+  }
+  listStored() {
+    return Object.entries(this.data).map(([providerId, credential]) => ({
+      providerId,
+      type: credential.type,
+      updatedAt: credential.updatedAt
+    })).sort((a, b) => a.providerId.localeCompare(b.providerId));
+  }
+  hasStored(providerId) {
+    return providerId in this.data;
+  }
+  /**
+   * Install a process-lifetime API key override scoped to a specific target.
+   * Overrides are keyed by `targetId` (not providerId) so two targets
+   * sharing a runtime do not share the override. `clio-coder --api-key <key>`
+   * applies only to the active target, not every target on that provider.
+   */
+  setRuntimeOverride(targetId, apiKey) {
+    if (targetId.length === 0) {
+      throw new Error("auth.setRuntimeOverride: empty targetId");
+    }
+    const resolved = normalizeStoredApiKeyRef(apiKey);
+    if (!resolved) throw new Error(`auth.setRuntimeOverride: empty key for target=${targetId}`);
+    this.runtimeOverrides.set(targetId, resolved);
+  }
+  clearRuntimeOverride(targetId) {
+    if (targetId.length === 0) return;
+    this.runtimeOverrides.delete(targetId);
+  }
+  setFallbackResolver(resolver) {
+    this.fallbackResolver = resolver;
+  }
+  status(providerId, opts) {
+    if (opts?.targetId && this.runtimeOverrides.has(opts.targetId)) {
+      return {
+        providerId,
+        available: true,
+        credentialType: "api_key",
+        source: "runtime-override",
+        detail: providerId
+      };
+    }
+    const stored = this.data[providerId];
+    if (stored?.type === "api_key") {
+      return {
+        providerId,
+        available: true,
+        credentialType: "api_key",
+        source: "stored-api-key",
+        detail: providerId
+      };
+    }
+    if (stored?.type === "oauth") {
+      return {
+        providerId,
+        available: true,
+        credentialType: "oauth",
+        source: "stored-oauth",
+        detail: providerId
+      };
+    }
+    const env = resolveEnvironmentApiKey(providerId, opts?.explicitEnvVar);
+    if (env.apiKey) {
+      return {
+        providerId,
+        available: true,
+        credentialType: "api_key",
+        source: "environment",
+        detail: env.source ?? providerId
+      };
+    }
+    if (opts?.includeFallback !== false) {
+      const fallback = this.fallbackResolver?.(providerId)?.trim();
+      if (fallback && fallback.length > 0) {
+        return {
+          providerId,
+          available: true,
+          credentialType: "api_key",
+          source: "fallback",
+          detail: providerId
+        };
+      }
+    }
+    return {
+      providerId,
+      available: false,
+      credentialType: null,
+      source: "none",
+      detail: null
+    };
+  }
+  statusForTarget(target, opts) {
+    const args = {};
+    if (opts?.includeFallback !== void 0) args.includeFallback = opts.includeFallback;
+    if (target.explicitEnvVar) args.explicitEnvVar = target.explicitEnvVar;
+    if (target.targetId) args.targetId = target.targetId;
+    return this.status(target.providerId, args);
+  }
+  async refreshOAuthCredentialWithLock(providerId, signal) {
+    let latestData;
+    const result = await this.backend.withLockAsync(
+      async (current) => {
+        const read = readStorageData(current);
+        if (read.damage !== null) {
+          this.damage = read.damage;
+          throw new AuthStorageDamagedError(read.damage, this.backend.describe?.());
+        }
+        const currentData = read.data;
+        latestData = currentData;
+        const stored = currentData[providerId];
+        if (stored?.type !== "oauth") {
+          return { result: null };
+        }
+        if (Date.now() < stored.expires) {
+          return { result: { apiKey: await getOAuthApiKey(providerId, stored), credential: stored } };
+        }
+        const refreshed = await refreshOAuthCredentials(providerId, stored, signal);
+        const next = {
+          type: "oauth",
+          ...refreshed,
+          updatedAt: nowIso()
+        };
+        const merged = { ...currentData, [providerId]: next };
+        latestData = merged;
+        return {
+          result: { apiKey: await getOAuthApiKey(providerId, next), credential: next },
+          next: serializeStorageData(merged)
+        };
+      },
+      { signal }
+    );
+    if (latestData) this.data = latestData;
+    this.damage = null;
+    return result;
+  }
+  async resolveApiKey(providerId, opts) {
+    if (opts?.targetId) {
+      const override = this.runtimeOverrides.get(opts.targetId);
+      if (override) {
+        return {
+          providerId,
+          available: true,
+          credentialType: "api_key",
+          source: "runtime-override",
+          detail: providerId,
+          apiKey: override
+        };
+      }
+    }
+    const stored = this.data[providerId];
+    if (stored?.type === "api_key") {
+      const apiKey = resolveStoredApiKey(stored.key, providerId);
+      return {
+        providerId,
+        available: true,
+        credentialType: "api_key",
+        source: "stored-api-key",
+        detail: providerId,
+        ...apiKey ? { apiKey } : {}
+      };
+    }
+    if (stored?.type === "oauth") {
+      const provider = getOAuthProvider(providerId);
+      if (!provider) {
+        return {
+          providerId,
+          available: true,
+          credentialType: "oauth",
+          source: "stored-oauth",
+          detail: providerId
+        };
+      }
+      if (Date.now() < stored.expires) {
+        return {
+          providerId,
+          available: true,
+          credentialType: "oauth",
+          source: "stored-oauth",
+          detail: providerId,
+          apiKey: await getOAuthApiKey(providerId, stored)
+        };
+      }
+      try {
+        const refreshed = await this.refreshOAuthCredentialWithLock(
+          providerId,
+          opts?.signal ?? new AbortController().signal
+        );
+        if (refreshed) {
+          return {
+            providerId,
+            available: true,
+            credentialType: "oauth",
+            source: "stored-oauth",
+            detail: providerId,
+            apiKey: refreshed.apiKey
+          };
+        }
+      } catch (error) {
+        if (opts?.signal?.aborted) throw opts.signal.reason ?? error;
+        this.reload();
+        const updated = this.data[providerId];
+        if (updated?.type === "oauth" && Date.now() < updated.expires) {
+          return {
+            providerId,
+            available: true,
+            credentialType: "oauth",
+            source: "stored-oauth",
+            detail: providerId,
+            apiKey: await getOAuthApiKey(providerId, updated)
+          };
+        }
+      }
+      return {
+        providerId,
+        available: true,
+        credentialType: "oauth",
+        source: "stored-oauth",
+        detail: providerId
+      };
+    }
+    const env = resolveEnvironmentApiKey(providerId, opts?.explicitEnvVar);
+    if (env.apiKey) {
+      return {
+        providerId,
+        available: true,
+        credentialType: "api_key",
+        source: "environment",
+        detail: env.source ?? providerId,
+        apiKey: env.apiKey
+      };
+    }
+    if (opts?.includeFallback !== false) {
+      const fallback = this.fallbackResolver?.(providerId)?.trim();
+      if (fallback && fallback.length > 0) {
+        return {
+          providerId,
+          available: true,
+          credentialType: "api_key",
+          source: "fallback",
+          detail: providerId,
+          apiKey: fallback
+        };
+      }
+    }
+    return {
+      providerId,
+      available: false,
+      credentialType: null,
+      source: "none",
+      detail: null
+    };
+  }
+  resolveForTarget(target, opts) {
+    const args = {};
+    if (opts?.includeFallback !== void 0) args.includeFallback = opts.includeFallback;
+    if (opts?.signal !== void 0) args.signal = opts.signal;
+    if (target.explicitEnvVar) args.explicitEnvVar = target.explicitEnvVar;
+    if (target.targetId) args.targetId = target.targetId;
+    return this.resolveApiKey(target.providerId, args);
+  }
+  async login(providerId, callbacks) {
+    const credentials = await loginWithOAuthProvider(providerId, callbacks);
+    this.set(providerId, { type: "oauth", ...credentials, updatedAt: nowIso() });
+  }
+  logout(providerId) {
+    this.remove(providerId);
+  }
+  getOAuthProviders() {
+    return listOAuthProviders().map((provider) => ({ id: provider.id, name: provider.name })).sort((a, b) => a.id.localeCompare(b.id));
+  }
+};
+
+// src/domains/providers/auth/index.ts
+init_esm_shims();
+
+// src/domains/providers/auth/backend-file.ts
+init_esm_shims();
+import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+function atomicWriteSecret(absPath, contents) {
+  safeResourceWrite(absPath, contents, { encoding: "utf8", mode: 384 });
+  chmodSync(absPath, 384);
+}
+function authStoragePath() {
+  return join(resolveClioDirs().config, "credentials.yaml");
+}
+var FileAuthStorageBackend = class {
+  constructor(path = authStoragePath()) {
+    this.path = path;
+  }
+  path;
+  describe() {
+    return this.path;
+  }
+  ensureParentDir() {
+    mkdirSync(dirname(this.path), { recursive: true, mode: 448 });
+  }
+  // Writers publish complete files with an atomic rename, so a reader sees
+  // either the prior or next committed snapshot without creating a lockfile or
+  // initializing a missing home. Read-modify-write operations still take the
+  // exclusive lock below and read again inside it before merging changes.
+  read() {
+    try {
+      return readFileSync(this.path, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  }
+  withLock(fn) {
+    this.ensureParentDir();
+    return withStateFileLockSync(this.path, () => {
+      const current = this.read();
+      const { result, next } = fn(current);
+      if (next !== void 0) {
+        atomicWriteSecret(this.path, next);
+      }
+      return result;
+    });
+  }
+  async withLockAsync(fn, options) {
+    options?.signal?.throwIfAborted();
+    this.ensureParentDir();
+    return withStateFileLock(
+      this.path,
+      async () => {
+        options?.signal?.throwIfAborted();
+        const current = existsSync(this.path) ? await readFile(this.path, "utf8") : void 0;
+        const { result, next } = await fn(current);
+        options?.signal?.throwIfAborted();
+        if (next !== void 0) {
+          atomicWriteSecret(this.path, next);
+        }
+        return result;
+      },
+      options?.signal ? { signal: options.signal } : {}
+    );
+  }
+};
+
+// src/domains/providers/auth/backend-memory.ts
+init_esm_shims();
+function abortReason(signal) {
+  if (signal.reason !== void 0) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+function raceWithAbortSignal(operation, signal) {
+  if (!signal) return operation;
+  if (signal.aborted) {
+    void operation.catch(() => {
+    });
+    return Promise.reject(abortReason(signal));
+  }
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(abortReason(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    void operation.then(
+      (value) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        resolve(value);
+      },
+      (error) => {
+        if (settled) return;
+        settled = true;
+        cleanup();
+        reject(error);
+      }
+    );
+    if (signal.aborted) onAbort();
+  });
+}
+var InMemoryAuthStorageBackend = class {
+  value;
+  asyncChain = Promise.resolve();
+  withLock(fn) {
+    const { result, next } = fn(this.value);
+    if (next !== void 0) this.value = next;
+    return result;
+  }
+  withLockAsync(fn, options) {
+    const previous = this.asyncChain;
+    const operation = (async () => {
+      await previous.catch(() => {
+      });
+      options?.signal?.throwIfAborted();
+      const { result, next } = await fn(this.value);
+      options?.signal?.throwIfAborted();
+      if (next !== void 0) this.value = next;
+      return result;
+    })();
+    this.asyncChain = operation.catch(() => {
+    });
+    return raceWithAbortSignal(operation, options?.signal);
+  }
+};
+
+// src/domains/providers/auth/index.ts
+function openAuthStorage(path) {
+  return new AuthStorage(new FileAuthStorageBackend(path));
+}
+function createMemoryAuthStorage(data = {}) {
+  const backend = new InMemoryAuthStorageBackend();
+  const storage = new AuthStorage(backend);
+  for (const [providerId, credential] of Object.entries(data)) {
+    storage.set(providerId, credential);
+  }
+  return storage;
+}
+
+export {
+  registerClioOAuthProviders,
+  authStoragePath,
+  resolveAuthTarget,
+  resolveRuntimeAuthTarget,
+  targetRequiresAuth,
+  authNotRequiredStatus,
+  openAuthStorage,
+  createMemoryAuthStorage
+};
+//# sourceMappingURL=chunk-Z4GLJ6J4.js.map