@jeffreycao/copilot-api 2.4.2 → 2.5.2

package/README.md

@@ -406,9 +406,12 @@ npx @jeffreycao/copilot-api@latest start
 With options:
 
 ```sh
-npx @jeffreycao/copilot-api@latest start --port 8080
+npx @jeffreycao/copilot-api@latest auth keys --add your-gateway-api-key
+npx @jeffreycao/copilot-api@latest start --host 0.0.0.0 --port 8080
 ```
 
+Binding to `0.0.0.0` exposes the gateway to the network, so the server requires at least one gateway API key and restricts CORS to same-origin requests.
+
 For authentication or provider configuration only:
 
 ```sh
@@ -434,17 +437,21 @@ Run the container with a bind mount so auth data survives restarts:
 
 ```sh
 mkdir -p ./copilot-data
+docker run --rm -v $(pwd)/copilot-data:/root/.local/share/copilot-api copilot-api --auth keys --add your-gateway-api-key
 docker run -p 4141:4141 -v $(pwd)/copilot-data:/root/.local/share/copilot-api copilot-api
 ```
 
 This stores GitHub auth data, provider config, and other gateway state in `./copilot-data` on the host, mapped to `/root/.local/share/copilot-api` in the container.
+The image explicitly listens on `0.0.0.0` so Docker port publishing works and refuses to start until at least one gateway API key is configured. Non-loopback listeners also restrict CORS to the request's own origin.
 
 Or pass a GitHub token directly:
 
 ```sh
-docker run -p 4141:4141 -e GH_TOKEN=your_github_token_here copilot-api
+docker run -p 4141:4141 -v $(pwd)/copilot-data:/root/.local/share/copilot-api -e GH_TOKEN=your_github_token_here copilot-api
 ```
 
+The entrypoint exports `GH_TOKEN` as `COPILOT_API_GITHUB_TOKEN`, so the token is handed to the server through the environment instead of the process arguments.
+
 ## Electron Desktop App
 
 If you prefer a GUI, this repository also includes an Electron desktop app in `desktop/`. It supports GitHub Copilot sign-in, OpenAI Codex OAuth, and API-key configuration for Kimi, DeepSeek, DashScope, OpenRouter, or a custom provider. After authorization or provider configuration, it can start and stop the local proxy with one click and shows the local endpoint, auth header, available models, usage, and logs in the app.
@@ -628,13 +635,16 @@ The following command line options are available for the `start` command:
 
 | Option         | Description                                                                   | Default    | Alias |
 | -------------- | ----------------------------------------------------------------------------- | ---------- | ----- |
+| --host         | Host to listen on; non-loopback hosts require a configured gateway API key   | 127.0.0.1 | none  |
 | --port         | Port to listen on                                                             | 4141       | -p    |
 | --verbose      | Enable verbose logging                                                        | false      | -v    |
-| --github-token | Provide GitHub token directly (must be generated using the `auth` subcommand) | none       | -g    |
+| --github-token | Provide GitHub token directly (must be generated using the `auth` subcommand); prefer `COPILOT_API_GITHUB_TOKEN`, since arguments are visible in the process list | none       | -g    |
 | --claude-code  | Generate a command to launch Claude Code with Copilot API config              | false      | -c    |
 | --show-token   | Show GitHub and Copilot tokens on fetch and refresh                           | false      | none  |
 | --proxy-env    | Initialize proxy from environment variables                                   | false      | none  |
 
+Passing the GitHub token on the command line exposes it to every local user through the process list, so prefer the `COPILOT_API_GITHUB_TOKEN` environment variable. The gateway resolves the token in this order: `--github-token` → `COPILOT_API_GITHUB_TOKEN` → the token file written by `auth login`.
+
 ### Auth Command Options
 
 | Option       | Description               | Default | Alias |
@@ -649,7 +659,7 @@ Use `copilot-api auth login --provider deepseek`, `--provider dashscope`, `--pro
 
 Use `copilot-api auth login --provider custom` to add or update another third-party provider from the CLI. The command prompts for the provider name, supported type (`anthropic`, `openai-compatible`, or `openai-responses`), `baseUrl`, masked `apiKey`, and `authType`; `authType` may be left as the type default or set to `x-api-key` / `authorization`.
 
-Gateway API keys live under `auth.apiKeys` in `config.json`. Manage them with `copilot-api auth keys` (one operation per invocation): add a key with `--add <key>`, remove one with `--remove <key>`, list all with `--list`, or clear them all with `--clear`. Clients authenticate with any configured key via `x-api-key` or `Authorization: Bearer`. When no keys are configured, `copilot-api start` starts with authentication bypassed and prints a startup info message.
+Gateway API keys live under `auth.apiKeys` in `config.json`. Manage them with `copilot-api auth keys` (one operation per invocation): add a key with `--add <key>`, remove one with `--remove <key>`, list all with `--list`, or clear them all with `--clear`. Clients authenticate with any configured key via `x-api-key` or `Authorization: Bearer`. Without keys, loopback listeners start with authentication bypassed and print an info message; non-loopback listeners refuse to start.
 
 ### Debug Command Options
 
@@ -686,8 +696,8 @@ Gateway API keys live under `auth.apiKeys` in `config.json`. Manage them with `c
     },
     "useMessagesApi": true,
     "useResponsesApiWebSocket": true,
-    "responsesTransport": {
-      "headersTimeoutMsV2": 300000,
+    "upstreamTransport": {
+      "headersTimeoutMs": 300000,
       "streamInactivityTimeoutMs": 300000,
       "websocketOpenTimeoutMs": 30000,
       "websocketPoolIdleTimeoutMs": 60000,
@@ -700,7 +710,7 @@ Gateway API keys live under `auth.apiKeys` in `config.json`. Manage them with `c
     "messageApiWebSearchModel": "gpt-5-mini"
   }
   ```
-- **auth.apiKeys:** API keys used for request authentication on non-admin routes. Supports multiple keys for rotation. Requests can authenticate with either `x-api-key: <key>` or `Authorization: Bearer <key>`. If empty or omitted, authentication for non-admin routes is disabled.
+- **auth.apiKeys:** API keys used for request authentication on non-admin routes. Supports multiple keys for rotation. Requests can authenticate with either `x-api-key: <key>` or `Authorization: Bearer <key>`. If empty or omitted, authentication for non-admin routes is disabled only on loopback listeners; non-loopback listeners refuse to start.
 - **auth.adminApiKey:** Single admin key used only for `/admin/*` routes. If missing, the server generates a random key at startup and writes it back to `config.json`. Requests use the same `x-api-key` or `Authorization: Bearer` headers, but regular `auth.apiKeys` never grant access to `/admin/*`.
 - **modelMappings:** Exact `sourceModel -> targetModel` rewrites shared by top-level `POST /v1/messages`, `POST /v1/messages/count_tokens`, `POST /v1/responses`, and `POST /v1/chat/completions` requests. Omit it or leave it as `{}` to disable rewrites. Both the source and target must be non-empty strings. Targets can be regular model IDs or `provider/model` aliases such as `dashscope/qwen3.6-plus`, and the rewrite happens before provider alias parsing. These mappings are not split per interface. The admin endpoints `GET/POST /admin/config/model-mappings` read and update only this field.
 - **extraPrompts:** Map of `model -> prompt` appended to the first system prompt when translating Anthropic-style requests to Responses API. Use this to inject guardrails or guidance per model. Missing default entries are auto-added without overwriting your custom prompts. For GPT-5.3+ models (e.g. `gpt-5.3-codex`, `gpt-5.4`, `gpt-5.5`), a built-in commentary prompt is used as fallback when not explicitly configured. The built-in prompts enable phase-aware commentary, which lets the model emit a short user-facing progress update before tools or deeper reasoning.
@@ -735,7 +745,7 @@ Gateway API keys live under `auth.apiKeys` in `config.json`. Manage them with `c
   - **Configuration values:** `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max`.
 - **useMessagesApi:** When `true`, models that advertise Copilot's native `/v1/messages` endpoint use the Messages API. If Messages is disabled or unavailable for the selected model, the gateway uses Responses when that model advertises a Responses endpoint, then falls back to Chat Completions when supported. Set this to `false` to skip native Messages routing. Defaults to `true`.
 - **useResponsesApiWebSocket:** When `true`, Copilot Responses requests use WebSocket for models that advertise `ws:/responses`; models that advertise only `/responses` use HTTP. Streamed Responses requests for the built-in `codex` provider use WebSocket whenever this setting is enabled, while non-streaming Codex requests always use HTTP. Set this to `false` to make Copilot use HTTP `/responses` where the selected model advertises it and to send streamed Codex Responses requests over HTTP. WebSocket failures are not retried automatically over HTTP. Defaults to `true`. If a proxy, VPN, or network blocks or destabilizes WebSocket traffic, disable this setting or switch networks.
-- **responsesTransport:** Positive integer lifecycle and buffering limits for every upstream Responses transport. Invalid, zero, or negative values fall back to the defaults shown above. `headersTimeoutMsV2` covers connection setup through receipt of HTTP response headers; it is not a total generation deadline. `streamInactivityTimeoutMs` is reset by every HTTP body chunk or WebSocket message, allowing long generations to continue while they remain active. `websocketOpenTimeoutMs` limits the WebSocket handshake, while `websocketPoolIdleTimeoutMs` controls only completed, reusable pooled sockets. The byte and message limits bound queued WebSocket events; exceeding either limit fails that stream and invalidates its socket rather than dropping or reordering events.
+- **upstreamTransport:** Positive integer lifecycle and buffering limits for the upstream chat completions, responses, and messages transports. Invalid, zero, or negative values fall back to the defaults shown above. `headersTimeoutMs` covers connection setup through receipt of HTTP response headers; it is not a total generation deadline. `streamInactivityTimeoutMs` is reset by every HTTP body chunk or WebSocket message, allowing long generations to continue while they remain active. `websocketOpenTimeoutMs` limits the WebSocket handshake, while `websocketPoolIdleTimeoutMs` controls only completed, reusable pooled sockets. The byte and message limits bound queued WebSocket events; exceeding either limit fails that stream and invalidates its socket rather than dropping or reordering events.
 - **useResponsesApiWebSearch:** When `true`, the server keeps Responses API tools with `type: "web_search"` and forwards them upstream. Set to `false` to strip those tools from `/responses` payloads. Defaults to `true`.
 - **alphaSearchCodexPriority:** Defaults to `true`. Top-level alpha-search requests prefer the Codex alpha-search endpoint because it does not consume provider quota. If Codex is unavailable, or this setting is `false`, requests with a `provider/model` alias other than `codex/model` use that provider's `/v1/responses` endpoint, and requests without a provider prefix use GitHub Copilot Responses web search. The adapter recognizes every current Codex search command; unsupported `image_query` and `screenshot` operations return successful no-retry tool output.
 - **alphaSearchModel:** Native Responses search model used when a Messages-backed Responses Lite model cannot run Responses web search directly. Defaults to `gpt-5-mini`; it may be a regular Copilot model or an `openai-responses` `provider/model` alias. Set it to an empty string to disable this redirect, in which case alpha-search requests for those models return an invalid-request error.
@@ -748,7 +758,7 @@ Edit this file to customize prompts or swap in your own fast model. Restart the
 
 ## API Authentication
 
-- **Protected non-admin routes:** All routes except `/`, `/usage-viewer`, and `/usage-viewer/` require authentication when `auth.apiKeys` is configured and non-empty.
+- **Protected non-admin routes:** All routes except `/`, `/usage-viewer`, and `/usage-viewer/` require authentication when `auth.apiKeys` is configured and non-empty. Non-loopback listeners require a non-empty `auth.apiKeys` configuration at startup and continue failing closed if the keys are later cleared.
 - **Admin routes:** All `/admin/*` routes require `auth.adminApiKey`. If it is missing, the server generates one at startup and persists it to `config.json` before serving requests.
 - **Allowed auth headers:**
   - `x-api-key: <your_key>`

package/README.zh-CN.md

@@ -434,9 +434,12 @@ npx @jeffreycao/copilot-api@latest start
 带参数示例：
 
 ```sh
-npx @jeffreycao/copilot-api@latest start --port 8080
+npx @jeffreycao/copilot-api@latest auth keys --add your-gateway-api-key
+npx @jeffreycao/copilot-api@latest start --host 0.0.0.0 --port 8080
 ```
 
+绑定到 `0.0.0.0` 会将网关暴露到网络，因此服务要求至少配置一个网关 API Key，并将 CORS 限制为同源请求。
+
 如果只想做认证或 provider 配置：
 
 ```sh
@@ -464,17 +467,21 @@ docker build -t copilot-api .
 
 ```sh
 mkdir -p ./copilot-data
+docker run --rm -v $(pwd)/copilot-data:/root/.local/share/copilot-api copilot-api --auth keys --add your-gateway-api-key
 docker run -p 4141:4141 -v $(pwd)/copilot-data:/root/.local/share/copilot-api copilot-api
 ```
 
 这会把宿主机上的 `./copilot-data` 映射到容器内的 `/root/.local/share/copilot-api`，用于持久化 GitHub 认证数据、provider 配置和其他 gateway 状态。
+镜像会显式监听 `0.0.0.0` 以支持 Docker 端口映射，并在未配置网关 API Key 时拒绝启动。非回环监听还会将 CORS 限制为请求自身的同源地址。
 
 也可以直接通过环境变量传入 GitHub token：
 
 ```sh
-docker run -p 4141:4141 -e GH_TOKEN=your_github_token_here copilot-api
+docker run -p 4141:4141 -v $(pwd)/copilot-data:/root/.local/share/copilot-api -e GH_TOKEN=your_github_token_here copilot-api
 ```
 
+entrypoint 会把 `GH_TOKEN` 导出为 `COPILOT_API_GITHUB_TOKEN`，因此 token 是通过环境变量交给服务的，不会出现在进程参数里。
+
 <a id="electron-desktop-app"></a>
 
 ## Electron 桌面应用
@@ -670,13 +677,16 @@ Copilot API 现在使用子命令结构，主要命令包括：
 
 | 选项 | 说明 | 默认值 | 别名 |
 | --- | --- | --- | --- |
+| --host | 监听主机；非回环地址要求已配置网关 API Key | 127.0.0.1 | 无 |
 | --port | 监听端口 | 4141 | -p |
 | --verbose | 启用详细日志 | false | -v |
-| --github-token | 直接提供 GitHub token（必须通过 `auth` 子命令生成） | 无 | -g |
+| --github-token | 直接提供 GitHub token（必须通过 `auth` 子命令生成）；建议使用 `COPILOT_API_GITHUB_TOKEN`，命令行参数会出现在进程列表中 | 无 | -g |
 | --claude-code | 生成一个使用 Copilot API 配置启动 Claude Code 的命令 | false | -c |
 | --show-token | 在获取和刷新时显示 GitHub 与 Copilot token | false | 无 |
 | --proxy-env | 从环境变量初始化代理 | false | 无 |
 
+不建议把 GitHub token 放在命令行上：本机任意用户都能从进程列表里读到它，请优先使用 `COPILOT_API_GITHUB_TOKEN` 环境变量。token 的解析顺序为：`--github-token` → `COPILOT_API_GITHUB_TOKEN` → `auth login` 写入的 token 文件。
+
 ### Auth 命令选项
 
 | 选项 | 说明 | 默认值 | 别名 |
@@ -691,7 +701,7 @@ Copilot API 现在使用子命令结构，主要命令包括：
 
 使用 `copilot-api auth login --provider custom` 可以通过 CLI 新增或更新其他第三方 provider。命令会依次提示输入 provider name、项目支持的 type（`anthropic`、`openai-compatible` 或 `openai-responses`）、`baseUrl`、掩码显示的 `apiKey` 和 `authType`；`authType` 可保持 type 默认值，也可选择 `x-api-key` / `authorization`。
 
-网关 API Key 存放在 `config.json` 的 `auth.apiKeys` 中，可通过 `copilot-api auth keys` 管理（每次只执行一种操作）：`--add <key>` 添加、`--remove <key>` 删除、`--list` 列出全部、`--clear` 清空。客户端通过 `x-api-key` 或 `Authorization: Bearer` 使用任意已配置的 Key 认证。未配置任何 Key 时，`copilot-api start` 会以“不校验认证”的方式启动并输出一条 info 级别的启动提示。
+网关 API Key 存放在 `config.json` 的 `auth.apiKeys` 中，可通过 `copilot-api auth keys` 管理（每次只执行一种操作）：`--add <key>` 添加、`--remove <key>` 删除、`--list` 列出全部、`--clear` 清空。客户端通过 `x-api-key` 或 `Authorization: Bearer` 使用任意已配置的 Key 认证。未配置任何 Key 时，回环监听会以“不校验认证”的方式启动并输出一条 info 级别提示；非回环监听则拒绝启动。
 
 ### Debug 命令选项
 
@@ -730,8 +740,8 @@ Copilot API 现在使用子命令结构，主要命令包括：
     },
     "useMessagesApi": true,
     "useResponsesApiWebSocket": true,
-    "responsesTransport": {
-      "headersTimeoutMsV2": 300000,
+    "upstreamTransport": {
+      "headersTimeoutMs": 300000,
       "streamInactivityTimeoutMs": 300000,
       "websocketOpenTimeoutMs": 30000,
       "websocketPoolIdleTimeoutMs": 60000,
@@ -744,7 +754,7 @@ Copilot API 现在使用子命令结构，主要命令包括：
     "messageApiWebSearchModel": "gpt-5-mini"
   }
   ```
-- **auth.apiKeys：** 用于普通非 admin 路由的 API key。支持多个 key 轮换使用。请求可通过 `x-api-key: <key>` 或 `Authorization: Bearer <key>` 进行认证。若为空或省略，则普通路由的认证会被禁用。
+- **auth.apiKeys：** 用于普通非 admin 路由的 API key。支持多个 key 轮换使用。请求可通过 `x-api-key: <key>` 或 `Authorization: Bearer <key>` 进行认证。若为空或省略，仅回环监听会禁用普通路由认证；非回环监听会拒绝启动。
 - **auth.adminApiKey：** 仅用于 `/admin/*` 路由的单个 admin key。若未配置，服务会在启动时自动生成一个随机 key，并回写到 `config.json`。它同样使用 `x-api-key` 或 `Authorization: Bearer` 这两种头，但普通 `auth.apiKeys` 不能访问 `/admin/*`。
 - **modelMappings：** 用于顶层 `POST /v1/messages`、`POST /v1/messages/count_tokens`、`POST /v1/responses` 和 `POST /v1/chat/completions` 请求的精确 `sourceModel -> targetModel` 重写映射，这几类接口共用同一份规则。省略该字段或保留为 `{}` 时，不会做模型重写。`source` 和 `target` 都必须是非空字符串。`target` 可以是普通模型 ID，也可以是 `provider/model` 形式的别名，例如 `dashscope/qwen3.6-plus`；重写发生在 provider alias 解析之前。这些映射不再按接口区分。`GET/POST /admin/config/model-mappings` 管理接口读写的也只有这个字段。
 - **extraPrompts：** `model -> prompt` 的映射。把 Anthropic 风格请求翻译为 Responses API 时，会将其附加到第一条 system prompt 后面。你可以借此为不同模型注入护栏或指引。缺失的默认项会自动补齐，但不会覆盖你自定义的 prompt。对于 GPT-5.3+ 模型（如 `gpt-5.3-codex`、`gpt-5.4`、`gpt-5.5`），未显式配置时会自动使用内置的 commentary prompt。内置 prompt 会启用带阶段感知的 commentary，让模型在工具调用或更深层推理前先发出简短的用户可见进度说明。
@@ -779,7 +789,7 @@ Copilot API 现在使用子命令结构，主要命令包括：
   - **配置可选值：** `none`、`minimal`、`low`、`medium`、`high`、`xhigh`、`max`。
 - **useMessagesApi：** 当为 `true` 时，声明了 Copilot 原生 `/v1/messages` 端点的模型会使用 Messages API。如果所选模型未声明 Messages 端点或关闭了该配置，网关会在模型声明了 Responses 端点时使用 Responses，否则在模型支持时回退到 Chat Completions。设为 `false` 可跳过原生 Messages 路由。默认值为 `true`。
 - **useResponsesApiWebSocket：** 当为 `true` 时，Copilot Responses 请求会对声明了 `ws:/responses` 的模型使用 WebSocket；仅声明 `/responses` 的模型使用 HTTP。内置 `codex` provider 的流式 Responses 请求只要启用了该配置就会使用 WebSocket，非流式 Codex 请求始终使用 HTTP。设为 `false` 后，Copilot 会在所选模型声明了 `/responses` 时使用 HTTP，Codex 的流式 Responses 请求也会改走 HTTP。WebSocket 失败后不会自动通过 HTTP 重试。默认值为 `true`。如果代理、VPN 或网络会阻断或干扰 WebSocket 流量，请关闭该配置或切换网络。
-- **responsesTransport：** 所有上游 Responses transport 共用的生命周期与缓冲区正整数限制。无效值、零或负数会回退到上面列出的默认值。`headersTimeoutMsV2` 从连接建立开始计算，到收到 HTTP 响应头为止，并不是整个生成过程的总时限。每收到一个 HTTP body chunk 或 WebSocket message 都会重置 `streamInactivityTimeoutMs`，因此持续活跃的长推理任务不会被短总时限中断。`websocketOpenTimeoutMs` 限制 WebSocket 握手时间；`websocketPoolIdleTimeoutMs` 只控制已正常完成且可复用的空闲连接。WebSocket 队列同时受字节数和消息数上限约束；超过任一上限时会终止该 stream 并使 socket 失效，而不会丢弃或重排事件。
+- **upstreamTransport：** 上游 chat completions、responses、messages 三类请求共用的生命周期与缓冲区正整数限制。无效值、零或负数会回退到上面列出的默认值。`headersTimeoutMs` 从连接建立开始计算，到收到 HTTP 响应头为止，并不是整个生成过程的总时限。每收到一个 HTTP body chunk 或 WebSocket message 都会重置 `streamInactivityTimeoutMs`，因此持续活跃的长推理任务不会被短总时限中断。`websocketOpenTimeoutMs` 限制 WebSocket 握手时间；`websocketPoolIdleTimeoutMs` 只控制已正常完成且可复用的空闲连接。WebSocket 队列同时受字节数和消息数上限约束；超过任一上限时会终止该 stream 并使 socket 失效，而不会丢弃或重排事件。
 - **useResponsesApiWebSearch：** 当为 `true` 时，服务端会保留 Responses API 中 `type: "web_search"` 的工具并透传到上游。设为 `false` 则会从 `/responses` payload 中移除这些工具。默认值为 `true`。
 - **alphaSearchCodexPriority：** 默认值为 `true`。顶层 alpha-search 请求优先使用 Codex alpha-search 端点，因为它不会消耗 provider 配额。若 Codex 不可用，或该配置设为 `false`，使用非 `codex/model` 的 `provider/model` 别名的请求会调用目标 provider 的 `/v1/responses` 端点，没有 provider 前缀的请求使用 GitHub Copilot Responses web search。该适配器会识别当前所有 Codex search command；不受支持的 `image_query` 和 `screenshot` 会返回成功且明确要求不要重试的 tool output。
 - **alphaSearchModel：** Messages-backed 的 Responses Lite 模型不能直接执行 Responses web search 时使用的原生 Responses 搜索模型，默认值为 `gpt-5-mini`。可以配置普通 Copilot 模型或 `openai-responses` 类型的 `provider/model`；设为空字符串可禁用，此时这类模型的 alpha-search 请求会返回参数错误。
@@ -794,7 +804,7 @@ Copilot API 现在使用子命令结构，主要命令包括：
 
 ## API 认证
 
-- **受保护的普通路由：** 当配置了 `auth.apiKeys` 且非空时，除 `/`、`/usage-viewer` 和 `/usage-viewer/` 以外的普通路由都需要认证。
+- **受保护的普通路由：** 当配置了 `auth.apiKeys` 且非空时，除 `/`、`/usage-viewer` 和 `/usage-viewer/` 以外的普通路由都需要认证。非回环监听要求启动时存在非空的 `auth.apiKeys`，即使运行期间 Key 被清空也会继续以拒绝请求的方式安全失败。
 - **Admin 路由：** 所有 `/admin/*` 路由都要求 `auth.adminApiKey`。如果缺失，服务会在启动时自动生成并在开始提供服务前写回 `config.json`。
 - **允许的认证头：**
   - `x-api-key: <your_key>`

package/dist/{auth-DvqwYkJr.js → auth-DQZ-A7MU.js}

@@ -1,5 +1,5 @@
-import { M as setConfiguredApiKeys, N as PATHS, P as ensurePaths, a as normalizeProviderBaseUrl, c as setProviderConfig, n as getRawProviderConfig, r as isSupportedProviderType, y as SUPPORTED_PROVIDER_TYPES } from "./config-DVWu2hKk.js";
-import { A as getConfiguredApiKeys, K as state, M as loginCodex, a as setupGitHubToken, n as persistCodexCredentials } from "./token-D0GGk3E8.js";
+import { M as setConfiguredApiKeys, N as PATHS, P as ensurePaths, a as normalizeProviderBaseUrl, c as setProviderConfig, n as getRawProviderConfig, r as isSupportedProviderType, y as SUPPORTED_PROVIDER_TYPES } from "./config-Dj2ZvQuL.js";
+import { J as state, M as getConfiguredApiKeys, P as loginCodex, a as setupGitHubToken, n as persistCodexCredentials } from "./token-CaFzyRJX.js";
 import { defineCommand } from "citty";
 import consola from "consola";
 //#region src/lib/quick-providers.ts
@@ -490,4 +490,4 @@ const auth = defineCommand({
 //#endregion
 export { runProviderSetup as i, runAuthKeys as n, runAuthLogin as r, auth as t };
 
-//# sourceMappingURL=auth-DvqwYkJr.js.map
+//# sourceMappingURL=auth-DQZ-A7MU.js.map

package/dist/{auth-DvqwYkJr.js.map → auth-DQZ-A7MU.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-DvqwYkJr.js","names":[],"sources":["../src/lib/quick-providers.ts","../src/lib/interactive-prompt.ts","../src/auth.ts"],"sourcesContent":["import type { ProviderType } from \"./config\"\n\ninterface QuickProviderConfig {\n  type: ProviderType\n  baseUrl: string\n  pricingCurrency: string\n  editableType: boolean\n}\n\nexport const QUICK_PROVIDER_CONFIGS = {\n  \"opencode-go\": {\n    type: \"openai-compatible\",\n    baseUrl: \"https://opencode.ai/zen/go\",\n    pricingCurrency: \"USD\",\n    editableType: false,\n  },\n  kimi: {\n    type: \"openai-compatible\",\n    baseUrl: \"https://api.kimi.com/coding\",\n    pricingCurrency: \"USD\",\n    editableType: true,\n  },\n  deepseek: {\n    type: \"anthropic\",\n    baseUrl: \"https://api.deepseek.com/anthropic\",\n    pricingCurrency: \"CNY\",\n    editableType: true,\n  },\n  dashscope: {\n    type: \"openai-compatible\",\n    baseUrl: \"https://dashscope.aliyuncs.com/compatible-mode\",\n    pricingCurrency: \"CNY\",\n    editableType: true,\n  },\n  openrouter: {\n    type: \"anthropic\",\n    baseUrl: \"https://openrouter.ai/api\",\n    pricingCurrency: \"USD\",\n    editableType: false,\n  },\n} satisfies Record<string, QuickProviderConfig>\n\nexport type QuickProviderName = keyof typeof QUICK_PROVIDER_CONFIGS\n","import consola from \"consola\"\n\ninterface PromptSelectOption {\n  label: string\n  value: string\n  hint?: string\n}\n\ninterface TextPromptOptions {\n  type?: \"text\"\n  default?: string\n  initial?: string\n  placeholder?: string\n}\n\ninterface SelectPromptOptions {\n  type: \"select\"\n  initial?: string\n  options: Array<string | PromptSelectOption>\n}\n\nexport type InteractivePromptOptions = SelectPromptOptions | TextPromptOptions\n\ninterface ClackSelectOptions {\n  message: string\n  initialValue?: string\n  options: Array<PromptSelectOption>\n}\n\ninterface ClackTextOptions {\n  message: string\n  defaultValue?: string\n  initialValue?: string\n  placeholder?: string\n}\n\nexport interface ClackPromptBackend {\n  isCancel(value: unknown): boolean\n  select(options: ClackSelectOptions): Promise<string | symbol>\n  text(options: ClackTextOptions): Promise<string | symbol>\n}\n\ninterface PromptRuntime {\n  bunVersion?: string\n  platform: NodeJS.Platform\n  stdinIsTTY?: boolean\n  stdoutIsTTY?: boolean\n  stdoutIsTTYStream?: boolean\n}\n\n// Consola 3.4.2 bundles a prompt implementation that writes keyboard input to\n// tty fd 0. Bun treats that as a real stdin write on Windows and throws EPIPE.\nexport function shouldUseClackPrompt(\n  runtime: PromptRuntime = {\n    bunVersion: process.versions.bun,\n    platform: process.platform,\n    stdinIsTTY: process.stdin.isTTY,\n    stdoutIsTTY: process.stdout.isTTY,\n    stdoutIsTTYStream: typeof process.stdout.getColorDepth === \"function\",\n  },\n): boolean {\n  return Boolean(\n    runtime.platform === \"win32\"\n      && runtime.bunVersion\n      && runtime.stdinIsTTY\n      && runtime.stdoutIsTTY\n      && runtime.stdoutIsTTYStream,\n  )\n}\n\nfunction getCancelValue(options: InteractivePromptOptions): string | undefined {\n  return options.type === \"select\" ?\n      options.initial\n    : (options.default ?? options.initial)\n}\n\nexport async function promptWithClack(\n  message: string,\n  options: InteractivePromptOptions,\n  backend: ClackPromptBackend,\n): Promise<string | undefined> {\n  if (options.type === \"select\") {\n    const value = await backend.select({\n      message,\n      options: options.options.map((option) =>\n        typeof option === \"string\" ? { label: option, value: option } : option,\n      ),\n      initialValue: options.initial,\n    })\n    if (backend.isCancel(value)) {\n      return getCancelValue(options)\n    }\n    return typeof value === \"string\" ? value : undefined\n  }\n\n  const value = await backend.text({\n    message,\n    defaultValue: options.default,\n    initialValue: options.initial,\n    placeholder: options.placeholder,\n  })\n  if (backend.isCancel(value)) {\n    return getCancelValue(options)\n  }\n  return typeof value === \"string\" ? value : undefined\n}\n\nexport async function prompt(\n  message: string,\n  options: InteractivePromptOptions,\n): Promise<string | undefined> {\n  if (!shouldUseClackPrompt()) {\n    if (options.type === \"select\") {\n      const value = await consola.prompt(message, options)\n      return typeof value === \"string\" ? value : undefined\n    }\n    return await consola.prompt(message, options)\n  }\n\n  const clack = await import(\"@clack/prompts\")\n  return await promptWithClack(message, options, clack)\n}\n","#!/usr/bin/env node\n\nimport { defineCommand } from \"citty\"\nimport consola from \"consola\"\n\nimport {\n  getRawProviderConfig,\n  isSupportedProviderType,\n  normalizeProviderBaseUrl,\n  setProviderConfig,\n  setConfiguredApiKeys,\n  SUPPORTED_PROVIDER_TYPES,\n  type ProviderAuthType,\n  type ProviderConfig,\n  type ProviderType,\n} from \"./lib/config\"\nimport { loginCodex } from \"./lib/oauth/codex\"\nimport { PATHS, ensurePaths } from \"./lib/paths\"\nimport { getConfiguredApiKeys } from \"./lib/request-auth\"\nimport {\n  QUICK_PROVIDER_CONFIGS,\n  type QuickProviderName,\n} from \"./lib/quick-providers\"\nimport { prompt } from \"./lib/interactive-prompt\"\nimport { state } from \"./lib/state\"\nimport { persistCodexCredentials, setupGitHubToken } from \"./lib/token\"\n\ninterface RunAuthOptions {\n  provider?: string\n  verbose: boolean\n  showToken: boolean\n}\n\nconst authArgs = {\n  provider: {\n    type: \"string\",\n    description:\n      \"Provider to log in with or configure (copilot, codex, opencode-go, kimi, deepseek, dashscope, openrouter, custom)\",\n  },\n  verbose: {\n    alias: \"v\",\n    type: \"boolean\",\n    default: false,\n    description: \"Enable verbose logging\",\n  },\n  \"show-token\": {\n    type: \"boolean\",\n    default: false,\n    description: \"Show provider access token on auth\",\n  },\n} as const\n\nconst BUILTIN_PROVIDER_NAMES = [\"copilot\", \"codex\"] as const\nconst QUICK_PROVIDER_NAMES = Object.keys(\n  QUICK_PROVIDER_CONFIGS,\n) as Array<QuickProviderName>\nconst AUTH_PROVIDER_NAMES = [\n  ...BUILTIN_PROVIDER_NAMES,\n  ...QUICK_PROVIDER_NAMES,\n  \"custom\",\n] as const\nconst CUSTOM_PROVIDER_AUTH_TYPE_OPTION = \"__default__\"\nconst QUICK_PROVIDER_DEFAULT_TYPE_OPTION = \"__default__\"\nconst CUSTOM_PROVIDER_AUTH_TYPES = [\"x-api-key\", \"authorization\"] as const\n\ntype BuiltinProviderName = (typeof BUILTIN_PROVIDER_NAMES)[number]\ntype AuthProviderName = (typeof AUTH_PROVIDER_NAMES)[number]\ntype CustomProviderAuthType = (typeof CUSTOM_PROVIDER_AUTH_TYPES)[number]\n\nconst BUILTIN_PROVIDER_LABELS: Record<BuiltinProviderName, string> = {\n  copilot: \"GitHub Copilot\",\n  codex: \"OpenAI Codex\",\n}\nconst AUTH_PROVIDER_LABELS: Record<AuthProviderName, string> = {\n  ...BUILTIN_PROVIDER_LABELS,\n  \"opencode-go\": \"OpenCode Go\",\n  kimi: \"Kimi\",\n  deepseek: \"DeepSeek\",\n  dashscope: \"DashScope\",\n  openrouter: \"OpenRouter\",\n  custom: \"Custom provider\",\n}\n\nfunction isAuthProviderName(\n  providerName: string,\n): providerName is AuthProviderName {\n  return AUTH_PROVIDER_NAMES.includes(providerName as AuthProviderName)\n}\n\nfunction isCustomProviderAuthType(\n  value: string,\n): value is CustomProviderAuthType {\n  return CUSTOM_PROVIDER_AUTH_TYPES.includes(value as CustomProviderAuthType)\n}\n\nfunction isQuickProviderName(\n  providerName: AuthProviderName,\n): providerName is QuickProviderName {\n  return QUICK_PROVIDER_NAMES.includes(providerName as QuickProviderName)\n}\n\nasync function resolveProviderSelection(\n  providerArg: string | undefined,\n): Promise<AuthProviderName> {\n  const availableProviders = [...AUTH_PROVIDER_NAMES]\n\n  if (providerArg !== undefined) {\n    const providerName = providerArg.trim()\n    if (!isAuthProviderName(providerName)) {\n      throw new Error(\n        `Unknown provider '${providerArg}'. Expected one of: ${availableProviders.join(\", \")}`,\n      )\n    }\n    return providerName\n  }\n\n  if (availableProviders.length === 1) {\n    return availableProviders[0]\n  }\n\n  const provider = await prompt(\"Select a provider to log in with\", {\n    type: \"select\",\n    options: availableProviders.map((providerName) => ({\n      label: `${AUTH_PROVIDER_LABELS[providerName]} (${providerName})`,\n      value: providerName,\n    })),\n  })\n\n  if (!provider || !isAuthProviderName(provider)) {\n    throw new Error(\"No provider selected\")\n  }\n\n  return provider\n}\n\nfunction assertCustomProviderName(providerName: string): void {\n  if (!providerName) {\n    throw new Error(\"Provider name must be a non-empty string\")\n  }\n\n  if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/u.test(providerName)) {\n    throw new Error(\n      \"Provider name must start with a letter or number and contain only letters, numbers, underscores, or hyphens\",\n    )\n  }\n\n  if (providerName === \"copilot\" || providerName === \"codex\") {\n    throw new Error(\n      `Provider name '${providerName}' is reserved for a builtin provider`,\n    )\n  }\n}\n\nasync function promptRequiredText(\n  message: string,\n  fieldName: string,\n): Promise<string> {\n  const value = await prompt(message, { type: \"text\" })\n  const normalizedValue = typeof value === \"string\" ? value.trim() : \"\"\n  if (!normalizedValue) {\n    throw new Error(`${fieldName} must be a non-empty string`)\n  }\n  return normalizedValue\n}\n\nfunction canUseMaskedPrompt(): boolean {\n  return Boolean(\n    process.stdin.isTTY\n      && process.stdout.isTTY\n      && typeof process.stdin.setRawMode === \"function\",\n  )\n}\n\nasync function promptMaskedText(message: string): Promise<string> {\n  if (!canUseMaskedPrompt()) {\n    const value = await prompt(message, { type: \"text\" })\n    return typeof value === \"string\" ? value : \"\"\n  }\n\n  return await new Promise<string>((resolve, reject) => {\n    let value = \"\"\n    const rawModeWasEnabled = process.stdin.isRaw === true\n\n    function cleanup(): void {\n      process.stdin.off(\"data\", onData)\n      process.stdin.setRawMode(rawModeWasEnabled)\n      process.stdin.pause()\n    }\n\n    function finish(): void {\n      cleanup()\n      process.stdout.write(\"\\n\")\n      resolve(value)\n    }\n\n    function cancel(): void {\n      cleanup()\n      process.stdout.write(\"\\n\")\n      reject(new Error(\"Prompt cancelled\"))\n    }\n\n    function onData(chunk: Buffer): void {\n      const input = chunk.toString(\"utf8\")\n\n      if (input.startsWith(\"\\u001B\")) {\n        return\n      }\n\n      for (const char of input) {\n        if (char === \"\\u0003\") {\n          cancel()\n          return\n        }\n\n        if (char === \"\\r\" || char === \"\\n\") {\n          finish()\n          return\n        }\n\n        if (char === \"\\b\" || char === \"\\u007F\") {\n          if (value.length > 0) {\n            value = value.slice(0, -1)\n            process.stdout.write(\"\\b \\b\")\n          }\n          continue\n        }\n\n        if (char >= \" \") {\n          value += char\n          process.stdout.write(\"*\")\n        }\n      }\n    }\n\n    process.stdout.write(`${message}: `)\n    process.stdin.setRawMode(true)\n    process.stdin.resume()\n    process.stdin.on(\"data\", onData)\n  })\n}\n\nasync function promptRequiredSecret(\n  message: string,\n  fieldName: string,\n): Promise<string> {\n  const value = await promptMaskedText(message)\n  const normalizedValue = value.trim()\n  if (!normalizedValue) {\n    throw new Error(`${fieldName} must be a non-empty string`)\n  }\n  return normalizedValue\n}\n\nasync function promptCustomProviderName(): Promise<string> {\n  const providerName = await promptRequiredText(\n    \"Enter provider name\",\n    \"Provider name\",\n  )\n  assertCustomProviderName(providerName)\n  return providerName\n}\n\nasync function promptCustomProviderType(): Promise<ProviderType> {\n  const providerType = await prompt(\"Select provider type\", {\n    type: \"select\",\n    options: SUPPORTED_PROVIDER_TYPES.map((type) => ({\n      label: type,\n      value: type,\n    })),\n  })\n\n  if (\n    typeof providerType !== \"string\"\n    || !isSupportedProviderType(providerType)\n  ) {\n    throw new Error(\"No provider type selected\")\n  }\n\n  return providerType\n}\n\nasync function promptQuickProviderType(\n  defaultType: ProviderType,\n): Promise<ProviderType> {\n  const providerType = await prompt(\n    `Select provider type (default: ${defaultType})`,\n    {\n      type: \"select\",\n      options: [\n        {\n          label: `Default (${defaultType})`,\n          value: QUICK_PROVIDER_DEFAULT_TYPE_OPTION,\n        },\n        ...SUPPORTED_PROVIDER_TYPES.map((type) => ({\n          label: type,\n          value: type,\n        })),\n      ],\n    },\n  )\n\n  if (providerType === QUICK_PROVIDER_DEFAULT_TYPE_OPTION) {\n    return defaultType\n  }\n\n  if (\n    typeof providerType === \"string\"\n    && isSupportedProviderType(providerType)\n  ) {\n    return providerType\n  }\n\n  throw new Error(\"No provider type selected\")\n}\n\nfunction getDefaultProviderAuthType(\n  providerType: ProviderType,\n): ProviderAuthType {\n  return providerType === \"anthropic\" ? \"x-api-key\" : \"authorization\"\n}\n\nasync function promptCustomProviderAuthType(\n  providerType: ProviderType,\n): Promise<ProviderAuthType | undefined> {\n  const defaultAuthType = getDefaultProviderAuthType(providerType)\n  const authType = await prompt(\"Select provider auth type\", {\n    type: \"select\",\n    options: [\n      {\n        label: `Default (${defaultAuthType})`,\n        value: CUSTOM_PROVIDER_AUTH_TYPE_OPTION,\n      },\n      ...CUSTOM_PROVIDER_AUTH_TYPES.map((value) => ({\n        label: value,\n        value,\n      })),\n    ],\n  })\n\n  if (authType === CUSTOM_PROVIDER_AUTH_TYPE_OPTION) {\n    return undefined\n  }\n\n  if (typeof authType === \"string\" && isCustomProviderAuthType(authType)) {\n    return authType\n  }\n\n  throw new Error(\"No provider auth type selected\")\n}\n\nasync function promptQuickProviderBaseUrl(\n  defaultBaseUrl: string,\n): Promise<string> {\n  const value = await prompt(\n    `Enter provider baseUrl (default: ${defaultBaseUrl})`,\n    {\n      type: \"text\",\n      default: defaultBaseUrl,\n      initial: defaultBaseUrl,\n    },\n  )\n  const baseUrl = normalizeProviderBaseUrl(\n    typeof value === \"string\" && value.trim() ? value : defaultBaseUrl,\n  )\n  if (!baseUrl) {\n    throw new Error(\"baseUrl must be a non-empty string\")\n  }\n\n  return baseUrl\n}\n\nfunction buildCustomProviderConfig(\n  existingProviderConfig: ProviderConfig,\n  options: {\n    apiKey: string\n    authType?: ProviderAuthType\n    baseUrl: string\n    pricingCurrency?: string\n    type: ProviderType\n  },\n): ProviderConfig {\n  return {\n    type: options.type,\n    enabled: true,\n    baseUrl: options.baseUrl,\n    apiKey: options.apiKey,\n    ...(options.authType ? { authType: options.authType } : {}),\n    pricingCurrency:\n      options.pricingCurrency ?? existingProviderConfig.pricingCurrency,\n    ...(existingProviderConfig.models ?\n      { models: existingProviderConfig.models }\n    : {}),\n  }\n}\n\nasync function configureCustomProvider(): Promise<void> {\n  const providerName = await promptCustomProviderName()\n  const type = await promptCustomProviderType()\n  const baseUrl = normalizeProviderBaseUrl(\n    await promptRequiredText(\"Enter provider baseUrl\", \"baseUrl\"),\n  )\n  if (!baseUrl) {\n    throw new Error(\"baseUrl must be a non-empty string\")\n  }\n\n  const apiKey = await promptRequiredSecret(\"Enter provider apiKey\", \"apiKey\")\n  const authType = await promptCustomProviderAuthType(type)\n  const existingProviderConfig = getRawProviderConfig(providerName) ?? {}\n\n  setProviderConfig(\n    providerName,\n    buildCustomProviderConfig(existingProviderConfig, {\n      apiKey,\n      authType,\n      baseUrl,\n      type,\n    }),\n  )\n\n  consola.success(\n    `Custom provider '${providerName}' written to ${PATHS.CONFIG_PATH}`,\n  )\n}\n\nasync function configureQuickProvider(\n  providerName: QuickProviderName,\n): Promise<void> {\n  const defaultProviderConfig = QUICK_PROVIDER_CONFIGS[providerName]\n  const apiKey = await promptRequiredSecret(\n    `Enter ${providerName} apiKey`,\n    \"apiKey\",\n  )\n  const type =\n    defaultProviderConfig.editableType ?\n      await promptQuickProviderType(defaultProviderConfig.type)\n    : defaultProviderConfig.type\n  const baseUrl = await promptQuickProviderBaseUrl(\n    defaultProviderConfig.baseUrl,\n  )\n  const existingProviderConfig = getRawProviderConfig(providerName) ?? {}\n\n  setProviderConfig(\n    providerName,\n    buildCustomProviderConfig(existingProviderConfig, {\n      apiKey,\n      baseUrl,\n      pricingCurrency: defaultProviderConfig.pricingCurrency,\n      type,\n    }),\n  )\n\n  consola.success(\n    `${AUTH_PROVIDER_LABELS[providerName]} provider '${providerName}' written to ${PATHS.CONFIG_PATH}`,\n  )\n}\n\nasync function loginWithCodex(): Promise<void> {\n  const credentials = await loginCodex({\n    onAuth(info) {\n      consola.info(\"Open the following URL to authenticate with Codex:\")\n      consola.log(info.url)\n      if (info.instructions) {\n        consola.info(info.instructions)\n      }\n    },\n    onPrompt(message) {\n      return prompt(message, { type: \"text\" }).then((value) => value ?? \"\")\n    },\n    onProgress(message) {\n      consola.debug(message)\n    },\n  })\n\n  await persistCodexCredentials(credentials, { enableProvider: true })\n  consola.success(\n    `Codex provider config written to ${PATHS.CONFIG_PATH} and credentials written to ${PATHS.CODEX_CREDENTIAL_PATH}`,\n  )\n}\n\nasync function loginWithProvider(provider: AuthProviderName): Promise<void> {\n  if (provider === \"copilot\") {\n    await setupGitHubToken({ force: true })\n    consola.success(\"GitHub token written to\", PATHS.GITHUB_TOKEN_PATH)\n    return\n  }\n\n  if (provider === \"codex\") {\n    await loginWithCodex()\n    return\n  }\n\n  if (isQuickProviderName(provider)) {\n    await configureQuickProvider(provider)\n    return\n  }\n\n  await configureCustomProvider()\n}\n\nexport async function runProviderSetup(): Promise<void> {\n  const provider = await resolveProviderSelection(undefined)\n  consola.info(`Logging in with ${AUTH_PROVIDER_LABELS[provider]}`)\n  await loginWithProvider(provider)\n}\n\nexport async function runAuthLogin(options: RunAuthOptions): Promise<void> {\n  const tlsModule = await import(\"./lib/tls\")\n  tlsModule.enableSystemCACompat()\n\n  if (options.verbose) {\n    consola.level = 5\n    consola.info(\"Verbose logging enabled\")\n  }\n\n  state.showToken = options.showToken\n\n  await ensurePaths()\n  const provider = await resolveProviderSelection(options.provider)\n\n  consola.info(`Logging in with ${AUTH_PROVIDER_LABELS[provider]}`)\n  await loginWithProvider(provider)\n}\n\nconst authKeysArgs = {\n  add: {\n    alias: \"a\",\n    type: \"string\",\n    description: \"Add an API key for gateway authentication\",\n  },\n  remove: {\n    alias: \"r\",\n    type: \"string\",\n    description: \"Remove an API key\",\n  },\n  list: {\n    alias: \"l\",\n    type: \"boolean\",\n    default: false,\n    description: \"List configured API keys\",\n  },\n  clear: {\n    type: \"boolean\",\n    default: false,\n    description: \"Remove all configured API keys\",\n  },\n} as const\n\ninterface RunAuthKeysOptions {\n  add?: string\n  remove?: string\n  list?: boolean\n  clear?: boolean\n}\n\nfunction normalizeAuthKeyValue(value: string): string {\n  const normalizedKey = value.trim()\n  if (!normalizedKey) {\n    throw new Error(\"API key must be a non-empty string\")\n  }\n  return normalizedKey\n}\n\nexport async function runAuthKeys(options: RunAuthKeysOptions): Promise<void> {\n  const tlsModule = await import(\"./lib/tls\")\n  tlsModule.enableSystemCACompat()\n\n  await ensurePaths()\n\n  const operations = [\n    ...(options.add !== undefined ? [\"add\"] : []),\n    ...(options.remove !== undefined ? [\"remove\"] : []),\n    ...(options.list ? [\"list\"] : []),\n    ...(options.clear ? [\"clear\"] : []),\n  ]\n  if (operations.length > 1) {\n    throw new Error(\n      \"Use only one of --add, --remove, --list, or --clear per invocation\",\n    )\n  }\n\n  const operation = operations[0] ?? \"list\"\n\n  if (operation === \"add\") {\n    const apiKey = normalizeAuthKeyValue(options.add ?? \"\")\n    const currentKeys = getConfiguredApiKeys()\n    if (currentKeys.includes(apiKey)) {\n      consola.info(\n        `API key already configured. ${currentKeys.length} API key(s) configured.`,\n      )\n      return\n    }\n    const storedKeys = setConfiguredApiKeys([...currentKeys, apiKey])\n    consola.success(\n      `API key added to ${PATHS.CONFIG_PATH}. ${storedKeys.length} API key(s) configured.`,\n    )\n    return\n  }\n\n  if (operation === \"remove\") {\n    const apiKey = normalizeAuthKeyValue(options.remove ?? \"\")\n    const currentKeys = getConfiguredApiKeys()\n    if (!currentKeys.includes(apiKey)) {\n      consola.info(\n        `API key not found. ${currentKeys.length} API key(s) configured.`,\n      )\n      return\n    }\n    const storedKeys = setConfiguredApiKeys(\n      currentKeys.filter((key) => key !== apiKey),\n    )\n    consola.success(\n      `API key removed from ${PATHS.CONFIG_PATH}. ${storedKeys.length} API key(s) configured.`,\n    )\n    return\n  }\n\n  if (operation === \"clear\") {\n    setConfiguredApiKeys([])\n    consola.success(`Removed all API keys from ${PATHS.CONFIG_PATH}.`)\n    return\n  }\n\n  const currentKeys = getConfiguredApiKeys()\n  if (currentKeys.length === 0) {\n    consola.info(\n      \"No API keys configured. Run `npx copilot-api auth keys --add <key>` to add one.\",\n    )\n    return\n  }\n  consola.info(\"Configured API keys:\")\n  for (const key of currentKeys) {\n    consola.info(`- ${key}`)\n  }\n}\n\nconst authLogin = defineCommand({\n  meta: {\n    name: \"login\",\n    description:\n      \"Authenticate or configure a provider without running the server\",\n  },\n  args: authArgs,\n  run({ args }) {\n    return runAuthLogin({\n      provider: args.provider,\n      verbose: args.verbose,\n      showToken: args[\"show-token\"],\n    })\n  },\n})\n\nconst authKeys = defineCommand({\n  meta: {\n    name: \"keys\",\n    description: \"Manage gateway API keys (auth.apiKeys) in the config\",\n  },\n  args: authKeysArgs,\n  run({ args }) {\n    return runAuthKeys({\n      add: args.add,\n      remove: args.remove,\n      list: args.list,\n      clear: args.clear,\n    })\n  },\n})\n\nexport const auth = defineCommand({\n  meta: {\n    name: \"auth\",\n    description: \"Run authentication flows without running the server\",\n  },\n  args: authArgs,\n  subCommands: {\n    login: authLogin,\n    keys: authKeys,\n  },\n  run({ args }) {\n    if ((args._[0] ?? \"\").trim()) {\n      return\n    }\n\n    return runAuthLogin({\n      provider: args.provider,\n      verbose: args.verbose,\n      showToken: args[\"show-token\"],\n    })\n  },\n})\n"],"mappings":";;;;;AASA,MAAa,yBAAyB;CACpC,eAAe;EACb,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,MAAM;EACJ,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,UAAU;EACR,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,WAAW;EACT,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,YAAY;EACV,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACF;;;ACYD,SAAgB,qBACd,UAAyB;CACvB,YAAY,QAAQ,SAAS;CAC7B,UAAU,QAAQ;CAClB,YAAY,QAAQ,MAAM;CAC1B,aAAa,QAAQ,OAAO;CAC5B,mBAAmB,OAAO,QAAQ,OAAO,kBAAkB;CAC5D,EACQ;CACT,OAAO,QACL,QAAQ,aAAa,WAChB,QAAQ,cACR,QAAQ,cACR,QAAQ,eACR,QAAQ,kBACd;;AAGH,SAAS,eAAe,SAAuD;CAC7E,OAAO,QAAQ,SAAS,WACpB,QAAQ,UACP,QAAQ,WAAW,QAAQ;;AAGlC,eAAsB,gBACpB,SACA,SACA,SAC6B;CAC7B,IAAI,QAAQ,SAAS,UAAU;EAC7B,MAAM,QAAQ,MAAM,QAAQ,OAAO;GACjC;GACA,SAAS,QAAQ,QAAQ,KAAK,WAC5B,OAAO,WAAW,WAAW;IAAE,OAAO;IAAQ,OAAO;IAAQ,GAAG,OACjE;GACD,cAAc,QAAQ;GACvB,CAAC;EACF,IAAI,QAAQ,SAAS,MAAM,EACzB,OAAO,eAAe,QAAQ;EAEhC,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;;CAG7C,MAAM,QAAQ,MAAM,QAAQ,KAAK;EAC/B;EACA,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACtB,CAAC;CACF,IAAI,QAAQ,SAAS,MAAM,EACzB,OAAO,eAAe,QAAQ;CAEhC,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;;AAG7C,eAAsB,OACpB,SACA,SAC6B;CAC7B,IAAI,CAAC,sBAAsB,EAAE;EAC3B,IAAI,QAAQ,SAAS,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,OAAO,SAAS,QAAQ;GACpD,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;;EAE7C,OAAO,MAAM,QAAQ,OAAO,SAAS,QAAQ;;CAI/C,OAAO,MAAM,gBAAgB,SAAS,SAAS,MAD3B,OAAO,kBAC0B;;;;ACvFvD,MAAM,WAAW;CACf,UAAU;EACR,MAAM;EACN,aACE;EACH;CACD,SAAS;EACP,OAAO;EACP,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACD,cAAc;EACZ,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACF;AAED,MAAM,yBAAyB,CAAC,WAAW,QAAQ;AACnD,MAAM,uBAAuB,OAAO,KAClC,uBACD;AACD,MAAM,sBAAsB;CAC1B,GAAG;CACH,GAAG;CACH;CACD;AACD,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,6BAA6B,CAAC,aAAa,gBAAgB;AAUjE,MAAM,uBAAyD;CAH7D,SAAS;CACT,OAAO;CAIP,eAAe;CACf,MAAM;CACN,UAAU;CACV,WAAW;CACX,YAAY;CACZ,QAAQ;CACT;AAED,SAAS,mBACP,cACkC;CAClC,OAAO,oBAAoB,SAAS,aAAiC;;AAGvE,SAAS,yBACP,OACiC;CACjC,OAAO,2BAA2B,SAAS,MAAgC;;AAG7E,SAAS,oBACP,cACmC;CACnC,OAAO,qBAAqB,SAAS,aAAkC;;AAGzE,eAAe,yBACb,aAC2B;CAC3B,MAAM,qBAAqB,CAAC,GAAG,oBAAoB;CAEnD,IAAI,gBAAgB,KAAA,GAAW;EAC7B,MAAM,eAAe,YAAY,MAAM;EACvC,IAAI,CAAC,mBAAmB,aAAa,EACnC,MAAM,IAAI,MACR,qBAAqB,YAAY,sBAAsB,mBAAmB,KAAK,KAAK,GACrF;EAEH,OAAO;;CAGT,IAAI,mBAAmB,WAAW,GAChC,OAAO,mBAAmB;CAG5B,MAAM,WAAW,MAAM,OAAO,oCAAoC;EAChE,MAAM;EACN,SAAS,mBAAmB,KAAK,kBAAkB;GACjD,OAAO,GAAG,qBAAqB,cAAc,IAAI,aAAa;GAC9D,OAAO;GACR,EAAE;EACJ,CAAC;CAEF,IAAI,CAAC,YAAY,CAAC,mBAAmB,SAAS,EAC5C,MAAM,IAAI,MAAM,uBAAuB;CAGzC,OAAO;;AAGT,SAAS,yBAAyB,cAA4B;CAC5D,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,CAAC,+BAA+B,KAAK,aAAa,EACpD,MAAM,IAAI,MACR,8GACD;CAGH,IAAI,iBAAiB,aAAa,iBAAiB,SACjD,MAAM,IAAI,MACR,kBAAkB,aAAa,sCAChC;;AAIL,eAAe,mBACb,SACA,WACiB;CACjB,MAAM,QAAQ,MAAM,OAAO,SAAS,EAAE,MAAM,QAAQ,CAAC;CACrD,MAAM,kBAAkB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG;CACnE,IAAI,CAAC,iBACH,MAAM,IAAI,MAAM,GAAG,UAAU,6BAA6B;CAE5D,OAAO;;AAGT,SAAS,qBAA8B;CACrC,OAAO,QACL,QAAQ,MAAM,SACT,QAAQ,OAAO,SACf,OAAO,QAAQ,MAAM,eAAe,WAC1C;;AAGH,eAAe,iBAAiB,SAAkC;CAChE,IAAI,CAAC,oBAAoB,EAAE;EACzB,MAAM,QAAQ,MAAM,OAAO,SAAS,EAAE,MAAM,QAAQ,CAAC;EACrD,OAAO,OAAO,UAAU,WAAW,QAAQ;;CAG7C,OAAO,MAAM,IAAI,SAAiB,SAAS,WAAW;EACpD,IAAI,QAAQ;EACZ,MAAM,oBAAoB,QAAQ,MAAM,UAAU;EAElD,SAAS,UAAgB;GACvB,QAAQ,MAAM,IAAI,QAAQ,OAAO;GACjC,QAAQ,MAAM,WAAW,kBAAkB;GAC3C,QAAQ,MAAM,OAAO;;EAGvB,SAAS,SAAe;GACtB,SAAS;GACT,QAAQ,OAAO,MAAM,KAAK;GAC1B,QAAQ,MAAM;;EAGhB,SAAS,SAAe;GACtB,SAAS;GACT,QAAQ,OAAO,MAAM,KAAK;GAC1B,uBAAO,IAAI,MAAM,mBAAmB,CAAC;;EAGvC,SAAS,OAAO,OAAqB;GACnC,MAAM,QAAQ,MAAM,SAAS,OAAO;GAEpC,IAAI,MAAM,WAAW,OAAS,EAC5B;GAGF,KAAK,MAAM,QAAQ,OAAO;IACxB,IAAI,SAAS,KAAU;KACrB,QAAQ;KACR;;IAGF,IAAI,SAAS,QAAQ,SAAS,MAAM;KAClC,QAAQ;KACR;;IAGF,IAAI,SAAS,QAAQ,SAAS,KAAU;KACtC,IAAI,MAAM,SAAS,GAAG;MACpB,QAAQ,MAAM,MAAM,GAAG,GAAG;MAC1B,QAAQ,OAAO,MAAM,QAAQ;;KAE/B;;IAGF,IAAI,QAAQ,KAAK;KACf,SAAS;KACT,QAAQ,OAAO,MAAM,IAAI;;;;EAK/B,QAAQ,OAAO,MAAM,GAAG,QAAQ,IAAI;EACpC,QAAQ,MAAM,WAAW,KAAK;EAC9B,QAAQ,MAAM,QAAQ;EACtB,QAAQ,MAAM,GAAG,QAAQ,OAAO;GAChC;;AAGJ,eAAe,qBACb,SACA,WACiB;CAEjB,MAAM,mBAAkB,MADJ,iBAAiB,QAAQ,EACf,MAAM;CACpC,IAAI,CAAC,iBACH,MAAM,IAAI,MAAM,GAAG,UAAU,6BAA6B;CAE5D,OAAO;;AAGT,eAAe,2BAA4C;CACzD,MAAM,eAAe,MAAM,mBACzB,uBACA,gBACD;CACD,yBAAyB,aAAa;CACtC,OAAO;;AAGT,eAAe,2BAAkD;CAC/D,MAAM,eAAe,MAAM,OAAO,wBAAwB;EACxD,MAAM;EACN,SAAS,yBAAyB,KAAK,UAAU;GAC/C,OAAO;GACP,OAAO;GACR,EAAE;EACJ,CAAC;CAEF,IACE,OAAO,iBAAiB,YACrB,CAAC,wBAAwB,aAAa,EAEzC,MAAM,IAAI,MAAM,4BAA4B;CAG9C,OAAO;;AAGT,eAAe,wBACb,aACuB;CACvB,MAAM,eAAe,MAAM,OACzB,kCAAkC,YAAY,IAC9C;EACE,MAAM;EACN,SAAS,CACP;GACE,OAAO,YAAY,YAAY;GAC/B,OAAO;GACR,EACD,GAAG,yBAAyB,KAAK,UAAU;GACzC,OAAO;GACP,OAAO;GACR,EAAE,CACJ;EACF,CACF;CAED,IAAI,iBAAiB,oCACnB,OAAO;CAGT,IACE,OAAO,iBAAiB,YACrB,wBAAwB,aAAa,EAExC,OAAO;CAGT,MAAM,IAAI,MAAM,4BAA4B;;AAG9C,SAAS,2BACP,cACkB;CAClB,OAAO,iBAAiB,cAAc,cAAc;;AAGtD,eAAe,6BACb,cACuC;CAEvC,MAAM,WAAW,MAAM,OAAO,6BAA6B;EACzD,MAAM;EACN,SAAS,CACP;GACE,OAAO,YALW,2BAA2B,aAKX,CAAC;GACnC,OAAO;GACR,EACD,GAAG,2BAA2B,KAAK,WAAW;GAC5C,OAAO;GACP;GACD,EAAE,CACJ;EACF,CAAC;CAEF,IAAI,aAAa,kCACf;CAGF,IAAI,OAAO,aAAa,YAAY,yBAAyB,SAAS,EACpE,OAAO;CAGT,MAAM,IAAI,MAAM,iCAAiC;;AAGnD,eAAe,2BACb,gBACiB;CACjB,MAAM,QAAQ,MAAM,OAClB,oCAAoC,eAAe,IACnD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV,CACF;CACD,MAAM,UAAU,yBACd,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,QAAQ,eACrD;CACD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,OAAO;;AAGT,SAAS,0BACP,wBACA,SAOgB;CAChB,OAAO;EACL,MAAM,QAAQ;EACd,SAAS;EACT,SAAS,QAAQ;EACjB,QAAQ,QAAQ;EAChB,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,UAAU,GAAG,EAAE;EAC1D,iBACE,QAAQ,mBAAmB,uBAAuB;EACpD,GAAI,uBAAuB,SACzB,EAAE,QAAQ,uBAAuB,QAAQ,GACzC,EAAE;EACL;;AAGH,eAAe,0BAAyC;CACtD,MAAM,eAAe,MAAM,0BAA0B;CACrD,MAAM,OAAO,MAAM,0BAA0B;CAC7C,MAAM,UAAU,yBACd,MAAM,mBAAmB,0BAA0B,UAAU,CAC9D;CACD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,MAAM,SAAS,MAAM,qBAAqB,yBAAyB,SAAS;CAC5E,MAAM,WAAW,MAAM,6BAA6B,KAAK;CAGzD,kBACE,cACA,0BAJ6B,qBAAqB,aAAa,IAAI,EAAE,EAInB;EAChD;EACA;EACA;EACA;EACD,CAAC,CACH;CAED,QAAQ,QACN,oBAAoB,aAAa,eAAe,MAAM,cACvD;;AAGH,eAAe,uBACb,cACe;CACf,MAAM,wBAAwB,uBAAuB;CACrD,MAAM,SAAS,MAAM,qBACnB,SAAS,aAAa,UACtB,SACD;CACD,MAAM,OACJ,sBAAsB,eACpB,MAAM,wBAAwB,sBAAsB,KAAK,GACzD,sBAAsB;CAC1B,MAAM,UAAU,MAAM,2BACpB,sBAAsB,QACvB;CAGD,kBACE,cACA,0BAJ6B,qBAAqB,aAAa,IAAI,EAAE,EAInB;EAChD;EACA;EACA,iBAAiB,sBAAsB;EACvC;EACD,CAAC,CACH;CAED,QAAQ,QACN,GAAG,qBAAqB,cAAc,aAAa,aAAa,eAAe,MAAM,cACtF;;AAGH,eAAe,iBAAgC;CAiB7C,MAAM,wBAAwB,MAhBJ,WAAW;EACnC,OAAO,MAAM;GACX,QAAQ,KAAK,qDAAqD;GAClE,QAAQ,IAAI,KAAK,IAAI;GACrB,IAAI,KAAK,cACP,QAAQ,KAAK,KAAK,aAAa;;EAGnC,SAAS,SAAS;GAChB,OAAO,OAAO,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAC,MAAM,UAAU,SAAS,GAAG;;EAEvE,WAAW,SAAS;GAClB,QAAQ,MAAM,QAAQ;;EAEzB,CAAC,EAEyC,EAAE,gBAAgB,MAAM,CAAC;CACpE,QAAQ,QACN,oCAAoC,MAAM,YAAY,8BAA8B,MAAM,wBAC3F;;AAGH,eAAe,kBAAkB,UAA2C;CAC1E,IAAI,aAAa,WAAW;EAC1B,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAC;EACvC,QAAQ,QAAQ,2BAA2B,MAAM,kBAAkB;EACnE;;CAGF,IAAI,aAAa,SAAS;EACxB,MAAM,gBAAgB;EACtB;;CAGF,IAAI,oBAAoB,SAAS,EAAE;EACjC,MAAM,uBAAuB,SAAS;EACtC;;CAGF,MAAM,yBAAyB;;AAGjC,eAAsB,mBAAkC;CACtD,MAAM,WAAW,MAAM,yBAAyB,KAAA,EAAU;CAC1D,QAAQ,KAAK,mBAAmB,qBAAqB,YAAY;CACjE,MAAM,kBAAkB,SAAS;;AAGnC,eAAsB,aAAa,SAAwC;CAEzE,CAAA,MADwB,OAAO,sBACrB,sBAAsB;CAEhC,IAAI,QAAQ,SAAS;EACnB,QAAQ,QAAQ;EAChB,QAAQ,KAAK,0BAA0B;;CAGzC,MAAM,YAAY,QAAQ;CAE1B,MAAM,aAAa;CACnB,MAAM,WAAW,MAAM,yBAAyB,QAAQ,SAAS;CAEjE,QAAQ,KAAK,mBAAmB,qBAAqB,YAAY;CACjE,MAAM,kBAAkB,SAAS;;AAGnC,MAAM,eAAe;CACnB,KAAK;EACH,OAAO;EACP,MAAM;EACN,aAAa;EACd;CACD,QAAQ;EACN,OAAO;EACP,MAAM;EACN,aAAa;EACd;CACD,MAAM;EACJ,OAAO;EACP,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACD,OAAO;EACL,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACF;AASD,SAAS,sBAAsB,OAAuB;CACpD,MAAM,gBAAgB,MAAM,MAAM;CAClC,IAAI,CAAC,eACH,MAAM,IAAI,MAAM,qCAAqC;CAEvD,OAAO;;AAGT,eAAsB,YAAY,SAA4C;CAE5E,CAAA,MADwB,OAAO,sBACrB,sBAAsB;CAEhC,MAAM,aAAa;CAEnB,MAAM,aAAa;EACjB,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,MAAM,GAAG,EAAE;EAC5C,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,SAAS,GAAG,EAAE;EAClD,GAAI,QAAQ,OAAO,CAAC,OAAO,GAAG,EAAE;EAChC,GAAI,QAAQ,QAAQ,CAAC,QAAQ,GAAG,EAAE;EACnC;CACD,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MACR,qEACD;CAGH,MAAM,YAAY,WAAW,MAAM;CAEnC,IAAI,cAAc,OAAO;EACvB,MAAM,SAAS,sBAAsB,QAAQ,OAAO,GAAG;EACvD,MAAM,cAAc,sBAAsB;EAC1C,IAAI,YAAY,SAAS,OAAO,EAAE;GAChC,QAAQ,KACN,+BAA+B,YAAY,OAAO,yBACnD;GACD;;EAEF,MAAM,aAAa,qBAAqB,CAAC,GAAG,aAAa,OAAO,CAAC;EACjE,QAAQ,QACN,oBAAoB,MAAM,YAAY,IAAI,WAAW,OAAO,yBAC7D;EACD;;CAGF,IAAI,cAAc,UAAU;EAC1B,MAAM,SAAS,sBAAsB,QAAQ,UAAU,GAAG;EAC1D,MAAM,cAAc,sBAAsB;EAC1C,IAAI,CAAC,YAAY,SAAS,OAAO,EAAE;GACjC,QAAQ,KACN,sBAAsB,YAAY,OAAO,yBAC1C;GACD;;EAEF,MAAM,aAAa,qBACjB,YAAY,QAAQ,QAAQ,QAAQ,OAAO,CAC5C;EACD,QAAQ,QACN,wBAAwB,MAAM,YAAY,IAAI,WAAW,OAAO,yBACjE;EACD;;CAGF,IAAI,cAAc,SAAS;EACzB,qBAAqB,EAAE,CAAC;EACxB,QAAQ,QAAQ,6BAA6B,MAAM,YAAY,GAAG;EAClE;;CAGF,MAAM,cAAc,sBAAsB;CAC1C,IAAI,YAAY,WAAW,GAAG;EAC5B,QAAQ,KACN,kFACD;EACD;;CAEF,QAAQ,KAAK,uBAAuB;CACpC,KAAK,MAAM,OAAO,aAChB,QAAQ,KAAK,KAAK,MAAM;;AAoC5B,MAAa,OAAO,cAAc;CAChC,MAAM;EACJ,MAAM;EACN,aAAa;EACd;CACD,MAAM;CACN,aAAa;EACX,OAvCc,cAAc;GAC9B,MAAM;IACJ,MAAM;IACN,aACE;IACH;GACD,MAAM;GACN,IAAI,EAAE,QAAQ;IACZ,OAAO,aAAa;KAClB,UAAU,KAAK;KACf,SAAS,KAAK;KACd,WAAW,KAAK;KACjB,CAAC;;GAEL,CAyBU;EACP,MAxBa,cAAc;GAC7B,MAAM;IACJ,MAAM;IACN,aAAa;IACd;GACD,MAAM;GACN,IAAI,EAAE,QAAQ;IACZ,OAAO,YAAY;KACjB,KAAK,KAAK;KACV,QAAQ,KAAK;KACb,MAAM,KAAK;KACX,OAAO,KAAK;KACb,CAAC;;GAEL,CAUS;EACP;CACD,IAAI,EAAE,QAAQ;EACZ,KAAK,KAAK,EAAE,MAAM,IAAI,MAAM,EAC1B;EAGF,OAAO,aAAa;GAClB,UAAU,KAAK;GACf,SAAS,KAAK;GACd,WAAW,KAAK;GACjB,CAAC;;CAEL,CAAC"}
+{"version":3,"file":"auth-DQZ-A7MU.js","names":[],"sources":["../src/lib/quick-providers.ts","../src/lib/interactive-prompt.ts","../src/auth.ts"],"sourcesContent":["import type { ProviderType } from \"./config\"\n\ninterface QuickProviderConfig {\n  type: ProviderType\n  baseUrl: string\n  pricingCurrency: string\n  editableType: boolean\n}\n\nexport const QUICK_PROVIDER_CONFIGS = {\n  \"opencode-go\": {\n    type: \"openai-compatible\",\n    baseUrl: \"https://opencode.ai/zen/go\",\n    pricingCurrency: \"USD\",\n    editableType: false,\n  },\n  kimi: {\n    type: \"openai-compatible\",\n    baseUrl: \"https://api.kimi.com/coding\",\n    pricingCurrency: \"USD\",\n    editableType: true,\n  },\n  deepseek: {\n    type: \"anthropic\",\n    baseUrl: \"https://api.deepseek.com/anthropic\",\n    pricingCurrency: \"CNY\",\n    editableType: true,\n  },\n  dashscope: {\n    type: \"openai-compatible\",\n    baseUrl: \"https://dashscope.aliyuncs.com/compatible-mode\",\n    pricingCurrency: \"CNY\",\n    editableType: true,\n  },\n  openrouter: {\n    type: \"anthropic\",\n    baseUrl: \"https://openrouter.ai/api\",\n    pricingCurrency: \"USD\",\n    editableType: false,\n  },\n} satisfies Record<string, QuickProviderConfig>\n\nexport type QuickProviderName = keyof typeof QUICK_PROVIDER_CONFIGS\n","import consola from \"consola\"\n\ninterface PromptSelectOption {\n  label: string\n  value: string\n  hint?: string\n}\n\ninterface TextPromptOptions {\n  type?: \"text\"\n  default?: string\n  initial?: string\n  placeholder?: string\n}\n\ninterface SelectPromptOptions {\n  type: \"select\"\n  initial?: string\n  options: Array<string | PromptSelectOption>\n}\n\nexport type InteractivePromptOptions = SelectPromptOptions | TextPromptOptions\n\ninterface ClackSelectOptions {\n  message: string\n  initialValue?: string\n  options: Array<PromptSelectOption>\n}\n\ninterface ClackTextOptions {\n  message: string\n  defaultValue?: string\n  initialValue?: string\n  placeholder?: string\n}\n\nexport interface ClackPromptBackend {\n  isCancel(value: unknown): boolean\n  select(options: ClackSelectOptions): Promise<string | symbol>\n  text(options: ClackTextOptions): Promise<string | symbol>\n}\n\ninterface PromptRuntime {\n  bunVersion?: string\n  platform: NodeJS.Platform\n  stdinIsTTY?: boolean\n  stdoutIsTTY?: boolean\n  stdoutIsTTYStream?: boolean\n}\n\n// Consola 3.4.2 bundles a prompt implementation that writes keyboard input to\n// tty fd 0. Bun treats that as a real stdin write on Windows and throws EPIPE.\nexport function shouldUseClackPrompt(\n  runtime: PromptRuntime = {\n    bunVersion: process.versions.bun,\n    platform: process.platform,\n    stdinIsTTY: process.stdin.isTTY,\n    stdoutIsTTY: process.stdout.isTTY,\n    stdoutIsTTYStream: typeof process.stdout.getColorDepth === \"function\",\n  },\n): boolean {\n  return Boolean(\n    runtime.platform === \"win32\"\n      && runtime.bunVersion\n      && runtime.stdinIsTTY\n      && runtime.stdoutIsTTY\n      && runtime.stdoutIsTTYStream,\n  )\n}\n\nfunction getCancelValue(options: InteractivePromptOptions): string | undefined {\n  return options.type === \"select\" ?\n      options.initial\n    : (options.default ?? options.initial)\n}\n\nexport async function promptWithClack(\n  message: string,\n  options: InteractivePromptOptions,\n  backend: ClackPromptBackend,\n): Promise<string | undefined> {\n  if (options.type === \"select\") {\n    const value = await backend.select({\n      message,\n      options: options.options.map((option) =>\n        typeof option === \"string\" ? { label: option, value: option } : option,\n      ),\n      initialValue: options.initial,\n    })\n    if (backend.isCancel(value)) {\n      return getCancelValue(options)\n    }\n    return typeof value === \"string\" ? value : undefined\n  }\n\n  const value = await backend.text({\n    message,\n    defaultValue: options.default,\n    initialValue: options.initial,\n    placeholder: options.placeholder,\n  })\n  if (backend.isCancel(value)) {\n    return getCancelValue(options)\n  }\n  return typeof value === \"string\" ? value : undefined\n}\n\nexport async function prompt(\n  message: string,\n  options: InteractivePromptOptions,\n): Promise<string | undefined> {\n  if (!shouldUseClackPrompt()) {\n    if (options.type === \"select\") {\n      const value = await consola.prompt(message, options)\n      return typeof value === \"string\" ? value : undefined\n    }\n    return await consola.prompt(message, options)\n  }\n\n  const clack = await import(\"@clack/prompts\")\n  return await promptWithClack(message, options, clack)\n}\n","#!/usr/bin/env node\n\nimport { defineCommand } from \"citty\"\nimport consola from \"consola\"\n\nimport {\n  getRawProviderConfig,\n  isSupportedProviderType,\n  normalizeProviderBaseUrl,\n  setProviderConfig,\n  setConfiguredApiKeys,\n  SUPPORTED_PROVIDER_TYPES,\n  type ProviderAuthType,\n  type ProviderConfig,\n  type ProviderType,\n} from \"./lib/config\"\nimport { loginCodex } from \"./lib/oauth/codex\"\nimport { PATHS, ensurePaths } from \"./lib/paths\"\nimport { getConfiguredApiKeys } from \"./lib/request-auth\"\nimport {\n  QUICK_PROVIDER_CONFIGS,\n  type QuickProviderName,\n} from \"./lib/quick-providers\"\nimport { prompt } from \"./lib/interactive-prompt\"\nimport { state } from \"./lib/state\"\nimport { persistCodexCredentials, setupGitHubToken } from \"./lib/token\"\n\ninterface RunAuthOptions {\n  provider?: string\n  verbose: boolean\n  showToken: boolean\n}\n\nconst authArgs = {\n  provider: {\n    type: \"string\",\n    description:\n      \"Provider to log in with or configure (copilot, codex, opencode-go, kimi, deepseek, dashscope, openrouter, custom)\",\n  },\n  verbose: {\n    alias: \"v\",\n    type: \"boolean\",\n    default: false,\n    description: \"Enable verbose logging\",\n  },\n  \"show-token\": {\n    type: \"boolean\",\n    default: false,\n    description: \"Show provider access token on auth\",\n  },\n} as const\n\nconst BUILTIN_PROVIDER_NAMES = [\"copilot\", \"codex\"] as const\nconst QUICK_PROVIDER_NAMES = Object.keys(\n  QUICK_PROVIDER_CONFIGS,\n) as Array<QuickProviderName>\nconst AUTH_PROVIDER_NAMES = [\n  ...BUILTIN_PROVIDER_NAMES,\n  ...QUICK_PROVIDER_NAMES,\n  \"custom\",\n] as const\nconst CUSTOM_PROVIDER_AUTH_TYPE_OPTION = \"__default__\"\nconst QUICK_PROVIDER_DEFAULT_TYPE_OPTION = \"__default__\"\nconst CUSTOM_PROVIDER_AUTH_TYPES = [\"x-api-key\", \"authorization\"] as const\n\ntype BuiltinProviderName = (typeof BUILTIN_PROVIDER_NAMES)[number]\ntype AuthProviderName = (typeof AUTH_PROVIDER_NAMES)[number]\ntype CustomProviderAuthType = (typeof CUSTOM_PROVIDER_AUTH_TYPES)[number]\n\nconst BUILTIN_PROVIDER_LABELS: Record<BuiltinProviderName, string> = {\n  copilot: \"GitHub Copilot\",\n  codex: \"OpenAI Codex\",\n}\nconst AUTH_PROVIDER_LABELS: Record<AuthProviderName, string> = {\n  ...BUILTIN_PROVIDER_LABELS,\n  \"opencode-go\": \"OpenCode Go\",\n  kimi: \"Kimi\",\n  deepseek: \"DeepSeek\",\n  dashscope: \"DashScope\",\n  openrouter: \"OpenRouter\",\n  custom: \"Custom provider\",\n}\n\nfunction isAuthProviderName(\n  providerName: string,\n): providerName is AuthProviderName {\n  return AUTH_PROVIDER_NAMES.includes(providerName as AuthProviderName)\n}\n\nfunction isCustomProviderAuthType(\n  value: string,\n): value is CustomProviderAuthType {\n  return CUSTOM_PROVIDER_AUTH_TYPES.includes(value as CustomProviderAuthType)\n}\n\nfunction isQuickProviderName(\n  providerName: AuthProviderName,\n): providerName is QuickProviderName {\n  return QUICK_PROVIDER_NAMES.includes(providerName as QuickProviderName)\n}\n\nasync function resolveProviderSelection(\n  providerArg: string | undefined,\n): Promise<AuthProviderName> {\n  const availableProviders = [...AUTH_PROVIDER_NAMES]\n\n  if (providerArg !== undefined) {\n    const providerName = providerArg.trim()\n    if (!isAuthProviderName(providerName)) {\n      throw new Error(\n        `Unknown provider '${providerArg}'. Expected one of: ${availableProviders.join(\", \")}`,\n      )\n    }\n    return providerName\n  }\n\n  if (availableProviders.length === 1) {\n    return availableProviders[0]\n  }\n\n  const provider = await prompt(\"Select a provider to log in with\", {\n    type: \"select\",\n    options: availableProviders.map((providerName) => ({\n      label: `${AUTH_PROVIDER_LABELS[providerName]} (${providerName})`,\n      value: providerName,\n    })),\n  })\n\n  if (!provider || !isAuthProviderName(provider)) {\n    throw new Error(\"No provider selected\")\n  }\n\n  return provider\n}\n\nfunction assertCustomProviderName(providerName: string): void {\n  if (!providerName) {\n    throw new Error(\"Provider name must be a non-empty string\")\n  }\n\n  if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/u.test(providerName)) {\n    throw new Error(\n      \"Provider name must start with a letter or number and contain only letters, numbers, underscores, or hyphens\",\n    )\n  }\n\n  if (providerName === \"copilot\" || providerName === \"codex\") {\n    throw new Error(\n      `Provider name '${providerName}' is reserved for a builtin provider`,\n    )\n  }\n}\n\nasync function promptRequiredText(\n  message: string,\n  fieldName: string,\n): Promise<string> {\n  const value = await prompt(message, { type: \"text\" })\n  const normalizedValue = typeof value === \"string\" ? value.trim() : \"\"\n  if (!normalizedValue) {\n    throw new Error(`${fieldName} must be a non-empty string`)\n  }\n  return normalizedValue\n}\n\nfunction canUseMaskedPrompt(): boolean {\n  return Boolean(\n    process.stdin.isTTY\n      && process.stdout.isTTY\n      && typeof process.stdin.setRawMode === \"function\",\n  )\n}\n\nasync function promptMaskedText(message: string): Promise<string> {\n  if (!canUseMaskedPrompt()) {\n    const value = await prompt(message, { type: \"text\" })\n    return typeof value === \"string\" ? value : \"\"\n  }\n\n  return await new Promise<string>((resolve, reject) => {\n    let value = \"\"\n    const rawModeWasEnabled = process.stdin.isRaw === true\n\n    function cleanup(): void {\n      process.stdin.off(\"data\", onData)\n      process.stdin.setRawMode(rawModeWasEnabled)\n      process.stdin.pause()\n    }\n\n    function finish(): void {\n      cleanup()\n      process.stdout.write(\"\\n\")\n      resolve(value)\n    }\n\n    function cancel(): void {\n      cleanup()\n      process.stdout.write(\"\\n\")\n      reject(new Error(\"Prompt cancelled\"))\n    }\n\n    function onData(chunk: Buffer): void {\n      const input = chunk.toString(\"utf8\")\n\n      if (input.startsWith(\"\\u001B\")) {\n        return\n      }\n\n      for (const char of input) {\n        if (char === \"\\u0003\") {\n          cancel()\n          return\n        }\n\n        if (char === \"\\r\" || char === \"\\n\") {\n          finish()\n          return\n        }\n\n        if (char === \"\\b\" || char === \"\\u007F\") {\n          if (value.length > 0) {\n            value = value.slice(0, -1)\n            process.stdout.write(\"\\b \\b\")\n          }\n          continue\n        }\n\n        if (char >= \" \") {\n          value += char\n          process.stdout.write(\"*\")\n        }\n      }\n    }\n\n    process.stdout.write(`${message}: `)\n    process.stdin.setRawMode(true)\n    process.stdin.resume()\n    process.stdin.on(\"data\", onData)\n  })\n}\n\nasync function promptRequiredSecret(\n  message: string,\n  fieldName: string,\n): Promise<string> {\n  const value = await promptMaskedText(message)\n  const normalizedValue = value.trim()\n  if (!normalizedValue) {\n    throw new Error(`${fieldName} must be a non-empty string`)\n  }\n  return normalizedValue\n}\n\nasync function promptCustomProviderName(): Promise<string> {\n  const providerName = await promptRequiredText(\n    \"Enter provider name\",\n    \"Provider name\",\n  )\n  assertCustomProviderName(providerName)\n  return providerName\n}\n\nasync function promptCustomProviderType(): Promise<ProviderType> {\n  const providerType = await prompt(\"Select provider type\", {\n    type: \"select\",\n    options: SUPPORTED_PROVIDER_TYPES.map((type) => ({\n      label: type,\n      value: type,\n    })),\n  })\n\n  if (\n    typeof providerType !== \"string\"\n    || !isSupportedProviderType(providerType)\n  ) {\n    throw new Error(\"No provider type selected\")\n  }\n\n  return providerType\n}\n\nasync function promptQuickProviderType(\n  defaultType: ProviderType,\n): Promise<ProviderType> {\n  const providerType = await prompt(\n    `Select provider type (default: ${defaultType})`,\n    {\n      type: \"select\",\n      options: [\n        {\n          label: `Default (${defaultType})`,\n          value: QUICK_PROVIDER_DEFAULT_TYPE_OPTION,\n        },\n        ...SUPPORTED_PROVIDER_TYPES.map((type) => ({\n          label: type,\n          value: type,\n        })),\n      ],\n    },\n  )\n\n  if (providerType === QUICK_PROVIDER_DEFAULT_TYPE_OPTION) {\n    return defaultType\n  }\n\n  if (\n    typeof providerType === \"string\"\n    && isSupportedProviderType(providerType)\n  ) {\n    return providerType\n  }\n\n  throw new Error(\"No provider type selected\")\n}\n\nfunction getDefaultProviderAuthType(\n  providerType: ProviderType,\n): ProviderAuthType {\n  return providerType === \"anthropic\" ? \"x-api-key\" : \"authorization\"\n}\n\nasync function promptCustomProviderAuthType(\n  providerType: ProviderType,\n): Promise<ProviderAuthType | undefined> {\n  const defaultAuthType = getDefaultProviderAuthType(providerType)\n  const authType = await prompt(\"Select provider auth type\", {\n    type: \"select\",\n    options: [\n      {\n        label: `Default (${defaultAuthType})`,\n        value: CUSTOM_PROVIDER_AUTH_TYPE_OPTION,\n      },\n      ...CUSTOM_PROVIDER_AUTH_TYPES.map((value) => ({\n        label: value,\n        value,\n      })),\n    ],\n  })\n\n  if (authType === CUSTOM_PROVIDER_AUTH_TYPE_OPTION) {\n    return undefined\n  }\n\n  if (typeof authType === \"string\" && isCustomProviderAuthType(authType)) {\n    return authType\n  }\n\n  throw new Error(\"No provider auth type selected\")\n}\n\nasync function promptQuickProviderBaseUrl(\n  defaultBaseUrl: string,\n): Promise<string> {\n  const value = await prompt(\n    `Enter provider baseUrl (default: ${defaultBaseUrl})`,\n    {\n      type: \"text\",\n      default: defaultBaseUrl,\n      initial: defaultBaseUrl,\n    },\n  )\n  const baseUrl = normalizeProviderBaseUrl(\n    typeof value === \"string\" && value.trim() ? value : defaultBaseUrl,\n  )\n  if (!baseUrl) {\n    throw new Error(\"baseUrl must be a non-empty string\")\n  }\n\n  return baseUrl\n}\n\nfunction buildCustomProviderConfig(\n  existingProviderConfig: ProviderConfig,\n  options: {\n    apiKey: string\n    authType?: ProviderAuthType\n    baseUrl: string\n    pricingCurrency?: string\n    type: ProviderType\n  },\n): ProviderConfig {\n  return {\n    type: options.type,\n    enabled: true,\n    baseUrl: options.baseUrl,\n    apiKey: options.apiKey,\n    ...(options.authType ? { authType: options.authType } : {}),\n    pricingCurrency:\n      options.pricingCurrency ?? existingProviderConfig.pricingCurrency,\n    ...(existingProviderConfig.models ?\n      { models: existingProviderConfig.models }\n    : {}),\n  }\n}\n\nasync function configureCustomProvider(): Promise<void> {\n  const providerName = await promptCustomProviderName()\n  const type = await promptCustomProviderType()\n  const baseUrl = normalizeProviderBaseUrl(\n    await promptRequiredText(\"Enter provider baseUrl\", \"baseUrl\"),\n  )\n  if (!baseUrl) {\n    throw new Error(\"baseUrl must be a non-empty string\")\n  }\n\n  const apiKey = await promptRequiredSecret(\"Enter provider apiKey\", \"apiKey\")\n  const authType = await promptCustomProviderAuthType(type)\n  const existingProviderConfig = getRawProviderConfig(providerName) ?? {}\n\n  setProviderConfig(\n    providerName,\n    buildCustomProviderConfig(existingProviderConfig, {\n      apiKey,\n      authType,\n      baseUrl,\n      type,\n    }),\n  )\n\n  consola.success(\n    `Custom provider '${providerName}' written to ${PATHS.CONFIG_PATH}`,\n  )\n}\n\nasync function configureQuickProvider(\n  providerName: QuickProviderName,\n): Promise<void> {\n  const defaultProviderConfig = QUICK_PROVIDER_CONFIGS[providerName]\n  const apiKey = await promptRequiredSecret(\n    `Enter ${providerName} apiKey`,\n    \"apiKey\",\n  )\n  const type =\n    defaultProviderConfig.editableType ?\n      await promptQuickProviderType(defaultProviderConfig.type)\n    : defaultProviderConfig.type\n  const baseUrl = await promptQuickProviderBaseUrl(\n    defaultProviderConfig.baseUrl,\n  )\n  const existingProviderConfig = getRawProviderConfig(providerName) ?? {}\n\n  setProviderConfig(\n    providerName,\n    buildCustomProviderConfig(existingProviderConfig, {\n      apiKey,\n      baseUrl,\n      pricingCurrency: defaultProviderConfig.pricingCurrency,\n      type,\n    }),\n  )\n\n  consola.success(\n    `${AUTH_PROVIDER_LABELS[providerName]} provider '${providerName}' written to ${PATHS.CONFIG_PATH}`,\n  )\n}\n\nasync function loginWithCodex(): Promise<void> {\n  const credentials = await loginCodex({\n    onAuth(info) {\n      consola.info(\"Open the following URL to authenticate with Codex:\")\n      consola.log(info.url)\n      if (info.instructions) {\n        consola.info(info.instructions)\n      }\n    },\n    onPrompt(message) {\n      return prompt(message, { type: \"text\" }).then((value) => value ?? \"\")\n    },\n    onProgress(message) {\n      consola.debug(message)\n    },\n  })\n\n  await persistCodexCredentials(credentials, { enableProvider: true })\n  consola.success(\n    `Codex provider config written to ${PATHS.CONFIG_PATH} and credentials written to ${PATHS.CODEX_CREDENTIAL_PATH}`,\n  )\n}\n\nasync function loginWithProvider(provider: AuthProviderName): Promise<void> {\n  if (provider === \"copilot\") {\n    await setupGitHubToken({ force: true })\n    consola.success(\"GitHub token written to\", PATHS.GITHUB_TOKEN_PATH)\n    return\n  }\n\n  if (provider === \"codex\") {\n    await loginWithCodex()\n    return\n  }\n\n  if (isQuickProviderName(provider)) {\n    await configureQuickProvider(provider)\n    return\n  }\n\n  await configureCustomProvider()\n}\n\nexport async function runProviderSetup(): Promise<void> {\n  const provider = await resolveProviderSelection(undefined)\n  consola.info(`Logging in with ${AUTH_PROVIDER_LABELS[provider]}`)\n  await loginWithProvider(provider)\n}\n\nexport async function runAuthLogin(options: RunAuthOptions): Promise<void> {\n  const tlsModule = await import(\"./lib/tls\")\n  tlsModule.enableSystemCACompat()\n\n  if (options.verbose) {\n    consola.level = 5\n    consola.info(\"Verbose logging enabled\")\n  }\n\n  state.showToken = options.showToken\n\n  await ensurePaths()\n  const provider = await resolveProviderSelection(options.provider)\n\n  consola.info(`Logging in with ${AUTH_PROVIDER_LABELS[provider]}`)\n  await loginWithProvider(provider)\n}\n\nconst authKeysArgs = {\n  add: {\n    alias: \"a\",\n    type: \"string\",\n    description: \"Add an API key for gateway authentication\",\n  },\n  remove: {\n    alias: \"r\",\n    type: \"string\",\n    description: \"Remove an API key\",\n  },\n  list: {\n    alias: \"l\",\n    type: \"boolean\",\n    default: false,\n    description: \"List configured API keys\",\n  },\n  clear: {\n    type: \"boolean\",\n    default: false,\n    description: \"Remove all configured API keys\",\n  },\n} as const\n\ninterface RunAuthKeysOptions {\n  add?: string\n  remove?: string\n  list?: boolean\n  clear?: boolean\n}\n\nfunction normalizeAuthKeyValue(value: string): string {\n  const normalizedKey = value.trim()\n  if (!normalizedKey) {\n    throw new Error(\"API key must be a non-empty string\")\n  }\n  return normalizedKey\n}\n\nexport async function runAuthKeys(options: RunAuthKeysOptions): Promise<void> {\n  const tlsModule = await import(\"./lib/tls\")\n  tlsModule.enableSystemCACompat()\n\n  await ensurePaths()\n\n  const operations = [\n    ...(options.add !== undefined ? [\"add\"] : []),\n    ...(options.remove !== undefined ? [\"remove\"] : []),\n    ...(options.list ? [\"list\"] : []),\n    ...(options.clear ? [\"clear\"] : []),\n  ]\n  if (operations.length > 1) {\n    throw new Error(\n      \"Use only one of --add, --remove, --list, or --clear per invocation\",\n    )\n  }\n\n  const operation = operations[0] ?? \"list\"\n\n  if (operation === \"add\") {\n    const apiKey = normalizeAuthKeyValue(options.add ?? \"\")\n    const currentKeys = getConfiguredApiKeys()\n    if (currentKeys.includes(apiKey)) {\n      consola.info(\n        `API key already configured. ${currentKeys.length} API key(s) configured.`,\n      )\n      return\n    }\n    const storedKeys = setConfiguredApiKeys([...currentKeys, apiKey])\n    consola.success(\n      `API key added to ${PATHS.CONFIG_PATH}. ${storedKeys.length} API key(s) configured.`,\n    )\n    return\n  }\n\n  if (operation === \"remove\") {\n    const apiKey = normalizeAuthKeyValue(options.remove ?? \"\")\n    const currentKeys = getConfiguredApiKeys()\n    if (!currentKeys.includes(apiKey)) {\n      consola.info(\n        `API key not found. ${currentKeys.length} API key(s) configured.`,\n      )\n      return\n    }\n    const storedKeys = setConfiguredApiKeys(\n      currentKeys.filter((key) => key !== apiKey),\n    )\n    consola.success(\n      `API key removed from ${PATHS.CONFIG_PATH}. ${storedKeys.length} API key(s) configured.`,\n    )\n    return\n  }\n\n  if (operation === \"clear\") {\n    setConfiguredApiKeys([])\n    consola.success(`Removed all API keys from ${PATHS.CONFIG_PATH}.`)\n    return\n  }\n\n  const currentKeys = getConfiguredApiKeys()\n  if (currentKeys.length === 0) {\n    consola.info(\n      \"No API keys configured. Run `npx copilot-api auth keys --add <key>` to add one.\",\n    )\n    return\n  }\n  consola.info(\"Configured API keys:\")\n  for (const key of currentKeys) {\n    consola.info(`- ${key}`)\n  }\n}\n\nconst authLogin = defineCommand({\n  meta: {\n    name: \"login\",\n    description:\n      \"Authenticate or configure a provider without running the server\",\n  },\n  args: authArgs,\n  run({ args }) {\n    return runAuthLogin({\n      provider: args.provider,\n      verbose: args.verbose,\n      showToken: args[\"show-token\"],\n    })\n  },\n})\n\nconst authKeys = defineCommand({\n  meta: {\n    name: \"keys\",\n    description: \"Manage gateway API keys (auth.apiKeys) in the config\",\n  },\n  args: authKeysArgs,\n  run({ args }) {\n    return runAuthKeys({\n      add: args.add,\n      remove: args.remove,\n      list: args.list,\n      clear: args.clear,\n    })\n  },\n})\n\nexport const auth = defineCommand({\n  meta: {\n    name: \"auth\",\n    description: \"Run authentication flows without running the server\",\n  },\n  args: authArgs,\n  subCommands: {\n    login: authLogin,\n    keys: authKeys,\n  },\n  run({ args }) {\n    if ((args._[0] ?? \"\").trim()) {\n      return\n    }\n\n    return runAuthLogin({\n      provider: args.provider,\n      verbose: args.verbose,\n      showToken: args[\"show-token\"],\n    })\n  },\n})\n"],"mappings":";;;;;AASA,MAAa,yBAAyB;CACpC,eAAe;EACb,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,MAAM;EACJ,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,UAAU;EACR,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,WAAW;EACT,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACD,YAAY;EACV,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,cAAc;EACf;CACF;;;ACYD,SAAgB,qBACd,UAAyB;CACvB,YAAY,QAAQ,SAAS;CAC7B,UAAU,QAAQ;CAClB,YAAY,QAAQ,MAAM;CAC1B,aAAa,QAAQ,OAAO;CAC5B,mBAAmB,OAAO,QAAQ,OAAO,kBAAkB;CAC5D,EACQ;CACT,OAAO,QACL,QAAQ,aAAa,WAChB,QAAQ,cACR,QAAQ,cACR,QAAQ,eACR,QAAQ,kBACd;;AAGH,SAAS,eAAe,SAAuD;CAC7E,OAAO,QAAQ,SAAS,WACpB,QAAQ,UACP,QAAQ,WAAW,QAAQ;;AAGlC,eAAsB,gBACpB,SACA,SACA,SAC6B;CAC7B,IAAI,QAAQ,SAAS,UAAU;EAC7B,MAAM,QAAQ,MAAM,QAAQ,OAAO;GACjC;GACA,SAAS,QAAQ,QAAQ,KAAK,WAC5B,OAAO,WAAW,WAAW;IAAE,OAAO;IAAQ,OAAO;IAAQ,GAAG,OACjE;GACD,cAAc,QAAQ;GACvB,CAAC;EACF,IAAI,QAAQ,SAAS,MAAM,EACzB,OAAO,eAAe,QAAQ;EAEhC,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;;CAG7C,MAAM,QAAQ,MAAM,QAAQ,KAAK;EAC/B;EACA,cAAc,QAAQ;EACtB,cAAc,QAAQ;EACtB,aAAa,QAAQ;EACtB,CAAC;CACF,IAAI,QAAQ,SAAS,MAAM,EACzB,OAAO,eAAe,QAAQ;CAEhC,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;;AAG7C,eAAsB,OACpB,SACA,SAC6B;CAC7B,IAAI,CAAC,sBAAsB,EAAE;EAC3B,IAAI,QAAQ,SAAS,UAAU;GAC7B,MAAM,QAAQ,MAAM,QAAQ,OAAO,SAAS,QAAQ;GACpD,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;;EAE7C,OAAO,MAAM,QAAQ,OAAO,SAAS,QAAQ;;CAI/C,OAAO,MAAM,gBAAgB,SAAS,SAAS,MAD3B,OAAO,kBAC0B;;;;ACvFvD,MAAM,WAAW;CACf,UAAU;EACR,MAAM;EACN,aACE;EACH;CACD,SAAS;EACP,OAAO;EACP,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACD,cAAc;EACZ,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACF;AAED,MAAM,yBAAyB,CAAC,WAAW,QAAQ;AACnD,MAAM,uBAAuB,OAAO,KAClC,uBACD;AACD,MAAM,sBAAsB;CAC1B,GAAG;CACH,GAAG;CACH;CACD;AACD,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,6BAA6B,CAAC,aAAa,gBAAgB;AAUjE,MAAM,uBAAyD;CAH7D,SAAS;CACT,OAAO;CAIP,eAAe;CACf,MAAM;CACN,UAAU;CACV,WAAW;CACX,YAAY;CACZ,QAAQ;CACT;AAED,SAAS,mBACP,cACkC;CAClC,OAAO,oBAAoB,SAAS,aAAiC;;AAGvE,SAAS,yBACP,OACiC;CACjC,OAAO,2BAA2B,SAAS,MAAgC;;AAG7E,SAAS,oBACP,cACmC;CACnC,OAAO,qBAAqB,SAAS,aAAkC;;AAGzE,eAAe,yBACb,aAC2B;CAC3B,MAAM,qBAAqB,CAAC,GAAG,oBAAoB;CAEnD,IAAI,gBAAgB,KAAA,GAAW;EAC7B,MAAM,eAAe,YAAY,MAAM;EACvC,IAAI,CAAC,mBAAmB,aAAa,EACnC,MAAM,IAAI,MACR,qBAAqB,YAAY,sBAAsB,mBAAmB,KAAK,KAAK,GACrF;EAEH,OAAO;;CAGT,IAAI,mBAAmB,WAAW,GAChC,OAAO,mBAAmB;CAG5B,MAAM,WAAW,MAAM,OAAO,oCAAoC;EAChE,MAAM;EACN,SAAS,mBAAmB,KAAK,kBAAkB;GACjD,OAAO,GAAG,qBAAqB,cAAc,IAAI,aAAa;GAC9D,OAAO;GACR,EAAE;EACJ,CAAC;CAEF,IAAI,CAAC,YAAY,CAAC,mBAAmB,SAAS,EAC5C,MAAM,IAAI,MAAM,uBAAuB;CAGzC,OAAO;;AAGT,SAAS,yBAAyB,cAA4B;CAC5D,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,CAAC,+BAA+B,KAAK,aAAa,EACpD,MAAM,IAAI,MACR,8GACD;CAGH,IAAI,iBAAiB,aAAa,iBAAiB,SACjD,MAAM,IAAI,MACR,kBAAkB,aAAa,sCAChC;;AAIL,eAAe,mBACb,SACA,WACiB;CACjB,MAAM,QAAQ,MAAM,OAAO,SAAS,EAAE,MAAM,QAAQ,CAAC;CACrD,MAAM,kBAAkB,OAAO,UAAU,WAAW,MAAM,MAAM,GAAG;CACnE,IAAI,CAAC,iBACH,MAAM,IAAI,MAAM,GAAG,UAAU,6BAA6B;CAE5D,OAAO;;AAGT,SAAS,qBAA8B;CACrC,OAAO,QACL,QAAQ,MAAM,SACT,QAAQ,OAAO,SACf,OAAO,QAAQ,MAAM,eAAe,WAC1C;;AAGH,eAAe,iBAAiB,SAAkC;CAChE,IAAI,CAAC,oBAAoB,EAAE;EACzB,MAAM,QAAQ,MAAM,OAAO,SAAS,EAAE,MAAM,QAAQ,CAAC;EACrD,OAAO,OAAO,UAAU,WAAW,QAAQ;;CAG7C,OAAO,MAAM,IAAI,SAAiB,SAAS,WAAW;EACpD,IAAI,QAAQ;EACZ,MAAM,oBAAoB,QAAQ,MAAM,UAAU;EAElD,SAAS,UAAgB;GACvB,QAAQ,MAAM,IAAI,QAAQ,OAAO;GACjC,QAAQ,MAAM,WAAW,kBAAkB;GAC3C,QAAQ,MAAM,OAAO;;EAGvB,SAAS,SAAe;GACtB,SAAS;GACT,QAAQ,OAAO,MAAM,KAAK;GAC1B,QAAQ,MAAM;;EAGhB,SAAS,SAAe;GACtB,SAAS;GACT,QAAQ,OAAO,MAAM,KAAK;GAC1B,uBAAO,IAAI,MAAM,mBAAmB,CAAC;;EAGvC,SAAS,OAAO,OAAqB;GACnC,MAAM,QAAQ,MAAM,SAAS,OAAO;GAEpC,IAAI,MAAM,WAAW,OAAS,EAC5B;GAGF,KAAK,MAAM,QAAQ,OAAO;IACxB,IAAI,SAAS,KAAU;KACrB,QAAQ;KACR;;IAGF,IAAI,SAAS,QAAQ,SAAS,MAAM;KAClC,QAAQ;KACR;;IAGF,IAAI,SAAS,QAAQ,SAAS,KAAU;KACtC,IAAI,MAAM,SAAS,GAAG;MACpB,QAAQ,MAAM,MAAM,GAAG,GAAG;MAC1B,QAAQ,OAAO,MAAM,QAAQ;;KAE/B;;IAGF,IAAI,QAAQ,KAAK;KACf,SAAS;KACT,QAAQ,OAAO,MAAM,IAAI;;;;EAK/B,QAAQ,OAAO,MAAM,GAAG,QAAQ,IAAI;EACpC,QAAQ,MAAM,WAAW,KAAK;EAC9B,QAAQ,MAAM,QAAQ;EACtB,QAAQ,MAAM,GAAG,QAAQ,OAAO;GAChC;;AAGJ,eAAe,qBACb,SACA,WACiB;CAEjB,MAAM,mBAAkB,MADJ,iBAAiB,QAAQ,EACf,MAAM;CACpC,IAAI,CAAC,iBACH,MAAM,IAAI,MAAM,GAAG,UAAU,6BAA6B;CAE5D,OAAO;;AAGT,eAAe,2BAA4C;CACzD,MAAM,eAAe,MAAM,mBACzB,uBACA,gBACD;CACD,yBAAyB,aAAa;CACtC,OAAO;;AAGT,eAAe,2BAAkD;CAC/D,MAAM,eAAe,MAAM,OAAO,wBAAwB;EACxD,MAAM;EACN,SAAS,yBAAyB,KAAK,UAAU;GAC/C,OAAO;GACP,OAAO;GACR,EAAE;EACJ,CAAC;CAEF,IACE,OAAO,iBAAiB,YACrB,CAAC,wBAAwB,aAAa,EAEzC,MAAM,IAAI,MAAM,4BAA4B;CAG9C,OAAO;;AAGT,eAAe,wBACb,aACuB;CACvB,MAAM,eAAe,MAAM,OACzB,kCAAkC,YAAY,IAC9C;EACE,MAAM;EACN,SAAS,CACP;GACE,OAAO,YAAY,YAAY;GAC/B,OAAO;GACR,EACD,GAAG,yBAAyB,KAAK,UAAU;GACzC,OAAO;GACP,OAAO;GACR,EAAE,CACJ;EACF,CACF;CAED,IAAI,iBAAiB,oCACnB,OAAO;CAGT,IACE,OAAO,iBAAiB,YACrB,wBAAwB,aAAa,EAExC,OAAO;CAGT,MAAM,IAAI,MAAM,4BAA4B;;AAG9C,SAAS,2BACP,cACkB;CAClB,OAAO,iBAAiB,cAAc,cAAc;;AAGtD,eAAe,6BACb,cACuC;CAEvC,MAAM,WAAW,MAAM,OAAO,6BAA6B;EACzD,MAAM;EACN,SAAS,CACP;GACE,OAAO,YALW,2BAA2B,aAKX,CAAC;GACnC,OAAO;GACR,EACD,GAAG,2BAA2B,KAAK,WAAW;GAC5C,OAAO;GACP;GACD,EAAE,CACJ;EACF,CAAC;CAEF,IAAI,aAAa,kCACf;CAGF,IAAI,OAAO,aAAa,YAAY,yBAAyB,SAAS,EACpE,OAAO;CAGT,MAAM,IAAI,MAAM,iCAAiC;;AAGnD,eAAe,2BACb,gBACiB;CACjB,MAAM,QAAQ,MAAM,OAClB,oCAAoC,eAAe,IACnD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV,CACF;CACD,MAAM,UAAU,yBACd,OAAO,UAAU,YAAY,MAAM,MAAM,GAAG,QAAQ,eACrD;CACD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,OAAO;;AAGT,SAAS,0BACP,wBACA,SAOgB;CAChB,OAAO;EACL,MAAM,QAAQ;EACd,SAAS;EACT,SAAS,QAAQ;EACjB,QAAQ,QAAQ;EAChB,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,UAAU,GAAG,EAAE;EAC1D,iBACE,QAAQ,mBAAmB,uBAAuB;EACpD,GAAI,uBAAuB,SACzB,EAAE,QAAQ,uBAAuB,QAAQ,GACzC,EAAE;EACL;;AAGH,eAAe,0BAAyC;CACtD,MAAM,eAAe,MAAM,0BAA0B;CACrD,MAAM,OAAO,MAAM,0BAA0B;CAC7C,MAAM,UAAU,yBACd,MAAM,mBAAmB,0BAA0B,UAAU,CAC9D;CACD,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,qCAAqC;CAGvD,MAAM,SAAS,MAAM,qBAAqB,yBAAyB,SAAS;CAC5E,MAAM,WAAW,MAAM,6BAA6B,KAAK;CAGzD,kBACE,cACA,0BAJ6B,qBAAqB,aAAa,IAAI,EAAE,EAInB;EAChD;EACA;EACA;EACA;EACD,CAAC,CACH;CAED,QAAQ,QACN,oBAAoB,aAAa,eAAe,MAAM,cACvD;;AAGH,eAAe,uBACb,cACe;CACf,MAAM,wBAAwB,uBAAuB;CACrD,MAAM,SAAS,MAAM,qBACnB,SAAS,aAAa,UACtB,SACD;CACD,MAAM,OACJ,sBAAsB,eACpB,MAAM,wBAAwB,sBAAsB,KAAK,GACzD,sBAAsB;CAC1B,MAAM,UAAU,MAAM,2BACpB,sBAAsB,QACvB;CAGD,kBACE,cACA,0BAJ6B,qBAAqB,aAAa,IAAI,EAAE,EAInB;EAChD;EACA;EACA,iBAAiB,sBAAsB;EACvC;EACD,CAAC,CACH;CAED,QAAQ,QACN,GAAG,qBAAqB,cAAc,aAAa,aAAa,eAAe,MAAM,cACtF;;AAGH,eAAe,iBAAgC;CAiB7C,MAAM,wBAAwB,MAhBJ,WAAW;EACnC,OAAO,MAAM;GACX,QAAQ,KAAK,qDAAqD;GAClE,QAAQ,IAAI,KAAK,IAAI;GACrB,IAAI,KAAK,cACP,QAAQ,KAAK,KAAK,aAAa;;EAGnC,SAAS,SAAS;GAChB,OAAO,OAAO,SAAS,EAAE,MAAM,QAAQ,CAAC,CAAC,MAAM,UAAU,SAAS,GAAG;;EAEvE,WAAW,SAAS;GAClB,QAAQ,MAAM,QAAQ;;EAEzB,CAAC,EAEyC,EAAE,gBAAgB,MAAM,CAAC;CACpE,QAAQ,QACN,oCAAoC,MAAM,YAAY,8BAA8B,MAAM,wBAC3F;;AAGH,eAAe,kBAAkB,UAA2C;CAC1E,IAAI,aAAa,WAAW;EAC1B,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAC;EACvC,QAAQ,QAAQ,2BAA2B,MAAM,kBAAkB;EACnE;;CAGF,IAAI,aAAa,SAAS;EACxB,MAAM,gBAAgB;EACtB;;CAGF,IAAI,oBAAoB,SAAS,EAAE;EACjC,MAAM,uBAAuB,SAAS;EACtC;;CAGF,MAAM,yBAAyB;;AAGjC,eAAsB,mBAAkC;CACtD,MAAM,WAAW,MAAM,yBAAyB,KAAA,EAAU;CAC1D,QAAQ,KAAK,mBAAmB,qBAAqB,YAAY;CACjE,MAAM,kBAAkB,SAAS;;AAGnC,eAAsB,aAAa,SAAwC;CAEzE,CAAA,MADwB,OAAO,sBACrB,sBAAsB;CAEhC,IAAI,QAAQ,SAAS;EACnB,QAAQ,QAAQ;EAChB,QAAQ,KAAK,0BAA0B;;CAGzC,MAAM,YAAY,QAAQ;CAE1B,MAAM,aAAa;CACnB,MAAM,WAAW,MAAM,yBAAyB,QAAQ,SAAS;CAEjE,QAAQ,KAAK,mBAAmB,qBAAqB,YAAY;CACjE,MAAM,kBAAkB,SAAS;;AAGnC,MAAM,eAAe;CACnB,KAAK;EACH,OAAO;EACP,MAAM;EACN,aAAa;EACd;CACD,QAAQ;EACN,OAAO;EACP,MAAM;EACN,aAAa;EACd;CACD,MAAM;EACJ,OAAO;EACP,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACD,OAAO;EACL,MAAM;EACN,SAAS;EACT,aAAa;EACd;CACF;AASD,SAAS,sBAAsB,OAAuB;CACpD,MAAM,gBAAgB,MAAM,MAAM;CAClC,IAAI,CAAC,eACH,MAAM,IAAI,MAAM,qCAAqC;CAEvD,OAAO;;AAGT,eAAsB,YAAY,SAA4C;CAE5E,CAAA,MADwB,OAAO,sBACrB,sBAAsB;CAEhC,MAAM,aAAa;CAEnB,MAAM,aAAa;EACjB,GAAI,QAAQ,QAAQ,KAAA,IAAY,CAAC,MAAM,GAAG,EAAE;EAC5C,GAAI,QAAQ,WAAW,KAAA,IAAY,CAAC,SAAS,GAAG,EAAE;EAClD,GAAI,QAAQ,OAAO,CAAC,OAAO,GAAG,EAAE;EAChC,GAAI,QAAQ,QAAQ,CAAC,QAAQ,GAAG,EAAE;EACnC;CACD,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,MACR,qEACD;CAGH,MAAM,YAAY,WAAW,MAAM;CAEnC,IAAI,cAAc,OAAO;EACvB,MAAM,SAAS,sBAAsB,QAAQ,OAAO,GAAG;EACvD,MAAM,cAAc,sBAAsB;EAC1C,IAAI,YAAY,SAAS,OAAO,EAAE;GAChC,QAAQ,KACN,+BAA+B,YAAY,OAAO,yBACnD;GACD;;EAEF,MAAM,aAAa,qBAAqB,CAAC,GAAG,aAAa,OAAO,CAAC;EACjE,QAAQ,QACN,oBAAoB,MAAM,YAAY,IAAI,WAAW,OAAO,yBAC7D;EACD;;CAGF,IAAI,cAAc,UAAU;EAC1B,MAAM,SAAS,sBAAsB,QAAQ,UAAU,GAAG;EAC1D,MAAM,cAAc,sBAAsB;EAC1C,IAAI,CAAC,YAAY,SAAS,OAAO,EAAE;GACjC,QAAQ,KACN,sBAAsB,YAAY,OAAO,yBAC1C;GACD;;EAEF,MAAM,aAAa,qBACjB,YAAY,QAAQ,QAAQ,QAAQ,OAAO,CAC5C;EACD,QAAQ,QACN,wBAAwB,MAAM,YAAY,IAAI,WAAW,OAAO,yBACjE;EACD;;CAGF,IAAI,cAAc,SAAS;EACzB,qBAAqB,EAAE,CAAC;EACxB,QAAQ,QAAQ,6BAA6B,MAAM,YAAY,GAAG;EAClE;;CAGF,MAAM,cAAc,sBAAsB;CAC1C,IAAI,YAAY,WAAW,GAAG;EAC5B,QAAQ,KACN,kFACD;EACD;;CAEF,QAAQ,KAAK,uBAAuB;CACpC,KAAK,MAAM,OAAO,aAChB,QAAQ,KAAK,KAAK,MAAM;;AAoC5B,MAAa,OAAO,cAAc;CAChC,MAAM;EACJ,MAAM;EACN,aAAa;EACd;CACD,MAAM;CACN,aAAa;EACX,OAvCc,cAAc;GAC9B,MAAM;IACJ,MAAM;IACN,aACE;IACH;GACD,MAAM;GACN,IAAI,EAAE,QAAQ;IACZ,OAAO,aAAa;KAClB,UAAU,KAAK;KACf,SAAS,KAAK;KACd,WAAW,KAAK;KACjB,CAAC;;GAEL,CAyBU;EACP,MAxBa,cAAc;GAC7B,MAAM;IACJ,MAAM;IACN,aAAa;IACd;GACD,MAAM;GACN,IAAI,EAAE,QAAQ;IACZ,OAAO,YAAY;KACjB,KAAK,KAAK;KACV,QAAQ,KAAK;KACb,MAAM,KAAK;KACX,OAAO,KAAK;KACb,CAAC;;GAEL,CAUS;EACP;CACD,IAAI,EAAE,QAAQ;EACZ,KAAK,KAAK,EAAE,MAAM,IAAI,MAAM,EAC1B;EAGF,OAAO,aAAa;GAClB,UAAU,KAAK;GACf,SAAS,KAAK;GACd,WAAW,KAAK;GACjB,CAAC;;CAEL,CAAC"}

package/dist/auth-GHhmC1D5.js

@@ -0,0 +1,2 @@
+import { t as auth } from "./auth-DQZ-A7MU.js";
+export { auth };

package/dist/{config-DVWu2hKk.js → config-Dj2ZvQuL.js}

@@ -73,8 +73,8 @@ async function ensureFile(filePath) {
 }
 //#endregion
 //#region src/lib/config-store.ts
-const defaultResponsesTransportConfig = {
-	headersTimeoutMsV2: 300 * 1e3,
+const defaultUpstreamTransportConfig = {
+	headersTimeoutMs: 300 * 1e3,
 	streamInactivityTimeoutMs: 300 * 1e3,
 	websocketMaxBufferedBytes: 8 * 1024 * 1024,
 	websocketMaxBufferedMessages: 1024,
@@ -111,7 +111,7 @@ const defaultConfig = {
 	modelReasoningEfforts: { "gpt-5-mini": "low" },
 	useMessagesApi: true,
 	useResponsesApiWebSocket: true,
-	responsesTransport: defaultResponsesTransportConfig,
+	upstreamTransport: defaultUpstreamTransportConfig,
 	useResponsesApiWebSearch: true,
 	alphaSearchCodexPriority: true,
 	alphaSearchModel: "gpt-5-mini",
@@ -199,7 +199,8 @@ function mergeDefaultConfig(config) {
 	const modelReasoningEfforts = config.modelReasoningEfforts ?? {};
 	const defaultModelReasoningEfforts = defaultConfig.modelReasoningEfforts ?? {};
 	const contextManagement = normalizeContextManagementConfig(config.contextManagement);
-	const responsesTransport = normalizeResponsesTransportConfig(config.responsesTransport);
+	const { changed: upstreamTransportMigrated, migrated: migratedUpstreamTransport } = migrateUpstreamTransportConfig(config);
+	const upstreamTransport = normalizeUpstreamTransportConfig(migratedUpstreamTransport);
 	const defaultContextManagementConfig = defaultConfig.contextManagement ?? {};
 	const missingExtraPromptModels = Object.keys(defaultExtraPrompts).filter((model) => !Object.hasOwn(extraPrompts, model));
 	const missingReasoningEffortModels = Object.keys(defaultModelReasoningEfforts).filter((model) => !Object.hasOwn(modelReasoningEfforts, model));
@@ -209,14 +210,15 @@ function mergeDefaultConfig(config) {
 	const hasReasoningEffortChanges = missingReasoningEffortModels.length > 0;
 	const hasResponsesApiCompactThresholdChanges = missingResponsesApiCompactThresholdModels.length > 0;
 	const hasContextManagementChanges = missingContextManagementKeys.length > 0;
-	const hasResponsesTransportChanges = Object.entries(responsesTransport).some(([key, value]) => config.responsesTransport?.[key] !== value);
-	if (!hasExtraPromptChanges && !hasReasoningEffortChanges && !hasResponsesApiCompactThresholdChanges && !hasContextManagementChanges && !hasResponsesTransportChanges) return {
+	const hasUpstreamTransportChanges = Object.entries(upstreamTransport).some(([key, value]) => migratedUpstreamTransport[key] !== value);
+	if (!hasExtraPromptChanges && !hasReasoningEffortChanges && !hasResponsesApiCompactThresholdChanges && !hasContextManagementChanges && !hasUpstreamTransportChanges && !upstreamTransportMigrated) return {
 		mergedConfig: config,
 		changed: false
 	};
+	const { responsesTransport: _legacyResponsesTransport, ...persistedConfig } = config;
 	return {
 		mergedConfig: {
-			...config,
+			...persistedConfig,
 			contextManagement: {
 				...defaultContextManagementConfig,
 				...contextManagement
@@ -233,7 +235,7 @@ function mergeDefaultConfig(config) {
 				...defaultModelReasoningEfforts,
 				...modelReasoningEfforts
 			},
-			responsesTransport
+			upstreamTransport
 		},
 		changed: true
 	};
@@ -245,6 +247,24 @@ function normalizeContextManagementConfig(value) {
 		...typeof value.responses === "boolean" ? { responses: value.responses } : {}
 	};
 }
+const migrateUpstreamTransportConfig = (config) => {
+	const legacyBlock = config.responsesTransport;
+	const { headersTimeoutMsV2, ...migrated } = config.upstreamTransport ?? legacyBlock ?? {};
+	const hasLegacyBlock = legacyBlock !== void 0;
+	const hasLegacyHeadersTimeout = headersTimeoutMsV2 !== void 0;
+	if (!hasLegacyBlock && !hasLegacyHeadersTimeout) return {
+		changed: false,
+		migrated
+	};
+	consola.info("Migrating deprecated transport config: responsesTransport -> upstreamTransport, headersTimeoutMsV2 -> headersTimeoutMs");
+	return {
+		changed: true,
+		migrated: migrated.headersTimeoutMs === void 0 && hasLegacyHeadersTimeout ? {
+			...migrated,
+			headersTimeoutMs: headersTimeoutMsV2
+		} : migrated
+	};
+};
 function ensureAdminApiKey(config) {
 	const normalizedAdminApiKey = normalizeAdminApiKey(config.auth?.adminApiKey);
 	if (normalizedAdminApiKey) {
@@ -301,20 +321,16 @@ function isMessagesApiEnabled() {
 function isResponsesApiWebSocketEnabled() {
 	return getConfig().useResponsesApiWebSocket ?? true;
 }
-function getResponsesTransportConfig() {
-	const { headersTimeoutMsV2, ...config } = normalizeResponsesTransportConfig(getConfig().responsesTransport);
-	return {
-		headersTimeoutMs: headersTimeoutMsV2,
-		...config
-	};
+function getUpstreamTransportConfig() {
+	return normalizeUpstreamTransportConfig(getConfig().upstreamTransport);
 }
-const normalizeResponsesTransportConfig = (configured) => ({
-	headersTimeoutMsV2: positiveIntegerOrDefault(configured?.headersTimeoutMsV2, defaultResponsesTransportConfig.headersTimeoutMsV2),
-	streamInactivityTimeoutMs: positiveIntegerOrDefault(configured?.streamInactivityTimeoutMs, defaultResponsesTransportConfig.streamInactivityTimeoutMs),
-	websocketMaxBufferedBytes: positiveIntegerOrDefault(configured?.websocketMaxBufferedBytes, defaultResponsesTransportConfig.websocketMaxBufferedBytes),
-	websocketMaxBufferedMessages: positiveIntegerOrDefault(configured?.websocketMaxBufferedMessages, defaultResponsesTransportConfig.websocketMaxBufferedMessages),
-	websocketOpenTimeoutMs: positiveIntegerOrDefault(configured?.websocketOpenTimeoutMs, defaultResponsesTransportConfig.websocketOpenTimeoutMs),
-	websocketPoolIdleTimeoutMs: positiveIntegerOrDefault(configured?.websocketPoolIdleTimeoutMs, defaultResponsesTransportConfig.websocketPoolIdleTimeoutMs)
+const normalizeUpstreamTransportConfig = (configured) => ({
+	headersTimeoutMs: positiveIntegerOrDefault(configured?.headersTimeoutMs, defaultUpstreamTransportConfig.headersTimeoutMs),
+	streamInactivityTimeoutMs: positiveIntegerOrDefault(configured?.streamInactivityTimeoutMs, defaultUpstreamTransportConfig.streamInactivityTimeoutMs),
+	websocketMaxBufferedBytes: positiveIntegerOrDefault(configured?.websocketMaxBufferedBytes, defaultUpstreamTransportConfig.websocketMaxBufferedBytes),
+	websocketMaxBufferedMessages: positiveIntegerOrDefault(configured?.websocketMaxBufferedMessages, defaultUpstreamTransportConfig.websocketMaxBufferedMessages),
+	websocketOpenTimeoutMs: positiveIntegerOrDefault(configured?.websocketOpenTimeoutMs, defaultUpstreamTransportConfig.websocketOpenTimeoutMs),
+	websocketPoolIdleTimeoutMs: positiveIntegerOrDefault(configured?.websocketPoolIdleTimeoutMs, defaultUpstreamTransportConfig.websocketPoolIdleTimeoutMs)
 });
 const positiveIntegerOrDefault = (value, fallback) => {
 	if (typeof value !== "number" || !Number.isFinite(value)) return fallback;
@@ -537,6 +553,6 @@ function isReservedProviderName(name) {
 	return name.trim() === "copilot";
 }
 //#endregion
-export { isResponsesApiWebSocketEnabled as A, getClaudeTokenMultiplier as C, isAlphaSearchCodexPriorityEnabled as D, getResponsesTransportConfig as E, setConfiguredApiKeys as M, PATHS as N, isMessagesApiEnabled as O, ensurePaths as P, getClaudeAutoModel as S, getMessageApiWebSearchModel as T, resolveMappedModel as _, normalizeProviderBaseUrl as a, getAlphaSearchModel as b, setProviderConfig as c, getModelResponsesApiCompactThreshold as d, getReasoningEffortForModel as f, isGpt56OrAbove as g, isContextManagementEnabledForResponses as h, listEnabledProviders as i, mergeConfigWithDefaults as j, isResponsesApiWebSearchEnabled as k, getExtraPromptForModel as l, isContextManagementEnabledForMessages as m, getRawProviderConfig as n, resolveEffectiveProviderType as o, getSmallModel as p, isSupportedProviderType as r, resolveProviderAuthType as s, getProviderConfig as t, getModelMappings as u, setModelMappings as v, getConfig as w, getAnthropicApiKey as x, SUPPORTED_PROVIDER_TYPES as y };
+export { isResponsesApiWebSocketEnabled as A, getClaudeTokenMultiplier as C, isAlphaSearchCodexPriorityEnabled as D, getUpstreamTransportConfig as E, writeFileAtomically as F, setConfiguredApiKeys as M, PATHS as N, isMessagesApiEnabled as O, ensurePaths as P, getClaudeAutoModel as S, getMessageApiWebSearchModel as T, resolveMappedModel as _, normalizeProviderBaseUrl as a, getAlphaSearchModel as b, setProviderConfig as c, getModelResponsesApiCompactThreshold as d, getReasoningEffortForModel as f, isGpt56OrAbove as g, isContextManagementEnabledForResponses as h, listEnabledProviders as i, mergeConfigWithDefaults as j, isResponsesApiWebSearchEnabled as k, getExtraPromptForModel as l, isContextManagementEnabledForMessages as m, getRawProviderConfig as n, resolveEffectiveProviderType as o, getSmallModel as p, isSupportedProviderType as r, resolveProviderAuthType as s, getProviderConfig as t, getModelMappings as u, setModelMappings as v, getConfig as w, getAnthropicApiKey as x, SUPPORTED_PROVIDER_TYPES as y };
 
-//# sourceMappingURL=config-DVWu2hKk.js.map
+//# sourceMappingURL=config-Dj2ZvQuL.js.map