@kimchi-dev/kimchictl 0.0.2

package/dist/auth/auth-file.js

@@ -0,0 +1,100 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { lock } from "proper-lockfile";
+import { isKimchiProvider } from "./provider-ids.js";
+/**
+ * Shared auth.json access — a port of the kimchi harness's `syncPiAuth`
+ * (kimchi-dev:src/pi-auth.ts). The file format is the harness's pi auth
+ * storage:
+ *
+ *   { "<providerId>": { "type": "api_key", "key": "…" }, … }
+ *
+ * written pretty-printed (2-space indent, trailing newline), mode 0600, under
+ * a proper-lockfile lock. kimchictl must stay byte-compatible: the harness
+ * reads the entries this writes, and vice versa.
+ *
+ * Difference vs the harness port: the harness derives provider ids from
+ * models.json and throws when it is missing; kimchictl takes the ids as a
+ * parameter (the login command derives them from models.json when present and
+ * from the models metadata API otherwise) so it can run on machines that
+ * have never installed the harness.
+ */
+/** Read the raw auth.json map. Returns {} when the file is absent or blank. */
+export function readAuthJson(authPath) {
+    if (!existsSync(authPath))
+        return {};
+    return JSON.parse(readFileSync(authPath, "utf-8") || "{}");
+}
+/** Read the saved Kimchi API key, if the shared auth.json has one. */
+export function readSavedApiKey(authPath) {
+    const entry = readAuthJson(authPath)["kimchi-dev"];
+    if (entry && typeof entry === "object" && "key" in entry && typeof entry.key === "string" && entry.key.length > 0) {
+        return entry.key;
+    }
+    return undefined;
+}
+/**
+ * Replace all Kimchi-managed entries in auth.json: delete every existing
+ * kimchi provider credential (`kimchi-dev`, `kimchi-dev/*`,
+ * `kimchi-experimental`), then, when apiKey is non-empty, write
+ * `{ type: "api_key", key }` for each id in providerIds (deduped,
+ * "kimchi-dev" always included). Empty apiKey = pure clear.
+ *
+ * Non-Kimchi providers are preserved untouched. Mirrors the harness: no-op
+ * content only re-chmods to 0600 instead of rewriting.
+ */
+export async function syncSharedAuth(authPath, apiKey, providerIds) {
+    mkdirSync(dirname(authPath), { recursive: true, mode: 0o700 });
+    const release = await lock(authPath, { realpath: false, retries: 10 });
+    try {
+        const authExists = existsSync(authPath);
+        if (!apiKey && !authExists)
+            return;
+        const credentials = authExists ? readAuthJson(authPath) : {};
+        const nextCredentials = { ...credentials };
+        for (const providerId of Object.keys(nextCredentials)) {
+            if (isKimchiProvider(providerId)) {
+                delete nextCredentials[providerId];
+            }
+        }
+        if (apiKey) {
+            const ids = new Set([...providerIds.filter(isKimchiProvider), "kimchi-dev"]);
+            for (const providerId of ids) {
+                nextCredentials[providerId] = { type: "api_key", key: apiKey };
+            }
+        }
+        if (authExists && isDeepStrictEqual(credentials, nextCredentials)) {
+            chmodSync(authPath, 0o600);
+            return;
+        }
+        writeFileSync(authPath, `${JSON.stringify(nextCredentials, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+        chmodSync(authPath, 0o600);
+    }
+    finally {
+        await release();
+    }
+}
+/** Remove all Kimchi credentials from auth.json (logout path). No-op when absent. */
+export async function clearSharedAuth(authPath) {
+    await syncSharedAuth(authPath, "", []);
+}
+/** Kimchi provider ids listed in an existing harness models.json ({} when absent/unreadable). */
+export function kimchiProviderIdsFromModelsJson(modelsPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(modelsPath, "utf-8"));
+    }
+    catch {
+        // models.json is the harness's file; an absent or corrupt one must not
+        // block kimchictl login — the provider-id list falls back to the metadata fetch.
+        return [];
+    }
+    if (!parsed || typeof parsed !== "object" || !("providers" in parsed))
+        return [];
+    const providers = parsed.providers;
+    if (!providers || typeof providers !== "object")
+        return [];
+    return Object.keys(providers).filter(isKimchiProvider);
+}
+//# sourceMappingURL=auth-file.js.map

package/dist/auth/auth-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-file.js","sourceRoot":"../src/","sources":["auth/auth-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;;;;;;;;;;;;;GAgBG;AAEH,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,CAA4B,CAAA;AACtF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAA;IAClD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnH,OAAO,KAAK,CAAC,GAAG,CAAA;IACjB,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,WAA8B;IACpG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU;YAAE,OAAM;QAElC,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5D,MAAM,eAAe,GAAG,EAAE,GAAG,WAAW,EAAE,CAAA;QAC1C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvD,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClC,OAAO,eAAe,CAAC,UAAU,CAAC,CAAA;YACnC,CAAC;QACF,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,YAAY,CAAC,CAAC,CAAA;YAC5E,KAAK,MAAM,UAAU,IAAI,GAAG,EAAE,CAAC;gBAC9B,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;YAC/D,CAAC;QACF,CAAC;QAED,IAAI,UAAU,IAAI,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;YACnE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAC1B,OAAM;QACP,CAAC;QAED,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5G,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC;YAAS,CAAC;QACV,MAAM,OAAO,EAAE,CAAA;IAChB,CAAC;AACF,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACrD,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IACjE,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD,CAAC;IAAC,MAAM,CAAC;QACR,uEAAuE;QACvE,iFAAiF;QACjF,OAAO,EAAE,CAAA;IACV,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IAChF,MAAM,SAAS,GAAI,MAAiC,CAAC,SAAS,CAAA;IAC9D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;AACvD,CAAC"}

package/dist/auth/browser-login.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Browser login — ported from the kimchi harness (kimchi-dev:src/cli-auth/):
+ * transient 127.0.0.1 callback server → open `webApp/cli-auth?callback=…&state=…`
+ * → web app delivers the API key back to the callback. Same URL grammar and
+ * state-CSRF validation so both tools can drive the same web flow.
+ */
+/** Web app base URL: KIMCHI_WEB_APP_URL override, default https://app.kimchi.dev. */
+export declare function resolveWebAppUrl(options?: {
+    webAppUrl?: string;
+}): string;
+export interface CallbackResult {
+    token?: string;
+    error?: string;
+}
+export interface CallbackServer {
+    port: number;
+    url: string;
+    result: Promise<CallbackResult>;
+    close: () => void;
+}
+export declare function generateState(): string;
+/**
+ * Start a temporary HTTP server on 127.0.0.1 to receive the token callback.
+ * Validates the state parameter against CSRF; times out after 5 minutes.
+ */
+export declare function startCallbackServer(expectedState: string): Promise<CallbackServer>;
+export interface BrowserAuthOptions {
+    /** Base URL of the Kimchi web app (default: https://app.kimchi.dev; env: KIMCHI_WEB_APP_URL) */
+    webAppUrl?: string;
+    /** Abort the flow (tears down the callback server early). */
+    signal?: AbortSignal;
+    /** Invoked with the browser URL before the browser opens. */
+    onBrowserUrl?: (url: string) => void;
+    /** Injected browser opener (tests). */
+    open?: (url: string) => Promise<unknown>;
+}
+export interface BrowserAuthResult {
+    token: string;
+}
+/**
+ * Authenticate via browser: redirect the user to the Kimchi web app; the
+ * resulting API key is sent back to the transient localhost callback server.
+ */
+export declare function authenticateViaBrowser(options?: BrowserAuthOptions): Promise<BrowserAuthResult>;
+//# sourceMappingURL=browser-login.d.ts.map

package/dist/auth/browser-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.d.ts","sourceRoot":"../src/","sources":["auth/browser-login.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEzE;AAuBD,MAAM,WAAW,cAAc;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IAC/B,KAAK,EAAE,MAAM,IAAI,CAAA;CACjB;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsHlF;AAED,MAAM,WAAW,kBAAkB;IAClC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;IACpC,uCAAuC;IACvC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,MAAM,CAAA;CACb;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4CzG"}

package/dist/auth/browser-login.js

@@ -0,0 +1,195 @@
+/**
+ * Browser login — ported from the kimchi harness (kimchi-dev:src/cli-auth/):
+ * transient 127.0.0.1 callback server → open `webApp/cli-auth?callback=…&state=…`
+ * → web app delivers the API key back to the callback. Same URL grammar and
+ * state-CSRF validation so both tools can drive the same web flow.
+ */
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import open from "open";
+const CALLBACK_PATH = "/callback";
+const CALLBACK_TIMEOUT_MS = 300_000; // 5 minutes, mirrors the harness
+const SUCCESS_MESSAGE = "Your CLI is now connected. You can close this window and return to kimchictl.";
+const DEFAULT_WEB_APP_URL = "https://app.kimchi.dev";
+/** Web app base URL: KIMCHI_WEB_APP_URL override, default https://app.kimchi.dev. */
+export function resolveWebAppUrl(options) {
+    return options?.webAppUrl ?? process.env.KIMCHI_WEB_APP_URL ?? DEFAULT_WEB_APP_URL;
+}
+function escapeHtml(text) {
+    return text
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+function pageHtml(title, heading, message, ok) {
+    const color = ok ? "#16a34a" : "#dc2626";
+    return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>
+<style>body{font-family:system-ui,sans-serif;display:flex;min-height:100vh;margin:0;align-items:center;justify-content:center;background:#fafafa}
+main{max-width:28rem;padding:2rem;text-align:center}h1{color:${color};font-size:1.25rem}p{color:#444}</style></head>
+<body><main><h1>${escapeHtml(heading)}</h1><p>${escapeHtml(message)}</p></main></body></html>`;
+}
+const successHtml = (message) => pageHtml("Login successful", "Login successful", message, true);
+const errorHtml = (title, message) => pageHtml(title, title, message, false);
+export function generateState() {
+    return randomBytes(32).toString("hex");
+}
+/**
+ * Start a temporary HTTP server on 127.0.0.1 to receive the token callback.
+ * Validates the state parameter against CSRF; times out after 5 minutes.
+ */
+export function startCallbackServer(expectedState) {
+    return new Promise((resolveStart, rejectStart) => {
+        let server;
+        let resolved = false;
+        let timeoutTimer;
+        let resolveResult;
+        function finish(result) {
+            if (resolved)
+                return;
+            resolved = true;
+            if (timeoutTimer)
+                clearTimeout(timeoutTimer);
+            resolveResult?.(result);
+            // Defer socket destruction so the HTTP response has time to flush
+            setTimeout(closeServer, 100);
+        }
+        function closeServer() {
+            if (!server)
+                return;
+            try {
+                server.closeAllConnections?.();
+                server.close();
+            }
+            catch {
+                // Already closing or closed — safe to ignore
+            }
+            server = undefined;
+        }
+        function onRequest(req, res) {
+            try {
+                const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+                const remote = req.socket.remoteAddress ?? "";
+                if (!(remote.startsWith("127.") || remote === "::1" || remote === "::ffff:127.0.0.1")) {
+                    res.writeHead(403, { "Content-Type": "text/html", Connection: "close" });
+                    res.end(errorHtml("Forbidden", "Only localhost connections are allowed."));
+                    return;
+                }
+                if (url.pathname !== CALLBACK_PATH) {
+                    res.writeHead(404, { "Content-Type": "text/plain", Connection: "close" });
+                    res.end("Not found");
+                    return;
+                }
+                const state = url.searchParams.get("state");
+                if (!state || state !== expectedState) {
+                    const errorMsg = "This request isn't valid. Please try logging in again from your terminal.";
+                    res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+                    res.end(errorHtml("Login error", errorMsg));
+                    finish({ error: errorMsg });
+                    return;
+                }
+                const error = url.searchParams.get("error");
+                if (error) {
+                    const errorMsg = url.searchParams.get("error_description") || error;
+                    res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+                    res.end(errorHtml("Authentication failed", errorMsg));
+                    finish({ error: errorMsg });
+                    return;
+                }
+                const token = url.searchParams.get("token");
+                if (!token) {
+                    const errorMsg = "No token was returned by the authentication server";
+                    res.writeHead(400, { "Content-Type": "text/html", Connection: "close" });
+                    res.end(errorHtml("Missing token", errorMsg));
+                    finish({ error: errorMsg });
+                    return;
+                }
+                res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+                res.end(successHtml(SUCCESS_MESSAGE));
+                finish({ token });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                res.writeHead(500, { "Content-Type": "text/plain", Connection: "close" });
+                res.end("Internal server error");
+                finish({ error: `Unexpected server error: ${message}` });
+                req.socket.destroy();
+            }
+        }
+        server = createServer(onRequest);
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server?.address();
+            if (!addr || typeof addr === "string") {
+                closeServer();
+                rejectStart(new Error("Could not determine callback server port"));
+                return;
+            }
+            const port = addr.port;
+            timeoutTimer = setTimeout(() => {
+                finish({ error: "Browser login timed out — please try again" });
+            }, CALLBACK_TIMEOUT_MS);
+            const resultPromise = new Promise((resolve) => {
+                resolveResult = resolve;
+            });
+            resolveStart({
+                port,
+                url: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
+                result: resultPromise,
+                close: () => {
+                    finish({ error: "Login cancelled" });
+                },
+            });
+        });
+        server.on("error", (err) => {
+            closeServer();
+            rejectStart(err);
+        });
+    });
+}
+/**
+ * Authenticate via browser: redirect the user to the Kimchi web app; the
+ * resulting API key is sent back to the transient localhost callback server.
+ */
+export async function authenticateViaBrowser(options = {}) {
+    const webAppUrl = resolveWebAppUrl(options);
+    const state = generateState();
+    const callbackServer = await startCallbackServer(state);
+    const onAbort = () => callbackServer.close();
+    try {
+        if (options.signal?.aborted) {
+            callbackServer.close();
+            throw new Error("Login cancelled");
+        }
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        const callbackUrl = encodeURIComponent(callbackServer.url);
+        const browserUrl = `${webAppUrl}/cli-auth?callback=${callbackUrl}&state=${encodeURIComponent(state)}`;
+        options.onBrowserUrl?.(browserUrl);
+        console.log("Opening your browser to complete login…");
+        const opener = options.open ?? open;
+        try {
+            await opener(browserUrl);
+        }
+        catch {
+            console.log("Couldn't open your browser automatically. Please visit the URL above manually.");
+        }
+        const result = await callbackServer.result;
+        if (result.error) {
+            throw new Error(result.error);
+        }
+        if (!result.token) {
+            throw new Error("Browser login completed but no token was received");
+        }
+        callbackServer.close();
+        return { token: result.token };
+    }
+    catch (err) {
+        callbackServer.close();
+        throw err;
+    }
+    finally {
+        options.signal?.removeEventListener("abort", onAbort);
+    }
+}
+//# sourceMappingURL=browser-login.js.map

package/dist/auth/browser-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.js","sourceRoot":"../src/","sources":["auth/browser-login.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAChG,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,MAAM,aAAa,GAAG,WAAW,CAAA;AACjC,MAAM,mBAAmB,GAAG,OAAO,CAAA,CAAC,iCAAiC;AACrE,MAAM,eAAe,GAAG,+EAA+E,CAAA;AAEvG,MAAM,mBAAmB,GAAG,wBAAwB,CAAA;AAEpD,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAChE,OAAO,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,mBAAmB,CAAA;AACnF,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC/B,OAAO,IAAI;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe,EAAE,EAAW;IAC7E,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IACxC,OAAO;2CACmC,UAAU,CAAC,KAAK,CAAC;;+DAEG,KAAK;kBAClD,UAAU,CAAC,OAAO,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,2BAA2B,CAAA;AAC9F,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AACxG,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;AAc5F,MAAM,UAAU,aAAa;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACxD,OAAO,IAAI,OAAO,CAAiB,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;QAChE,IAAI,MAA0B,CAAA;QAC9B,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,YAAuD,CAAA;QAC3D,IAAI,aAAwD,CAAA;QAE5D,SAAS,MAAM,CAAC,MAAsB;YACrC,IAAI,QAAQ;gBAAE,OAAM;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,IAAI,YAAY;gBAAE,YAAY,CAAC,YAAY,CAAC,CAAA;YAC5C,aAAa,EAAE,CAAC,MAAM,CAAC,CAAA;YACvB,kEAAkE;YAClE,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QAC7B,CAAC;QAED,SAAS,WAAW;YACnB,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,IAAI,CAAC;gBACJ,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;gBAC9B,MAAM,CAAC,KAAK,EAAE,CAAA;YACf,CAAC;YAAC,MAAM,CAAC;gBACR,6CAA6C;YAC9C,CAAC;YACD,MAAM,GAAG,SAAS,CAAA;QACnB,CAAC;QAED,SAAS,SAAS,CAAC,GAAoB,EAAE,GAAmB;YAC3D,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;gBAEhF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAA;gBAC7C,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,kBAAkB,CAAC,EAAE,CAAC;oBACvF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;oBACxE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC,CAAA;oBAC1E,OAAM;gBACP,CAAC;gBAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;oBACzE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;oBACpB,OAAM;gBACP,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBACvC,MAAM,QAAQ,GAAG,2EAA2E,CAAA;oBAC5F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;oBACxE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;oBAC3C,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;oBAC3B,OAAM;gBACP,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAA;oBACnE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;oBACxE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAA;oBACrD,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;oBAC3B,OAAM;gBACP,CAAC;gBAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;oBACZ,MAAM,QAAQ,GAAG,oDAAoD,CAAA;oBACrE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;oBACxE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAA;oBAC7C,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;oBAC3B,OAAM;gBACP,CAAC;gBAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;gBACxE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,CAAA;gBACrC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;gBACzE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;gBAChC,MAAM,CAAC,EAAE,KAAK,EAAE,4BAA4B,OAAO,EAAE,EAAE,CAAC,CAAA;gBACxD,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;YACrB,CAAC;QACF,CAAC;QAED,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAEhC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,EAAE,OAAO,EAAE,CAAA;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvC,WAAW,EAAE,CAAA;gBACb,WAAW,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAA;gBAClE,OAAM;YACP,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;YAEtB,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,MAAM,CAAC,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC,CAAA;YAChE,CAAC,EAAE,mBAAmB,CAAC,CAAA;YAEvB,MAAM,aAAa,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;gBAC7D,aAAa,GAAG,OAAO,CAAA;YACxB,CAAC,CAAC,CAAA;YAEF,YAAY,CAAC;gBACZ,IAAI;gBACJ,GAAG,EAAE,oBAAoB,IAAI,GAAG,aAAa,EAAE;gBAC/C,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,GAAG,EAAE;oBACX,MAAM,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAA;gBACrC,CAAC;aACD,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC1B,WAAW,EAAE,CAAA;YACb,WAAW,CAAC,GAAG,CAAC,CAAA;QACjB,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAiBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAA8B,EAAE;IAC5E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;IAC7B,MAAM,cAAc,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAEvD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,CAAA;IAE5C,IAAI,CAAC;QACJ,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,cAAc,CAAC,KAAK,EAAE,CAAA;YACtB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAElE,MAAM,WAAW,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QAC1D,MAAM,UAAU,GAAG,GAAG,SAAS,sBAAsB,WAAW,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;QAErG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAA;QAElC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAA;QACnC,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAA;QAC9F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAA;QAE1C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACrE,CAAC;QAED,cAAc,CAAC,KAAK,EAAE,CAAA;QACtB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,cAAc,CAAC,KAAK,EAAE,CAAA;QACtB,MAAM,GAAG,CAAA;IACV,CAAC;YAAS,CAAC;QACV,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;AACF,CAAC"}

package/dist/auth/config-file.d.ts

@@ -0,0 +1,4 @@
+export declare function readApiKeyFromConfig(configPath: string): string | undefined;
+/** Set the apiKey field (pass undefined to remove it). Preserves all other fields. */
+export declare function writeApiKeyToConfig(configPath: string, apiKey: string | undefined): void;
+//# sourceMappingURL=config-file.d.ts.map

package/dist/auth/config-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.d.ts","sourceRoot":"../src/","sources":["auth/config-file.ts"],"names":[],"mappings":"AA0BA,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ3E;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAYxF"}

package/dist/auth/config-file.js

@@ -0,0 +1,52 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * Minimal config.json access — the harness's other credential slot.
+ *
+ * The harness browser login writes the API key to BOTH auth.json and
+ * config.json (`writeApiKey` in kimchi-dev:src/config.ts), and its startup
+ * sync repairs auth.json from config.json. kimchictl mirrors that so a
+ * kimchictl-first login activates the harness without a second login, and a
+ * `kimchictl logout` doesn't leave a live key behind in config.json.
+ *
+ * Only the `apiKey` field is ever touched; all other fields are preserved.
+ */
+function readConfigRaw(configPath) {
+    if (!existsSync(configPath))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(configPath, "utf-8") || "{}");
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        // A corrupt config.json must not wedge kimchictl; leave the harness to re-write it.
+        return {};
+    }
+}
+export function readApiKeyFromConfig(configPath) {
+    const raw = readConfigRaw(configPath);
+    // The harness accepts camelCase and snake_case historical spellings.
+    for (const field of ["apiKey", "api_key"]) {
+        const value = raw[field];
+        if (typeof value === "string" && value.length > 0)
+            return value;
+    }
+    return undefined;
+}
+/** Set the apiKey field (pass undefined to remove it). Preserves all other fields. */
+export function writeApiKeyToConfig(configPath, apiKey) {
+    const raw = readConfigRaw(configPath);
+    if (apiKey === undefined) {
+        if (raw.apiKey === undefined)
+            return;
+        // undefined-assignment instead of delete: the file is immediately
+        // JSON.stringify'd, which drops undefined properties the same way.
+        raw.apiKey = undefined;
+    }
+    else {
+        raw.apiKey = apiKey;
+    }
+    mkdirSync(dirname(configPath), { recursive: true, mode: 0o700 });
+    writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+}
+//# sourceMappingURL=config-file.js.map

package/dist/auth/config-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-file.js","sourceRoot":"../src/","sources":["auth/config-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC;;;;;;;;;;GAUG;AAEH,SAAS,aAAa,CAAC,UAAkB;IACxC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAA;QACpE,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjH,CAAC;IAAC,MAAM,CAAC;QACR,oFAAoF;QACpF,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACtD,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACrC,qEAAqE;IACrE,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;IAChE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,MAA0B;IACjF,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAM;QACpC,kEAAkE;QAClE,mEAAmE;QACnE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAA;IACvB,CAAC;SAAM,CAAC;QACP,GAAG,CAAC,MAAM,GAAG,MAAM,CAAA;IACpB,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChE,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AACnG,CAAC"}

package/dist/auth/models-providers.d.ts

@@ -0,0 +1,17 @@
+export declare class ModelsFetchError extends Error {
+    readonly status?: number;
+    constructor(message: string, options?: {
+        status?: number;
+    });
+}
+export interface FetchProviderIdsOptions {
+    /** LLM service base URL; default https://llm.kimchi.dev. Env override: KIMCHI_LLM_ENDPOINT. */
+    endpoint?: string;
+    fetch?: typeof globalThis.fetch;
+}
+/**
+ * Fetch the active model list and derive Kimchi provider ids from it.
+ * Throws ModelsFetchError with .status on HTTP failure (401 = invalid key).
+ */
+export declare function fetchKimchiProviderIds(apiKey: string, options?: FetchProviderIdsOptions): Promise<string[]>;
+//# sourceMappingURL=models-providers.d.ts.map

package/dist/auth/models-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models-providers.d.ts","sourceRoot":"../src/","sources":["auth/models-providers.ts"],"names":[],"mappings":"AAgBA,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;gBACZ,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;CAK9D;AAUD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAC/B;AAMD;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA4BjH"}

package/dist/auth/models-providers.js

@@ -0,0 +1,63 @@
+import { KIMCHI_PROVIDER_ID } from "./provider-ids.js";
+/**
+ * Minimal models-metadata fetch used to (a) validate an API key at login and
+ * (b) derive the full set of Kimchi provider ids for auth.json
+ * ("kimchi-dev" plus one "kimchi-dev/<upstream>" per upstream provider),
+ * matching what the harness writes from models.json.
+ *
+ * Endpoint shape and derivation rules mirror kimchi-dev:src/models.ts
+ * (buildModelsConfig). Only the id set matters here — models.json itself
+ * remains the harness's file to write and is never created by kimchictl.
+ */
+const DEFAULT_LLM_ENDPOINT = "https://llm.kimchi.dev";
+const FETCH_TIMEOUT_MS = 20_000;
+export class ModelsFetchError extends Error {
+    status;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = "ModelsFetchError";
+        this.status = options.status;
+    }
+}
+function normalizeLlmEndpoint(endpoint) {
+    const trimmed = endpoint?.trim();
+    if (!trimmed)
+        return DEFAULT_LLM_ENDPOINT;
+    // Mirror the harness: scheme-less values get https:// so `dev.example.com` works.
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+    return withScheme.replace(/\/+$/, "");
+}
+function resolveLlmEndpoint(options) {
+    return options?.endpoint ?? process.env.KIMCHI_LLM_ENDPOINT ?? DEFAULT_LLM_ENDPOINT;
+}
+/**
+ * Fetch the active model list and derive Kimchi provider ids from it.
+ * Throws ModelsFetchError with .status on HTTP failure (401 = invalid key).
+ */
+export async function fetchKimchiProviderIds(apiKey, options) {
+    const fetchImpl = options?.fetch ?? globalThis.fetch;
+    const url = `${normalizeLlmEndpoint(resolveLlmEndpoint(options))}/v1/models/metadata?include_in_cli=true`;
+    const resp = await fetchImpl(url, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!resp.ok) {
+        throw new ModelsFetchError(`Failed to fetch models: ${resp.status} ${resp.statusText}`, { status: resp.status });
+    }
+    const body = (await resp.json().catch(() => undefined));
+    if (!body || !Array.isArray(body.models)) {
+        throw new ModelsFetchError("Unexpected response shape from models API");
+    }
+    const ids = new Set([KIMCHI_PROVIDER_ID]);
+    for (const model of body.models) {
+        if (model && typeof model === "object" && "provider" in model) {
+            const provider = model.provider;
+            // "ai-enabler" entries live under the base "kimchi-dev" provider (mirrors buildModelsConfig).
+            if (typeof provider === "string" && provider !== "ai-enabler") {
+                ids.add(`${KIMCHI_PROVIDER_ID}/${provider}`);
+            }
+        }
+    }
+    return [...ids];
+}
+//# sourceMappingURL=models-providers.js.map

package/dist/auth/models-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models-providers.js","sourceRoot":"../src/","sources":["auth/models-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD;;;;;;;;;GASG;AAEH,MAAM,oBAAoB,GAAG,wBAAwB,CAAA;AACrD,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACjC,MAAM,CAAS;IACxB,YAAY,OAAe,EAAE,UAA+B,EAAE;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAC9B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,CAAC;CACD;AAED,SAAS,oBAAoB,CAAC,QAAiB;IAC9C,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,oBAAoB,CAAA;IACzC,kFAAkF;IAClF,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAA;IAC5F,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACtC,CAAC;AAQD,SAAS,kBAAkB,CAAC,OAAiC;IAC5D,OAAO,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,CAAA;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc,EAAE,OAAiC;IAC7F,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IACpD,MAAM,GAAG,GAAG,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,yCAAyC,CAAA;IAEzG,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACjC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;QAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;KAC7C,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACjH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAqC,CAAA;IAC3F,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,gBAAgB,CAAC,2CAA2C,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,kBAAkB,CAAC,CAAC,CAAA;IACjD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAI,KAA+B,CAAC,QAAQ,CAAA;YAC1D,8FAA8F;YAC9F,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC/D,GAAG,CAAC,GAAG,CAAC,GAAG,kBAAkB,IAAI,QAAQ,EAAE,CAAC,CAAA;YAC7C,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;AAChB,CAAC"}

package/dist/auth/paths.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Shared-credential paths, mirroring kimchi-dev exactly:
+ *
+ *   ~/.config/kimchi/harness/     agent dir — auth.json, models.json
+ *                                 (overridable via KIMCHI_CODING_AGENT_DIR,
+ *                                  same fallback as kimchi-dev:src/cli.ts)
+ *   ~/.config/kimchi/config.json  shared wizard config — the `apiKey` slot
+ *                                 (fixed path, no env override — same as
+ *                                  kimchi-dev:src/config.ts KIMCHI_CONFIG_PATH)
+ */
+export declare function resolveKimchiAgentDir(env?: NodeJS.ProcessEnv): string;
+export declare function resolveAuthJsonPath(env?: NodeJS.ProcessEnv): string;
+export declare function resolveModelsJsonPath(env?: NodeJS.ProcessEnv): string;
+export declare function resolveConfigJsonPath(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/auth/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"../src/","sources":["auth/paths.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAElF;AAED,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEhF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAElF;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAElF"}

package/dist/auth/paths.js

@@ -0,0 +1,25 @@
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+/**
+ * Shared-credential paths, mirroring kimchi-dev exactly:
+ *
+ *   ~/.config/kimchi/harness/     agent dir — auth.json, models.json
+ *                                 (overridable via KIMCHI_CODING_AGENT_DIR,
+ *                                  same fallback as kimchi-dev:src/cli.ts)
+ *   ~/.config/kimchi/config.json  shared wizard config — the `apiKey` slot
+ *                                 (fixed path, no env override — same as
+ *                                  kimchi-dev:src/config.ts KIMCHI_CONFIG_PATH)
+ */
+export function resolveKimchiAgentDir(env = process.env) {
+    return env.KIMCHI_CODING_AGENT_DIR ?? resolve(env.HOME ?? homedir(), ".config", "kimchi", "harness");
+}
+export function resolveAuthJsonPath(env = process.env) {
+    return resolve(resolveKimchiAgentDir(env), "auth.json");
+}
+export function resolveModelsJsonPath(env = process.env) {
+    return resolve(resolveKimchiAgentDir(env), "models.json");
+}
+export function resolveConfigJsonPath(env = process.env) {
+    return resolve(env.HOME ?? homedir(), ".config", "kimchi", "config.json");
+}
+//# sourceMappingURL=paths.js.map

package/dist/auth/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"../src/","sources":["auth/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,OAAO,GAAG,CAAC,uBAAuB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;AACrG,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,OAAO,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,OAAO,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;AAC1E,CAAC"}

package/dist/auth/provider-ids.d.ts

@@ -0,0 +1,4 @@
+export declare const KIMCHI_PROVIDER_ID = "kimchi-dev";
+/** True for every Kimchi-managed provider, including experimental models. */
+export declare function isKimchiProvider(provider: string): boolean;
+//# sourceMappingURL=provider-ids.d.ts.map

package/dist/auth/provider-ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-ids.d.ts","sourceRoot":"../src/","sources":["auth/provider-ids.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,kBAAkB,eAAe,CAAA;AAG9C,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM1D"}

package/dist/auth/provider-ids.js

@@ -0,0 +1,12 @@
+// Provider-id predicates. Dependency-free mirror of kimchi-dev's
+// src/kimchi-provider.ts — the auth.json contract is shared with the harness,
+// so the id grammar must stay in lockstep.
+export const KIMCHI_PROVIDER_ID = "kimchi-dev";
+const KIMCHI_EXPERIMENTAL_PROVIDER_ID = "kimchi-experimental";
+/** True for every Kimchi-managed provider, including experimental models. */
+export function isKimchiProvider(provider) {
+    return (provider === KIMCHI_PROVIDER_ID ||
+        provider.startsWith(`${KIMCHI_PROVIDER_ID}/`) ||
+        provider === KIMCHI_EXPERIMENTAL_PROVIDER_ID);
+}
+//# sourceMappingURL=provider-ids.js.map

package/dist/auth/provider-ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-ids.js","sourceRoot":"../src/","sources":["auth/provider-ids.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,8EAA8E;AAC9E,2CAA2C;AAE3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAC9C,MAAM,+BAA+B,GAAG,qBAAqB,CAAA;AAE7D,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAChD,OAAO,CACN,QAAQ,KAAK,kBAAkB;QAC/B,QAAQ,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC;QAC7C,QAAQ,KAAK,+BAA+B,CAC5C,CAAA;AACF,CAAC"}

package/dist/auth/resolve.d.ts

@@ -0,0 +1,19 @@
+export type ApiKeySource = "environment" | "config" | "auth-json";
+export interface ResolvedApiKey {
+    key: string;
+    source: ApiKeySource;
+}
+/**
+ * Credential resolution, mirroring the harness precedence
+ * (kimchi-dev:src/config.ts — env key beats the saved login):
+ *   1. KIMCHI_API_KEY environment variable
+ *   2. config.json `apiKey` (the harness's saved key)
+ *   3. auth.json `kimchi-dev` entry
+ */
+export declare function resolveApiKey(env?: NodeJS.ProcessEnv): ResolvedApiKey | undefined;
+/** Standard error for commands that need a credential that isn't there. */
+export declare function requireApiKey(env?: NodeJS.ProcessEnv): ResolvedApiKey;
+export declare class NotLoggedInError extends Error {
+    constructor();
+}
+//# sourceMappingURL=resolve.d.ts.map

package/dist/auth/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"../src/","sources":["auth/resolve.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEjE,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,YAAY,CAAA;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,GAAG,SAAS,CAW9F;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAMlF;AAED,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C"}