@mastra/code-sdk 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/auth/providers/xai.js

@@ -0,0 +1,205 @@
+import { createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from "../device-code.js";
+//#region src/auth/providers/xai.ts
+/**
+* xAI OAuth flow (Grok)
+*
+* Ported from pi-mono's xAI OAuth implementation:
+* https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts
+*
+* xAI uses a standard RFC 8628 device authorization grant, so the flow needs
+* no inbound connection to the server. The primitives are split into
+* `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist
+* the JSON-serializable pending state between HTTP requests; the blocking
+* `loginXAI()` wraps them for TUI use.
+*/
+const CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
+const TOKEN_URL = "https://auth.x.ai/oauth2/token";
+const SCOPE = "openid profile email offline_access grok-cli:access api:access";
+const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;
+const REFRESH_SKEW_MS = 300 * 1e3;
+async function postForm(url, params, signal) {
+	return fetch(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(params).toString(),
+		signal
+	});
+}
+/** The verification URI is opened by the user; only accept https URLs. */
+function validateVerificationUri(raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);
+	}
+	if (parsed.protocol !== "https:") throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);
+	return parsed.toString();
+}
+function credentialsFromTokenResponse(data, previousRefreshToken) {
+	const record = data ?? {};
+	const access = record.access_token;
+	if (typeof access !== "string" || access.length === 0) throw new Error("xAI token response missing access_token");
+	const refresh = typeof record.refresh_token === "string" && record.refresh_token.length > 0 ? record.refresh_token : previousRefreshToken;
+	if (!refresh) throw new Error("xAI token response missing refresh_token");
+	const expiresIn = typeof record.expires_in === "number" && record.expires_in > 0 ? record.expires_in : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;
+	return {
+		access,
+		refresh,
+		expires: Date.now() + expiresIn * 1e3 - REFRESH_SKEW_MS
+	};
+}
+/**
+* Start an xAI device-code login: request a user code and return the
+* serializable pending state for subsequent polls.
+*/
+async function startXAIDeviceLogin(options) {
+	const response = await postForm(DEVICE_CODE_URL, {
+		client_id: CLIENT_ID,
+		scope: SCOPE
+	}, options?.signal);
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ""}`);
+	}
+	const data = await response.json();
+	if (!data.device_code || !data.user_code || !data.verification_uri) throw new Error("xAI device authorization response missing required fields");
+	const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);
+	return {
+		deviceCode: data.device_code,
+		userCode: data.user_code,
+		url,
+		instructions: `Enter code: ${data.user_code}`,
+		state: createDeviceCodePollState({
+			intervalSeconds: data.interval,
+			expiresInSeconds: typeof data.expires_in === "number" && data.expires_in > 0 ? data.expires_in : 600
+		})
+	};
+}
+async function pollXAITokenOnce(pending, signal) {
+	const response = await postForm(TOKEN_URL, {
+		grant_type: DEVICE_CODE_GRANT_TYPE,
+		device_code: pending.deviceCode,
+		client_id: CLIENT_ID
+	}, signal);
+	if (response.ok) {
+		const data = await response.json();
+		try {
+			return {
+				status: "complete",
+				result: credentialsFromTokenResponse(data)
+			};
+		} catch (error) {
+			return {
+				status: "failed",
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	const text = await response.text().catch(() => "");
+	let body = {};
+	try {
+		body = JSON.parse(text);
+	} catch {}
+	switch (body.error) {
+		case "authorization_pending": return {
+			status: "pending",
+			intervalSeconds: body.interval
+		};
+		case "slow_down": return {
+			status: "slow_down",
+			intervalSeconds: body.interval
+		};
+		case "access_denied":
+		case "authorization_denied": return {
+			status: "failed",
+			error: "xAI authorization was denied"
+		};
+		case "expired_token": return {
+			status: "failed",
+			error: "xAI device code expired before authorization completed"
+		};
+		default: return {
+			status: "failed",
+			error: `xAI device authorization failed: ${response.status}${text ? ` ${text}` : ""}`
+		};
+	}
+}
+/**
+* Perform exactly one upstream poll for a pending xAI device login.
+* Returns the updated pending state so callers (e.g. web routes) can persist
+* slow_down interval growth between polls. Never throws for flow-level
+* conditions.
+*/
+async function pollXAIDeviceLogin(pending, options) {
+	const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));
+	switch (step.status) {
+		case "complete": return {
+			status: "complete",
+			credentials: step.result
+		};
+		case "failed": return {
+			status: "failed",
+			error: step.error
+		};
+		case "pending":
+		case "slow_down": return {
+			status: "pending",
+			nextPollMs: step.nextPollMs,
+			pending: {
+				...pending,
+				state: step.state
+			}
+		};
+	}
+}
+/**
+* Login with xAI OAuth (device-code flow), blocking until authorized.
+*/
+async function loginXAI(callbacks) {
+	const pending = await startXAIDeviceLogin({ signal: callbacks.signal });
+	callbacks.onAuth({
+		url: pending.url,
+		instructions: pending.instructions
+	});
+	callbacks.onProgress?.("Waiting for xAI device authorization...");
+	return pollDeviceCodeUntilComplete({
+		state: pending.state,
+		pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),
+		signal: callbacks.signal
+	});
+}
+/**
+* Refresh xAI OAuth token
+*/
+async function refreshXAIToken(refreshToken, signal) {
+	const response = await postForm(TOKEN_URL, {
+		grant_type: "refresh_token",
+		client_id: CLIENT_ID,
+		refresh_token: refreshToken
+	}, signal);
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`xAI token refresh failed: ${response.status}${text ? ` ${text}` : ""}`);
+	}
+	return credentialsFromTokenResponse(await response.json(), refreshToken);
+}
+const xaiOAuthProvider = {
+	id: "xai",
+	name: "xAI (Grok)",
+	async login(callbacks) {
+		return loginXAI(callbacks);
+	},
+	async refreshToken(credentials) {
+		return refreshXAIToken(credentials.refresh);
+	},
+	getApiKey(credentials) {
+		return credentials.access;
+	}
+};
+//#endregion
+export { loginXAI, pollXAIDeviceLogin, refreshXAIToken, startXAIDeviceLogin, xaiOAuthProvider };
+
+//# sourceMappingURL=xai.js.map

package/dist/auth/providers/xai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai.js","names":[],"sources":["../../../src/auth/providers/xai.ts"],"sourcesContent":["/**\n * xAI OAuth flow (Grok)\n *\n * Ported from pi-mono's xAI OAuth implementation:\n * https://github.com/badlogic/pi-mono/blob/main/packages/ai/src/utils/oauth/xai.ts\n *\n * xAI uses a standard RFC 8628 device authorization grant, so the flow needs\n * no inbound connection to the server. The primitives are split into\n * `startXAIDeviceLogin()` / `pollXAIDeviceLogin()` so web routes can persist\n * the JSON-serializable pending state between HTTP requests; the blocking\n * `loginXAI()` wraps them for TUI use.\n */\n\nimport { createDeviceCodePollState, pollDeviceCodeUntilComplete, stepDeviceCodePoll } from '../device-code.js';\nimport type { DeviceCodePollOutcome, DeviceCodePollState } from '../device-code.js';\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from '../types.js';\n\nconst CLIENT_ID = 'b1a00492-073a-47ea-816f-4c329264a828';\nconst DEVICE_CODE_URL = 'https://auth.x.ai/oauth2/device/code';\nconst TOKEN_URL = 'https://auth.x.ai/oauth2/token';\nconst SCOPE = 'openid profile email offline_access grok-cli:access api:access';\nconst DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';\nconst DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 3600;\n// Refresh 5 minutes before actual expiry (same skew as Anthropic).\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\n\nasync function postForm(url: string, params: Record<string, string>, signal?: AbortSignal): Promise<Response> {\n  return fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams(params).toString(),\n    signal,\n  });\n}\n\n/** The verification URI is opened by the user; only accept https URLs. */\nfunction validateVerificationUri(raw: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);\n  }\n  if (parsed.protocol !== 'https:') {\n    throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);\n  }\n  return parsed.toString();\n}\n\nfunction credentialsFromTokenResponse(data: unknown, previousRefreshToken?: string): OAuthCredentials {\n  const record = (data ?? {}) as Record<string, unknown>;\n  const access = record.access_token;\n  if (typeof access !== 'string' || access.length === 0) {\n    throw new Error('xAI token response missing access_token');\n  }\n\n  // xAI may not rotate the refresh token on refresh; keep the previous one.\n  const refresh =\n    typeof record.refresh_token === 'string' && record.refresh_token.length > 0\n      ? record.refresh_token\n      : previousRefreshToken;\n  if (!refresh) {\n    throw new Error('xAI token response missing refresh_token');\n  }\n\n  const expiresIn =\n    typeof record.expires_in === 'number' && record.expires_in > 0\n      ? record.expires_in\n      : DEFAULT_TOKEN_EXPIRES_IN_SECONDS;\n\n  return {\n    access,\n    refresh,\n    expires: Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS,\n  };\n}\n\n/**\n * Serializable pending state for an xAI device-code login. Safe to persist\n * (e.g. a `pending jsonb` column) so polling can span HTTP requests.\n */\nexport interface XAIDeviceLoginPending {\n  deviceCode: string;\n  userCode: string;\n  /** Verification URL for the user to open (https-only, validated). */\n  url: string;\n  instructions: string;\n  /** RFC 8628 poll-loop state (interval growth, deadline, slow_down count). */\n  state: DeviceCodePollState;\n}\n\nexport type XAIDevicePollResult =\n  | { status: 'complete'; credentials: OAuthCredentials }\n  | { status: 'pending'; nextPollMs: number; pending: XAIDeviceLoginPending }\n  | { status: 'failed'; error: string };\n\n/**\n * Start an xAI device-code login: request a user code and return the\n * serializable pending state for subsequent polls.\n */\nexport async function startXAIDeviceLogin(options?: { signal?: AbortSignal }): Promise<XAIDeviceLoginPending> {\n  const response = await postForm(DEVICE_CODE_URL, { client_id: CLIENT_ID, scope: SCOPE }, options?.signal);\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ''}`);\n  }\n\n  const data = (await response.json()) as {\n    device_code?: string;\n    user_code?: string;\n    verification_uri?: string;\n    verification_uri_complete?: string;\n    interval?: number;\n    expires_in?: number;\n  };\n\n  if (!data.device_code || !data.user_code || !data.verification_uri) {\n    throw new Error('xAI device authorization response missing required fields');\n  }\n\n  const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);\n\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    url,\n    instructions: `Enter code: ${data.user_code}`,\n    state: createDeviceCodePollState({\n      intervalSeconds: data.interval,\n      expiresInSeconds: typeof data.expires_in === 'number' && data.expires_in > 0 ? data.expires_in : 600,\n    }),\n  };\n}\n\nasync function pollXAITokenOnce(\n  pending: XAIDeviceLoginPending,\n  signal?: AbortSignal,\n): Promise<DeviceCodePollOutcome<OAuthCredentials>> {\n  const response = await postForm(\n    TOKEN_URL,\n    {\n      grant_type: DEVICE_CODE_GRANT_TYPE,\n      device_code: pending.deviceCode,\n      client_id: CLIENT_ID,\n    },\n    signal,\n  );\n\n  if (response.ok) {\n    const data = (await response.json()) as unknown;\n    try {\n      return { status: 'complete', result: credentialsFromTokenResponse(data) };\n    } catch (error) {\n      return { status: 'failed', error: error instanceof Error ? error.message : String(error) };\n    }\n  }\n\n  const text = await response.text().catch(() => '');\n  let body: { error?: string; interval?: number } = {};\n  try {\n    body = JSON.parse(text) as { error?: string; interval?: number };\n  } catch {\n    // Non-JSON error body — fail loudly below with the raw text.\n  }\n\n  switch (body.error) {\n    case 'authorization_pending':\n      return { status: 'pending', intervalSeconds: body.interval };\n    case 'slow_down':\n      return { status: 'slow_down', intervalSeconds: body.interval };\n    case 'access_denied':\n    case 'authorization_denied':\n      return { status: 'failed', error: 'xAI authorization was denied' };\n    case 'expired_token':\n      return { status: 'failed', error: 'xAI device code expired before authorization completed' };\n    default:\n      return {\n        status: 'failed',\n        error: `xAI device authorization failed: ${response.status}${text ? ` ${text}` : ''}`,\n      };\n  }\n}\n\n/**\n * Perform exactly one upstream poll for a pending xAI device login.\n * Returns the updated pending state so callers (e.g. web routes) can persist\n * slow_down interval growth between polls. Never throws for flow-level\n * conditions.\n */\nexport async function pollXAIDeviceLogin(\n  pending: XAIDeviceLoginPending,\n  options?: { signal?: AbortSignal },\n): Promise<XAIDevicePollResult> {\n  const step = await stepDeviceCodePoll(pending.state, () => pollXAITokenOnce(pending, options?.signal));\n\n  switch (step.status) {\n    case 'complete':\n      return { status: 'complete', credentials: step.result };\n    case 'failed':\n      return { status: 'failed', error: step.error };\n    case 'pending':\n    case 'slow_down':\n      return {\n        status: 'pending',\n        nextPollMs: step.nextPollMs,\n        pending: { ...pending, state: step.state },\n      };\n  }\n}\n\n/**\n * Login with xAI OAuth (device-code flow), blocking until authorized.\n */\nexport async function loginXAI(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n  const pending = await startXAIDeviceLogin({ signal: callbacks.signal });\n\n  callbacks.onAuth({ url: pending.url, instructions: pending.instructions });\n  callbacks.onProgress?.('Waiting for xAI device authorization...');\n\n  return pollDeviceCodeUntilComplete({\n    state: pending.state,\n    pollOnce: () => pollXAITokenOnce(pending, callbacks.signal),\n    signal: callbacks.signal,\n  });\n}\n\n/**\n * Refresh xAI OAuth token\n */\nexport async function refreshXAIToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials> {\n  const response = await postForm(\n    TOKEN_URL,\n    {\n      grant_type: 'refresh_token',\n      client_id: CLIENT_ID,\n      refresh_token: refreshToken,\n    },\n    signal,\n  );\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => '');\n    throw new Error(`xAI token refresh failed: ${response.status}${text ? ` ${text}` : ''}`);\n  }\n\n  return credentialsFromTokenResponse((await response.json()) as unknown, refreshToken);\n}\n\nexport const xaiOAuthProvider: OAuthProviderInterface = {\n  id: 'xai',\n  name: 'xAI (Grok)',\n\n  async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n    return loginXAI(callbacks);\n  },\n\n  async refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n    return refreshXAIToken(credentials.refresh);\n  },\n\n  getApiKey(credentials: OAuthCredentials): string {\n    return credentials.access;\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;AAiBA,MAAM,YAAY;AAClB,MAAM,kBAAkB;AACxB,MAAM,YAAY;AAClB,MAAM,QAAQ;AACd,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AAEzC,MAAM,kBAAkB,MAAS;AAEjC,eAAe,SAAS,KAAa,QAAgC,QAAyC;CAC5G,OAAO,MAAM,KAAK;EAChB,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB,MAAM,CAAC,CAAC,SAAS;EAC3C;CACF,CAAC;AACH;;AAGA,SAAS,wBAAwB,KAAqB;CACpD,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,kEAAkE,KAAK;CACzF;CACA,IAAI,OAAO,aAAa,UACtB,MAAM,IAAI,MAAM,mEAAmE,KAAK;CAE1F,OAAO,OAAO,SAAS;AACzB;AAEA,SAAS,6BAA6B,MAAe,sBAAiD;CACpG,MAAM,SAAU,QAAQ,CAAC;CACzB,MAAM,SAAS,OAAO;CACtB,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,MAAM,IAAI,MAAM,yCAAyC;CAI3D,MAAM,UACJ,OAAO,OAAO,kBAAkB,YAAY,OAAO,cAAc,SAAS,IACtE,OAAO,gBACP;CACN,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,0CAA0C;CAG5D,MAAM,YACJ,OAAO,OAAO,eAAe,YAAY,OAAO,aAAa,IACzD,OAAO,aACP;CAEN,OAAO;EACL;EACA;EACA,SAAS,KAAK,IAAI,IAAI,YAAY,MAAO;CAC3C;AACF;;;;;AAyBA,eAAsB,oBAAoB,SAAoE;CAC5G,MAAM,WAAW,MAAM,SAAS,iBAAiB;EAAE,WAAW;EAAW,OAAO;CAAM,GAAG,SAAS,MAAM;CAExG,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,gDAAgD,SAAS,SAAS,OAAO,IAAI,SAAS,IAAI;CAC5G;CAEA,MAAM,OAAQ,MAAM,SAAS,KAAK;CASlC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,aAAa,CAAC,KAAK,kBAChD,MAAM,IAAI,MAAM,2DAA2D;CAG7E,MAAM,MAAM,wBAAwB,KAAK,6BAA6B,KAAK,gBAAgB;CAE3F,OAAO;EACL,YAAY,KAAK;EACjB,UAAU,KAAK;EACf;EACA,cAAc,eAAe,KAAK;EAClC,OAAO,0BAA0B;GAC/B,iBAAiB,KAAK;GACtB,kBAAkB,OAAO,KAAK,eAAe,YAAY,KAAK,aAAa,IAAI,KAAK,aAAa;EACnG,CAAC;CACH;AACF;AAEA,eAAe,iBACb,SACA,QACkD;CAClD,MAAM,WAAW,MAAM,SACrB,WACA;EACE,YAAY;EACZ,aAAa,QAAQ;EACrB,WAAW;CACb,GACA,MACF;CAEA,IAAI,SAAS,IAAI;EACf,MAAM,OAAQ,MAAM,SAAS,KAAK;EAClC,IAAI;GACF,OAAO;IAAE,QAAQ;IAAY,QAAQ,6BAA6B,IAAI;GAAE;EAC1E,SAAS,OAAO;GACd,OAAO;IAAE,QAAQ;IAAU,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EAC3F;CACF;CAEA,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,IAAI,OAA8C,CAAC;CACnD,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,QAAQ,CAER;CAEA,QAAQ,KAAK,OAAb;EACE,KAAK,yBACH,OAAO;GAAE,QAAQ;GAAW,iBAAiB,KAAK;EAAS;EAC7D,KAAK,aACH,OAAO;GAAE,QAAQ;GAAa,iBAAiB,KAAK;EAAS;EAC/D,KAAK;EACL,KAAK,wBACH,OAAO;GAAE,QAAQ;GAAU,OAAO;EAA+B;EACnE,KAAK,iBACH,OAAO;GAAE,QAAQ;GAAU,OAAO;EAAyD;EAC7F,SACE,OAAO;GACL,QAAQ;GACR,OAAO,oCAAoC,SAAS,SAAS,OAAO,IAAI,SAAS;EACnF;CACJ;AACF;;;;;;;AAQA,eAAsB,mBACpB,SACA,SAC8B;CAC9B,MAAM,OAAO,MAAM,mBAAmB,QAAQ,aAAa,iBAAiB,SAAS,SAAS,MAAM,CAAC;CAErG,QAAQ,KAAK,QAAb;EACE,KAAK,YACH,OAAO;GAAE,QAAQ;GAAY,aAAa,KAAK;EAAO;EACxD,KAAK,UACH,OAAO;GAAE,QAAQ;GAAU,OAAO,KAAK;EAAM;EAC/C,KAAK;EACL,KAAK,aACH,OAAO;GACL,QAAQ;GACR,YAAY,KAAK;GACjB,SAAS;IAAE,GAAG;IAAS,OAAO,KAAK;GAAM;EAC3C;CACJ;AACF;;;;AAKA,eAAsB,SAAS,WAA2D;CACxF,MAAM,UAAU,MAAM,oBAAoB,EAAE,QAAQ,UAAU,OAAO,CAAC;CAEtE,UAAU,OAAO;EAAE,KAAK,QAAQ;EAAK,cAAc,QAAQ;CAAa,CAAC;CACzE,UAAU,aAAa,yCAAyC;CAEhE,OAAO,4BAA4B;EACjC,OAAO,QAAQ;EACf,gBAAgB,iBAAiB,SAAS,UAAU,MAAM;EAC1D,QAAQ,UAAU;CACpB,CAAC;AACH;;;;AAKA,eAAsB,gBAAgB,cAAsB,QAAiD;CAC3G,MAAM,WAAW,MAAM,SACrB,WACA;EACE,YAAY;EACZ,WAAW;EACX,eAAe;CACjB,GACA,MACF;CAEA,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,6BAA6B,SAAS,SAAS,OAAO,IAAI,SAAS,IAAI;CACzF;CAEA,OAAO,6BAA8B,MAAM,SAAS,KAAK,GAAe,YAAY;AACtF;AAEA,MAAa,mBAA2C;CACtD,IAAI;CACJ,MAAM;CAEN,MAAM,MAAM,WAA2D;EACrE,OAAO,SAAS,SAAS;CAC3B;CAEA,MAAM,aAAa,aAA0D;EAC3E,OAAO,gBAAgB,YAAY,OAAO;CAC5C;CAEA,UAAU,aAAuC;EAC/C,OAAO,YAAY;CACrB;AACF"}

package/dist/auth/storage.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Credential storage for API keys and OAuth tokens.
+ * Handles loading, saving, and refreshing credentials from auth.json.
+ */
+import type { AuthCredential, OAuthLoginCallbacks, OAuthProviderId, OAuthProviderInterface } from './types.js';
+/**
+ * Best/default models for each OAuth provider.
+ * Used when auto-selecting a model after login.
+ */
+export declare const PROVIDER_DEFAULT_MODELS: Record<OAuthProviderId, string>;
+/**
+ * Get an OAuth provider by ID
+ */
+export declare function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined;
+/**
+ * Get all registered OAuth providers
+ */
+export declare function getOAuthProviders(): OAuthProviderInterface[];
+/**
+ * Credential storage backed by a JSON file.
+ */
+export declare class AuthStorage {
+    private authPath;
+    private data;
+    constructor(authPath?: string);
+    /**
+     * Reload credentials from disk.
+     */
+    reload(): void;
+    /**
+     * Save credentials to disk.
+     */
+    private save;
+    /**
+     * Get credential for a provider.
+     */
+    get(provider: string): AuthCredential | undefined;
+    /**
+     * Set credential for a provider.
+     */
+    set(provider: string, credential: AuthCredential): void;
+    /**
+     * Remove credential for a provider.
+     */
+    remove(provider: string): void;
+    /**
+     * List all providers with credentials.
+     */
+    list(): string[];
+    /**
+     * Check if credentials exist for a provider.
+     */
+    has(provider: string): boolean;
+    /**
+     * Check if logged in via OAuth for a provider.
+     */
+    isLoggedIn(provider: string): boolean;
+    /**
+     * Check if a stored API key exists for a provider.
+     * Keys are stored under `apikey:<provider>` in auth.json.
+     */
+    hasStoredApiKey(provider: string): boolean;
+    /**
+     * Get a stored API key for a provider, if any.
+     */
+    getStoredApiKey(provider: string): string | undefined;
+    /**
+     * Store an API key for a provider.
+     * Also sets the corresponding environment variable so model resolution can find it.
+     */
+    setStoredApiKey(provider: string, key: string, envVar?: string): void;
+    /**
+     * Load all stored API keys into process.env.
+     * Called at startup so model resolution can find stored keys.
+     * Only sets env vars that aren't already set (env vars take precedence).
+     */
+    loadStoredApiKeysIntoEnv(providerEnvVars: Record<string, string | undefined>): void;
+    /**
+     * Login to an OAuth provider.
+     */
+    login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks): Promise<void>;
+    /**
+     * Logout from a provider.
+     */
+    logout(provider: string): void;
+    /**
+     * Get API key for a provider, auto-refreshing OAuth tokens if needed.
+     */
+    getApiKey(providerId: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/auth/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/auth/storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,OAAO,KAAK,EACV,cAAc,EAEd,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAQnE,CAAC;AAUF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,eAAe,GAAG,sBAAsB,GAAG,SAAS,CAExF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,sBAAsB,EAAE,CAE5D;AAED;;GAEG;AACH,qBAAa,WAAW;IAGV,OAAO,CAAC,QAAQ;IAF5B,OAAO,CAAC,IAAI,CAAuB;gBAEf,QAAQ,GAAE,MAA2C;IAIzE;;OAEG;IACH,MAAM,IAAI,IAAI;IAYd;;OAEG;IACH,OAAO,CAAC,IAAI;IASZ;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIjD;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI;IAKvD;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAK9B;;OAEG;IACH,IAAI,IAAI,MAAM,EAAE;IAIhB;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKrC;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAK1C;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrD;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAOrE;;;;OAIG;IACH,wBAAwB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI;IAWnF;;OAEG;IACG,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvF;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI9B;;OAEG;IACG,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA8BjE"}

package/dist/auth/storage.js

@@ -0,0 +1,197 @@
+import { getAppDataDir } from "../utils/project.js";
+import { anthropicOAuthProvider } from "./providers/anthropic.js";
+import { githubCopilotOAuthProvider } from "./providers/github-copilot.js";
+import { openaiCodexOAuthProvider } from "./providers/openai-codex.js";
+import { xaiOAuthProvider } from "./providers/xai.js";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+//#region src/auth/storage.ts
+/**
+* Credential storage for API keys and OAuth tokens.
+* Handles loading, saving, and refreshing credentials from auth.json.
+*/
+/**
+* Best/default models for each OAuth provider.
+* Used when auto-selecting a model after login.
+*/
+const PROVIDER_DEFAULT_MODELS = {
+	anthropic: "anthropic/claude-fable-5",
+	"openai-codex": "openai/gpt-5.6-sol",
+	"github-copilot": "github-copilot/gpt-4.1",
+	xai: "xai/grok-4.5"
+};
+const oauthProviderRegistry = /* @__PURE__ */ new Map([
+	[anthropicOAuthProvider.id, anthropicOAuthProvider],
+	[openaiCodexOAuthProvider.id, openaiCodexOAuthProvider],
+	[githubCopilotOAuthProvider.id, githubCopilotOAuthProvider],
+	[xaiOAuthProvider.id, xaiOAuthProvider]
+]);
+/**
+* Get an OAuth provider by ID
+*/
+function getOAuthProvider(id) {
+	return oauthProviderRegistry.get(id);
+}
+/**
+* Get all registered OAuth providers
+*/
+function getOAuthProviders() {
+	return Array.from(oauthProviderRegistry.values());
+}
+/**
+* Credential storage backed by a JSON file.
+*/
+var AuthStorage = class {
+	authPath;
+	data = {};
+	constructor(authPath = join(getAppDataDir(), "auth.json")) {
+		this.authPath = authPath;
+		this.reload();
+	}
+	/**
+	* Reload credentials from disk.
+	*/
+	reload() {
+		if (!existsSync(this.authPath)) {
+			this.data = {};
+			return;
+		}
+		try {
+			this.data = JSON.parse(readFileSync(this.authPath, "utf-8"));
+		} catch {
+			this.data = {};
+		}
+	}
+	/**
+	* Save credentials to disk.
+	*/
+	save() {
+		const dir = dirname(this.authPath);
+		if (!existsSync(dir)) mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(this.authPath, JSON.stringify(this.data, null, 2), "utf-8");
+		chmodSync(this.authPath, 384);
+	}
+	/**
+	* Get credential for a provider.
+	*/
+	get(provider) {
+		return this.data[provider] ?? void 0;
+	}
+	/**
+	* Set credential for a provider.
+	*/
+	set(provider, credential) {
+		this.data[provider] = credential;
+		this.save();
+	}
+	/**
+	* Remove credential for a provider.
+	*/
+	remove(provider) {
+		delete this.data[provider];
+		this.save();
+	}
+	/**
+	* List all providers with credentials.
+	*/
+	list() {
+		return Object.keys(this.data);
+	}
+	/**
+	* Check if credentials exist for a provider.
+	*/
+	has(provider) {
+		return provider in this.data;
+	}
+	/**
+	* Check if logged in via OAuth for a provider.
+	*/
+	isLoggedIn(provider) {
+		return this.data[provider]?.type === "oauth";
+	}
+	/**
+	* Check if a stored API key exists for a provider.
+	* Keys are stored under `apikey:<provider>` in auth.json.
+	*/
+	hasStoredApiKey(provider) {
+		const cred = this.data[`apikey:${provider}`];
+		return cred?.type === "api_key" && cred.key.length > 0;
+	}
+	/**
+	* Get a stored API key for a provider, if any.
+	*/
+	getStoredApiKey(provider) {
+		const cred = this.data[`apikey:${provider}`];
+		return cred?.type === "api_key" && cred.key.length > 0 ? cred.key : void 0;
+	}
+	/**
+	* Store an API key for a provider.
+	* Also sets the corresponding environment variable so model resolution can find it.
+	*/
+	setStoredApiKey(provider, key, envVar) {
+		this.set(`apikey:${provider}`, {
+			type: "api_key",
+			key
+		});
+		if (envVar) process.env[envVar] = key;
+	}
+	/**
+	* Load all stored API keys into process.env.
+	* Called at startup so model resolution can find stored keys.
+	* Only sets env vars that aren't already set (env vars take precedence).
+	*/
+	loadStoredApiKeysIntoEnv(providerEnvVars) {
+		for (const [key, cred] of Object.entries(this.data)) {
+			if (!key.startsWith("apikey:") || cred.type !== "api_key" || !cred.key) continue;
+			const envVar = providerEnvVars[key.substring(7)];
+			if (envVar && !process.env[envVar]) process.env[envVar] = cred.key;
+		}
+	}
+	/**
+	* Login to an OAuth provider.
+	*/
+	async login(providerId, callbacks) {
+		const provider = getOAuthProvider(providerId);
+		if (!provider) throw new Error(`Unknown OAuth provider: ${providerId}`);
+		const credentials = await provider.login(callbacks);
+		this.set(providerId, {
+			type: "oauth",
+			...credentials
+		});
+	}
+	/**
+	* Logout from a provider.
+	*/
+	logout(provider) {
+		this.remove(provider);
+	}
+	/**
+	* Get API key for a provider, auto-refreshing OAuth tokens if needed.
+	*/
+	async getApiKey(providerId) {
+		const cred = this.data[providerId];
+		if (cred?.type === "api_key") return cred.key;
+		if (cred?.type === "oauth") {
+			const provider = getOAuthProvider(providerId);
+			if (!provider) return;
+			if (Date.now() >= cred.expires) try {
+				const newCreds = await provider.refreshToken(cred);
+				this.set(providerId, {
+					type: "oauth",
+					...newCreds
+				});
+				return provider.getApiKey(newCreds);
+			} catch {
+				return;
+			}
+			return provider.getApiKey(cred);
+		}
+	}
+};
+//#endregion
+export { AuthStorage, PROVIDER_DEFAULT_MODELS, getOAuthProvider, getOAuthProviders };
+
+//# sourceMappingURL=storage.js.map

package/dist/auth/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","names":[],"sources":["../../src/auth/storage.ts"],"sourcesContent":["/**\n * Credential storage for API keys and OAuth tokens.\n * Handles loading, saving, and refreshing credentials from auth.json.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { getAppDataDir } from '../utils/project.js';\nimport { anthropicOAuthProvider } from './providers/anthropic.js';\nimport { githubCopilotOAuthProvider } from './providers/github-copilot.js';\nimport { openaiCodexOAuthProvider } from './providers/openai-codex.js';\nimport { xaiOAuthProvider } from './providers/xai.js';\nimport type {\n  AuthCredential,\n  AuthStorageData,\n  OAuthLoginCallbacks,\n  OAuthProviderId,\n  OAuthProviderInterface,\n} from './types.js';\n\n/**\n * Best/default models for each OAuth provider.\n * Used when auto-selecting a model after login.\n */\nexport const PROVIDER_DEFAULT_MODELS: Record<OAuthProviderId, string> = {\n  anthropic: 'anthropic/claude-fable-5',\n  'openai-codex': 'openai/gpt-5.6-sol',\n  // gpt-4.1 routes through `/chat/completions` (which our OpenAI-compatible\n  // adapter handles); Anthropic-shaped Copilot models (Claude on `/v1/messages`)\n  // are not yet wired up, so picking one as the post-login default would error.\n  'github-copilot': 'github-copilot/gpt-4.1',\n  xai: 'xai/grok-4.5',\n};\n\n// Provider registry\nconst oauthProviderRegistry = new Map<string, OAuthProviderInterface>([\n  [anthropicOAuthProvider.id, anthropicOAuthProvider],\n  [openaiCodexOAuthProvider.id, openaiCodexOAuthProvider],\n  [githubCopilotOAuthProvider.id, githubCopilotOAuthProvider],\n  [xaiOAuthProvider.id, xaiOAuthProvider],\n]);\n\n/**\n * Get an OAuth provider by ID\n */\nexport function getOAuthProvider(id: OAuthProviderId): OAuthProviderInterface | undefined {\n  return oauthProviderRegistry.get(id);\n}\n\n/**\n * Get all registered OAuth providers\n */\nexport function getOAuthProviders(): OAuthProviderInterface[] {\n  return Array.from(oauthProviderRegistry.values());\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage {\n  private data: AuthStorageData = {};\n\n  constructor(private authPath: string = join(getAppDataDir(), 'auth.json')) {\n    this.reload();\n  }\n\n  /**\n   * Reload credentials from disk.\n   */\n  reload(): void {\n    if (!existsSync(this.authPath)) {\n      this.data = {};\n      return;\n    }\n    try {\n      this.data = JSON.parse(readFileSync(this.authPath, 'utf-8'));\n    } catch {\n      this.data = {};\n    }\n  }\n\n  /**\n   * Save credentials to disk.\n   */\n  private save(): void {\n    const dir = dirname(this.authPath);\n    if (!existsSync(dir)) {\n      mkdirSync(dir, { recursive: true, mode: 0o700 });\n    }\n    writeFileSync(this.authPath, JSON.stringify(this.data, null, 2), 'utf-8');\n    chmodSync(this.authPath, 0o600);\n  }\n\n  /**\n   * Get credential for a provider.\n   */\n  get(provider: string): AuthCredential | undefined {\n    return this.data[provider] ?? undefined;\n  }\n\n  /**\n   * Set credential for a provider.\n   */\n  set(provider: string, credential: AuthCredential): void {\n    this.data[provider] = credential;\n    this.save();\n  }\n\n  /**\n   * Remove credential for a provider.\n   */\n  remove(provider: string): void {\n    delete this.data[provider];\n    this.save();\n  }\n\n  /**\n   * List all providers with credentials.\n   */\n  list(): string[] {\n    return Object.keys(this.data);\n  }\n\n  /**\n   * Check if credentials exist for a provider.\n   */\n  has(provider: string): boolean {\n    return provider in this.data;\n  }\n\n  /**\n   * Check if logged in via OAuth for a provider.\n   */\n  isLoggedIn(provider: string): boolean {\n    const cred = this.data[provider];\n    return cred?.type === 'oauth';\n  }\n\n  /**\n   * Check if a stored API key exists for a provider.\n   * Keys are stored under `apikey:<provider>` in auth.json.\n   */\n  hasStoredApiKey(provider: string): boolean {\n    const cred = this.data[`apikey:${provider}`];\n    return cred?.type === 'api_key' && cred.key.length > 0;\n  }\n\n  /**\n   * Get a stored API key for a provider, if any.\n   */\n  getStoredApiKey(provider: string): string | undefined {\n    const cred = this.data[`apikey:${provider}`];\n    return cred?.type === 'api_key' && cred.key.length > 0 ? cred.key : undefined;\n  }\n\n  /**\n   * Store an API key for a provider.\n   * Also sets the corresponding environment variable so model resolution can find it.\n   */\n  setStoredApiKey(provider: string, key: string, envVar?: string): void {\n    this.set(`apikey:${provider}`, { type: 'api_key', key });\n    if (envVar) {\n      process.env[envVar] = key;\n    }\n  }\n\n  /**\n   * Load all stored API keys into process.env.\n   * Called at startup so model resolution can find stored keys.\n   * Only sets env vars that aren't already set (env vars take precedence).\n   */\n  loadStoredApiKeysIntoEnv(providerEnvVars: Record<string, string | undefined>): void {\n    for (const [key, cred] of Object.entries(this.data)) {\n      if (!key.startsWith('apikey:') || cred.type !== 'api_key' || !cred.key) continue;\n      const provider = key.substring('apikey:'.length);\n      const envVar = providerEnvVars[provider];\n      if (envVar && !process.env[envVar]) {\n        process.env[envVar] = cred.key;\n      }\n    }\n  }\n\n  /**\n   * Login to an OAuth provider.\n   */\n  async login(providerId: OAuthProviderId, callbacks: OAuthLoginCallbacks): Promise<void> {\n    const provider = getOAuthProvider(providerId);\n    if (!provider) {\n      throw new Error(`Unknown OAuth provider: ${providerId}`);\n    }\n\n    const credentials = await provider.login(callbacks);\n    this.set(providerId, { type: 'oauth', ...credentials });\n  }\n\n  /**\n   * Logout from a provider.\n   */\n  logout(provider: string): void {\n    this.remove(provider);\n  }\n\n  /**\n   * Get API key for a provider, auto-refreshing OAuth tokens if needed.\n   */\n  async getApiKey(providerId: string): Promise<string | undefined> {\n    const cred = this.data[providerId];\n\n    if (cred?.type === 'api_key') {\n      return cred.key;\n    }\n\n    if (cred?.type === 'oauth') {\n      const provider = getOAuthProvider(providerId);\n      if (!provider) {\n        return undefined;\n      }\n\n      // Check if token needs refresh\n      if (Date.now() >= cred.expires) {\n        try {\n          const newCreds = await provider.refreshToken(cred);\n          this.set(providerId, { type: 'oauth', ...newCreds });\n          return provider.getApiKey(newCreds);\n        } catch {\n          // Refresh failed - user needs to re-login\n          return undefined;\n        }\n      }\n\n      return provider.getApiKey(cred);\n    }\n\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAwBA,MAAa,0BAA2D;CACtE,WAAW;CACX,gBAAgB;CAIhB,kBAAkB;CAClB,KAAK;AACP;AAGA,MAAM,wCAAwB,IAAI,IAAoC;CACpE,CAAC,uBAAuB,IAAI,sBAAsB;CAClD,CAAC,yBAAyB,IAAI,wBAAwB;CACtD,CAAC,2BAA2B,IAAI,0BAA0B;CAC1D,CAAC,iBAAiB,IAAI,gBAAgB;AACxC,CAAC;;;;AAKD,SAAgB,iBAAiB,IAAyD;CACxF,OAAO,sBAAsB,IAAI,EAAE;AACrC;;;;AAKA,SAAgB,oBAA8C;CAC5D,OAAO,MAAM,KAAK,sBAAsB,OAAO,CAAC;AAClD;;;;AAKA,IAAa,cAAb,MAAyB;CAGH;CAFpB,OAAgC,CAAC;CAEjC,YAAY,WAA2B,KAAK,cAAc,GAAG,WAAW,GAAG;EAAvD,KAAA,WAAA;EAClB,KAAK,OAAO;CACd;;;;CAKA,SAAe;EACb,IAAI,CAAC,WAAW,KAAK,QAAQ,GAAG;GAC9B,KAAK,OAAO,CAAC;GACb;EACF;EACA,IAAI;GACF,KAAK,OAAO,KAAK,MAAM,aAAa,KAAK,UAAU,OAAO,CAAC;EAC7D,QAAQ;GACN,KAAK,OAAO,CAAC;EACf;CACF;;;;CAKA,OAAqB;EACnB,MAAM,MAAM,QAAQ,KAAK,QAAQ;EACjC,IAAI,CAAC,WAAW,GAAG,GACjB,UAAU,KAAK;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAEjD,cAAc,KAAK,UAAU,KAAK,UAAU,KAAK,MAAM,MAAM,CAAC,GAAG,OAAO;EACxE,UAAU,KAAK,UAAU,GAAK;CAChC;;;;CAKA,IAAI,UAA8C;EAChD,OAAO,KAAK,KAAK,aAAa,KAAA;CAChC;;;;CAKA,IAAI,UAAkB,YAAkC;EACtD,KAAK,KAAK,YAAY;EACtB,KAAK,KAAK;CACZ;;;;CAKA,OAAO,UAAwB;EAC7B,OAAO,KAAK,KAAK;EACjB,KAAK,KAAK;CACZ;;;;CAKA,OAAiB;EACf,OAAO,OAAO,KAAK,KAAK,IAAI;CAC9B;;;;CAKA,IAAI,UAA2B;EAC7B,OAAO,YAAY,KAAK;CAC1B;;;;CAKA,WAAW,UAA2B;EAEpC,OADa,KAAK,KAAK,SACZ,EAAE,SAAS;CACxB;;;;;CAMA,gBAAgB,UAA2B;EACzC,MAAM,OAAO,KAAK,KAAK,UAAU;EACjC,OAAO,MAAM,SAAS,aAAa,KAAK,IAAI,SAAS;CACvD;;;;CAKA,gBAAgB,UAAsC;EACpD,MAAM,OAAO,KAAK,KAAK,UAAU;EACjC,OAAO,MAAM,SAAS,aAAa,KAAK,IAAI,SAAS,IAAI,KAAK,MAAM,KAAA;CACtE;;;;;CAMA,gBAAgB,UAAkB,KAAa,QAAuB;EACpE,KAAK,IAAI,UAAU,YAAY;GAAE,MAAM;GAAW;EAAI,CAAC;EACvD,IAAI,QACF,QAAQ,IAAI,UAAU;CAE1B;;;;;;CAOA,yBAAyB,iBAA2D;EAClF,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,IAAI,GAAG;GACnD,IAAI,CAAC,IAAI,WAAW,SAAS,KAAK,KAAK,SAAS,aAAa,CAAC,KAAK,KAAK;GAExE,MAAM,SAAS,gBADE,IAAI,UAAU,CACO;GACtC,IAAI,UAAU,CAAC,QAAQ,IAAI,SACzB,QAAQ,IAAI,UAAU,KAAK;EAE/B;CACF;;;;CAKA,MAAM,MAAM,YAA6B,WAA+C;EACtF,MAAM,WAAW,iBAAiB,UAAU;EAC5C,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,2BAA2B,YAAY;EAGzD,MAAM,cAAc,MAAM,SAAS,MAAM,SAAS;EAClD,KAAK,IAAI,YAAY;GAAE,MAAM;GAAS,GAAG;EAAY,CAAC;CACxD;;;;CAKA,OAAO,UAAwB;EAC7B,KAAK,OAAO,QAAQ;CACtB;;;;CAKA,MAAM,UAAU,YAAiD;EAC/D,MAAM,OAAO,KAAK,KAAK;EAEvB,IAAI,MAAM,SAAS,WACjB,OAAO,KAAK;EAGd,IAAI,MAAM,SAAS,SAAS;GAC1B,MAAM,WAAW,iBAAiB,UAAU;GAC5C,IAAI,CAAC,UACH;GAIF,IAAI,KAAK,IAAI,KAAK,KAAK,SACrB,IAAI;IACF,MAAM,WAAW,MAAM,SAAS,aAAa,IAAI;IACjD,KAAK,IAAI,YAAY;KAAE,MAAM;KAAS,GAAG;IAAS,CAAC;IACnD,OAAO,SAAS,UAAU,QAAQ;GACpC,QAAQ;IAEN;GACF;GAGF,OAAO,SAAS,UAAU,IAAI;EAChC;CAGF;AACF"}

package/dist/auth/types.d.ts

@@ -0,0 +1,89 @@
+/**
+ * OAuth types for authentication providers
+ */
+export interface OAuthCredentials {
+    refresh: string;
+    access: string;
+    expires: number;
+    [key: string]: unknown;
+}
+export type OAuthProviderId = string;
+export interface OAuthAuthInfo {
+    url: string;
+    instructions?: string;
+}
+export interface OAuthPrompt {
+    message: string;
+    placeholder?: string;
+    allowEmpty?: boolean;
+}
+/**
+ * A selectable authentication mode for an OAuth provider.
+ * Providers that support multiple flows (e.g. browser callback vs. device code)
+ * advertise them via `OAuthProviderInterface.authModes`. The TUI shows a
+ * sub-selector when more than one mode is available so users don't need to
+ * discover the flow through environment variables.
+ */
+export interface AuthMode {
+    id: string;
+    name: string;
+    description?: string;
+}
+export interface OAuthLoginCallbacks {
+    onAuth: (info: OAuthAuthInfo) => void;
+    onPrompt: (prompt: OAuthPrompt) => Promise<string>;
+    onProgress?: (message: string) => void;
+    onManualCodeInput?: () => Promise<string>;
+    signal?: AbortSignal;
+    /** Selected authentication mode id (matches one of `OAuthProviderInterface.authModes`). */
+    authMode?: string;
+}
+export interface OAuthProviderInterface {
+    readonly id: OAuthProviderId;
+    readonly name: string;
+    /** Whether this provider uses a local callback server (vs manual code paste) */
+    readonly usesCallbackServer?: boolean;
+    /**
+     * Optional list of selectable auth flows. When set with two or more entries,
+     * the TUI prompts the user to pick a mode before starting the login flow and
+     * forwards the choice via `OAuthLoginCallbacks.authMode`.
+     */
+    readonly authModes?: ReadonlyArray<AuthMode>;
+    /** Run the login flow, return credentials to persist */
+    login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;
+    /** Refresh expired credentials, return updated credentials to persist */
+    refreshToken(credentials: OAuthCredentials): Promise<OAuthCredentials>;
+    /** Convert credentials to API key string for the provider */
+    getApiKey(credentials: OAuthCredentials): string;
+}
+export type ApiKeyCredential = {
+    type: 'api_key';
+    key: string;
+};
+export type OAuthCredential = {
+    type: 'oauth';
+} & OAuthCredentials;
+export type AuthCredential = ApiKeyCredential | OAuthCredential;
+export type AuthStorageData = Record<string, AuthCredential>;
+/**
+ * The read surface model resolution and the OAuth fetch wrappers need from a
+ * credential source. `AuthStorage` satisfies it structurally (file-backed,
+ * server-global); deployed web injects a per-tenant implementation backed by
+ * the app database so each caller's own credentials are used.
+ */
+export interface CredentialStore {
+    /** Whether model resolution may fall back to process environment credentials. */
+    readonly allowEnvironmentFallback?: boolean;
+    /** Refresh any cached view (no-op for sources that are always fresh). */
+    reload(): void;
+    /** Credential in the provider's main slot (`anthropic`, `openai-codex`, …). */
+    get(provider: string): AuthCredential | undefined;
+    /** Dedicated stored API key for a provider, if any. */
+    getStoredApiKey(provider: string): string | undefined;
+    /**
+     * Ready-to-use key/token for a provider, refreshing expired OAuth
+     * credentials first. Implementations own refresh serialization.
+     */
+    getApiKey(provider: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC;IACtC,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,gFAAgF;IAChF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAE7C,wDAAwD;IACxD,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjE,yEAAyE;IACzE,YAAY,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEvE,6DAA6D;IAC7D,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;CAClD;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,gBAAgB,CAAC;AAErB,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,yEAAyE;IACzE,MAAM,IAAI,IAAI,CAAC;IACf,+EAA+E;IAC/E,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAClD,uDAAuD;IACvD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtD;;;OAGG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1D"}

package/dist/auth/types.js

@@ -0,0 +1 @@
+export {};

package/dist/clipboard/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Platform-specific clipboard image extraction.
+ *
+ * Checks the system clipboard for image data and returns it as base64.
+ * Uses synchronous execution (execSync) since this only runs on paste events.
+ */
+export interface ClipboardImage {
+    data: string;
+    mimeType: string;
+}
+/**
+ * Read plain text from the system clipboard.
+ * Returns null if clipboard is empty or reading fails.
+ */
+export declare function getClipboardText(): string | null;
+/**
+ * Write plain text to the system clipboard.
+ * Returns true on success, false on failure.
+ */
+export declare function setClipboardText(text: string): boolean;
+/**
+ * Check the system clipboard for image data and return it as base64.
+ * Returns null if no image data is found or extraction fails.
+ */
+export declare function getClipboardImage(): ClipboardImage | null;
+//# sourceMappingURL=index.d.ts.map