@nathapp/nax-ai 0.1.2 → 0.1.3

package/README.md

@@ -33,6 +33,37 @@ While the API is unstable, `latest` and `next` both point at the current 0.x rel
 
 A `ToolDefinition` can carry an optional `constrainedSampling: { type: "json_schema"; strict: "prefer" | "require" }` to ask the provider to constrain a tool's arguments to its schema. Support is per-model, not caller-controllable — some models simply cannot honour it. `"prefer"` degrades silently to an unconstrained tool when the model lacks support, so a well-formed response is not evidence the constraint was applied; `"require"` throws instead of degrading.
 
+### Logging in
+
+`login()` obtains a credential and writes it to the store you pass. It covers
+both api-key entry and OAuth, choosing between them when a provider offers
+both, and returns metadata rather than the credential — the store already has
+it.
+
+```ts
+import { createFileCredentialStore, login } from "@nathapp/nax-ai";
+
+const credentials = createFileCredentialStore({ path: `${homedir()}/.nax/credentials` });
+
+const result = await login({
+  providerId: "openrouter",
+  credentials,
+  interaction: {
+    prompt: async (prompt) => ask(prompt.message),  // your UI
+    notify: (event) => render(event),
+  },
+});
+// result: { providerId: "openrouter", method: "oauth", kind: "oauth" }
+```
+
+Permitted OAuth flows are `openai-codex` and `openrouter`; see
+`PERMITTED_OAUTH_FLOWS`. A provider outside that list keeps its api-key login.
+
+There is no `logout`: removing a credential is `credentials.delete(providerId)`.
+Note that nothing is revoked upstream — the provider-side token stays valid
+until it expires, so a UI should say the credential was removed locally rather
+than that the user was logged out.
+
 ## Scope
 
 This package speaks a generic LLM vocabulary — models, messages, tool calls, usage, credentials. It knows nothing about any consumer's domain concepts, and that direction is one-way by design: consumers map onto their own types at their own boundary.

package/dist/auth/login-errors.d.ts

@@ -0,0 +1,24 @@
+import type { ProviderId } from "../types.ts";
+import type { LoginMethod } from "./login-types.ts";
+/**
+ * The provider offers no login method this package can run — either none at
+ * all, or not the one the caller named. Distinct from a policy refusal, which
+ * raises OAuthFlowProhibitedError: an absence and a prohibition send a reader
+ * to different problems.
+ */
+export declare class AuthMethodUnavailableError extends Error {
+    readonly providerId: ProviderId;
+    readonly requested: LoginMethod | undefined;
+    constructor(providerId: ProviderId, requested?: LoginMethod);
+}
+/** The user cancelled, or the caller aborted. Not a failure. */
+export declare class LoginCancelledError extends Error {
+    readonly providerId: ProviderId;
+    constructor(providerId: ProviderId);
+}
+/** The flow ran and did not produce a usable credential. */
+export declare class LoginFailedError extends Error {
+    readonly providerId: ProviderId;
+    constructor(providerId: ProviderId, reason: string);
+}
+//# sourceMappingURL=login-errors.d.ts.map

package/dist/auth/login-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-errors.d.ts","sourceRoot":"","sources":["../../src/auth/login-errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAIhC,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,SAAS,CAAC;IAE5C,YAAY,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,WAAW,EAS1D;CACF;AAED,gEAAgE;AAChE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,YAAY,UAAU,EAAE,UAAU,EAIjC;CACF;AAED,4DAA4D;AAC5D,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,YAAY,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAIjD;CACF"}

package/dist/auth/login-errors.js

@@ -0,0 +1,40 @@
+/**
+ * The provider offers no login method this package can run — either none at
+ * all, or not the one the caller named. Distinct from a policy refusal, which
+ * raises OAuthFlowProhibitedError: an absence and a prohibition send a reader
+ * to different problems.
+ */
+export class AuthMethodUnavailableError extends Error {
+    providerId;
+    // Declared as `| undefined` rather than optional: under
+    // exactOptionalPropertyTypes, assigning a possibly-undefined parameter to an
+    // optional field is a type error.
+    requested;
+    constructor(providerId, requested) {
+        super(requested === undefined
+            ? `Provider "${providerId}" offers no login method this package can run.`
+            : `Provider "${providerId}" does not offer "${requested}" login.`);
+        this.name = "AuthMethodUnavailableError";
+        this.providerId = providerId;
+        this.requested = requested;
+    }
+}
+/** The user cancelled, or the caller aborted. Not a failure. */
+export class LoginCancelledError extends Error {
+    providerId;
+    constructor(providerId) {
+        super(`Login to "${providerId}" was cancelled.`);
+        this.name = "LoginCancelledError";
+        this.providerId = providerId;
+    }
+}
+/** The flow ran and did not produce a usable credential. */
+export class LoginFailedError extends Error {
+    providerId;
+    constructor(providerId, reason) {
+        super(`Login to "${providerId}" failed: ${reason}`);
+        this.name = "LoginFailedError";
+        this.providerId = providerId;
+    }
+}
+//# sourceMappingURL=login-errors.js.map

package/dist/auth/login-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-errors.js","sourceRoot":"","sources":["../../src/auth/login-errors.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,UAAU,CAAa;IAChC,wDAAwD;IACxD,6EAA6E;IAC7E,kCAAkC;IACzB,SAAS,CAA0B;IAE5C,YAAY,UAAsB,EAAE,SAAuB;QACzD,KAAK,CACH,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,aAAa,UAAU,gDAAgD;YACzE,CAAC,CAAC,aAAa,UAAU,qBAAqB,SAAS,UAAU,CACpE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,UAAU,CAAa;IAEhC,YAAY,UAAsB;QAChC,KAAK,CAAC,aAAa,UAAU,kBAAkB,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,UAAU,CAAa;IAEhC,YAAY,UAAsB,EAAE,MAAc;QAChD,KAAK,CAAC,aAAa,UAAU,aAAa,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF"}

package/dist/auth/login-types.d.ts

@@ -0,0 +1,90 @@
+/**
+ * The vocabulary of a login, in nax-ai's own terms.
+ *
+ * pi-ai's equivalents are snake_case (`auth_url`, `device_code`, `manual_code`,
+ * `api_key`); these are kebab-case, matching `ProtocolError.kind`'s
+ * `rate-limit` and `bad-request`. That translation is the boundary: it is what
+ * keeps a rename upstream from becoming a breaking change here.
+ */
+import type { CredentialStore, ProviderId, StoredCredential } from "../types.ts";
+export type LoginMethod = "api-key" | "oauth";
+export interface LoginOption {
+    readonly id: string;
+    readonly label: string;
+    readonly description?: string;
+}
+/**
+ * `signal` cancels this one prompt — a flow uses it when an out-of-band event
+ * resolves the step, e.g. a manual-code prompt raced against a callback
+ * server. It is not the whole login's signal, which lives on `LoginOptions`.
+ */
+export type LoginPrompt = {
+    readonly signal?: AbortSignal;
+} & ({
+    readonly type: "text";
+    readonly message: string;
+    readonly placeholder?: string;
+} | {
+    readonly type: "secret";
+    readonly message: string;
+    readonly placeholder?: string;
+} | {
+    readonly type: "select";
+    readonly message: string;
+    readonly options: readonly LoginOption[];
+} | {
+    readonly type: "manual-code";
+    readonly message: string;
+    readonly placeholder?: string;
+});
+export interface LoginLink {
+    readonly url: string;
+    readonly label?: string;
+}
+export type LoginEvent = {
+    readonly type: "info";
+    readonly message: string;
+    readonly links?: readonly LoginLink[];
+} | {
+    readonly type: "auth-url";
+    readonly url: string;
+    readonly instructions?: string;
+} | {
+    readonly type: "device-code";
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly intervalSeconds?: number;
+    readonly expiresInSeconds?: number;
+} | {
+    readonly type: "progress";
+    readonly message: string;
+};
+/**
+ * Login interaction, serving both api-key and OAuth flows.
+ *
+ * `prompt()` returns the entered text or, for `select`, the chosen option id.
+ * Reject it to cancel.
+ */
+export interface LoginInteraction {
+    prompt(prompt: LoginPrompt): Promise<string>;
+    notify(event: LoginEvent): void;
+}
+export interface LoginOptions {
+    readonly providerId: ProviderId;
+    readonly credentials: CredentialStore;
+    readonly interaction: LoginInteraction;
+    /** Skips the method prompt. Throws if the named method is unavailable. */
+    readonly method?: LoginMethod;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Metadata, deliberately not the credential: `login()` has already written it
+ * to the store, and returning the secret would create a second copy with no
+ * consumer. A caller that cannot obtain it cannot leak it.
+ */
+export interface LoginResult {
+    readonly providerId: ProviderId;
+    readonly method: LoginMethod;
+    readonly kind: StoredCredential["kind"];
+}
+//# sourceMappingURL=login-types.d.ts.map

package/dist/auth/login-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-types.d.ts","sourceRoot":"","sources":["../../src/auth/login-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEjF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAE9C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,CAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAClF;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAA;CAAE,GAC/F;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAC5F,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACnF;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;CACzC"}

package/dist/auth/login-types.js

@@ -0,0 +1,10 @@
+/**
+ * The vocabulary of a login, in nax-ai's own terms.
+ *
+ * pi-ai's equivalents are snake_case (`auth_url`, `device_code`, `manual_code`,
+ * `api_key`); these are kebab-case, matching `ProtocolError.kind`'s
+ * `rate-limit` and `bad-request`. That translation is the boundary: it is what
+ * keeps a rename upstream from becoming a breaking change here.
+ */
+export {};
+//# sourceMappingURL=login-types.js.map

package/dist/auth/login-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-types.js","sourceRoot":"","sources":["../../src/auth/login-types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/auth/login.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Obtaining a credential, as opposed to holding or using one.
+ *
+ * This module never imports pi-ai: every provider-specific step is behind a
+ * LoginRunner that pi-auth.ts resolved. The credential is written to the
+ * caller's store before this returns, and never handed back.
+ */
+import type { LoginOptions, LoginResult } from "./login-types.ts";
+import { resolveLoginTarget } from "./pi-auth.ts";
+/** Test seam. */
+export declare const _resolveTarget: {
+    resolve: typeof resolveLoginTarget;
+};
+export declare function login(options: LoginOptions): Promise<LoginResult>;
+//# sourceMappingURL=login.d.ts.map

package/dist/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAe,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EAAoB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,iBAAiB;AACjB,eAAO,MAAM,cAAc;IAAK,OAAO;CAAsB,CAAC;AA8C9D,wBAAsB,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAgCvE"}

package/dist/auth/login.js

@@ -0,0 +1,84 @@
+/**
+ * Obtaining a credential, as opposed to holding or using one.
+ *
+ * This module never imports pi-ai: every provider-specific step is behind a
+ * LoginRunner that pi-auth.ts resolved. The credential is written to the
+ * caller's store before this returns, and never handed back.
+ */
+import { AuthMethodUnavailableError, LoginCancelledError, LoginFailedError } from "./login-errors.js";
+import { OAuthFlowProhibitedError } from "./oauth-policy.js";
+import { resolveLoginTarget } from "./pi-auth.js";
+/** Test seam. */
+export const _resolveTarget = { resolve: resolveLoginTarget };
+async function select(available, options, signal) {
+    const { providerId, method, interaction } = options;
+    if (method !== undefined) {
+        const named = available.find((choice) => choice.method === method);
+        if (named === undefined)
+            throw new AuthMethodUnavailableError(providerId, method);
+        return named;
+    }
+    const only = available.length === 1 ? available[0] : undefined;
+    if (only !== undefined)
+        return only;
+    const answer = await interaction.prompt({
+        type: "select",
+        message: `How do you want to sign in to "${providerId}"?`,
+        options: available.map((choice) => ({ id: choice.method, label: choice.runner.label })),
+        ...(signal !== undefined ? { signal } : {}),
+    });
+    const picked = available.find((choice) => choice.method === answer);
+    // An unrecognised answer is not a reason to guess: falling back to the first
+    // method would bill against a credential path the user did not choose.
+    if (picked === undefined)
+        throw new AuthMethodUnavailableError(providerId);
+    return picked;
+}
+function isCancellation(error, signal) {
+    if (signal.aborted)
+        return true;
+    return error instanceof Error && error.name === "AbortError";
+}
+/**
+ * A credential whose key is empty is not a credential. The store would accept
+ * it and every later call would fail with an auth error pointing nowhere near
+ * this login.
+ */
+function assertUsable(credential, providerId) {
+    if (credential.kind === "api-key" && credential.key.length === 0) {
+        throw new LoginFailedError(providerId, "the flow returned an empty API key");
+    }
+}
+export async function login(options) {
+    const { providerId, credentials, interaction, signal } = options;
+    const target = await _resolveTarget.resolve(providerId);
+    const available = [];
+    if (target.apiKey !== undefined)
+        available.push({ method: "api-key", runner: target.apiKey });
+    if (target.oauth !== undefined)
+        available.push({ method: "oauth", runner: target.oauth });
+    if (available.length === 0)
+        throw new AuthMethodUnavailableError(providerId);
+    const abort = signal ?? new AbortController().signal;
+    let chosen;
+    let credential;
+    try {
+        chosen = await select(available, options, abort);
+        credential = await chosen.runner.run(interaction, abort);
+    }
+    catch (error) {
+        // A policy refusal keeps its own identity: its recorded reason is the
+        // point, and a generic failure would discard it.
+        if (error instanceof OAuthFlowProhibitedError)
+            throw error;
+        if (isCancellation(error, abort))
+            throw new LoginCancelledError(providerId);
+        throw error;
+    }
+    assertUsable(credential, providerId);
+    // modify, never a bare write: it is what holds the store's lock across the
+    // whole read-modify-write.
+    await credentials.modify(providerId, async () => credential);
+    return { providerId, method: chosen.method, kind: credential.kind };
+}
+//# sourceMappingURL=login.js.map

package/dist/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEtG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAoB,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEpE,iBAAiB;AACjB,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAI9D,KAAK,UAAU,MAAM,CAAC,SAA4B,EAAE,OAAqB,EAAE,MAAmB;IAC5F,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAEpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;QACtC,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,kCAAkC,UAAU,IAAI;QACzD,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACpE,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,MAAmB;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,UAA4B,EAAE,UAAsB;IACxE,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB;IAC/C,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAExD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAE1F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAErD,IAAI,MAAc,CAAC;IACnB,IAAI,UAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,KAAK,YAAY,wBAAwB;YAAE,MAAM,KAAK,CAAC;QAC3D,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC;IACd,CAAC;IAED,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAErC,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;IAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC"}

package/dist/auth/oauth-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-policy.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,UAAU,EAIrD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAGtE,CAAC;AAEH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,YAAY,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAIjD;CACF;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAQrE"}
+{"version":3,"file":"oauth-policy.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,UAAU,EAAkD,CAAC;AAE1G;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAKtE,CAAC;AAEH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,YAAY,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAIjD;CACF;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAQrE"}

package/dist/auth/oauth-policy.js

@@ -20,17 +20,14 @@
  * provider whose terms permit third-party OAuth use, or whose flow is a
  * first-party developer credential rather than a consumer subscription.
  */
-export const PERMITTED_OAUTH_FLOWS = Object.freeze([
-    "openai-codex",
-    "github-copilot",
-    "openrouter",
-]);
+export const PERMITTED_OAUTH_FLOWS = Object.freeze(["openai-codex", "openrouter"]);
 /**
  * OAuth flows that must never be registered, with the reason recorded so a
  * future reader does not "fix" the omission.
  */
 export const PROHIBITED_OAUTH_FLOWS = Object.freeze({
     anthropic: "Anthropic subscription OAuth outside the official Claude CLI is server-blocked and a Consumer ToS violation. Route Claude subscription traffic through the official CLI instead.",
+    "github-copilot": "Not cleared: the upstream catalog marks this flow isSubscription: true, which fails this allowlist's 'first-party developer credential rather than a consumer subscription' clause, and its terms were never checked against the other one. This is an unresolved terms question, not an established violation like anthropic's — a review may reverse it on evidence. The provider's api-key login is unaffected.",
 });
 export class OAuthFlowProhibitedError extends Error {
     providerId;

package/dist/auth/oauth-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-policy.js","sourceRoot":"","sources":["../../src/auth/oauth-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0B,MAAM,CAAC,MAAM,CAAC;IACxE,cAAc;IACd,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyC,MAAM,CAAC,MAAM,CAAC;IACxF,SAAS,EACP,kLAAkL;CACrL,CAAC,CAAC;AAEH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,UAAU,CAAa;IAEhC,YAAY,UAAsB,EAAE,MAAc;QAChD,KAAK,CAAC,mBAAmB,UAAU,oBAAoB,MAAM,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAsB;IACzD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,uBAAuB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauth-policy.js","sourceRoot":"","sources":["../../src/auth/oauth-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA0B,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;AAE1G;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyC,MAAM,CAAC,MAAM,CAAC;IACxF,SAAS,EACP,kLAAkL;IACpL,gBAAgB,EACd,oZAAoZ;CACvZ,CAAC,CAAC;AAEH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,UAAU,CAAa;IAEhC,YAAY,UAAsB,EAAE,MAAc;QAChD,KAAK,CAAC,mBAAmB,UAAU,oBAAoB,MAAM,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAsB;IACzD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAsB;IAC7D,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,uBAAuB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC"}

package/dist/auth/pi-auth.d.ts

@@ -4,9 +4,52 @@
  * On the ALLOWED list in scripts/check-pi-ai-imports.ts. Nothing here leaks a
  * pi-ai type through an export a consumer sees.
  */
-import type { MutableModels, CredentialStore as PiCredentialStore } from "@earendil-works/pi-ai";
-import type { CredentialStore } from "../types.ts";
+import type { MutableModels, CredentialStore as PiCredentialStore, Provider as PiProvider } from "@earendil-works/pi-ai";
+import type { CredentialStore, ProviderId, StoredCredential } from "../types.ts";
+import type { LoginInteraction } from "./login-types.ts";
 import type { AuthResolver } from "./resolver.ts";
 export declare function toPiCredentialStore(store: CredentialStore): PiCredentialStore;
 export declare function createPiAuthResolver(models: MutableModels): AuthResolver;
+export interface LoginRunner {
+    /** Shown in the method prompt when a provider offers both. */
+    readonly label: string;
+    run(interaction: LoginInteraction, signal: AbortSignal): Promise<StoredCredential>;
+}
+export interface LoginTarget {
+    readonly apiKey?: LoginRunner;
+    readonly oauth?: LoginRunner;
+}
+/**
+ * Test seam. The real read is a dynamic import because pi-ai's provider table
+ * is large and only login needs it, matching pi-catalog.ts's own pattern.
+ */
+export declare const _loginDeps: {
+    providers: () => Promise<readonly PiProvider[]>;
+};
+/**
+ * Resolves which logins a provider can actually run.
+ *
+ * Reads pi's own two auth fields, NOT ResolvedProvider.auth: toProviderAuth
+ * resolves api-key over oauth when a provider declares both, which hides
+ * openrouter's OAuth flow (wrong) and anthropic's (right) indistinguishably.
+ *
+ * The allowlist is applied per method, not per provider, so a provider with a
+ * disallowed OAuth flow keeps its api-key login.
+ */
+export declare function resolveLoginTarget(providerId: ProviderId): Promise<LoginTarget>;
+/**
+ * Whether ambient auth alone would satisfy this provider.
+ *
+ * Enumerating env var names cannot answer this: ProviderAuth.env is
+ * descriptive only, often absent, and never read by auth resolution. pi's own
+ * resolve() returns undefined when a provider is not configured and already
+ * merges env vars, AWS profiles and ADC files, so asking it with no credential
+ * is the question exactly. check() is the side-effect-free variant, preferred
+ * because resolve() may execute commands.
+ *
+ * A probe that throws is reported as "not available" rather than propagated:
+ * this only ever decorates a diagnostic, and breaking the command it decorates
+ * would be worse than a missing warning.
+ */
+export declare function ambientAuthAvailable(providerId: ProviderId): Promise<boolean>;
 //# sourceMappingURL=pi-auth.d.ts.map

package/dist/auth/pi-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pi-auth.d.ts","sourceRoot":"","sources":["../../src/auth/pi-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAc,aAAa,EAAE,eAAe,IAAI,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC7G,OAAO,KAAK,EAAE,eAAe,EAA8B,MAAM,aAAa,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,eAAe,CAAC;AAoChE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CA8B7E;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,CAkBxE"}
+{"version":3,"file":"pi-auth.d.ts","sourceRoot":"","sources":["../../src/auth/pi-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,aAAa,EAGb,eAAe,IAAI,iBAAiB,EACpC,QAAQ,IAAI,UAAU,EACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,eAAe,EAAY,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3F,OAAO,KAAK,EAAc,gBAAgB,EAAe,MAAM,kBAAkB,CAAC;AAElF,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,eAAe,CAAC;AAoChE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,CA8B7E;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,CAkBxE;AAED,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAC9B;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB,SAAS,QAAY,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC;CAIpD,CAAC;AAQF;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAwCrF;AA+DD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBnF"}

package/dist/auth/pi-auth.js

@@ -4,6 +4,9 @@
  * On the ALLOWED list in scripts/check-pi-ai-imports.ts. Nothing here leaks a
  * pi-ai type through an export a consumer sees.
  */
+import { defaultProviderAuthContext } from "@earendil-works/pi-ai";
+import { AuthMethodUnavailableError, LoginFailedError } from "./login-errors.js";
+import { assertOAuthFlowPermitted, isOAuthFlowPermitted } from "./oauth-policy.js";
 function toPi(credential) {
     if (credential === undefined)
         return undefined;
@@ -81,4 +84,154 @@ export function createPiAuthResolver(models) {
         },
     };
 }
+/**
+ * Test seam. The real read is a dynamic import because pi-ai's provider table
+ * is large and only login needs it, matching pi-catalog.ts's own pattern.
+ */
+export const _loginDeps = {
+    providers: async () => {
+        const { builtinProviders } = await import("@earendil-works/pi-ai/providers/all");
+        return builtinProviders();
+    },
+};
+function required(credential, providerId) {
+    const stored = fromPi(credential);
+    if (stored === undefined)
+        throw new LoginFailedError(providerId, "the flow returned no credential");
+    return stored;
+}
+/**
+ * Resolves which logins a provider can actually run.
+ *
+ * Reads pi's own two auth fields, NOT ResolvedProvider.auth: toProviderAuth
+ * resolves api-key over oauth when a provider declares both, which hides
+ * openrouter's OAuth flow (wrong) and anthropic's (right) indistinguishably.
+ *
+ * The allowlist is applied per method, not per provider, so a provider with a
+ * disallowed OAuth flow keeps its api-key login.
+ */
+export async function resolveLoginTarget(providerId) {
+    const provider = (await _loginDeps.providers()).find((candidate) => candidate.id === providerId);
+    if (provider === undefined)
+        throw new AuthMethodUnavailableError(providerId);
+    const target = {};
+    const apiKeyAuth = provider.auth.apiKey;
+    if (apiKeyAuth?.login !== undefined) {
+        // bind rather than call detached: pi's flows are object methods and may
+        // read `this`.
+        const run = apiKeyAuth.login.bind(apiKeyAuth);
+        target.apiKey = {
+            label: apiKeyAuth.name,
+            run: async (interaction, signal) => required(await run({ ...toPiInteraction(interaction), signal }), providerId),
+        };
+    }
+    const oauthAuth = provider.auth.oauth;
+    if (oauthAuth !== undefined && isOAuthFlowPermitted(providerId)) {
+        const run = oauthAuth.login.bind(oauthAuth);
+        target.oauth = {
+            label: oauthAuth.loginLabel ?? oauthAuth.name,
+            run: async (interaction, signal) => {
+                // Before the loader is touched, not after: pi bundles every flow behind
+                // one lazy loader, so the gate must sit in front of it.
+                assertOAuthFlowPermitted(providerId);
+                return required(await run({ ...toPiInteraction(interaction), signal }), providerId);
+            },
+        };
+    }
+    if (target.apiKey === undefined && provider.auth.oauth !== undefined) {
+        // The provider's only method is an OAuth flow this package refuses to run.
+        // A policy refusal must not read as an absence: throw the policy error
+        // rather than AuthMethodUnavailableError. assertOAuthFlowPermitted
+        // distinguishes prohibited (OAuthFlowProhibitedError) from unknown.
+        assertOAuthFlowPermitted(providerId);
+    }
+    return target;
+}
+function fromPiPrompt(prompt) {
+    const signal = prompt.signal !== undefined ? { signal: prompt.signal } : {};
+    switch (prompt.type) {
+        case "manual_code":
+            return {
+                ...signal,
+                type: "manual-code",
+                message: prompt.message,
+                ...(prompt.placeholder !== undefined ? { placeholder: prompt.placeholder } : {}),
+            };
+        case "select":
+            return { ...signal, type: "select", message: prompt.message, options: prompt.options };
+        default:
+            return {
+                ...signal,
+                type: prompt.type,
+                message: prompt.message,
+                ...(prompt.placeholder !== undefined ? { placeholder: prompt.placeholder } : {}),
+            };
+    }
+}
+function fromPiEvent(event) {
+    switch (event.type) {
+        case "auth_url":
+            return {
+                type: "auth-url",
+                url: event.url,
+                ...(event.instructions !== undefined ? { instructions: event.instructions } : {}),
+            };
+        case "device_code":
+            return {
+                type: "device-code",
+                userCode: event.userCode,
+                verificationUri: event.verificationUri,
+                ...(event.intervalSeconds !== undefined ? { intervalSeconds: event.intervalSeconds } : {}),
+                ...(event.expiresInSeconds !== undefined ? { expiresInSeconds: event.expiresInSeconds } : {}),
+            };
+        case "info":
+            return { type: "info", message: event.message, ...(event.links !== undefined ? { links: event.links } : {}) };
+        default:
+            return { type: "progress", message: event.message };
+    }
+}
+/**
+ * Presents a consumer's LoginInteraction to pi. pi calls us, so this maps
+ * inward: pi's snake_case names become nax-ai's kebab-case ones.
+ */
+function toPiInteraction(interaction) {
+    return {
+        prompt: async (prompt) => interaction.prompt(fromPiPrompt(prompt)),
+        notify: (event) => {
+            interaction.notify(fromPiEvent(event));
+        },
+    };
+}
+/**
+ * Whether ambient auth alone would satisfy this provider.
+ *
+ * Enumerating env var names cannot answer this: ProviderAuth.env is
+ * descriptive only, often absent, and never read by auth resolution. pi's own
+ * resolve() returns undefined when a provider is not configured and already
+ * merges env vars, AWS profiles and ADC files, so asking it with no credential
+ * is the question exactly. check() is the side-effect-free variant, preferred
+ * because resolve() may execute commands.
+ *
+ * A probe that throws is reported as "not available" rather than propagated:
+ * this only ever decorates a diagnostic, and breaking the command it decorates
+ * would be worse than a missing warning.
+ */
+export async function ambientAuthAvailable(providerId) {
+    const provider = (await _loginDeps.providers()).find((candidate) => candidate.id === providerId);
+    const apiKey = provider?.auth.apiKey;
+    if (apiKey === undefined)
+        return false;
+    const ctx = defaultProviderAuthContext();
+    const signal = new AbortController().signal;
+    try {
+        // Bind rather than call detached: pi's auth objects are methods that may read `this`.
+        if (apiKey.check !== undefined) {
+            return (await apiKey.check.bind(apiKey)({ ctx, signal })) !== undefined;
+        }
+        return (await apiKey.resolve.bind(apiKey)({ ctx, signal })) !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=pi-auth.js.map

package/dist/auth/pi-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"pi-auth.js","sourceRoot":"","sources":["../../src/auth/pi-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,SAAS,IAAI,CAAC,UAAwC;IACpD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,UAAkC;IAChD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE9D,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAC/B,IAAI,CACF,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,gEAAgE;YAChE,2DAA2D;YAC3D,kEAAkE;YAClE,4DAA4D;YAC5D,+DAA+D;YAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC,CACH;QAEH,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC3B,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAa;YACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YAClC,OAAO;gBACL,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAC5B,CAAC,CAAC;wBACE,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC7F;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pi-auth.js","sourceRoot":"","sources":["../../src/auth/pi-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGnF,SAAS,IAAI,CAAC,UAAwC;IACpD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,UAAkC;IAChD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE;YACzB,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,OAAO,EAAE,UAAU,CAAC,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE9D,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAC/B,IAAI,CACF,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,gEAAgE;YAChE,2DAA2D;YAC3D,kEAAkE;YAClE,4DAA4D;YAC5D,+DAA+D;YAC/D,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC,CACH;QAEH,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;YAC3B,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAa;YACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;YAC1B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YAClC,OAAO;gBACL,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;oBAC5B,CAAC,CAAC;wBACE,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAC7F;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,KAAK,IAAoC,EAAE;QACpD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACjF,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;CACF,CAAC;AAEF,SAAS,QAAQ,CAAC,UAAsB,EAAE,UAAsB;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAsB;IAC7D,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACjG,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAkD,EAAE,CAAC;IAEjE,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;IACxC,IAAI,UAAU,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QACpC,wEAAwE;QACxE,eAAe;QACf,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,GAAG;YACd,KAAK,EAAE,UAAU,CAAC,IAAI;YACtB,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,CAAC;SACjH,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;IACtC,IAAI,SAAS,KAAK,SAAS,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,GAAG;YACb,KAAK,EAAE,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI;YAC7C,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;gBACjC,wEAAwE;gBACxE,wDAAwD;gBACxD,wBAAwB,CAAC,UAAU,CAAC,CAAC;gBACrC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;YACtF,CAAC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACrE,2EAA2E;QAC3E,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO;gBACL,GAAG,MAAM;gBACT,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACzF;YACE,OAAO;gBACL,GAAG,MAAM;gBACT,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAkB;IACrC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,UAAU;YACb,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9F,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChH;YACE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,WAA6B;IAIpD,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAChB,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAsB;IAC/D,MAAM,QAAQ,GAAG,CAAC,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAE5C,IAAI,CAAC;QACH,sFAAsF;QACtF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -11,7 +11,11 @@
  * this surface to be replaced — provider by provider — without consumers
  * noticing.
  */
+export { login } from "./auth/login.ts";
+export { AuthMethodUnavailableError, LoginCancelledError, LoginFailedError, } from "./auth/login-errors.ts";
+export type { LoginEvent, LoginInteraction, LoginLink, LoginMethod, LoginOption, LoginOptions, LoginPrompt, LoginResult, } from "./auth/login-types.ts";
 export { assertOAuthFlowPermitted, isOAuthFlowPermitted, OAuthFlowProhibitedError, PERMITTED_OAUTH_FLOWS, PROHIBITED_OAUTH_FLOWS, } from "./auth/oauth-policy.ts";
+export { ambientAuthAvailable } from "./auth/pi-auth.ts";
 export type { AuthResolver, ResolvedAuth } from "./auth/resolver.ts";
 export { type Client, type ClientOptions, type ClientRequest, createClient } from "./client.ts";
 export { createFileCredentialStore, type FileCredentialStoreOptions, } from "./credentials/file-store.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,OAAO,EAAE,gBAAgB,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,YAAY,EACV,OAAO,EACP,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,OAAO,EACP,WAAW,EACX,QAAQ,EACR,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,UAAU,EACV,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,WAAW,EACX,YAAY,EACZ,WAAW,EACX,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EACV,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,UAAU,EACV,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,aAAa,EACb,aAAa,EACb,QAAQ,EACR,cAAc,EACd,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,KAAK,OAAO,EAAE,gBAAgB,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,YAAY,EACV,OAAO,EACP,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,OAAO,EACP,WAAW,EACX,QAAQ,EACR,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -11,7 +11,10 @@
  * this surface to be replaced — provider by provider — without consumers
  * noticing.
  */
+export { login } from "./auth/login.js";
+export { AuthMethodUnavailableError, LoginCancelledError, LoginFailedError, } from "./auth/login-errors.js";
 export { assertOAuthFlowPermitted, isOAuthFlowPermitted, OAuthFlowProhibitedError, PERMITTED_OAUTH_FLOWS, PROHIBITED_OAUTH_FLOWS, } from "./auth/oauth-policy.js";
+export { ambientAuthAvailable } from "./auth/pi-auth.js";
 export { createClient } from "./client.js";
 export { createFileCredentialStore, } from "./credentials/file-store.js";
 export { createMemoryCredentialStore } from "./credentials/memory-store.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAuD,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACL,yBAAyB,GAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EACL,iBAAiB,EAGjB,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,cAAc,EAGd,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAgB7D,OAAO,EAAgB,gBAAgB,EAAmC,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAsBxD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAWhC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAuD,YAAY,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,EACL,yBAAyB,GAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EACL,iBAAiB,EAGjB,WAAW,GACZ,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,cAAc,EAGd,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAgB7D,OAAO,EAAgB,gBAAgB,EAAmC,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAsBxD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nathapp/nax-ai",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Provider-agnostic LLM client: completions, streaming, tool calls, usage and auth across API-key and OAuth providers.",
   "type": "module",
   "main": "./dist/index.js",