@nyte-ai/ai 0.0.0-stage → 0.0.18

package/dist/src/auth/oauth/openai-codex.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) flow: browser login races a localhost callback
+ * server on port 1455 against a manual paste prompt; device-code login covers
+ * headless boxes via the shared RFC 8628 poller. Node-only (node:crypto,
+ * node:http) and loaded lazily so browser builds never pull those in.
+ */
+import { type OAuthAuth } from "../types.ts";
+export declare const ORIGINATOR = "nyte";
+export declare function getAccountId(accessToken: string): string | null;
+export declare const openaiCodexOAuth: OAuthAuth;

package/dist/src/auth/oauth/openai-codex.js

@@ -0,0 +1,18 @@
+import {
+  ORIGINATOR2,
+  getAccountId2,
+  openaiCodexOAuth2
+} from "../../../chunks/account-limits-cache-xz65wyd1.js";
+import"../../../chunks/account-limits-cache-d1ypzqzp.js";
+import"../../../chunks/account-limits-cache-8vzx8k6r.js";
+import"../../../chunks/account-limits-cache-tc38g0ca.js";
+import"../../../chunks/account-limits-cache-b0x2sfya.js";
+import"../../../chunks/account-limits-cache-v4n30az2.js";
+import"../../../chunks/account-limits-cache-4hptgd2h.js";
+import"../../../chunks/account-limits-cache-j2bt392s.js";
+import"../../../chunks/account-limits-cache-b23sbrke.js";
+export {
+  ORIGINATOR2 as ORIGINATOR,
+  getAccountId2 as getAccountId,
+  openaiCodexOAuth2 as openaiCodexOAuth
+};

package/dist/src/auth/oauth/pkce.d.ts

@@ -0,0 +1,12 @@
+/**
+ * PKCE utilities using the Web Crypto API, so the same code runs in Node 20+
+ * and browsers.
+ */
+/**
+ * Generate PKCE code verifier and challenge.
+ * Uses Web Crypto API for cross-platform compatibility.
+ */
+export declare function generatePKCE(): Promise<{
+    verifier: string;
+    challenge: string;
+}>;

package/dist/src/auth/oauth/pkce.js

@@ -0,0 +1,6 @@
+import {
+  generatePKCE2
+} from "../../../chunks/account-limits-cache-tc38g0ca.js";
+export {
+  generatePKCE2 as generatePKCE
+};

package/dist/src/auth/resolve.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Provider auth resolution: explicit overrides first, then the stored
+ * credential (OAuth refreshed under the store lock with double-checked
+ * expiry), then ambient sources. Storage and refresh failures surface as
+ * `ModelsError` with a code the caller can branch on.
+ */
+import type { ProviderEnv } from "../types.ts";
+import type { AuthContext, AuthResult, CredentialStore, ProviderAuth } from "./types.ts";
+export type ModelsErrorCode = "model_source" | "model_validation" | "provider" | "stream" | "auth" | "oauth";
+export interface AuthResolutionOverrides {
+    apiKey?: string;
+    env?: ProviderEnv;
+    /** Require this much remaining OAuth-token validity; defaults to five minutes. */
+    minOAuthValidityMs?: number;
+    signal?: AbortSignal;
+}
+export declare class ModelsError extends Error {
+    readonly code: ModelsErrorCode;
+    constructor(code: ModelsErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Auth resolution shared by the `Models` and `ImagesModels` collections.
+ * A stored credential owns the provider: ambient/env is consulted only when
+ * nothing is stored. No silent env fallback after a failed refresh or for a
+ * credential type without a matching handler.
+ */
+export declare function resolveProviderAuth(provider: {
+    id: string;
+    auth: ProviderAuth;
+}, credentials: CredentialStore, authContext: AuthContext, overrides?: AuthResolutionOverrides): Promise<AuthResult | undefined>;
+/**
+ * Cap on one token refresh. Every refresh runs inside `CredentialStore.modify`,
+ * so this is also how long a refresh can hold the credential lock other clients
+ * are waiting on.
+ */
+export declare const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 15000;

package/dist/src/auth/resolve.js

@@ -0,0 +1,12 @@
+import {
+  ModelsError2,
+  resolveProviderAuth2,
+  DEFAULT_OAUTH_REFRESH_TIMEOUT_MS2
+} from "../../chunks/account-limits-cache-7z9s8j16.js";
+import"../../chunks/account-limits-cache-9wqk28n5.js";
+import"../../chunks/account-limits-cache-j2bt392s.js";
+export {
+  DEFAULT_OAUTH_REFRESH_TIMEOUT_MS2 as DEFAULT_OAUTH_REFRESH_TIMEOUT_MS,
+  ModelsError2 as ModelsError,
+  resolveProviderAuth2 as resolveProviderAuth
+};

package/dist/src/auth/store.d.ts

@@ -0,0 +1,29 @@
+import type { AuthOperationOptions, CredentialAccounts, CredentialInfo, CredentialStore } from "./types.ts";
+export declare function defaultAuthPath(): string;
+/**
+ * File-backed credential store. The file is created 0600 under a 0700
+ * directory. Storage failures reject instead of resolving empty, so a file
+ * that cannot be read is never replaced by one that drops its credentials.
+ */
+export declare class FileCredentialStore implements CredentialStore {
+    private readonly path;
+    private readonly lockPath;
+    constructor(path?: string);
+    /** Entries stay `unknown` so an unreadable credential survives another provider's write. */
+    private load;
+    /**
+     * Publish by rename so a concurrent reader never observes a half-written file. An advisory
+     * lock cannot make the held check and the rename one step; the check keeps a holder that
+     * already lost its lock from overwriting the current owner.
+     */
+    private save;
+    private withLock;
+    read(providerId: string, options?: AuthOperationOptions): Promise<CredentialAccounts | undefined>;
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
+    /**
+     * Persists a credential `fn` produced even when the caller stopped waiting: a refresh rotates
+     * the token the stored one replaces, so dropping it would leave a spent credential on disk.
+     */
+    modify(providerId: string, fn: (current: CredentialAccounts | undefined) => Promise<CredentialAccounts | undefined>, options?: AuthOperationOptions): Promise<CredentialAccounts | undefined>;
+    delete(providerId: string, options?: AuthOperationOptions): Promise<void>;
+}

package/dist/src/auth/store.js

@@ -0,0 +1,10 @@
+import {
+  defaultAuthPath2,
+  FileCredentialStore2
+} from "../../chunks/account-limits-cache-c7v93krb.js";
+import"../../chunks/account-limits-cache-b0x2sfya.js";
+import"../../chunks/account-limits-cache-rz8p1g5y.js";
+export {
+  FileCredentialStore2 as FileCredentialStore,
+  defaultAuthPath2 as defaultAuthPath
+};

package/dist/src/auth/types.d.ts

@@ -0,0 +1,291 @@
+import { Type } from "typebox";
+import type { ProviderEnv, ProviderHeaders } from "../types.ts";
+/**
+ * Request auth for a single model request. If a value cannot be expressed as
+ * `apiKey`, `headers`, or `baseUrl`, it is provider config, not auth.
+ */
+export interface ModelAuth {
+    apiKey?: string;
+    headers?: ProviderHeaders;
+    baseUrl?: string;
+}
+/**
+ * Stored api-key credential. `env` holds provider-scoped environment/config
+ * values such as Cloudflare account/gateway ids.
+ */
+export interface ApiKeyCredential {
+    type: "api_key";
+    key?: string;
+    env?: ProviderEnv;
+}
+/** Stored OAuth credential. */
+export interface OAuthCredential {
+    type: "oauth";
+    refresh: string;
+    access: string;
+    expires: number;
+    [key: string]: unknown;
+}
+/** An OAuth token endpoint's answer to a code exchange or a refresh. */
+export interface OAuthTokenResponse {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+}
+export declare const OAuthTokenResponseSchema: Type.TUnsafe<OAuthTokenResponse>;
+/** One type-tagged credential for a stored account. */
+export type Credential = ApiKeyCredential | OAuthCredential;
+/** A named provider account. Its local id stays stable across token refreshes. */
+export interface CredentialAccount {
+    readonly id: string;
+    readonly label: string;
+    readonly credential: Credential;
+}
+/** A provider's accounts and explicit selection, mutated together under the store lock. */
+export interface CredentialAccounts {
+    readonly active: string | null;
+    readonly accounts: readonly CredentialAccount[];
+}
+/** Non-secret credential metadata for account/status enumeration. */
+export interface CredentialInfo {
+    providerId: string;
+    id: string;
+    label: string;
+    type: Credential["type"];
+    active: boolean;
+}
+/** Parse persisted accounts and migrate a previous single credential at the storage boundary. */
+export declare function readCredentialAccounts(value: unknown): CredentialAccounts | undefined;
+/** Optional cancellation for public auth and credential operations. */
+export interface AuthOperationOptions {
+    signal?: AbortSignal;
+}
+/**
+ * App-owned account storage, keyed by `Provider.id`. `modify` is the only write path, so every mutation is a
+ * serialized read-modify-write; `Models.getAuth()` runs OAuth refresh inside
+ * `modify` so concurrent requests cannot double-refresh a rotated token. The
+ * app appends and selects a completed login inside `modify`. Login/logout orchestration
+ * is app-owned.
+ *
+ * Error semantics: `read` resolves `undefined` for missing entries. Methods
+ * reject only on storage failure; `Models` wraps such rejections in
+ * `ModelsError` with code "auth". Best-effort stores that serve an in-memory
+ * view and record persistence errors internally (like coding-agent's
+ * AuthStorage) are valid implementations.
+ */
+export interface CredentialStore {
+    /**
+     * Read stored accounts, including possibly expired credentials. Display/status use;
+     * resolved request auth comes from `Models.getAuth()`.
+     */
+    read(providerId: string, options?: AuthOperationOptions): Promise<CredentialAccounts | undefined>;
+    /**
+     * List stored credential metadata without resolving or exposing secrets.
+     * Implementations must not execute configured API-key commands while listing.
+     */
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
+    /**
+     * Serialized write, the only write path. `fn` sees the current accounts
+     * because correct writes (refresh, login-during-refresh) depend on it;
+     * return the new collection, or undefined to leave the entry unchanged.
+     * Mutual exclusion per provider id, cross-process too where the backing
+     * store supports it (e.g. a file lock). Resolves with the post-write
+     * collection. Rejections from `fn` propagate. A collection `fn` returned is
+     * stored even when the operation aborts afterwards, because a refresh has
+     * already rotated the token the stored one replaces.
+     * An empty account collection removes the provider entry atomically.
+     */
+    modify(providerId: string, fn: (current: CredentialAccounts | undefined) => Promise<CredentialAccounts | undefined>, options?: AuthOperationOptions): Promise<CredentialAccounts | undefined>;
+    /** Remove every account for a provider. Implementations serialize this against `modify`. */
+    delete(providerId: string, options?: AuthOperationOptions): Promise<void>;
+}
+/** Environment access for auth resolution. Injectable for tests and browsers. */
+export interface AuthContext {
+    env(name: string): Promise<string | undefined>;
+    /** Check whether a file exists. Supports a leading `~`. Always false in browsers. */
+    fileExists(path: string): Promise<boolean>;
+}
+/** Result of resolving auth for a model. */
+export interface AuthResult {
+    auth: ModelAuth;
+    /** Local stored-account id captured for this request; absent for ambient or explicit auth. */
+    accountId?: string;
+    /** Provider-scoped environment/config values resolved from credentials and ambient context. */
+    env?: ProviderEnv;
+    /** Human-readable label for status UI: "ANTHROPIC_API_KEY", "OAuth", "~/.aws/credentials". */
+    source?: string;
+}
+export interface AuthCheck {
+    source?: string;
+    type: "api_key" | "oauth";
+}
+export type AuthType = "api_key" | "oauth";
+/**
+ * Prompt shown to the user during login. `signal` lets the flow cancel a
+ * pending prompt when an out-of-band event resolves the step, e.g. a
+ * `manual_code` prompt raced against a callback server, aborted when the
+ * callback wins.
+ */
+export type AuthPrompt = {
+    signal?: AbortSignal;
+} & ({
+    type: "text";
+    message: string;
+    placeholder?: string;
+} | {
+    type: "secret";
+    message: string;
+    placeholder?: string;
+} | {
+    type: "select";
+    message: string;
+    options: readonly {
+        id: string;
+        label: string;
+        description?: string;
+    }[];
+} | {
+    type: "manual_code";
+    message: string;
+    placeholder?: string;
+});
+export interface AuthInfoLink {
+    url: string;
+    label?: string;
+}
+export type AuthEvent = {
+    type: "info";
+    message: string;
+    links?: readonly AuthInfoLink[];
+} | {
+    type: "auth_url";
+    url: string;
+    instructions?: string;
+} | {
+    type: "device_code";
+    userCode: string;
+    verificationUri: string;
+    intervalSeconds?: number;
+    expiresInSeconds?: number;
+    /** Shown with the code for as long as the code is; a later event never replaces it. */
+    instructions?: string;
+} | {
+    type: "progress";
+    message: string;
+};
+/**
+ * Login interaction callbacks serving both api-key and OAuth flows.
+ *
+ * `prompt()` returns the entered/selected string (`select` returns the option
+ * id). Rejects on cancel/abort. `signal` aborts the whole login flow;
+ * per-prompt cancellation uses `AuthPrompt.signal`.
+ */
+export interface AuthInteraction {
+    signal?: AbortSignal;
+    browser?: "host" | "elsewhere" | undefined;
+    prompt(prompt: AuthPrompt): Promise<string>;
+    notify(event: AuthEvent): void;
+}
+/** Normalized interaction passed to provider login implementations. */
+export type ProviderAuthInteraction = AuthInteraction & {
+    signal: AbortSignal;
+};
+/**
+ * Api-key auth: stored key/provider env plus ambient sources (env vars, AWS
+ * profiles, ADC files). Ambient-only providers omit `login`.
+ */
+export interface ApiKeyAuth {
+    /** Display name, e.g. "Anthropic API key". */
+    name: string;
+    /** Interactive setup (prompt for key/provider env). Absent = ambient-only. */
+    login?(interaction: ProviderAuthInteraction): Promise<ApiKeyCredential>;
+    /**
+     * Optional side-effect-free availability check. Use this when `resolve()` may
+     * execute commands or perform other request-time work. Missing means Models
+     * checks availability by resolving auth.
+     */
+    check?(input: {
+        ctx: AuthContext;
+        credential?: ApiKeyCredential;
+        signal: AbortSignal;
+    }): Promise<AuthCheck | undefined>;
+    /**
+     * Resolve auth from the stored credential and/or ambient sources, merging
+     * per field (`credential.key ?? env("...")`, `credential.env?.NAME ?? env("...")`).
+     * undefined = not configured. Resolution is provider-scoped; model-specific
+     * endpoint preparation happens after auth has been resolved.
+     */
+    resolve(input: {
+        ctx: AuthContext;
+        credential?: ApiKeyCredential;
+        signal: AbortSignal;
+    }): Promise<AuthResult | undefined>;
+}
+/**
+ * OAuth auth. The `refresh`/`toAuth` split lets `Models` own the locked
+ * refresh pattern: `refresh` produces a credential, `toAuth` derives request
+ * auth from whatever credential ends up stored.
+ */
+export interface OAuthAuth {
+    /** Display name, e.g. "Anthropic (Claude Pro/Max)". */
+    name: string;
+    /** Whether access through this auth method is backed by a provider subscription. */
+    isSubscription?: boolean;
+    /** Selector label for the OAuth login option, e.g. "Sign in with SuperGrok or X Premium". */
+    loginLabel?: string;
+    /** Availability of externally managed OAuth, without refreshing or importing its credentials. */
+    check?(input: {
+        ctx: AuthContext;
+        signal: AbortSignal;
+    }): Promise<AuthCheck | undefined>;
+    login(interaction: ProviderAuthInteraction): Promise<OAuthCredential>;
+    /**
+     * Exchange the refresh token. Network call; throws on failure
+     * (invalid_grant etc.). `Models` runs this under the store lock.
+     */
+    refresh(credential: OAuthCredential, signal: AbortSignal): Promise<OAuthCredential>;
+    /**
+     * Side-effect-free derivation of request auth from a valid credential.
+     * Covers per-credential baseUrl (GitHub Copilot). Async so lazy wrappers
+     * can load the implementation on first use.
+     */
+    toAuth(credential: OAuthCredential): Promise<ModelAuth>;
+}
+/**
+ * Provider auth. At least one of `apiKey`/`oauth` must be present: even
+ * ambient-credential providers and keyless local servers provide `apiKey`
+ * auth whose `resolve()` reports whether the provider is configured.
+ */
+export interface ProviderAuth {
+    apiKey?: ApiKeyAuth;
+    oauth?: OAuthAuth;
+    /**
+     * Prove resolved auth against the provider with one cheap, non-generating
+     * request. Network failures may throw; `Models.verifyAuth()` reports them as
+     * `unreachable`. Results must not carry secret material.
+     */
+    verify?(input: {
+        auth: ModelAuth;
+        ctx: AuthContext;
+        signal: AbortSignal;
+    }): Promise<ProviderAuthVerification>;
+}
+export type AuthVerification = {
+    readonly ok: true;
+    readonly source: string;
+    /** False when a credential is present but no provider request proved it. */
+    readonly verified: boolean;
+    readonly detail?: string;
+} | {
+    readonly ok: false;
+    readonly reason: "unconfigured" | "rejected" | "unreachable";
+    readonly message: string;
+};
+/** A provider's verdict; `Models.verifyAuth()` adds the credential source. */
+export type ProviderAuthVerification = {
+    readonly ok: true;
+    readonly verified?: false;
+    readonly detail?: string;
+} | Extract<AuthVerification, {
+    ok: false;
+}>;

package/dist/src/auth/types.js

@@ -0,0 +1,8 @@
+import {
+  OAuthTokenResponseSchema2,
+  readCredentialAccounts2
+} from "../../chunks/account-limits-cache-b0x2sfya.js";
+export {
+  OAuthTokenResponseSchema2 as OAuthTokenResponseSchema,
+  readCredentialAccounts2 as readCredentialAccounts
+};

package/dist/src/auth/verify.d.ts

@@ -0,0 +1,13 @@
+import type { ProviderHeaders } from "../types.ts";
+import type { ProviderAuthVerification } from "./types.ts";
+/**
+ * GET an authenticated endpoint and read the credential verdict from its
+ * status: 2xx accepts, 401/403 rejects, anything else leaves it unproven.
+ */
+export declare function verifyWithRequest(input: {
+    provider: string;
+    url: string;
+    headers: ProviderHeaders;
+    signal: AbortSignal;
+    detail?: (body: unknown) => string | undefined;
+}): Promise<ProviderAuthVerification>;

package/dist/src/auth/verify.js

@@ -0,0 +1,7 @@
+import {
+  verifyWithRequest2
+} from "../../chunks/account-limits-cache-ydq8p8qp.js";
+import"../../chunks/account-limits-cache-ag5b8dja.js";
+export {
+  verifyWithRequest2 as verifyWithRequest
+};

package/dist/src/bun-oauth.d.ts

@@ -0,0 +1,2 @@
+/** Register the OAuth flows included in this host bundle. */
+export declare function registerBunOAuthFlows(): void;

package/dist/src/bun-oauth.js

@@ -0,0 +1,25 @@
+import"../chunks/account-limits-cache-b23sbrke.js";
+import"../chunks/account-limits-cache-b0x2sfya.js";
+import"../chunks/account-limits-cache-d1ypzqzp.js";
+import"../chunks/account-limits-cache-8vzx8k6r.js";
+import {
+  registerOAuthFlow2
+} from "../chunks/account-limits-cache-v4n30az2.js";
+import"../chunks/account-limits-cache-tc38g0ca.js";
+import {
+  anthropicOAuth2
+} from "../chunks/account-limits-cache-4fn5w63p.js";
+import"../chunks/account-limits-cache-j2bt392s.js";
+import"../chunks/account-limits-cache-4hptgd2h.js";
+import {
+  openaiCodexOAuth2
+} from "../chunks/account-limits-cache-xz65wyd1.js";
+
+// src/bun-oauth.ts
+function registerBunOAuthFlows() {
+  registerOAuthFlow2("anthropic", anthropicOAuth2);
+  registerOAuthFlow2("openaiCodex", openaiCodexOAuth2);
+}
+export {
+  registerBunOAuthFlows
+};

package/dist/src/env-api-keys.d.ts

@@ -0,0 +1,32 @@
+/**
+ * API-key discovery from environment variables, per provider. Reports which
+ * variables are set (`findEnvKeys`) and resolves the key a request may use
+ * (`getEnvApiKey`); ANTHROPIC_AUTH_TOKEN is reported but never returned as an
+ * API key because requests must send it as a bearer token.
+ */
+import type { KnownProvider, ProviderEnv } from "./types.ts";
+export declare const ANTHROPIC_AUTH_TOKEN_ENV = "ANTHROPIC_AUTH_TOKEN";
+export declare const ANTHROPIC_OAUTH_TOKEN_ENV = "ANTHROPIC_OAUTH_TOKEN";
+export declare const ANTHROPIC_API_KEY_ENV = "ANTHROPIC_API_KEY";
+export declare const ANTHROPIC_FEDERATION_RULE_ID_ENV = "ANTHROPIC_FEDERATION_RULE_ID";
+export declare const ANTHROPIC_ORGANIZATION_ID_ENV = "ANTHROPIC_ORGANIZATION_ID";
+export declare const ANTHROPIC_SERVICE_ACCOUNT_ID_ENV = "ANTHROPIC_SERVICE_ACCOUNT_ID";
+export declare const ANTHROPIC_IDENTITY_TOKEN_FILE_ENV = "ANTHROPIC_IDENTITY_TOKEN_FILE";
+export declare const ANTHROPIC_WORKSPACE_ID_ENV = "ANTHROPIC_WORKSPACE_ID";
+export declare const ANTHROPIC_ENV_KEYS: readonly ["ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+/**
+ * Find configured environment variables that can provide an API key for a provider.
+ *
+ * This only reports actual API key variables. It intentionally excludes ambient
+ * credential sources such as AWS profiles, AWS IAM credentials, and Google
+ * Application Default Credentials.
+ */
+export declare function findEnvKeys(provider: KnownProvider, env?: ProviderEnv): string[] | undefined;
+export declare function findEnvKeys(provider: string, env?: ProviderEnv): string[] | undefined;
+/**
+ * Get API key for provider from known environment variables, e.g. OPENAI_API_KEY.
+ *
+ * Will not return API keys for providers that require OAuth tokens.
+ */
+export declare function getEnvApiKey(provider: KnownProvider, env?: ProviderEnv): string | undefined;
+export declare function getEnvApiKey(provider: string, env?: ProviderEnv): string | undefined;

package/dist/src/env-api-keys.js

@@ -0,0 +1,27 @@
+import {
+  ANTHROPIC_AUTH_TOKEN_ENV2,
+  ANTHROPIC_OAUTH_TOKEN_ENV2,
+  ANTHROPIC_API_KEY_ENV2,
+  ANTHROPIC_FEDERATION_RULE_ID_ENV2,
+  ANTHROPIC_ORGANIZATION_ID_ENV2,
+  ANTHROPIC_SERVICE_ACCOUNT_ID_ENV2,
+  ANTHROPIC_IDENTITY_TOKEN_FILE_ENV2,
+  ANTHROPIC_WORKSPACE_ID_ENV2,
+  ANTHROPIC_ENV_KEYS2,
+  findEnvKeys2,
+  getEnvApiKey2
+} from "../chunks/account-limits-cache-hyzn1jmk.js";
+import"../chunks/account-limits-cache-b23sbrke.js";
+export {
+  ANTHROPIC_API_KEY_ENV2 as ANTHROPIC_API_KEY_ENV,
+  ANTHROPIC_AUTH_TOKEN_ENV2 as ANTHROPIC_AUTH_TOKEN_ENV,
+  ANTHROPIC_ENV_KEYS2 as ANTHROPIC_ENV_KEYS,
+  ANTHROPIC_FEDERATION_RULE_ID_ENV2 as ANTHROPIC_FEDERATION_RULE_ID_ENV,
+  ANTHROPIC_IDENTITY_TOKEN_FILE_ENV2 as ANTHROPIC_IDENTITY_TOKEN_FILE_ENV,
+  ANTHROPIC_OAUTH_TOKEN_ENV2 as ANTHROPIC_OAUTH_TOKEN_ENV,
+  ANTHROPIC_ORGANIZATION_ID_ENV2 as ANTHROPIC_ORGANIZATION_ID_ENV,
+  ANTHROPIC_SERVICE_ACCOUNT_ID_ENV2 as ANTHROPIC_SERVICE_ACCOUNT_ID_ENV,
+  ANTHROPIC_WORKSPACE_ID_ENV2 as ANTHROPIC_WORKSPACE_ID_ENV,
+  findEnvKeys2 as findEnvKeys,
+  getEnvApiKey2 as getEnvApiKey
+};

package/dist/src/file-models-store.d.ts

@@ -0,0 +1,18 @@
+import type { ModelsStore, ModelsStoreEntry, ModelsStoreOperationOptions } from "./models-store.ts";
+export declare function defaultModelsStorePath(): string;
+/**
+ * A catalog cache, not secrets: unreadable content reads as empty and heals
+ * on the next write. A malformed provider entry is ignored until a hosted
+ * refresh replaces it. A legacy pre-filtered entry serves its models without
+ * validators, so the next refresh fetches the full catalog.
+ */
+export declare class FileModelsStore implements ModelsStore {
+    private readonly path;
+    constructor(path?: string);
+    private load;
+    private rawCatalogs;
+    private save;
+    read(providerId: string, options?: ModelsStoreOperationOptions): Promise<ModelsStoreEntry | undefined>;
+    write(providerId: string, entry: ModelsStoreEntry, options?: ModelsStoreOperationOptions): Promise<void>;
+    delete(providerId: string, options?: ModelsStoreOperationOptions): Promise<void>;
+}

package/dist/src/file-models-store.js

@@ -0,0 +1,9 @@
+import {
+  defaultModelsStorePath2,
+  FileModelsStore2
+} from "../chunks/account-limits-cache-a55e14fr.js";
+import"../chunks/account-limits-cache-rz8p1g5y.js";
+export {
+  FileModelsStore2 as FileModelsStore,
+  defaultModelsStorePath2 as defaultModelsStorePath
+};

package/dist/src/index.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @nyte-ai/ai: the provider layer. Side-effect free: provider factories and API
+ * implementations are exported explicitly below; nothing registers globally.
+ */
+export type { Static, TSchema } from "typebox";
+export { Type } from "typebox";
+export type { AnthropicEffort, AnthropicOptions, AnthropicThinkingDisplay, } from "./api/anthropic-messages.ts";
+export * from "./api/deferred.ts";
+export type { GoogleOptions } from "./api/google-generative-ai.ts";
+export * from "./api/lazy.ts";
+export { OpenAICodexCompactionError } from "./api/openai-codex-compaction-error.ts";
+export type { OpenAICodexCompactResult } from "./api/openai-codex-compact.ts";
+export type { OpenAICodexResponsesOptions } from "./api/openai-codex-protocol.ts";
+export type { OpenAICompletionsOptions } from "./api/openai-completions-params.ts";
+export type { OpenAIResponsesOptions } from "./api/openai-responses.ts";
+export type { OpenAICompactResult } from "./api/openai-compact.ts";
+export * from "./auth/context.ts";
+export * from "./auth/credential-store.ts";
+export * from "./auth/helpers.ts";
+export * from "./auth/types.ts";
+export { defaultAuthPath, FileCredentialStore } from "./auth/store.ts";
+export { defaultModelsStorePath, FileModelsStore } from "./file-models-store.ts";
+export { ModelsError, resolveProviderAuth, type AuthResolutionOverrides, type ModelsErrorCode, } from "./auth/resolve.ts";
+export { anthropicOAuth } from "./auth/oauth/anthropic.ts";
+export { githubCopilotOAuth, type GitHubCopilotOAuthOptions } from "./auth/oauth/github-copilot.ts";
+export { getAccountId, openaiCodexOAuth } from "./auth/oauth/openai-codex.ts";
+export { loadAnthropicOAuth, loadOpenAICodexOAuth } from "./auth/oauth/load.ts";
+export { oauthErrorHtml, oauthSuccessHtml } from "./auth/oauth/oauth-page.ts";
+export { generatePKCE } from "./auth/oauth/pkce.ts";
+export { abortableSleep, pollOAuthDeviceCodeFlow, type OAuthDeviceCodePollOptions, type OAuthDeviceCodePollResult, } from "./auth/oauth/device-code.ts";
+export * from "./env-api-keys.ts";
+export * from "./models.ts";
+export { getFastModeCostMultiplier } from "./model-pricing.ts";
+export { baseModel, FAST_MODEL_SUFFIX, fastModelId, providerIdentity, supportsFastMode, withFastVariants, } from "./model-variants.ts";
+export * from "./models-store.ts";
+export * from "./prompt-cache.ts";
+export * from "./session-resources.ts";
+export * from "./types.ts";
+export type { ApiOptionsMap, ApiStreamOptions } from "./api-options.ts";
+export * from "./utils/diagnostics.ts";
+export * from "./utils/estimate.ts";
+export * from "./utils/event-stream.ts";
+export * from "./utils/json-parse.ts";
+export * from "./utils/failure.ts";
+export * from "./utils/overflow.ts";
+export * from "./utils/retry.ts";
+export { contentText, getSystemMessageText, renderSystemMessageUpdate } from "./utils/text.ts";
+export * from "./utils/transcript.ts";
+export * from "./utils/typebox-helpers.ts";
+export { uuidv7 } from "./utils/uuid.ts";
+export * from "./utils/validation.ts";
+export { anthropicProvider } from "./providers/anthropic.ts";
+export { createNyteModels, defaultModelPerProvider, nyteProviders, } from "./providers/nyte-catalog.ts";
+export { githubCopilotProvider } from "./providers/github-copilot.ts";
+export { opencodeGoProvider } from "./providers/opencode-go.ts";
+export { opencodeProvider } from "./providers/opencode.ts";
+export { openaiProvider } from "./providers/openai.ts";
+export { openaiCodexProvider } from "./providers/openai-codex.ts";
+export { fetchOpenAICodexAccountLimits } from "./providers/openai-codex-limits.ts";
+export { fetchAnthropicAccountLimits } from "./providers/anthropic-limits.ts";
+export { openrouterProvider } from "./providers/openrouter.ts";
+export { vercelAiGatewayProvider } from "./providers/vercel-ai-gateway.ts";