@pentoshi/clai 4.12.1 → 4.13.0

package/dist/llm/qoder/qoder-login.js

@@ -0,0 +1,153 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { exchangeQoderPersonalToken, importQoderCliCredential, parseQoderToken, pickString, qoderAuthHeaders, QoderAuthError, QODER_OPENAPI_ORIGIN, readQoderAuthResponse, readQoderMachineId, readQoderMachineIdentity, } from "./qoder-auth.js";
+import { qoderCredentialFromImport, signQoderCredential, } from "./qoder-credential.js";
+export const QODER_WEB_ORIGIN = "https://qoder.com";
+export const QODER_PAT_URL = `${QODER_WEB_ORIGIN}/account/integrations`;
+export const QODER_DEVICE_CLIENT_ID = "e883ade2-e6e3-4d6d-adf7-f92ceff5fdcb";
+export const QODER_UI_LOGIN_TIMEOUT_MS = 180_000;
+export function canOpenQoderBrowser(env = process.env, platform = process.platform) {
+    if (env.CLAI_NO_BROWSER || env.CI || env.DEBIAN_FRONTEND === "noninteractive")
+        return false;
+    if (env.BROWSER === "none" || env.BROWSER === "www-browser")
+        return false;
+    if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+        return false;
+    return platform !== "linux" || Boolean(env.DISPLAY || env.WAYLAND_DISPLAY || env.MIR_SOCKET);
+}
+async function localMachineId(claiHome) {
+    const path = join(claiHome, "qoder-machine-id");
+    try {
+        const stored = (await readFile(path, "utf8")).trim();
+        if (stored)
+            return stored;
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    await mkdir(claiHome, { recursive: true, mode: 0o700 });
+    const id = randomUUID();
+    try {
+        await writeFile(path, id, { mode: 0o600, flag: "wx" });
+        return id;
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "EEXIST"))
+            throw error;
+        const stored = (await readFile(path, "utf8")).trim();
+        if (!stored)
+            throw new QoderAuthError("Qoder machine identity is empty. Remove ~/.clai/qoder-machine-id and retry.");
+        return stored;
+    }
+}
+export async function getQoderLoginIdentity(options = {}) {
+    const [cliId, machine] = await Promise.all([
+        readQoderMachineId(options.qoderHome),
+        readQoderMachineIdentity(options.qoderHome),
+    ]);
+    return {
+        machineId: cliId ?? await localMachineId(options.claiHome ?? join(homedir(), ".clai")),
+        machineToken: machine?.machineToken ?? "",
+        machineCode: machine?.machineCode,
+        machineType: machine?.machineType,
+    };
+}
+export async function startQoderDeviceAuth(options = {}) {
+    options.signal?.throwIfAborted();
+    const identity = options.identity ?? await getQoderLoginIdentity();
+    options.signal?.throwIfAborted();
+    const verifier = randomBytes(64).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    const nonce = randomUUID();
+    const params = new URLSearchParams({
+        challenge,
+        challenge_method: "S256",
+        nonce,
+        machine_id: identity.machineId,
+        client_id: QODER_DEVICE_CLIENT_ID,
+    });
+    if (identity.machineToken)
+        params.set("machine_token", identity.machineToken);
+    return { authUrl: `${QODER_WEB_ORIGIN}/device/selectAccounts?${params}`, nonce, verifier, identity };
+}
+async function finishQoderLogin(tokens, identity, loginMethod, options, personalAccessToken) {
+    const timeout = AbortSignal.timeout(20_000);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    signal.throwIfAborted();
+    const response = await (options.fetcher ?? fetch)(`${QODER_OPENAPI_ORIGIN}/api/v1/userinfo`, {
+        headers: { ...qoderAuthHeaders(), Authorization: `Bearer ${tokens.accessToken}` },
+        signal,
+    });
+    const profile = await readQoderAuthResponse(response);
+    const uid = pickString(profile, "id", "user_id", "uid");
+    if (!uid)
+        throw new QoderAuthError("Qoder profile did not include an account id.");
+    const credential = await signQoderCredential({
+        ...identity,
+        uid,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expireTime: tokens.expiresAt !== undefined ? Math.floor(tokens.expiresAt / 1000) : undefined,
+        refreshTokenExpireTime: tokens.refreshTokenExpiresAt !== undefined ? Math.floor(tokens.refreshTokenExpiresAt / 1000) : undefined,
+        email: pickString(profile, "email"),
+        name: pickString(profile, "name", "username", "user_name"),
+        personalAccessToken,
+        loginMethod,
+        dataPolicyAgreed: profile.data_policy_agreed === true || profile.dataPolicyAgreed === true,
+    });
+    signal.throwIfAborted();
+    return credential;
+}
+export async function pollQoderDeviceAuth(start, options = {}) {
+    const deadline = AbortSignal.timeout(options.timeoutMs ?? QODER_UI_LOGIN_TIMEOUT_MS);
+    const signal = options.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+    const params = new URLSearchParams({ nonce: start.nonce, verifier: start.verifier, challenge_method: "S256" });
+    const url = `${QODER_OPENAPI_ORIGIN}/api/v1/deviceToken/poll?${params}`;
+    let failures = 0;
+    for (;;) {
+        signal.throwIfAborted();
+        let response;
+        try {
+            response = await (options.fetcher ?? fetch)(url, {
+                headers: qoderAuthHeaders(),
+                signal: AbortSignal.any([signal, AbortSignal.timeout(20_000)]),
+            });
+            failures = 0;
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            if (++failures >= 3)
+                throw error;
+        }
+        if (response && response.status !== 404) {
+            const tokens = parseQoderToken(await readQoderAuthResponse(response));
+            return finishQoderLogin(tokens, start.identity, "browser", { ...options, signal });
+        }
+        await response?.body?.cancel();
+        await delay(options.intervalMs ?? 1000, undefined, { signal });
+    }
+}
+export async function loginQoderWithPat(personalAccessToken, options = {}) {
+    const pat = personalAccessToken.trim();
+    if (!pat)
+        throw new QoderAuthError("A Qoder personal access token is required.");
+    options.signal?.throwIfAborted();
+    const identity = options.identity ?? await getQoderLoginIdentity();
+    const tokens = await exchangeQoderPersonalToken({
+        ...options,
+        personalAccessToken: pat,
+        machineId: identity.machineCode || identity.machineId,
+        machineToken: identity.machineToken,
+    });
+    return finishQoderLogin(tokens, identity, "token", options, pat);
+}
+export async function importQoderAccount() {
+    const imported = await importQoderCliCredential();
+    const identity = await getQoderLoginIdentity();
+    return qoderCredentialFromImport({ ...imported, ...identity });
+}
+//# sourceMappingURL=qoder-login.js.map

package/dist/llm/qoder/qoder-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qoder-login.js","sourceRoot":"","sources":["../../../src/llm/qoder/qoder-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,eAAe,EACf,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,GAGzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,gBAAgB,uBAAuB,CAAC;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ;IAChF,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,eAAe,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QACzF,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,6EAA6E,CAAC,CAAC;QACrH,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAGxC,EAAE;IACJ,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO;QACL,SAAS,EAAE,KAAK,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACtF,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,EAAE;QACzC,WAAW,EAAE,OAAO,EAAE,WAAW;QACjC,WAAW,EAAE,OAAO,EAAE,WAAW;KAClC,CAAC;AACJ,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAEvC,EAAE;IACJ,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,qBAAqB,EAAE,CAAC;IACnE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS;QACT,gBAAgB,EAAE,MAAM;QACxB,KAAK;QACL,UAAU,EAAE,QAAQ,CAAC,SAAS;QAC9B,SAAS,EAAE,sBAAsB;KAClC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,GAAG,gBAAgB,0BAA0B,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAA2B,EAC3B,QAA8B,EAC9B,WAAgC,EAChC,OAAgC,EAChC,mBAA4B;IAE5B,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACrF,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,GAAG,oBAAoB,kBAAkB,EAAE;QAC3F,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;QACjF,MAAM;KACP,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,8CAA8C,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;QAC3C,GAAG,QAAQ;QACX,GAAG;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,UAAU,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5F,sBAAsB,EAAE,MAAM,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAChI,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;QACnC,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC;QAC1D,mBAAmB;QACnB,WAAW;QACX,gBAAgB,EAAE,OAAO,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI;KAC3F,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA2B,EAAE,UAGnE,EAAE;IACJ,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,yBAAyB,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,GAAG,oBAAoB,4BAA4B,MAAM,EAAE,CAAC;IACxE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,SAAS,CAAC;QACR,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,QAA8B,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;gBAC/C,OAAO,EAAE,gBAAgB,EAAE;gBAC3B,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;aAC/D,CAAC,CAAC;YACH,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,EAAE,QAAQ,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC;QACnC,CAAC;QACD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtE,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,mBAA2B,EAAE,UAEjE,EAAE;IACJ,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,cAAc,CAAC,4CAA4C,CAAC,CAAC;IACjF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,qBAAqB,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;QAC9C,GAAG,OAAO;QACV,mBAAmB,EAAE,GAAG;QACxB,SAAS,EAAE,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,SAAS;QACrD,YAAY,EAAE,QAAQ,CAAC,YAAY;KACpC,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC/C,OAAO,yBAAyB,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/dist/llm/qoder/qoder-refresh.d.ts

@@ -0,0 +1,4 @@
+import type { ProviderAuth } from "../provider.js";
+import { type QoderCredential } from "./qoder-credential.js";
+export declare function refreshQoderAccount(slotId: string): Promise<QoderCredential>;
+export declare function withQoderCredential<T>(auth: ProviderAuth, run: (credential: QoderCredential) => Promise<T>, onStatus?: ((message: string) => void) | undefined, canRetry?: () => boolean): Promise<T>;

package/dist/llm/qoder/qoder-refresh.js

@@ -0,0 +1,165 @@
+import { getProviderKeys, replaceProviderKey } from "../../store/keys.js";
+import { ProviderError } from "../http.js";
+import { exchangeQoderPersonalToken, expiryMilliseconds, QoderAuthError, refreshQoderDeviceToken, } from "./qoder-auth.js";
+import { withQoderAccountMutation } from "./qoder-accounts.js";
+import { encodeQoderCredential, parseQoderCredential, qoderCredentialExpiry, qoderCredentialMetadata, signQoderCredential, } from "./qoder-credential.js";
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const REFRESH_GRACE_MS = 30 * 1000;
+class QoderCredentialStoreError extends Error {
+}
+const refreshesInFlight = new Map();
+const rotatedCredentials = new Map();
+function rememberRotation(oldValue, fresh) {
+    rotatedCredentials.set(oldValue, fresh);
+    while (rotatedCredentials.size > 128) {
+        const oldest = rotatedCredentials.keys().next().value;
+        if (oldest === undefined)
+            break;
+        rotatedCredentials.delete(oldest);
+    }
+}
+function resolveCredential(value) {
+    let current = { credential: parseQoderCredential(value), value };
+    for (let i = 0; i < 128; i++) {
+        const rotated = rotatedCredentials.get(current.value);
+        if (!rotated || rotated.value === current.value)
+            break;
+        current = rotated;
+    }
+    return current;
+}
+function updateAuth(auth, fresh) {
+    auth.apiKey = fresh.value;
+    auth.refreshToken = fresh.credential.refreshToken;
+    auth.expiresAt = qoderCredentialExpiry(fresh.credential);
+}
+function renewable(credential, auth) {
+    return Boolean(credential.personalAccessToken || credential.refreshToken || auth.refreshToken);
+}
+function isAuthFailure(error) {
+    if (error instanceof ProviderError) {
+        return error.status === 401 || (error.status === 403 && /expired|invalid|unauthorized/i.test(error.message));
+    }
+    return error instanceof QoderAuthError && error.status === 401;
+}
+async function persistCredential(oldValue, fresh) {
+    try {
+        await withQoderAccountMutation(async () => {
+            if (await replaceProviderKey("qoder", oldValue, fresh.value, qoderCredentialMetadata(fresh.credential)))
+                return;
+            const keys = await getProviderKeys("qoder");
+            if (keys.source === "env" || keys.keys.some((key) => key.value === fresh.value))
+                return;
+            throw new QoderCredentialStoreError("Qoder refreshed its credentials, but the matching clai account could not be found to save them.");
+        });
+    }
+    catch (error) {
+        if (error instanceof QoderCredentialStoreError)
+            throw error;
+        throw new QoderCredentialStoreError("Qoder refreshed its credentials, but clai could not save the rotated tokens. Sign in again through /set qoder.");
+    }
+    rememberRotation(oldValue, fresh);
+}
+async function rotateCredential(credential, auth) {
+    const refreshToken = credential.refreshToken ?? auth.refreshToken;
+    const refreshExpiresAt = expiryMilliseconds(credential.refreshTokenExpireTime);
+    if (!credential.personalAccessToken && refreshExpiresAt !== undefined && refreshExpiresAt <= Date.now()) {
+        throw new QoderAuthError("Qoder refresh token has expired. Sign in again through /set qoder.", 401);
+    }
+    const options = {
+        machineId: credential.machineId,
+        machineType: credential.machineType,
+        machineCode: credential.machineCode,
+        loginMethod: credential.loginMethod,
+    };
+    let result;
+    if (credential.personalAccessToken) {
+        result = await exchangeQoderPersonalToken({
+            personalAccessToken: credential.personalAccessToken,
+            machineId: credential.machineCode || credential.machineId,
+            machineToken: credential.machineToken,
+        });
+    }
+    else {
+        if (!refreshToken)
+            throw new ProviderError("Qoder access token expired and no refresh token is available; sign in again through /set qoder.", 401);
+        result = await refreshQoderDeviceToken({ ...options, refreshToken });
+    }
+    return signQoderCredential({
+        ...credential,
+        accessToken: result.accessToken,
+        refreshToken: result.refreshToken ?? refreshToken,
+        ...(result.expiresAt !== undefined ? { expireTime: Math.floor(result.expiresAt / 1000) } : {}),
+        ...(result.refreshTokenExpiresAt !== undefined ? { refreshTokenExpireTime: Math.floor(result.refreshTokenExpiresAt / 1000) } : {}),
+    });
+}
+async function refreshCredential(current, auth) {
+    const identity = current.credential.personalAccessToken ?? current.credential.refreshToken ?? auth.refreshToken ?? current.value;
+    let refresh = refreshesInFlight.get(identity);
+    if (!refresh) {
+        refresh = (async () => {
+            const credential = await rotateCredential(current.credential, auth);
+            const fresh = { credential, value: encodeQoderCredential(credential) };
+            await persistCredential(current.value, fresh);
+            return fresh;
+        })();
+        refreshesInFlight.set(identity, refresh);
+    }
+    try {
+        const fresh = await refresh;
+        updateAuth(auth, fresh);
+        return fresh;
+    }
+    finally {
+        if (refreshesInFlight.get(identity) === refresh)
+            refreshesInFlight.delete(identity);
+    }
+}
+export async function refreshQoderAccount(slotId) {
+    const keys = await getProviderKeys("qoder");
+    const slot = keys.source === "env" ? undefined : keys.keys.find((key) => key.id === slotId);
+    if (!slot)
+        throw new QoderAuthError("Qoder account was not found.");
+    const current = resolveCredential(slot.value);
+    const auth = { apiKey: current.value, refreshToken: slot.refreshToken, expiresAt: slot.expiresAt };
+    return (await refreshCredential(current, auth)).credential;
+}
+export async function withQoderCredential(auth, run, onStatus, canRetry = () => true) {
+    if (typeof auth.apiKey !== "string")
+        throw new QoderAuthError("Qoder authentication required. Sign in through /provider qoder.");
+    let current = resolveCredential(auth.apiKey);
+    if (current.value !== auth.apiKey)
+        updateAuth(auth, current);
+    const expiresAt = qoderCredentialExpiry(current.credential, auth);
+    if (renewable(current.credential, auth) && expiresAt !== undefined && expiresAt <= Date.now() + REFRESH_BUFFER_MS) {
+        onStatus?.("ℹ Qoder authentication expiring — refreshing token");
+        try {
+            current = await refreshCredential(current, auth);
+            onStatus?.("ℹ Qoder token refreshed");
+        }
+        catch (error) {
+            if (error instanceof QoderCredentialStoreError)
+                throw error;
+            if (error instanceof QoderAuthError && error.status && [400, 401, 403].includes(error.status))
+                throw error;
+            if (expiresAt - Date.now() <= REFRESH_GRACE_MS)
+                throw error;
+            onStatus?.("ℹ Qoder refresh temporarily failed; using the current token until it expires");
+        }
+    }
+    else if (!renewable(current.credential, auth) && expiresAt !== undefined && expiresAt <= Date.now()) {
+        throw new ProviderError("Qoder access token expired and no refresh token is available; sign in again through /set qoder.", 401);
+    }
+    try {
+        return await run(current.credential);
+    }
+    catch (error) {
+        if (!isAuthFailure(error) || !renewable(current.credential, auth) || !canRetry())
+            throw error;
+        onStatus?.("ℹ Qoder authentication rejected — refreshing token");
+        const fresh = await refreshCredential(current, auth);
+        onStatus?.("ℹ Qoder token refreshed — retrying request");
+        return run(fresh.credential);
+    }
+}
+//# sourceMappingURL=qoder-refresh.js.map

package/dist/llm/qoder/qoder-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qoder-refresh.js","sourceRoot":"","sources":["../../../src/llm/qoder/qoder-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,EACd,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,yBAA0B,SAAQ,KAAK;CAAG;AAOhD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA6C,CAAC;AAC/E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAEvE,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAA+B;IACzE,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,kBAAkB,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,OAAO,GAAG,EAAE,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;YAAE,MAAM;QACvD,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,IAAkB,EAAE,KAA+B;IACrE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;IAClD,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,UAA2B,EAAE,IAAkB;IAChE,OAAO,OAAO,CAAC,UAAU,CAAC,mBAAmB,IAAI,UAAU,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAA+B;IAChF,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC,KAAK,IAAI,EAAE;YACxC,IAAI,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAAE,OAAO;YAChH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO;YACxF,MAAM,IAAI,yBAAyB,CAAC,iGAAiG,CAAC,CAAC;QACzI,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB;YAAE,MAAM,KAAK,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CAAC,gHAAgH,CAAC,CAAC;IACxJ,CAAC;IACD,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,UAA2B,EAAE,IAAkB;IAC7E,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;IAClE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,mBAAmB,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACxG,MAAM,IAAI,cAAc,CAAC,oEAAoE,EAAE,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,WAAW,EAAE,UAAU,CAAC,WAAW;KACpC,CAAC;IACF,IAAI,MAAM,CAAC;IACX,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACnC,MAAM,GAAG,MAAM,0BAA0B,CAAC;YACxC,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YACnD,SAAS,EAAE,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,SAAS;YACzD,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,aAAa,CAAC,iGAAiG,EAAE,GAAG,CAAC,CAAC;QACnJ,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,mBAAmB,CAAC;QACzB,GAAG,UAAU;QACb,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,YAAY;QACjD,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnI,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAiC,EAAE,IAAkB;IACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC;IACjI,IAAI,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;QAC5B,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO;YAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,cAAc,CAAC,8BAA8B,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACjH,OAAO,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAkB,EAClB,GAAgD,EAChD,QAAkD,EAClD,WAA0B,GAAG,EAAE,CAAC,IAAI;IAEpC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,cAAc,CAAC,iEAAiE,CAAC,CAAC;IACjI,IAAI,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM;QAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAClH,QAAQ,EAAE,CAAC,oDAAoD,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjD,QAAQ,EAAE,CAAC,yBAAyB,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yBAAyB;gBAAE,MAAM,KAAK,CAAC;YAC5D,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC3G,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YAC5D,QAAQ,EAAE,CAAC,8EAA8E,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtG,MAAM,IAAI,aAAa,CAAC,iGAAiG,EAAE,GAAG,CAAC,CAAC;IAClI,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YAAE,MAAM,KAAK,CAAC;QAC9F,QAAQ,EAAE,CAAC,oDAAoD,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,QAAQ,EAAE,CAAC,4CAA4C,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/llm/qoder/qoder-signer.d.ts

@@ -0,0 +1,66 @@
+export declare const QODER_CLIENT_TYPE = "5";
+export declare const QODER_BUSINESS_PRODUCT = "cli";
+export declare const QODER_BUSINESS_TYPE = "agent";
+export declare const QODER_SCENE = "assistant";
+export interface QoderSignedRequest {
+    url: string;
+    headers: Record<string, string>;
+    body?: string | undefined;
+}
+export interface QoderSignerIdentity {
+    machineId: string;
+    cosyVersion: string;
+    userInfo?: QoderUserInfo | undefined;
+}
+export interface QoderUserInfo {
+    uid?: string | undefined;
+    encryptUserInfo?: string | undefined;
+    key?: string | undefined;
+}
+interface QoderRequestResult {
+    url: string;
+    headers: {
+        forEach(cb: (value: string, key: string) => void): void;
+    };
+    body: Uint8Array | string | undefined;
+}
+interface QoderContextHandle {
+    prepareRequest(endpoint: string, path: string, method: string, authType: string, body: string | undefined, headers: string | undefined): QoderRequestResult;
+    prepareInferRequest(baseUrl: string, body: string, modelKey: string, modelSource: string): QoderRequestResult;
+    get_external_providers_access(): string;
+    free(): void;
+}
+export interface QoderGlueModule {
+    default(options: {
+        module_or_path: Uint8Array;
+    }): Promise<unknown>;
+    QoderContext: new (machineId: string, cosyVersion: string, userInfoJson: string, envJson: string) => QoderContextHandle;
+    credential_storage_decrypt(data: string, key: string): Uint8Array | string;
+    decrypt_server_response(data: string): string;
+    generate_runtime_auth_fields(userInfoJson: string): string;
+}
+export declare function loadSignerModule(): Promise<QoderGlueModule>;
+export declare function qoderUserInfoJson(info?: QoderUserInfo | undefined): string;
+export declare function qoderEnvJson(): string;
+export declare class QoderSigner {
+    private readonly context;
+    private constructor();
+    static create(identity: QoderSignerIdentity): Promise<QoderSigner>;
+    prepare(request: {
+        endpoint: string;
+        path: string;
+        method: string;
+        authType: string;
+        body?: string | undefined;
+        headers?: Record<string, string> | undefined;
+    }): QoderSignedRequest;
+    prepareInfer(request: {
+        baseUrl: string;
+        body: string;
+        modelKey: string;
+        modelSource?: string | undefined;
+    }): QoderSignedRequest;
+    externalProvidersAccess(): string;
+    free(): void;
+}
+export {};

package/dist/llm/qoder/qoder-signer.js

@@ -0,0 +1,119 @@
+import { gunzipSync } from "node:zlib";
+import { createHash } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { isBunRuntime } from "../../os/bun-runtime.js";
+import { QODER_SIGNER_GLUE_JS_BASE64 } from "./signer-glue.generated.js";
+import { QODER_SIGNER_WASM_GZIP_BASE64, QODER_SIGNER_WASM_SHA256, } from "./signer-wasm.generated.js";
+export const QODER_CLIENT_TYPE = "5";
+export const QODER_BUSINESS_PRODUCT = "cli";
+export const QODER_BUSINESS_TYPE = "agent";
+export const QODER_SCENE = "assistant";
+let runtimePromise;
+function signerWasmBytes() {
+    const bytes = new Uint8Array(gunzipSync(Buffer.from(QODER_SIGNER_WASM_GZIP_BASE64, "base64")));
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (digest !== QODER_SIGNER_WASM_SHA256) {
+        throw new Error("qoder signer wasm failed its integrity check");
+    }
+    return bytes;
+}
+function loadSignerRuntime() {
+    if (runtimePromise)
+        return runtimePromise;
+    runtimePromise = (async () => {
+        const source = Buffer.from(QODER_SIGNER_GLUE_JS_BASE64, "base64").toString("utf8");
+        const module = await importSignerGlue(source);
+        await module.default({ module_or_path: signerWasmBytes() });
+        return module;
+    })().catch((error) => {
+        runtimePromise = undefined;
+        throw error;
+    });
+    return runtimePromise;
+}
+async function importSignerGlue(source) {
+    if (!isBunRuntime()) {
+        return await import(`data:text/javascript;base64,${Buffer.from(source, "utf8").toString("base64")}`);
+    }
+    const directory = await mkdtemp(join(tmpdir(), "clai-qoder-signer-"));
+    try {
+        const file = join(directory, "signer.mjs");
+        await writeFile(file, source, { mode: 0o600, flag: "wx" });
+        return await import(pathToFileURL(file).href);
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}
+export function loadSignerModule() {
+    return loadSignerRuntime();
+}
+export function qoderUserInfoJson(info) {
+    return JSON.stringify({
+        uid: info?.uid ?? "",
+        encrypt_user_info: info?.encryptUserInfo ?? "",
+        key: info?.key ?? "",
+    });
+}
+export function qoderEnvJson() {
+    return JSON.stringify({
+        client_type: QODER_CLIENT_TYPE,
+        business_product: QODER_BUSINESS_PRODUCT,
+        business_type: QODER_BUSINESS_TYPE,
+        scene: QODER_SCENE,
+    });
+}
+function headersToRecord(result) {
+    const out = {};
+    result.headers.forEach((value, key) => {
+        out[key] = value;
+    });
+    return out;
+}
+function bodyToText(body) {
+    if (body === undefined)
+        return undefined;
+    if (typeof body === "string")
+        return body.length > 0 ? body : undefined;
+    return body.length > 0 ? new TextDecoder().decode(body) : undefined;
+}
+function toSignedRequest(result) {
+    const text = bodyToText(result.body);
+    return {
+        url: result.url,
+        headers: headersToRecord(result),
+        ...(text !== undefined ? { body: text } : {}),
+    };
+}
+export class QoderSigner {
+    context;
+    constructor(context) {
+        this.context = context;
+    }
+    static async create(identity) {
+        const { QoderContext } = await loadSignerRuntime();
+        const context = new QoderContext(identity.machineId, identity.cosyVersion, qoderUserInfoJson(identity.userInfo), qoderEnvJson());
+        return new QoderSigner(context);
+    }
+    prepare(request) {
+        return toSignedRequest(this.context.prepareRequest(request.endpoint, request.path, request.method, request.authType, request.body, request.headers ? JSON.stringify(request.headers) : undefined));
+    }
+    prepareInfer(request) {
+        return toSignedRequest(this.context.prepareInferRequest(request.baseUrl, request.body, request.modelKey, request.modelSource ?? "system"));
+    }
+    externalProvidersAccess() {
+        return this.context.get_external_providers_access();
+    }
+    free() {
+        try {
+            this.context.free();
+        }
+        catch {
+            // Context was already released by a failed prepare; ignore.
+        }
+    }
+}
+//# sourceMappingURL=qoder-signer.js.map

package/dist/llm/qoder/qoder-signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qoder-signer.js","sourceRoot":"","sources":["../../../src/llm/qoder/qoder-signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAC3C,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AA0DvC,IAAI,cAAoD,CAAC;AAEzD,SAAS,eAAe;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,CAC1B,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,QAAQ,CAAC,CAAC,CACjE,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,wBAAwB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,cAAc,GAAG,SAAS,CAAC;QAC3B,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc;IAC5C,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,OAAO,MAAM,MAAM,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAoB,CAAC;IAC1H,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAoB,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAgC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE;QACpB,iBAAiB,EAAE,IAAI,EAAE,eAAe,IAAI,EAAE;QAC9C,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,iBAAiB;QAC9B,gBAAgB,EAAE,sBAAsB;QACxC,aAAa,EAAE,mBAAmB;QAClC,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACpC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAqC;IACvD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;QAChC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,WAAW;IACe;IAArC,YAAqC,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEpE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAA6B;QAC/C,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,YAAY,CAC9B,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,WAAW,EACpB,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACpC,YAAY,EAAE,CACf,CAAC;QACF,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,CAAC,OAOP;QACC,OAAO,eAAe,CACpB,IAAI,CAAC,OAAO,CAAC,cAAc,CACzB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAC9D,CACF,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,OAKZ;QACC,OAAO,eAAe,CACpB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAC9B,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,WAAW,IAAI,QAAQ,CAChC,CACF,CAAC;IACJ,CAAC;IAED,uBAAuB;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC;IACtD,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;CACF"}

package/dist/llm/qoder/qoder.d.ts

@@ -0,0 +1,20 @@
+import { type LlmProvider } from "../provider.js";
+import { readQoderMachineId, readQoderMachineIdentity } from "./qoder-auth.js";
+export { encodeQoderCredential, qoderCredentialFromImport, type QoderCredential } from "./qoder-credential.js";
+export declare const QODER_FREE_SUFFIX = ":free";
+export declare function isQoderFreeEntry(entry: {
+    is_free?: boolean;
+    price_factor?: number;
+}): boolean;
+/**
+ * Model ids carry a price tag so `/model` shows the multiplier qodercli shows:
+ * `key:free` for a 0.00 multiplier, `key:0.5x` for a paid multiplier. The tag is
+ * display-only and stripped before the wire call (see {@link qoderWireModelKey}).
+ */
+export declare function qoderListedModel(key: string, entry: {
+    is_free?: boolean;
+    price_factor?: number;
+}): string;
+export declare function qoderWireModelKey(model: string): string;
+export declare const qoderProvider: LlmProvider;
+export { readQoderMachineId, readQoderMachineIdentity };