@psnext/slingcli 2.5.20260724-1 → 2.5.20260727-1

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/openrouter.js

@@ -0,0 +1,222 @@
+/**
+ * OpenRouter OAuth PKCE flow.
+ *
+ * OpenRouter exchanges an authorization code for a permanent, user-controlled
+ * API key rather than an expiring access/refresh token pair. The callback is
+ * handled by a one-shot loopback server on an ephemeral port.
+ *
+ * NOTE: This module uses Node.js http.createServer for the OAuth callback server.
+ * It is only intended for CLI use, not browser environments.
+ */
+import { createServer } from "node:http";
+import { getProviderEnvValue } from "../../utils/provider-env.js";
+import { oauthErrorHtml, oauthSuccessHtml } from "./oauth-page.js";
+import { generatePKCE } from "./pkce.js";
+const AUTHORIZE_URL = "https://openrouter.ai/auth";
+const TOKEN_URL = "https://openrouter.ai/api/v1/auth/keys";
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const TOKEN_EXCHANGE_TIMEOUT_MS = 30_000;
+function getCallbackHost() {
+    return getProviderEnvValue("PI_OAUTH_CALLBACK_HOST") || "127.0.0.1";
+}
+function sendHtml(response, status, html) {
+    response.statusCode = status;
+    response.setHeader("content-type", "text/html; charset=utf-8");
+    response.setHeader("cache-control", "no-store");
+    response.end(html);
+}
+function errorDetail(body) {
+    if (typeof body.error_description === "string")
+        return body.error_description;
+    if (typeof body.message === "string")
+        return body.message;
+    if (typeof body.error === "string")
+        return body.error;
+    if (body.error && typeof body.error === "object" && !Array.isArray(body.error)) {
+        const message = body.error.message;
+        if (typeof message === "string")
+            return message;
+    }
+    return undefined;
+}
+async function exchangeAuthorizationCode(code, verifier, signal) {
+    if (signal?.aborted)
+        throw new Error("Login cancelled");
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(signal?.reason);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const timeout = setTimeout(() => controller.abort(new Error("OpenRouter OAuth token exchange timed out")), TOKEN_EXCHANGE_TIMEOUT_MS);
+    let response;
+    let body = {};
+    try {
+        response = await fetch(TOKEN_URL, {
+            method: "POST",
+            headers: { accept: "application/json", "content-type": "application/json" },
+            body: JSON.stringify({ code, code_verifier: verifier, code_challenge_method: "S256" }),
+            signal: controller.signal,
+        });
+        try {
+            const parsed = (await response.json());
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+                body = parsed;
+        }
+        catch {
+            if (response.ok)
+                throw new Error("OpenRouter OAuth returned invalid JSON");
+        }
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw new Error("Login cancelled");
+        if (controller.signal.aborted)
+            throw new Error("OpenRouter OAuth token exchange timed out");
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+        signal?.removeEventListener("abort", onAbort);
+    }
+    if (!response.ok) {
+        const detail = errorDetail(body);
+        throw new Error(`OpenRouter OAuth key exchange failed (HTTP ${response.status})${detail ? `: ${detail}` : ""}`);
+    }
+    if (typeof body.key !== "string" || body.key.length === 0) {
+        throw new Error('OpenRouter OAuth response carries no "key"');
+    }
+    return {
+        type: "oauth",
+        access: body.key,
+        refresh: "",
+        expires: Number.MAX_SAFE_INTEGER,
+    };
+}
+async function startCallbackServer(callbackPath, verifier, signal) {
+    if (signal?.aborted)
+        throw new Error("Login cancelled");
+    const callbackHost = getCallbackHost();
+    let resolveCredential = () => { };
+    let rejectCredential = () => { };
+    const credential = new Promise((resolve, reject) => {
+        resolveCredential = resolve;
+        rejectCredential = reject;
+    });
+    let server;
+    let claimed = false;
+    let settled = false;
+    let timeout;
+    let onAbort;
+    const finish = (result) => {
+        if (settled)
+            return;
+        settled = true;
+        if (timeout)
+            clearTimeout(timeout);
+        if (onAbort)
+            signal?.removeEventListener("abort", onAbort);
+        server.close();
+        if ("credential" in result)
+            resolveCredential(result.credential);
+        else
+            rejectCredential(result.error);
+    };
+    server = createServer((request, response) => {
+        void (async () => {
+            const requestUrl = new URL(request.url ?? "/", `http://${callbackHost}`);
+            if (request.method !== "GET" || requestUrl.pathname !== callbackPath) {
+                sendHtml(response, 404, oauthErrorHtml("OAuth callback route not found."));
+                return;
+            }
+            if (claimed || settled) {
+                sendHtml(response, 409, oauthErrorHtml("This OAuth callback has already been used."));
+                return;
+            }
+            const oauthError = requestUrl.searchParams.get("error");
+            if (oauthError) {
+                const description = requestUrl.searchParams.get("error_description") ?? oauthError;
+                sendHtml(response, 400, oauthErrorHtml("OpenRouter authorization was denied.", description));
+                finish({ error: new Error(`OpenRouter authorization failed: ${description}`) });
+                return;
+            }
+            const code = requestUrl.searchParams.get("code");
+            if (!code) {
+                sendHtml(response, 400, oauthErrorHtml("OpenRouter returned no authorization code."));
+                return;
+            }
+            claimed = true;
+            try {
+                const result = await exchangeAuthorizationCode(code, verifier, signal);
+                sendHtml(response, 200, oauthSuccessHtml("Signed in to OpenRouter. You may now close this page."));
+                finish({ credential: result });
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : "Unknown token exchange error";
+                sendHtml(response, 502, oauthErrorHtml("OpenRouter key exchange failed.", message));
+                finish({ error: error instanceof Error ? error : new Error(message) });
+            }
+        })();
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, callbackHost, () => {
+            server.removeListener("error", reject);
+            resolve();
+        });
+    });
+    server.on("error", (error) => finish({ error }));
+    onAbort = () => finish({ error: new Error("Login cancelled") });
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) {
+        signal.removeEventListener("abort", onAbort);
+        server.close();
+        throw new Error("Login cancelled");
+    }
+    timeout = setTimeout(() => finish({ error: new Error("OpenRouter OAuth login timed out") }), LOGIN_TIMEOUT_MS);
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        finish({ error: new Error("Could not determine the OpenRouter OAuth callback port") });
+        throw new Error("Could not determine the OpenRouter OAuth callback port");
+    }
+    return {
+        callbackUrl: `http://${callbackHost}:${address.port}${callbackPath}`,
+        credential,
+        close: () => finish({ error: new Error("Login cancelled") }),
+    };
+}
+async function loginOpenRouter(interaction) {
+    const { verifier, challenge } = await generatePKCE();
+    const callbackPath = `/oauth/callback/${crypto.randomUUID()}`;
+    const callback = await startCallbackServer(callbackPath, verifier, interaction.signal);
+    const authorizeUrl = new URL(AUTHORIZE_URL);
+    authorizeUrl.search = new URLSearchParams({
+        callback_url: callback.callbackUrl,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+    }).toString();
+    interaction.notify({
+        type: "progress",
+        message: `Listening for OpenRouter OAuth callback on ${callback.callbackUrl}`,
+    });
+    interaction.notify({
+        type: "auth_url",
+        url: authorizeUrl.toString(),
+        instructions: "Complete sign-in in your browser.",
+    });
+    try {
+        return await callback.credential;
+    }
+    finally {
+        callback.close();
+    }
+}
+export const openRouterOAuth = {
+    name: "OpenRouter OAuth",
+    loginLabel: "Sign in with OpenRouter",
+    login: loginOpenRouter,
+    async refresh(credential) {
+        return credential;
+    },
+    async toAuth(credential) {
+        return { apiKey: credential.access };
+    },
+};
+//# sourceMappingURL=openrouter.js.map

package/node_modules/@earendil-works/pi-ai/dist/auth/oauth/radius.js

@@ -1,8 +1,9 @@
 /**
  * Radius gateway OAuth flow.
  *
- * Radius is a pi-messages gateway. OAuth endpoints are discovered from the
- * gateway (`/v1/oauth`); model catalog loading is owned by the Radius provider.
+ * Radius is a pi-messages gateway. OAuth client APIs live on the configured
+ * gateway; only the interactive browser authorization endpoint is discovered.
+ * Model catalog loading is owned by the Radius provider.
  *
  * NOTE: This module uses node:http for the OAuth callback server.
  * It is only intended for CLI use, not browser environments.
@@ -25,14 +26,21 @@ const REDIRECT_URI = `http://${CALLBACK_HOST}:${CALLBACK_PORT}${CALLBACK_PATH}`;
 const TOKEN_EXPIRY_SKEW_MS = 60_000;
 const LOGIN_METHOD_BROWSER = "browser";
 const LOGIN_METHOD_DEVICE_CODE = "device-code";
-async function loadRadiusOAuthConfig(gateway) {
+const OAUTH_CLIENT_ID = "pi-gateway";
+const OAUTH_SCOPE = "gateway offline_access";
+const OAUTH_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+async function loadRadiusOAuthDiscovery(gateway) {
     const response = await fetch(new URL("/v1/oauth", gateway), {
         headers: { accept: "application/json" },
     });
     if (!response.ok) {
         throw new Error(`Could not load Radius OAuth config from ${gateway}: ${response.status} ${await response.text()}`);
     }
-    return (await response.json());
+    const discovery = (await response.json());
+    if (typeof discovery.authorizationEndpoint !== "string") {
+        throw new Error(`Invalid Radius OAuth config from ${gateway}`);
+    }
+    return { authorizationEndpoint: discovery.authorizationEndpoint };
 }
 class OAuthResponseError extends Error {
     status;
@@ -64,10 +72,10 @@ async function readOAuthResponseError(response, message) {
     }
     return new OAuthResponseError(response.status, oauthError, description, message);
 }
-async function requestOAuthToken(oauth, body, signal) {
+async function requestOAuthToken(gateway, body, signal) {
     let response;
     try {
-        response = await fetch(oauth.tokenEndpoint, {
+        response = await fetch(new URL("/v1/oauth/token", gateway), {
             method: "POST",
             headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
             body,
@@ -157,15 +165,15 @@ function startOAuthCallbackServer(expectedState, signal) {
         });
     });
 }
-async function loginWithBrowser(oauth, interaction) {
+async function loginWithBrowser(gateway, authorizationEndpoint, interaction) {
     const { verifier, challenge } = await generatePKCE();
     const state = crypto.randomUUID();
-    const authorizeUrl = new URL(oauth.authorizationEndpoint);
+    const authorizeUrl = new URL(authorizationEndpoint);
     authorizeUrl.search = new URLSearchParams({
         response_type: "code",
-        client_id: oauth.clientId,
+        client_id: OAUTH_CLIENT_ID,
         redirect_uri: REDIRECT_URI,
-        scope: oauth.scope,
+        scope: OAUTH_SCOPE,
         code_challenge: challenge,
         code_challenge_method: "S256",
         handoff: "url",
@@ -186,9 +194,9 @@ async function loginWithBrowser(oauth, interaction) {
             }
             throw new Error("OAuth callback did not complete.");
         }
-        return await requestOAuthToken(oauth, new URLSearchParams({
+        return await requestOAuthToken(gateway, new URLSearchParams({
             grant_type: "authorization_code",
-            client_id: oauth.clientId,
+            client_id: OAUTH_CLIENT_ID,
             redirect_uri: REDIRECT_URI,
             code,
             code_verifier: verifier,
@@ -198,13 +206,13 @@ async function loginWithBrowser(oauth, interaction) {
         callbackServer.close();
     }
 }
-async function requestDeviceAuthorization(oauth, signal) {
+async function requestDeviceAuthorization(gateway, signal) {
     let response;
     try {
-        response = await fetch(oauth.deviceAuthorizationEndpoint, {
+        response = await fetch(new URL("/v1/oauth/device", gateway), {
             method: "POST",
             headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
-            body: new URLSearchParams({ client_id: oauth.clientId, scope: oauth.scope }),
+            body: new URLSearchParams({ client_id: OAUTH_CLIENT_ID, scope: OAUTH_SCOPE }),
             signal,
         });
     }
@@ -218,24 +226,23 @@ async function requestDeviceAuthorization(oauth, signal) {
         throw await readOAuthResponseError(response, "Radius OAuth device authorization failed");
     }
     const data = (await response.json());
-    if (!data.device_code || !data.user_code || !data.expires_in) {
+    if (!data.device_code || !data.user_code || !data.verification_uri || !data.expires_in) {
         throw new Error("Radius OAuth device authorization response is missing required fields");
     }
     return {
         device_code: data.device_code,
         user_code: data.user_code,
         verification_uri: data.verification_uri,
-        verification_uri_complete: data.verification_uri_complete,
         expires_in: data.expires_in,
         interval: data.interval,
     };
 }
-async function loginWithDeviceCode(oauth, interaction) {
-    const device = await requestDeviceAuthorization(oauth, interaction.signal);
+async function loginWithDeviceCode(gateway, interaction) {
+    const device = await requestDeviceAuthorization(gateway, interaction.signal);
     interaction.notify({
         type: "device_code",
         userCode: device.user_code,
-        verificationUri: device.verification_uri || oauth.verificationEndpoint,
+        verificationUri: device.verification_uri,
         intervalSeconds: device.interval,
         expiresInSeconds: device.expires_in,
     });
@@ -245,9 +252,9 @@ async function loginWithDeviceCode(oauth, interaction) {
         signal: interaction.signal,
         poll: async () => {
             try {
-                const credentials = await requestOAuthToken(oauth, new URLSearchParams({
-                    grant_type: oauth.deviceCodeGrantType,
-                    client_id: oauth.clientId,
+                const credentials = await requestOAuthToken(gateway, new URLSearchParams({
+                    grant_type: OAUTH_DEVICE_CODE_GRANT_TYPE,
+                    client_id: OAUTH_CLIENT_ID,
                     device_code: device.device_code,
                 }), interaction.signal);
                 return { status: "complete", value: credentials };
@@ -277,7 +284,6 @@ export function createRadiusOAuth(options) {
     return {
         name: options.name,
         async login(interaction) {
-            const oauth = await loadRadiusOAuthConfig(gateway);
             const loginMethod = await interaction.prompt({
                 type: "select",
                 message: `Sign in to ${options.name}:`,
@@ -289,23 +295,19 @@ export function createRadiusOAuth(options) {
                     },
                 ],
             });
-            let credential;
             if (loginMethod === LOGIN_METHOD_DEVICE_CODE) {
-                credential = await loginWithDeviceCode(oauth, interaction);
-            }
-            else if (loginMethod === LOGIN_METHOD_BROWSER) {
-                credential = await loginWithBrowser(oauth, interaction);
+                return loginWithDeviceCode(gateway, interaction);
             }
-            else {
-                throw new Error(`Unknown ${options.name} sign-in method: ${loginMethod}`);
+            if (loginMethod === LOGIN_METHOD_BROWSER) {
+                const discovery = await loadRadiusOAuthDiscovery(gateway);
+                return loginWithBrowser(gateway, discovery.authorizationEndpoint, interaction);
             }
-            return credential;
+            throw new Error(`Unknown ${options.name} sign-in method: ${loginMethod}`);
         },
         async refresh(credential, signal) {
-            const oauth = await loadRadiusOAuthConfig(gateway);
-            const refreshed = await requestOAuthToken(oauth, new URLSearchParams({
+            const refreshed = await requestOAuthToken(gateway, new URLSearchParams({
                 grant_type: "refresh_token",
-                client_id: oauth.clientId,
+                client_id: OAUTH_CLIENT_ID,
                 refresh_token: credential.refresh,
             }), signal);
             return refreshed;

package/node_modules/@earendil-works/pi-ai/dist/auth/resolve.js

@@ -1,11 +1,21 @@
+import { formatThrownValue } from "../utils/diagnostics.js";
 export class ModelsError extends Error {
     code;
     constructor(code, message, options) {
-        super(message, options);
+        super(withCauseDetail(message, options?.cause), options);
         this.name = "ModelsError";
         this.code = code;
     }
 }
+/** Callers surface `error.message` only, so keep the underlying reason in it. */
+function withCauseDetail(message, cause) {
+    if (cause === undefined || cause === null)
+        return message;
+    const detail = formatThrownValue(cause).trim();
+    if (!detail || message.includes(detail))
+        return message;
+    return `${message}: ${detail}`;
+}
 /**
  * Auth resolution shared by the `Models` and `ImagesModels` collections.
  * A stored credential owns the provider: ambient/env is consulted only when

package/node_modules/@earendil-works/pi-ai/dist/bun-oauth.js

@@ -3,6 +3,7 @@ import { githubCopilotOAuth } from "./auth/oauth/github-copilot.js";
 import { kimiCodingOAuth } from "./auth/oauth/kimi-coding.js";
 import { registerBundledOAuthFlowLoaders } from "./auth/oauth/load.js";
 import { openaiCodexOAuth } from "./auth/oauth/openai-codex.js";
+import { openRouterOAuth } from "./auth/oauth/openrouter.js";
 import { createRadiusOAuth } from "./auth/oauth/radius.js";
 import { xaiOAuth } from "./auth/oauth/xai.js";
 /** Register OAuth flows statically embedded in the standalone Bun binary. */
@@ -11,6 +12,7 @@ export function registerBunOAuthFlows() {
         anthropic: () => anthropicOAuth,
         openaiCodex: () => openaiCodexOAuth,
         githubCopilot: () => githubCopilotOAuth,
+        openrouter: () => openRouterOAuth,
         kimiCoding: () => kimiCodingOAuth,
         xai: () => xaiOAuth,
         radius: createRadiusOAuth,

package/node_modules/@earendil-works/pi-ai/dist/env-api-keys.js

@@ -27,6 +27,9 @@ if (typeof process !== "undefined" && (process.versions?.node || process.version
     });
 }
 import { getProviderEnvValue } from "./utils/provider-env.js";
+export const ANTHROPIC_AUTH_TOKEN_ENV = "ANTHROPIC_AUTH_TOKEN";
+export const ANTHROPIC_OAUTH_TOKEN_ENV = "ANTHROPIC_OAUTH_TOKEN";
+export const ANTHROPIC_API_KEY_ENV = "ANTHROPIC_API_KEY";
 let cachedVertexAdcCredentialsExists = null;
 function hasVertexAdcCredentials(env) {
     const explicitCredentialsPath = env?.GOOGLE_APPLICATION_CREDENTIALS;
@@ -61,9 +64,10 @@ function getApiKeyEnvVars(provider) {
     if (provider === "github-copilot") {
         return ["COPILOT_GITHUB_TOKEN"];
     }
-    // ANTHROPIC_OAUTH_TOKEN takes precedence over ANTHROPIC_API_KEY
+    // ANTHROPIC_AUTH_TOKEN participates in env discovery/status, but
+    // getEnvApiKey() skips it because requests must pass it as Authorization: Bearer.
     if (provider === "anthropic") {
-        return ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
+        return [ANTHROPIC_AUTH_TOKEN_ENV, ANTHROPIC_OAUTH_TOKEN_ENV, ANTHROPIC_API_KEY_ENV];
     }
     const envMap = {
         "ant-ling": "ANT_LING_API_KEY",
@@ -114,7 +118,9 @@ export function findEnvKeys(provider, env) {
 export function getEnvApiKey(provider, env) {
     const envKeys = findEnvKeys(provider, env);
     if (envKeys?.[0]) {
-        return getProviderEnvValue(envKeys[0], env);
+        const apiKeyEnv = provider === "anthropic" ? envKeys.find((key) => key !== ANTHROPIC_AUTH_TOKEN_ENV) : envKeys[0];
+        if (apiKeyEnv)
+            return getProviderEnvValue(apiKeyEnv, env);
     }
     // Vertex AI supports either an explicit API key or Application Default Credentials.
     // Auth is configured via `gcloud auth application-default login`.

package/node_modules/@earendil-works/pi-ai/dist/image-models.generated.js

@@ -227,6 +227,21 @@ export const IMAGE_MODELS = {
                 cacheWrite: 0,
             },
         },
+        "microsoft/mai-image-2.5-pro": {
+            id: "microsoft/mai-image-2.5-pro",
+            name: "Microsoft: MAI-Image-2.5 Pro",
+            api: "openrouter-images",
+            provider: "openrouter",
+            baseUrl: "https://openrouter.ai/api/v1",
+            input: ["text", "image"],
+            output: ["image"],
+            cost: {
+                input: 5,
+                output: 0,
+                cacheRead: 0,
+                cacheWrite: 0,
+            },
+        },
         "openai/gpt-5-image": {
             id: "openai/gpt-5-image",
             name: "OpenAI: GPT-5 Image",

package/node_modules/@earendil-works/pi-ai/dist/model-catalog.js

@@ -0,0 +1,4 @@
+export function flattenModelCatalog(_provider, groups) {
+    return Object.assign({}, ...Object.values(groups));
+}
+//# sourceMappingURL=model-catalog.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/all.js

@@ -8,6 +8,7 @@ import { azureOpenAIResponsesProvider } from "./azure-openai-responses.js";
 import { cerebrasProvider } from "./cerebras.js";
 import { cloudflareAIGatewayProvider } from "./cloudflare-ai-gateway.js";
 import { cloudflareWorkersAIProvider } from "./cloudflare-workers-ai.js";
+import modelDataManifest from "./data/.manifest.json" with { type: "json" };
 import { deepseekProvider } from "./deepseek.js";
 import { fireworksProvider } from "./fireworks.js";
 import { githubCopilotProvider } from "./github-copilot.js";
@@ -49,9 +50,10 @@ export function getBuiltinModel(provider, modelId) {
 export function getBuiltinProviders() {
     return Object.keys(MODELS);
 }
-/** URL of a generated provider catalog, used to compare its mtime with remote catalogs during development. */
-export function getBuiltinModelDataUrl(provider) {
-    return new URL(`./data/${provider}.json`, import.meta.url);
+/** Generation timestamp shared by all built-in provider catalogs. */
+export function getBuiltinModelDataGeneratedAt() {
+    const generatedAt = Date.parse(modelDataManifest.generatedAt);
+    return Number.isNaN(generatedAt) ? undefined : generatedAt;
 }
 export function getBuiltinModels(provider) {
     const models = MODELS[provider];

package/node_modules/@earendil-works/pi-ai/dist/providers/amazon-bedrock.models.js

@@ -1,5 +1,6 @@
 // This file is auto-generated by scripts/generate-models.ts
 // Do not edit manually - run 'npm run generate-models' to update
 import values from "./data/amazon-bedrock.json" with { type: "json" };
-export const AMAZON_BEDROCK_MODELS = values;
+import { flattenModelCatalog } from "../model-catalog.js";
+export const AMAZON_BEDROCK_MODELS = flattenModelCatalog("amazon-bedrock", values);
 //# sourceMappingURL=amazon-bedrock.models.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/ant-ling.models.js

@@ -1,5 +1,6 @@
 // This file is auto-generated by scripts/generate-models.ts
 // Do not edit manually - run 'npm run generate-models' to update
 import values from "./data/ant-ling.json" with { type: "json" };
-export const ANT_LING_MODELS = values;
+import { flattenModelCatalog } from "../model-catalog.js";
+export const ANT_LING_MODELS = flattenModelCatalog("ant-ling", values);
 //# sourceMappingURL=ant-ling.models.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/anthropic.js

@@ -1,16 +1,43 @@
 import { anthropicMessagesApi } from "../api/anthropic-messages.lazy.js";
-import { envApiKeyAuth, lazyOAuth } from "../auth/helpers.js";
+import { lazyOAuth } from "../auth/helpers.js";
 import { loadAnthropicOAuth } from "../auth/oauth/load.js";
+import { ANTHROPIC_API_KEY_ENV, ANTHROPIC_AUTH_TOKEN_ENV, ANTHROPIC_OAUTH_TOKEN_ENV } from "../env-api-keys.js";
 import { createProvider } from "../models.js";
 import { ANTHROPIC_MODELS } from "./anthropic.models.js";
+function anthropicApiKeyAuth() {
+    return {
+        name: "Anthropic API key",
+        login: async (interaction) => ({
+            type: "api_key",
+            key: await interaction.prompt({ type: "secret", message: "Enter Anthropic API key" }),
+        }),
+        resolve: async ({ ctx, credential }) => {
+            if (credential?.key) {
+                return { auth: { apiKey: credential.key }, env: credential.env, source: "stored credential" };
+            }
+            const authToken = await ctx.env(ANTHROPIC_AUTH_TOKEN_ENV);
+            if (authToken) {
+                return {
+                    auth: { headers: { Authorization: `Bearer ${authToken}` } },
+                    source: ANTHROPIC_AUTH_TOKEN_ENV,
+                };
+            }
+            for (const envVar of [ANTHROPIC_OAUTH_TOKEN_ENV, ANTHROPIC_API_KEY_ENV]) {
+                const apiKey = await ctx.env(envVar);
+                if (apiKey)
+                    return { auth: { apiKey }, source: envVar };
+            }
+            return undefined;
+        },
+    };
+}
 export function anthropicProvider() {
     return createProvider({
         id: "anthropic",
         name: "Anthropic",
         baseUrl: "https://api.anthropic.com",
         auth: {
-            // ANTHROPIC_OAUTH_TOKEN takes precedence over ANTHROPIC_API_KEY
-            apiKey: envApiKeyAuth("Anthropic API key", ["ANTHROPIC_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]),
+            apiKey: anthropicApiKeyAuth(),
             oauth: lazyOAuth({ name: "Anthropic (Claude Pro/Max)", load: loadAnthropicOAuth }),
         },
         models: Object.values(ANTHROPIC_MODELS),

package/node_modules/@earendil-works/pi-ai/dist/providers/anthropic.models.js

@@ -1,5 +1,6 @@
 // This file is auto-generated by scripts/generate-models.ts
 // Do not edit manually - run 'npm run generate-models' to update
 import values from "./data/anthropic.json" with { type: "json" };
-export const ANTHROPIC_MODELS = values;
+import { flattenModelCatalog } from "../model-catalog.js";
+export const ANTHROPIC_MODELS = flattenModelCatalog("anthropic", values);
 //# sourceMappingURL=anthropic.models.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/azure-openai-responses.models.js

@@ -1,5 +1,6 @@
 // This file is auto-generated by scripts/generate-models.ts
 // Do not edit manually - run 'npm run generate-models' to update
 import values from "./data/azure-openai-responses.json" with { type: "json" };
-export const AZURE_OPENAI_RESPONSES_MODELS = values;
+import { flattenModelCatalog } from "../model-catalog.js";
+export const AZURE_OPENAI_RESPONSES_MODELS = flattenModelCatalog("azure-openai-responses", values);
 //# sourceMappingURL=azure-openai-responses.models.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/cerebras.models.js

@@ -1,5 +1,6 @@
 // This file is auto-generated by scripts/generate-models.ts
 // Do not edit manually - run 'npm run generate-models' to update
 import values from "./data/cerebras.json" with { type: "json" };
-export const CEREBRAS_MODELS = values;
+import { flattenModelCatalog } from "../model-catalog.js";
+export const CEREBRAS_MODELS = flattenModelCatalog("cerebras", values);
 //# sourceMappingURL=cerebras.models.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/cloudflare-ai-gateway.models.js

@@ -1,5 +1,6 @@
 // This file is auto-generated by scripts/generate-models.ts
 // Do not edit manually - run 'npm run generate-models' to update
 import values from "./data/cloudflare-ai-gateway.json" with { type: "json" };
-export const CLOUDFLARE_AI_GATEWAY_MODELS = values;
+import { flattenModelCatalog } from "../model-catalog.js";
+export const CLOUDFLARE_AI_GATEWAY_MODELS = flattenModelCatalog("cloudflare-ai-gateway", values);
 //# sourceMappingURL=cloudflare-ai-gateway.models.js.map

package/node_modules/@earendil-works/pi-ai/dist/providers/cloudflare-workers-ai.models.js

@@ -1,5 +1,6 @@
 // This file is auto-generated by scripts/generate-models.ts
 // Do not edit manually - run 'npm run generate-models' to update
 import values from "./data/cloudflare-workers-ai.json" with { type: "json" };
-export const CLOUDFLARE_WORKERS_AI_MODELS = values;
+import { flattenModelCatalog } from "../model-catalog.js";
+export const CLOUDFLARE_WORKERS_AI_MODELS = flattenModelCatalog("cloudflare-workers-ai", values);
 //# sourceMappingURL=cloudflare-workers-ai.models.js.map