@sriinnu/kosha-discovery 1.1.0 → 1.5.0

package/dist/cost.js

@@ -0,0 +1,377 @@
+/**
+ * kosha-discovery — Cost primitives shared by the proxy and the CLI.
+ *
+ * Three pieces, all pure synthesis over the model + provider catalog:
+ *   - Pre-flight cost estimation (input + expected-output tokens × rates).
+ *   - JSONL spend ledger persisted under `~/.kosha/`, partitioned one file
+ *     per calendar month (`ledger-YYYY-MM.jsonl`) so the budget gate only
+ *     ever scans the month it cares about — not the full history. The legacy
+ *     append-only `ledger.jsonl` is still read for backward compat so
+ *     existing installs keep working until it stops growing.
+ *   - Monthly budget gate driven by `KOSHA_MONTHLY_BUDGET_USD`.
+ *
+ * No tokenizer dependency — request bodies travel through the proxy
+ * untouched, so we approximate input tokens with a coarse char→token ratio.
+ * @module
+ */
+import { appendFile, mkdir, readFile, readdir, rename, unlink, writeFile } from "fs/promises";
+import { randomBytes } from "crypto";
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { normalizeTokenUsage } from "./tally.js";
+/**
+ * The USD figure a ledger row contributes to spend: an adjustment row's
+ * delta; otherwise the reconciled upstream cost when the row has one, the
+ * pre-flight estimate if not. Every reader (budget gate, `kosha spend`,
+ * /metrics) goes through this so they agree.
+ */
+export function ledgerRowUsd(row) {
+    if (row.kind === "adjustment") {
+        return typeof row.adjustmentUsd === "number" && Number.isFinite(row.adjustmentUsd) ? row.adjustmentUsd : 0;
+    }
+    if (typeof row.actualUsd === "number" && Number.isFinite(row.actualUsd))
+        return row.actualUsd;
+    return typeof row.estimatedUsd === "number" && Number.isFinite(row.estimatedUsd) ? row.estimatedUsd : 0;
+}
+/** True for rows that represent a completed request (not a later correction). */
+export function isRequestRow(row) {
+    return row.kind !== "adjustment";
+}
+/**
+ * Turn a provider `usage` block into a reconciled USD cost against the
+ * model's pricing. Returns null when the model has no usable pricing or the
+ * block carries no token counts. Cache rates fall back to the provider's
+ * published ratios (Anthropic: reads 0.1×, writes 1.25× input; OpenAI: reads
+ * 0.5× input) when the catalog entry lacks explicit cache pricing, so a
+ * cached request is never priced as if it were fully uncached.
+ */
+export function actualCostFromUsage(model, rawUsage, shape) {
+    const pricing = model.pricing;
+    if (!pricing || typeof pricing.inputPerMillion !== "number" || typeof pricing.outputPerMillion !== "number")
+        return null;
+    if (!rawUsage || typeof rawUsage !== "object")
+        return null;
+    const usage = normalizeTokenUsage(rawUsage);
+    if (!usage)
+        return null;
+    const cacheRead = usage.cachedInputTokens ?? 0;
+    const cacheWrite = usage.cacheWriteTokens ?? 0;
+    const uncachedInput = shape === "openai" ? Math.max(0, usage.inputTokens - cacheRead) : usage.inputTokens;
+    const readRate = pricing.cacheReadPerMillion ?? pricing.inputPerMillion * (shape === "anthropic" ? 0.1 : 0.5);
+    const writeRate = pricing.cacheWritePerMillion ?? (shape === "anthropic" ? pricing.inputPerMillion * 1.25 : 0);
+    const usd = tokensTimesRate(uncachedInput, pricing.inputPerMillion) +
+        tokensTimesRate(usage.outputTokens, pricing.outputPerMillion) +
+        tokensTimesRate(cacheRead, readRate) +
+        tokensTimesRate(cacheWrite, writeRate);
+    if (!Number.isFinite(usd) || usd < 0)
+        return null;
+    return { usd, inputTokens: uncachedInput, outputTokens: usage.outputTokens, cacheReadTokens: cacheRead, cacheWriteTokens: cacheWrite };
+}
+export const DEFAULT_LEDGER_PATH = join(homedir(), ".kosha", "ledger.jsonl");
+/**
+ * How many monthly partitions to retain on disk. Older partitions are
+ * trimmed opportunistically on append. Tunable via
+ * `KOSHA_LEDGER_RETENTION_MONTHS`; non-positive / unparseable values fall
+ * back to the default. The legacy `ledger.jsonl` is never trimmed by the
+ * partition sweeper — only `ledger-YYYY-MM.jsonl` siblings are.
+ */
+const DEFAULT_RETENTION_MONTHS = 12;
+/**
+ * Conservative chars-per-token used when we don't have a tokenizer wired up.
+ * This is intentionally lower than the OpenAI rule of thumb (~4) so the
+ * estimate skews high; underestimating spend is the dangerous direction.
+ */
+const CHARS_PER_TOKEN = 3.5;
+/** Output tokens to assume when the caller doesn't request `max_tokens`. */
+const DEFAULT_EXPECTED_OUTPUT_TOKENS = 512;
+/** Per-MTok rates are stored in USD; price = (tokens/1_000_000) * rate. */
+function tokensTimesRate(tokens, perMillion) {
+    return (tokens / 1_000_000) * perMillion;
+}
+/**
+ * Estimate the USD cost of forwarding `requestBody` to `model`. Returns null
+ * when the model has no usable pricing — the caller should treat that as
+ * "cost unknown" rather than free.
+ */
+export function estimateRequestCost(model, requestBody) {
+    const pricing = model.pricing;
+    if (!pricing)
+        return null;
+    if (typeof pricing.inputPerMillion !== "number" || typeof pricing.outputPerMillion !== "number")
+        return null;
+    const inputTokens = approximateInputTokens(requestBody);
+    // `max_completion_tokens` is OpenAI's current spelling; `max_tokens` the legacy one.
+    const requestedOutput = typeof requestBody.max_completion_tokens === "number" && requestBody.max_completion_tokens > 0
+        ? requestBody.max_completion_tokens
+        : typeof requestBody.max_tokens === "number" && requestBody.max_tokens > 0
+            ? requestBody.max_tokens
+            : undefined;
+    const expectedOutputTokens = requestedOutput !== undefined ? Math.floor(requestedOutput) : DEFAULT_EXPECTED_OUTPUT_TOKENS;
+    const estimatedUsd = tokensTimesRate(inputTokens, pricing.inputPerMillion) +
+        tokensTimesRate(expectedOutputTokens, pricing.outputPerMillion);
+    return { estimatedUsd, inputTokens, expectedOutputTokens };
+}
+/**
+ * Approximate input token count by walking the OpenAI-style `messages`
+ * array, falling back to total stringified body length. Intentionally
+ * conservative (small CHARS_PER_TOKEN) so the estimate doesn't undershoot.
+ */
+function approximateInputTokens(body) {
+    const messages = body.messages;
+    if (Array.isArray(messages)) {
+        let chars = 0;
+        for (const msg of messages) {
+            if (!msg || typeof msg !== "object")
+                continue;
+            const content = msg.content;
+            if (typeof content === "string") {
+                chars += content.length;
+            }
+            else if (Array.isArray(content)) {
+                for (const part of content) {
+                    if (typeof part === "string")
+                        chars += part.length;
+                    else if (part && typeof part === "object" && typeof part.text === "string") {
+                        chars += part.text.length;
+                    }
+                }
+            }
+        }
+        if (chars > 0)
+            return Math.ceil(chars / CHARS_PER_TOKEN);
+    }
+    const fallback = JSON.stringify(body).length;
+    return Math.ceil(fallback / CHARS_PER_TOKEN);
+}
+/**
+ * Read `KOSHA_MONTHLY_BUDGET_USD` (if any). Returns null when no budget is
+ * configured — the proxy's budget gate then becomes a no-op. This cap is
+ * global: it is always compared against total spend, never a tenant's slice,
+ * so a caller cannot escape it by inventing a fresh tenant tag.
+ */
+export function readMonthlyBudgetUsd() {
+    return readPositiveUsd(process.env.KOSHA_MONTHLY_BUDGET_USD);
+}
+/**
+ * Read `KOSHA_TENANT_BUDGET_USD` (if any): an additional per-tenant monthly
+ * cap applied on top of the global one to requests that carry a tenant tag.
+ */
+export function readTenantBudgetUsd() {
+    return readPositiveUsd(process.env.KOSHA_TENANT_BUDGET_USD);
+}
+function readPositiveUsd(raw) {
+    if (!raw)
+        return null;
+    const parsed = Number.parseFloat(raw);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+/**
+ * Sum estimated USD spend for entries falling in the calendar month that
+ * contains `nowMs`. Tenant scopes the sum when given.
+ *
+ * Reads only the month's partition (`ledger-YYYY-MM.jsonl` next to
+ * `ledgerPath`) plus, for backward compat, the legacy append-only
+ * `ledgerPath` itself — so existing installs whose history still lives in
+ * the un-partitioned file keep counting until that file stops growing. At
+ * most two files are read, never the full history.
+ */
+export async function readSpendForMonth(nowMs, tenant, ledgerPath = DEFAULT_LEDGER_PATH) {
+    const cutoffStart = startOfMonth(nowMs);
+    const cutoffEnd = startOfNextMonth(nowMs);
+    // The month partition is the hot path; the legacy file is the fallback
+    // for pre-partitioning history. Order matters only for readability —
+    // both are filtered by the same ts window below.
+    const sources = [partitionPathFor(ledgerPath, nowMs), ledgerPath];
+    let total = 0;
+    for (const file of sources) {
+        let raw;
+        try {
+            raw = await readFile(file, "utf-8");
+        }
+        catch (err) {
+            // Missing file (partition not yet created, or legacy absent) is
+            // a clean "nothing here" — try the next source.
+            if (err?.code === "ENOENT")
+                continue;
+            throw err;
+        }
+        for (const line of raw.split("\n")) {
+            if (!line)
+                continue;
+            let row;
+            try {
+                row = JSON.parse(line);
+            }
+            catch {
+                continue; // skip corrupt lines, don't crash budget enforcement
+            }
+            if (row.ts < cutoffStart || row.ts >= cutoffEnd)
+                continue;
+            if (tenant && row.tenant !== tenant)
+                continue;
+            total += ledgerRowUsd(row);
+        }
+    }
+    return total;
+}
+/** Strip control characters and bound length on a ledger string field. The
+ *  ledger records caller-supplied values (modelId, tenant tag, the original
+ *  requested model string), so we sanitize them before writing to disk: each
+ *  line stays a single, well-formed JSON record. Without this, a crafted
+ *  model id with embedded CR/LF could split one row into two. */
+function sanitizeLedgerString(value) {
+    return value.replace(/[\r\n\t]/g, "").slice(0, 256);
+}
+/** Apply sanitizeLedgerString to every string field of the entry. Numeric
+ *  fields are pass-through. */
+function sanitizeEntry(entry) {
+    return {
+        ts: entry.ts,
+        provider: sanitizeLedgerString(entry.provider),
+        modelId: sanitizeLedgerString(entry.modelId),
+        requested: sanitizeLedgerString(entry.requested),
+        tenant: entry.tenant === null ? null : sanitizeLedgerString(entry.tenant),
+        estimatedUsd: entry.estimatedUsd,
+        estimatedInputTokens: entry.estimatedInputTokens,
+        estimatedOutputTokens: entry.estimatedOutputTokens,
+        upstreamStatus: entry.upstreamStatus,
+        ...(entry.actualUsd !== undefined ? { actualUsd: entry.actualUsd } : {}),
+        ...(entry.actualInputTokens !== undefined ? { actualInputTokens: entry.actualInputTokens } : {}),
+        ...(entry.actualOutputTokens !== undefined ? { actualOutputTokens: entry.actualOutputTokens } : {}),
+        ...(entry.cacheReadTokens !== undefined ? { cacheReadTokens: entry.cacheReadTokens } : {}),
+        ...(entry.cacheWriteTokens !== undefined ? { cacheWriteTokens: entry.cacheWriteTokens } : {}),
+        ...(entry.usageSource !== undefined ? { usageSource: entry.usageSource } : {}),
+        ...(entry.kind !== undefined ? { kind: entry.kind } : {}),
+        ...(entry.requestId !== undefined ? { requestId: sanitizeLedgerString(entry.requestId) } : {}),
+        ...(entry.adjustmentUsd !== undefined ? { adjustmentUsd: entry.adjustmentUsd } : {}),
+        ...(entry.adjustmentInputTokens !== undefined ? { adjustmentInputTokens: entry.adjustmentInputTokens } : {}),
+        ...(entry.adjustmentOutputTokens !== undefined ? { adjustmentOutputTokens: entry.adjustmentOutputTokens } : {}),
+    };
+}
+/** `YYYY-MM` (zero-padded month) for the UTC calendar month containing ts.
+ *  UTC matches startOfMonth/startOfNextMonth so the partition a row lands in
+ *  is exactly the month the budget cutoffs bracket. */
+function monthKeyFromTs(ts) {
+    const d = new Date(ts);
+    return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, "0")}`;
+}
+/** Parse a `YYYY-MM` key back to its UTC month-start epoch ms, or null when
+ *  the shape is wrong. Used by trim to age partitions out deterministically. */
+function monthStartFromKey(key) {
+    const m = /^(\d{4})-(\d{2})$/.exec(key);
+    if (!m)
+        return null;
+    const year = Number(m[1]);
+    const month = Number(m[2]) - 1; // JS months are 0-indexed
+    if (month < 0 || month > 11)
+        return null;
+    return Date.UTC(year, month, 1);
+}
+/** Path of the monthly partition file a given ts belongs in. Partitions are
+ *  siblings of the legacy ledger file so they share its directory and perms. */
+function partitionPathFor(ledgerPath, ts) {
+    return join(dirname(ledgerPath), `ledger-${monthKeyFromTs(ts)}.jsonl`);
+}
+/** Read the retention window from `KOSHA_LEDGER_RETENTION_MONTHS`, falling
+ *  back to the default for missing/non-positive/unparseable values. */
+function readRetentionMonths() {
+    const raw = process.env.KOSHA_LEDGER_RETENTION_MONTHS;
+    if (!raw)
+        return DEFAULT_RETENTION_MONTHS;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_RETENTION_MONTHS;
+}
+/**
+ * Drop monthly partition files older than the retention window. Best-effort:
+ * errors are swallowed because retention is housekeeping, not correctness.
+ * The legacy `ledgerPath` file itself is never touched — only
+ * `ledger-YYYY-MM.jsonl` siblings are eligible. Returns the count of
+ * partitions removed (handy for tests / a future `kosha ledger trim`).
+ *
+ * The window is "current month plus `retentionMonths - 1` prior months", so
+ * the default of 12 keeps a rolling year. Exported so the CLI can run an
+ * explicit sweep without waiting for an append.
+ */
+export async function trimLedgerPartitions(ledgerPath, nowMs, retentionMonths = readRetentionMonths()) {
+    const dir = dirname(ledgerPath);
+    const d = new Date(nowMs);
+    // First month we keep: current month shifted back (N-1). Date.UTC wraps
+    // negative months into prior years correctly (month -5 of 2026 → Aug 2025).
+    const cutoffStart = Date.UTC(d.getUTCFullYear(), d.getUTCMonth() - (retentionMonths - 1), 1);
+    let entries;
+    try {
+        entries = await readdir(dir);
+    }
+    catch {
+        // No directory yet (ENOENT) or unreadable — nothing to trim.
+        return 0;
+    }
+    let removed = 0;
+    for (const name of entries) {
+        const m = /^ledger-(\d{4})-(\d{2})\.jsonl$/.exec(name);
+        if (!m)
+            continue;
+        const start = monthStartFromKey(`${m[1]}-${m[2]}`);
+        if (start === null || start >= cutoffStart)
+            continue;
+        await unlink(join(dir, name)).catch(() => {
+            // raced with another sweeper or permission issue — fine, best-effort
+        });
+        removed += 1;
+    }
+    return removed;
+}
+/**
+ * Append one ledger entry atomically. The entry is written to the monthly
+ * partition for its own `ts` (`ledger-YYYY-MM.jsonl`), keeping each file
+ * bounded to a single month so budget reads don't scan the full history.
+ *
+ * Writes are append-only so concurrent processes don't clobber each other.
+ * A best-effort atomic create-and-rename is used if the first append hits
+ * ENOENT, so a fresh install comes up cleanly. After the write we run a
+ * best-effort retention trim so old partitions age out without a cron job.
+ */
+export async function appendLedgerEntry(entry, ledgerPath = DEFAULT_LEDGER_PATH) {
+    await mkdir(dirname(ledgerPath), { recursive: true });
+    const partPath = partitionPathFor(ledgerPath, entry.ts);
+    const line = `${JSON.stringify(sanitizeEntry(entry))}\n`;
+    try {
+        await appendFile(partPath, line, "utf-8");
+    }
+    catch (err) {
+        // If append fails (e.g. permissions) we just swallow — ledger is
+        // observability, not load-bearing routing state. A best-effort
+        // create-and-rename gets us going on a fresh install.
+        if (err?.code === "ENOENT") {
+            const tmp = `${partPath}.${randomBytes(4).toString("hex")}.tmp`;
+            try {
+                await writeFile(tmp, line, "utf-8");
+                await rename(tmp, partPath);
+            }
+            catch {
+                // give up silently
+            }
+        }
+    }
+    // Opportunistic, best-effort retention sweep. Housekeeping must never
+    // break the append — the ledger is observability.
+    try {
+        await trimLedgerPartitions(ledgerPath, entry.ts);
+    }
+    catch {
+        // swallowed
+    }
+}
+function startOfMonth(nowMs) {
+    const d = new Date(nowMs);
+    // Important: pair `getUTCMonth()`/`getUTCFullYear()` with `Date.UTC()`.
+    // The numeric `new Date(year, month, …)` constructor interprets its args
+    // as LOCAL time, so the previous code drifted by up to ~24h around month
+    // boundaries in any non-UTC timezone — breaking budget cutoffs.
+    return Date.UTC(d.getUTCFullYear(), d.getUTCMonth(), 1);
+}
+function startOfNextMonth(nowMs) {
+    const d = new Date(nowMs);
+    return Date.UTC(d.getUTCFullYear(), d.getUTCMonth() + 1, 1);
+}
+//# sourceMappingURL=cost.js.map

package/dist/cost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost.js","sourceRoot":"","sources":["../src/cost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AA8CjD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAA+E;IAC3G,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,CAAC,SAAS,CAAC;IAC9F,OAAO,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,GAA8B;IAC1D,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;AAClC,CAAC;AAoBD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAgB,EAAE,QAAiB,EAAE,KAAiB;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzH,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAmC,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,eAAe,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/G,MAAM,GAAG,GACR,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC;QACvD,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC;QAC7D,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC;QACpC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;AACxI,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAW,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AAErF;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;GAIG;AACH,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,4EAA4E;AAC5E,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAE3C,2EAA2E;AAC3E,SAAS,eAAe,CAAC,MAAc,EAAE,UAAkB;IAC1D,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC;AAC1C,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAgB,EAAE,WAAoC;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE7G,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACxD,qFAAqF;IACrF,MAAM,eAAe,GACpB,OAAO,WAAW,CAAC,qBAAqB,KAAK,QAAQ,IAAI,WAAW,CAAC,qBAAqB,GAAG,CAAC;QAC7F,CAAC,CAAC,WAAW,CAAC,qBAAqB;QACnC,CAAC,CAAC,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,GAAG,CAAC;YACzE,CAAC,CAAC,WAAW,CAAC,UAAU;YACxB,CAAC,CAAC,SAAS,CAAC;IACf,MAAM,oBAAoB,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC;IAE1H,MAAM,YAAY,GACjB,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC;QACrD,eAAe,CAAC,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,IAA6B;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,OAAO,GAAI,GAA6B,CAAC,OAAO,CAAC;YACvD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACjC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;oBAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;yBAC9C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACpG,KAAK,IAAK,IAAyB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjD,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IACnC,OAAO,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IAClC,OAAO,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,eAAe,CAAC,GAAuB;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAsB,EAAE,UAAU,GAAG,mBAAmB;IAC9G,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,uEAAuE;IACvE,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,OAAO,GAAG,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAClE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACJ,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACvB,gEAAgE;YAChE,gDAAgD;YAChD,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChE,MAAM,GAAG,CAAC;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,GAAgB,CAAC;YACrB,IAAI,CAAC;gBACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACR,SAAS,CAAC,qDAAqD;YAChE,CAAC;YACD,IAAI,GAAG,CAAC,EAAE,GAAG,WAAW,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS;gBAAE,SAAS;YAC1D,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YAC9C,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;iEAIiE;AACjE,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;+BAC+B;AAC/B,SAAS,aAAa,CAAC,KAAkB;IACxC,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5C,SAAS,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC;QAChD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC;QACzE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/G,CAAC;AACH,CAAC;AAED;;uDAEuD;AACvD,SAAS,cAAc,CAAC,EAAU;IACjC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;gFACgF;AAChF,SAAS,iBAAiB,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,0BAA0B;IAC1D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;gFACgF;AAChF,SAAS,gBAAgB,CAAC,UAAkB,EAAE,EAAU;IACvD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,cAAc,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;uEACuE;AACvE,SAAS,mBAAmB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,wBAAwB,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC;AAClF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,UAAkB,EAClB,KAAa,EACb,eAAe,GAAW,mBAAmB,EAAE;IAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,6DAA6D;QAC7D,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,WAAW;YAAE,SAAS;QACrD,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxC,qEAAqE;QACtE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAkB,EAAE,UAAU,GAAG,mBAAmB;IAC3F,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC;QACJ,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACvB,iEAAiE;QACjE,+DAA+D;QAC/D,sDAAsD;QACtD,IAAK,GAA6B,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAChE,IAAI,CAAC;gBACJ,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBACpC,MAAM,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACR,mBAAmB;YACpB,CAAC;QACF,CAAC;IACF,CAAC;IACD,sEAAsE;IACtE,kDAAkD;IAClD,IAAI,CAAC;QACJ,MAAM,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,gEAAgE;IAChE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACtC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/credentials/resolver.d.ts

@@ -29,6 +29,16 @@ import type { CredentialResult } from "../types.js";
 export declare class CredentialResolver {
     private readonly home;
     private readonly isWindows;
+    /**
+     * Return every plausible config-directory path for a per-tool config file,
+     * in resolution order. We honour both common Linux conventions
+     * (`$XDG_CONFIG_HOME/<tool>`, `~/.config/<tool>`) and the Windows
+     * convention (`%APPDATA%\<tool>`), so a user with credentials in any
+     * standard location is found rather than silently skipped.
+     */
+    private toolConfigCandidates;
+    /** Read the first existing JSON file from a list of candidate paths. */
+    private readFirstJson;
     /**
      * Resolve credentials for the given provider.
      *
@@ -71,6 +81,13 @@ export declare class CredentialResolver {
      *   (No known CLI tool stores OpenRouter keys on disk.)
      */
     private resolveOpenRouter;
+    /**
+     * Search hierarchy for Vercel AI Gateway credentials:
+     *   1. Explicit config key
+     *   2. `AI_GATEWAY_API_KEY` env var
+     *   3. `VERCEL_OIDC_TOKEN` env var (available on Vercel deployments)
+     */
+    private resolveVercelAIGateway;
     /**
      * Ollama runs locally and never requires authentication.
      * Returns `{ source: "none" }` unconditionally.

package/dist/credentials/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;GAUG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IAEpD;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuDlF;;;;;;;;OAQG;YACW,gBAAgB;IAuD9B;;;;;;OAMG;YACW,aAAa;IA2C3B;;;;;;OAMG;YACW,aAAa;IAkD3B;;;;;OAKG;YACW,iBAAiB;IAoB/B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAQrB;;;;;;;;;;;;;OAaG;YACW,wBAAwB;IAqDtC;;;;;;;;;OASG;YACW,gBAAgB;IAsB9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IAkC1B;;;;;;;;;;;;;;OAcG;YACW,uBAAuB;IA0CrC;;;;;;;OAOG;YACW,qBAAqB;IAkBnC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAavB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,kBAAkB;IAmB1B,oEAAoE;YACtD,QAAQ;IAStB,sEAAsE;YACxD,YAAY;IAQ1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IAiBvB,6CAA6C;IAC7C,OAAO,CAAC,cAAc;IAetB,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB;CAS3B"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;GAUG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IAEpD;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAU5B,wEAAwE;YAC1D,aAAa;IAQ3B;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAmDjF;IAMD;;;;;;;;OAQG;YACW,gBAAgB;IAuD9B;;;;;;OAMG;YACW,aAAa;IA2C3B;;;;;;OAMG;YACW,aAAa;IA4C3B;;;;;OAKG;YACW,iBAAiB;IAoB/B;;;;;OAKG;YACW,sBAAsB;IAsBpC;;;OAGG;IACH,OAAO,CAAC,aAAa;IAQrB;;;;;;;;;;;;;OAaG;YACW,wBAAwB;IAqDtC;;;;;;;;;OASG;YACW,gBAAgB;IAsB9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;;;;;;;;;;OAcG;YACW,uBAAuB;IA0CrC;;;;;;;OAOG;YACW,qBAAqB;IAkBnC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAavB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,kBAAkB;IAmB1B,oEAAoE;YACtD,QAAQ;IAStB,sEAAsE;YACxD,YAAY;IAQ1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IAiBvB,6CAA6C;IAC7C,OAAO,CAAC,cAAc;IAetB,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB;CAS3B"}

package/dist/credentials/resolver.js

@@ -33,6 +33,33 @@ import { normalizeProviderId } from "../provider-catalog.js";
 export class CredentialResolver {
     home = homedir();
     isWindows = platform() === "win32";
+    /**
+     * Return every plausible config-directory path for a per-tool config file,
+     * in resolution order. We honour both common Linux conventions
+     * (`$XDG_CONFIG_HOME/<tool>`, `~/.config/<tool>`) and the Windows
+     * convention (`%APPDATA%\<tool>`), so a user with credentials in any
+     * standard location is found rather than silently skipped.
+     */
+    toolConfigCandidates(tool, file) {
+        const paths = [];
+        const xdg = process.env.XDG_CONFIG_HOME;
+        if (xdg)
+            paths.push(join(xdg, tool, file));
+        paths.push(join(this.home, ".config", tool, file));
+        const appData = process.env.APPDATA;
+        if (this.isWindows && appData)
+            paths.push(join(appData, tool, file));
+        return paths;
+    }
+    /** Read the first existing JSON file from a list of candidate paths. */
+    async readFirstJson(paths) {
+        for (const path of paths) {
+            const data = await this.readJson(path);
+            if (data !== null)
+                return { data, path };
+        }
+        return null;
+    }
     /**
      * Resolve credentials for the given provider.
      *
@@ -52,6 +79,8 @@ export class CredentialResolver {
                 return this.resolveGoogle(explicitKey);
             case "openrouter":
                 return this.resolveOpenRouter(explicitKey);
+            case "vercel":
+                return this.resolveVercelAIGateway(explicitKey);
             case "ollama":
             case "llama.cpp":
                 return this.resolveOllama();
@@ -113,19 +142,19 @@ export class CredentialResolver {
         if (envKey) {
             return { apiKey: envKey, source: "env" };
         }
-        // 3. Claude CLI config — ~/.claude.json
-        const claudeJson = await this.readJson(join(this.home, ".claude.json"));
-        if (claudeJson?.apiKey) {
-            return { apiKey: claudeJson.apiKey, source: "cli", path: join(this.home, ".claude.json") };
+        // 3. Claude CLI config — ~/.claude.json (also %APPDATA%\claude\config.json on Windows)
+        const claudeJsonPaths = [join(this.home, ".claude.json")];
+        const appData = process.env.APPDATA;
+        if (this.isWindows && appData)
+            claudeJsonPaths.push(join(appData, "claude", "config.json"));
+        const claudeJson = await this.readFirstJson(claudeJsonPaths);
+        if (claudeJson?.data?.apiKey) {
+            return { apiKey: claudeJson.data.apiKey, source: "cli", path: claudeJson.path };
         }
-        // 4. Claude CLI settings — ~/.config/claude/settings.json
-        const claudeSettings = await this.readJson(join(this.home, ".config", "claude", "settings.json"));
-        if (claudeSettings?.apiKey) {
-            return {
-                apiKey: claudeSettings.apiKey,
-                source: "cli",
-                path: join(this.home, ".config", "claude", "settings.json"),
-            };
+        // 4. Claude CLI settings — XDG / ~/.config / APPDATA.
+        const claudeSettings = await this.readFirstJson(this.toolConfigCandidates("claude", "settings.json"));
+        if (claudeSettings?.data?.apiKey) {
+            return { apiKey: claudeSettings.data.apiKey, source: "cli", path: claudeSettings.path };
         }
         // 5. Claude CLI OAuth — ~/.claude/credentials.json
         const claudeOAuth = await this.readJson(join(this.home, ".claude", "credentials.json"));
@@ -136,10 +165,11 @@ export class CredentialResolver {
                 path: join(this.home, ".claude", "credentials.json"),
             };
         }
-        // 6. Codex CLI — ~/.codex/auth.json
-        const codexAuth = await this.readJson(join(this.home, ".codex", "auth.json"));
-        if (codexAuth?.anthropic) {
-            return { apiKey: codexAuth.anthropic, source: "cli", path: join(this.home, ".codex", "auth.json") };
+        // 6. Codex CLI — ~/.codex/auth.json, also XDG/APPDATA fallbacks.
+        const codexPaths = [join(this.home, ".codex", "auth.json"), ...this.toolConfigCandidates("codex", "auth.json")];
+        const codexAuth = await this.readFirstJson(codexPaths);
+        if (codexAuth?.data?.anthropic) {
+            return { apiKey: codexAuth.data.anthropic, source: "cli", path: codexAuth.path };
         }
         return { source: "none" };
     }
@@ -207,21 +237,17 @@ export class CredentialResolver {
         if (envKey) {
             return { apiKey: envKey, source: "env" };
         }
-        // 3. Gemini CLI credentials
-        const geminiCreds = await this.readJson(join(this.home, ".gemini", "credentials.json"));
-        if (geminiCreds?.apiKey) {
-            return {
-                apiKey: geminiCreds.apiKey,
-                source: "cli",
-                path: join(this.home, ".gemini", "credentials.json"),
-            };
+        // 3. Gemini CLI credentials — ~/.gemini, also XDG/APPDATA fallbacks.
+        const geminiPaths = [
+            join(this.home, ".gemini", "credentials.json"),
+            ...this.toolConfigCandidates("gemini", "credentials.json"),
+        ];
+        const geminiCreds = await this.readFirstJson(geminiPaths);
+        if (geminiCreds?.data?.apiKey) {
+            return { apiKey: geminiCreds.data.apiKey, source: "cli", path: geminiCreds.path };
         }
-        if (geminiCreds?.access_token) {
-            return {
-                accessToken: geminiCreds.access_token,
-                source: "cli",
-                path: join(this.home, ".gemini", "credentials.json"),
-            };
+        if (geminiCreds?.data?.access_token) {
+            return { accessToken: geminiCreds.data.access_token, source: "cli", path: geminiCreds.path };
         }
         // 4. gcloud application default credentials
         const gcloudPaths = this.getGcloudPaths();
@@ -259,6 +285,29 @@ export class CredentialResolver {
         return { source: "none" };
     }
     // ---------------------------------------------------------------------------
+    // Vercel AI Gateway
+    // ---------------------------------------------------------------------------
+    /**
+     * Search hierarchy for Vercel AI Gateway credentials:
+     *   1. Explicit config key
+     *   2. `AI_GATEWAY_API_KEY` env var
+     *   3. `VERCEL_OIDC_TOKEN` env var (available on Vercel deployments)
+     */
+    async resolveVercelAIGateway(explicitKey) {
+        if (explicitKey) {
+            return { apiKey: explicitKey, source: "config" };
+        }
+        const apiKey = process.env.AI_GATEWAY_API_KEY;
+        if (apiKey) {
+            return { apiKey, source: "env" };
+        }
+        const oidcToken = process.env.VERCEL_OIDC_TOKEN;
+        if (oidcToken) {
+            return { accessToken: oidcToken, source: "env" };
+        }
+        return { source: "none" };
+    }
+    // ---------------------------------------------------------------------------
     // Ollama (no auth needed)
     // ---------------------------------------------------------------------------
     /**
@@ -309,7 +358,7 @@ export class CredentialResolver {
         const awsCredentialsRaw = await this.readTextFile(awsCredentialsPath);
         if (awsCredentialsRaw !== null) {
             const defaultProfile = this.parseAwsIniSection(awsCredentialsRaw, "default");
-            const keyId = defaultProfile["aws_access_key_id"];
+            const keyId = defaultProfile.aws_access_key_id;
             if (keyId) {
                 const region = await this.resolveAwsRegion();
                 return { apiKey: keyId, source: "cli", path: awsCredentialsPath, metadata: { region } };
@@ -352,8 +401,8 @@ export class CredentialResolver {
         const configText = awsConfigRaw ?? (await this.readTextFile(join(this.home, ".aws", "config")));
         if (configText !== null) {
             // AWS config uses [profile default] for non-default profiles and [default] for the default
-            const section = this.parseAwsIniSection(configText, "profile default")["region"] ??
-                this.parseAwsIniSection(configText, "default")["region"];
+            const section = this.parseAwsIniSection(configText, "profile default").region ??
+                this.parseAwsIniSection(configText, "default").region;
             if (section) {
                 return section;
             }
@@ -379,7 +428,16 @@ export class CredentialResolver {
             const trimmed = line.trim();
             // Detect section headers
             if (trimmed.startsWith("[")) {
-                const header = trimmed.slice(1, trimmed.indexOf("]")).trim();
+                // A line that opens a section but never closes it is malformed.
+                // `indexOf("]")` returns -1 there, and `slice(1, -1)` would
+                // silently extract "everything but the last char" — quietly
+                // matching the wrong section. Skip the line instead.
+                const end = trimmed.indexOf("]");
+                if (end === -1) {
+                    inSection = false;
+                    continue;
+                }
+                const header = trimmed.slice(1, end).trim();
                 inSection = header === sectionName;
                 continue;
             }