@tokennotincluded/dsh-lmm-provider 0.1.0-alpha.3

package/lib/index.mjs

@@ -0,0 +1,1803 @@
+import { dirname, join, resolve } from "node:path";
+import { createAssistantMessageEventStream, createModels } from "@earendil-works/pi-ai";
+import { credentialKey } from "@deepseek-ai/dsh-credentials";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { LlmAdapter, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { getBuiltinModels, getBuiltinProviders } from "@earendil-works/pi-ai/providers/all";
+import { createServer } from "node:http";
+import { mkdir, open } from "node:fs/promises";
+import { anthropicMessagesApi, openAICompletionsApi, openAIResponsesApi } from "@earendil-works/pi-ai/compat";
+//#region vendor/pi-lmm-provider/src/protocol.ts
+const CLIENT_ID = "lmm-pi";
+const CALLBACK_PATH = "/oauth/lmm/callback";
+const APPLICATION_SCOPES = [
+	"catalog:read",
+	"balance:read",
+	"usage:read",
+	"models:invoke"
+];
+const MCP_SCOPES = ["mcp:bounties", "mcp:drawing"];
+const INITIAL_SCOPES = [...APPLICATION_SCOPES, ...MCP_SCOPES];
+const SUPPORTED_APIS = [
+	"openai-completions",
+	"openai-responses",
+	"anthropic-messages"
+];
+/** Messages are deliberately fixed: never include an HTTP body, code, or credential. */
+var LmmError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "LmmError";
+		this.code = code;
+	}
+};
+function requireValue(condition, message = "Invalid LMM protocol response.") {
+	if (!condition) throw new LmmError("invalid_response", message);
+}
+function object(value) {
+	requireValue(typeof value === "object" && value !== null && !Array.isArray(value));
+	return value;
+}
+function text(value, max = 1024) {
+	requireValue(typeof value === "string" && value.length > 0 && value.length <= max && !/[\p{Cc}\p{Cf}]/u.test(value));
+	return value;
+}
+function finite(value) {
+	requireValue(typeof value === "number" && Number.isFinite(value));
+	return value;
+}
+function nonnegative(value) {
+	const result = finite(value);
+	requireValue(result >= 0);
+	return result;
+}
+function nullableNumber(value) {
+	return value === null ? null : nonnegative(value);
+}
+function unixSeconds(value) {
+	const result = nonnegative(value);
+	requireValue(Number.isSafeInteger(result));
+	return result;
+}
+function base64url(value) {
+	return Buffer.from(value, "utf8").toString("base64url");
+}
+function canonicalId(value) {
+	const id = text(value, 4096);
+	requireValue(/^[A-Za-z0-9_-]+$/.test(id));
+	const decoded = Buffer.from(id, "base64url").toString("utf8");
+	requireValue(base64url(decoded) === id);
+	text(decoded);
+	return id;
+}
+function parseScope(value) {
+	const scope = text(value, 16384);
+	const parts = scope.split(" ");
+	requireValue(new Set(parts).size === parts.length);
+	for (const part of parts) {
+		if (INITIAL_SCOPES.includes(part)) continue;
+		requireValue(part.startsWith("group:"));
+		canonicalId(part.slice(6));
+	}
+	return scope;
+}
+function accessToken(value) {
+	const token = text(value, 4096);
+	requireValue(/^lmm_at_[A-Za-z0-9_-]+$/.test(token), "LMM requires its OAuth access token, not an API key.");
+	return token;
+}
+function credential(value, issuer) {
+	const item = object(value);
+	requireValue(item.type === "oauth" && item.lmm_issuer === issuer && item.lmm_resource === `${issuer}/api/oauth2`, "LMM credential belongs to another issuer or is not OAuth. Use /login.");
+	accessToken(item.access);
+	text(item.refresh, 4096);
+	text(item.lmm_session, 128);
+	parseScope(item.scope);
+	nonnegative(item.expires);
+	return item;
+}
+function boundedSignal(signal, timeoutMs = 15e3) {
+	return AbortSignal.any([...signal ? [signal] : [], AbortSignal.timeout(timeoutMs)]);
+}
+//#endregion
+//#region vendor/pi-lmm-provider/src/balance.ts
+function parseBalance(value) {
+	const row = object(value);
+	requireValue(row.schema_version === 1 && (row.currency === "platform_credit" || row.currency === "USD") && row.authorization_limit === null);
+	const quota = finite(row.quota);
+	const quotaPerUnit = finite(row.quota_per_unit);
+	requireValue(Number.isSafeInteger(quota) && quotaPerUnit > 0);
+	const remaining = row.balance === null ? null : finite(row.balance);
+	if (remaining !== null) {
+		const expected = quota / quotaPerUnit;
+		requireValue(Math.abs(remaining - expected) <= Math.max(1e-9, Math.abs(expected) * 1e-12), "LMM wallet amounts are inconsistent.");
+	}
+	return {
+		currency: "platform_credit",
+		remaining,
+		quota,
+		quota_per_unit: quotaPerUnit,
+		updated_at: unixSeconds(row.updated_at),
+		authorization_limit: null
+	};
+}
+function balanceStatus(balance, stale = false) {
+	if (!balance || balance.remaining === null) return "LMM · balance unavailable";
+	return `LMM ${new Intl.NumberFormat("en-US", { maximumFractionDigits: 6 }).format(balance.remaining)} platform credits${stale ? " · stale" : ""} · wallet only`;
+}
+//#endregion
+//#region vendor/pi-lmm-provider/src/catalog.ts
+function parseGroup(value) {
+	const row = object(value);
+	const id = canonicalId(row.id);
+	const name = text(row.name);
+	requireValue(id === base64url(name) && row.scope === `group:${id}`);
+	return {
+		id,
+		name,
+		scope: `group:${id}`,
+		multiplier: nullableNumber(row.multiplier)
+	};
+}
+function parsePricing(value) {
+	const row = object(value);
+	requireValue(typeof row.final_cost_depends_on_usage === "boolean");
+	return {
+		currency: text(row.currency, 16),
+		unit: text(row.unit, 64),
+		price_basis: text(row.price_basis, 64),
+		group_multiplier: nullableNumber(row.group_multiplier),
+		trust_multiplier: nullableNumber(row.trust_multiplier),
+		input: nullableNumber(row.input),
+		output: nullableNumber(row.output),
+		cache_read: nullableNumber(row.cache_read),
+		cache_write: nullableNumber(row.cache_write),
+		request: nullableNumber(row.request),
+		final_cost_depends_on_usage: row.final_cost_depends_on_usage,
+		updated_at: unixSeconds(row.updated_at)
+	};
+}
+function nativeCost(value, pricing) {
+	if (value === null || value === void 0) return null;
+	const row = object(value);
+	const cost = {
+		input: nonnegative(row.input),
+		output: nonnegative(row.output),
+		cacheRead: nonnegative(row.cacheRead),
+		cacheWrite: nonnegative(row.cacheWrite)
+	};
+	requireValue(pricing.currency === "USD" && pricing.unit === "million_tokens" && (pricing.price_basis === "configured_base_rates" || pricing.price_basis === "dynamic_estimate") && pricing.request === null, "LMM advertised a native cost for incompatible billing.");
+	requireValue(cost.input === pricing.input && cost.output === pricing.output && cost.cacheRead === pricing.cache_read && cost.cacheWrite === pricing.cache_write, "LMM native cost differs from its already-adjusted server rates.");
+	return cost;
+}
+function parseEntry(value, groups) {
+	const row = object(value);
+	const group_id = canonicalId(row.group_id);
+	const group = text(row.group);
+	const upstream_model = text(row.upstream_model, 512);
+	const id = text(row.id, 4096);
+	requireValue(groups.get(group_id)?.name === group && id === `lmm:${group_id}:${base64url(upstream_model)}`);
+	requireValue(Array.isArray(row.apis) && row.apis.length > 0 && row.apis.length <= 16);
+	const apis = [];
+	for (const value of row.apis) {
+		const api = text(value, 64);
+		if (SUPPORTED_APIS.includes(api)) apis.push(api);
+	}
+	requireValue(new Set(apis).size === apis.length);
+	const pricing = parsePricing(row.pricing);
+	return {
+		id,
+		group_id,
+		group,
+		upstream_model,
+		name: text(row.name),
+		apis,
+		pricing,
+		native_cost: nativeCost(row.native_cost, pricing)
+	};
+}
+function parseCatalog(value, resource, grantedScope) {
+	const body = object(value);
+	requireValue(body.schema_version === 1 && body.resource === resource);
+	requireValue(Array.isArray(body.groups) && body.groups.length <= 2e3 && Array.isArray(body.models) && body.models.length <= 2e4);
+	const scopes = new Set(grantedScope.split(" "));
+	const groups = body.groups.map(parseGroup);
+	const byGroup = new Map(groups.map((group) => [group.id, group]));
+	requireValue(byGroup.size === groups.length && groups.every((group) => scopes.has(group.scope)), "LMM catalog contains a group outside the granted OAuth scopes.");
+	const models = body.models.map((value) => parseEntry(value, byGroup));
+	requireValue(new Set(models.map((model) => model.id)).size === models.length);
+	return {
+		schema_version: 1,
+		resource,
+		updated_at: unixSeconds(body.updated_at),
+		groups,
+		models
+	};
+}
+/** Pi renders model.id in its native picker. Keep wire IDs separate from readable IDs. */
+function nativeModelId(entry) {
+	const part = (value) => value.replaceAll("%", "%25").replaceAll(" / ", "%20%2F%20");
+	return `${part(entry.group)} / ${part(entry.upstream_model)}`;
+}
+function admitCatalog(catalog, issuer, resolve = () => void 0) {
+	return catalog.models.map((entry) => {
+		const capabilities = resolve(entry);
+		if (!capabilities) return {
+			entry,
+			reason: "Capability metadata unavailable; not registered in /model."
+		};
+		const cost = entry.native_cost ?? capabilities.referenceCost;
+		if (!cost) return {
+			entry,
+			reason: "No native or reference cost; available for price inspection only."
+		};
+		requireValue(entry.apis.includes(capabilities.api) && Number.isSafeInteger(capabilities.contextWindow) && capabilities.contextWindow > 0 && Number.isSafeInteger(capabilities.maxTokens) && capabilities.maxTokens > 0 && capabilities.maxTokens <= capabilities.contextWindow && typeof capabilities.reasoning === "boolean" && capabilities.input.length > 0 && capabilities.input.every((input) => input === "text" || input === "image"));
+		text(capabilities.provenance);
+		const multiplier = entry.pricing.group_multiplier === null ? "unknown" : `${entry.pricing.group_multiplier}×`;
+		const estimate = entry.pricing.price_basis === "dynamic_estimate" ? " · estimate" : "";
+		const variable = entry.native_cost ? "" : " · LMM variable billing";
+		return {
+			entry,
+			model: {
+				id: nativeModelId(entry),
+				name: `${entry.group} / ${entry.upstream_model} · group ${multiplier}${estimate}${variable}`,
+				provider: "lmm",
+				api: capabilities.api,
+				baseUrl: capabilities.api === "anthropic-messages" ? issuer : `${issuer}/v1`,
+				reasoning: capabilities.reasoning,
+				input: [...capabilities.input],
+				contextWindow: capabilities.contextWindow,
+				maxTokens: capabilities.maxTokens,
+				compat: structuredClone(capabilities.compat),
+				cost: structuredClone(cost),
+				...capabilities.thinkingLevelMap ? { thinkingLevelMap: structuredClone(capabilities.thinkingLevelMap) } : {}
+			}
+		};
+	});
+}
+function amount(value) {
+	return value === null ? "unknown" : String(value);
+}
+function priceReport(admissions, filter = "") {
+	const selected = admissions.filter(({ entry }) => `${entry.id} ${entry.name}`.toLowerCase().includes(filter.toLowerCase()));
+	const lines = selected.slice(0, 40).map(({ entry, reason }) => {
+		const p = entry.pricing;
+		return [
+			`${entry.group} / ${entry.upstream_model}`,
+			`  ${p.currency}/${p.unit}; ${p.price_basis}; group ×${amount(p.group_multiplier)}, trust ×${amount(p.trust_multiplier)} (already included)`,
+			`  input ${amount(p.input)}, output ${amount(p.output)}, cache read ${amount(p.cache_read)}, cache write ${amount(p.cache_write)}, request ${amount(p.request)}`,
+			`  ${reason ?? "Select using native /model."} Snapshot ${(/* @__PURE__ */ new Date(p.updated_at * 1e3)).toISOString()}.`
+		].join("\n");
+	});
+	if (selected.length > 40) lines.push(`Showing 40 of ${selected.length}; pass an ID or name to /lmm-prices to narrow the read-only report.`);
+	lines.push("Final billing depends on usage and current server policy; this is not a locked quote or a budget approval. Unknown is not free.");
+	return lines.join("\n");
+}
+//#endregion
+//#region vendor/pi-lmm-provider/src/capabilities.ts
+const LANGUAGE_APIS = [
+	"anthropic-messages",
+	"azure-openai-responses",
+	"bedrock-converse-stream",
+	"google-generative-ai",
+	"google-vertex",
+	"mistral-conversations",
+	"openai-codex-responses",
+	"openai-completions",
+	"openai-responses"
+];
+const preferredSources = [
+	"openai",
+	"anthropic",
+	"deepseek",
+	"xai",
+	"moonshotai",
+	"minimax",
+	"google",
+	"zai"
+].map((provider) => [provider, new Map(getBuiltinModels(provider).map((model) => [model.id, model]))]);
+const preferredProviders = new Set(preferredSources.map(([provider]) => provider));
+const fallbackSources = getBuiltinProviders().filter((provider) => !preferredProviders.has(provider)).map((provider) => [provider, new Map(getBuiltinModels(provider).map((model) => [model.id, model]))]);
+function gatewayCompat(entry, compat) {
+	if (entry.group === "国产[Kimi/Deepseek/GLM]" && (entry.upstream_model === "glm-5.3" || entry.upstream_model === "glm-5.3-flash")) return {
+		...compat,
+		supportsLongCacheRetention: true,
+		sendSessionAffinityHeaders: true,
+		requiresReasoningContentOnAssistantMessages: true,
+		thinkingFormat: "deepseek"
+	};
+	return compat;
+}
+function candidates(entry, sources) {
+	const result = [];
+	for (const [provider, models] of sources) {
+		const model = models.get(entry.upstream_model);
+		if (!model) continue;
+		const nativeProtocol = SUPPORTED_APIS.includes(model.api) && entry.apis.includes(model.api);
+		if (!nativeProtocol && (!entry.apis.includes("openai-completions") || !LANGUAGE_APIS.includes(model.api))) continue;
+		const compat = gatewayCompat(entry, nativeProtocol ? structuredClone(model.compat ?? {}) : {
+			supportsDeveloperRole: false,
+			supportsStore: false,
+			supportsReasoningEffort: false,
+			maxTokensField: provider === "openai" ? "max_completion_tokens" : "max_tokens"
+		});
+		if ("allowedFallbackModels" in compat) delete compat.allowedFallbackModels;
+		result.push({
+			api: nativeProtocol ? model.api : "openai-completions",
+			contextWindow: model.contextWindow,
+			maxTokens: model.maxTokens,
+			reasoning: nativeProtocol && model.reasoning,
+			input: [...model.input],
+			compat,
+			referenceCost: structuredClone(model.cost),
+			thinkingLevelMap: nativeProtocol && model.thinkingLevelMap ? structuredClone(model.thinkingLevelMap) : void 0,
+			provenance: `pi-ai vendor catalog: ${provider}/${model.id}${nativeProtocol ? "" : "; server-advertised OpenAI-compatible transport"}`
+		});
+	}
+	return result;
+}
+/** Exact vendor catalog matches only. LMM account pricing always comes from its server. */
+const resolveKnownCapabilities = (entry) => {
+	const matches = candidates(entry, preferredSources);
+	const resolved = matches.length ? matches : candidates(entry, fallbackSources);
+	if (!resolved.length) return void 0;
+	const profile = ({ provenance: _source, referenceCost: _cost, ...rest }) => JSON.stringify(rest);
+	const first = resolved[0];
+	return resolved.every((candidate) => profile(candidate) === profile(first)) ? first : void 0;
+};
+//#endregion
+//#region vendor/pi-lmm-provider/src/http.ts
+var LmmHttp = class {
+	issuer;
+	resource;
+	fetch;
+	timeoutMs;
+	constructor(options = {}) {
+		const raw = options.issuer ?? "https://api.lmm.best";
+		const url = new URL(raw);
+		requireValue(!url.username && !url.password && !url.search && !url.hash && url.pathname === "/", "LMM issuer must be a trusted HTTPS origin without a path or credentials.");
+		requireValue(url.protocol === "https:" || options.allowLoopbackHttpForTests === true && url.protocol === "http:" && url.hostname === "127.0.0.1", "LMM requires HTTPS (except explicit local test fixtures).");
+		this.issuer = url.origin;
+		this.resource = `${this.issuer}/api/oauth2`;
+		this.fetch = options.fetch ?? globalThis.fetch;
+		this.timeoutMs = options.timeoutMs ?? 15e3;
+	}
+	async request(path, init = {}, maxBytes = 2e6) {
+		const signal = boundedSignal(init.signal ?? void 0, this.timeoutMs);
+		try {
+			const response = await this.fetch(`${this.issuer}${path}`, {
+				...init,
+				signal,
+				redirect: "error",
+				credentials: "omit",
+				cache: "no-store",
+				headers: {
+					accept: "application/json",
+					...init.headers
+				}
+			});
+			if (!response.ok) {
+				let errorCode = "";
+				if (response.headers.get("content-type")?.split(";")[0]?.trim() === "application/json" && response.body) try {
+					const body = object(JSON.parse(await response.text()));
+					if (typeof body.error === "object" && body.error !== null && !Array.isArray(body.error) && typeof body.error.code === "string") errorCode = body.error.code;
+					else if (typeof body.code === "string") errorCode = body.code;
+				} catch {}
+				else await response.body?.cancel();
+				if (errorCode === "IP_ACCESS_ROUTE_REJECTED") throw new LmmError("ip_policy", "LMM request was blocked by the current IP access policy. Change network or ask the administrator to allow this IP.");
+				if (response.status === 401 || response.status === 403) throw new LmmError("unauthorized", "LMM authorization is unavailable or was revoked. Use /login; no API-key fallback is allowed.");
+				if (response.status === 429) throw new LmmError("rate_limited", "LMM rate limit reached. Wait a moment and retry.");
+				if (response.status >= 500) throw new LmmError("upstream_unavailable", `LMM service is temporarily unavailable (HTTP ${response.status}). Try again shortly.`);
+				throw new LmmError("http_error", `LMM HTTP request failed (${response.status}).`);
+			}
+			if (response.status === 204 || path === "/api/oauth2/revoke") {
+				await response.body?.cancel();
+				return {};
+			}
+			requireValue(response.headers.get("content-type")?.split(";")[0]?.trim() === "application/json");
+			requireValue(response.body);
+			const reader = response.body.getReader();
+			const chunks = [];
+			let bytes = 0;
+			try {
+				while (true) {
+					signal.throwIfAborted();
+					const { value, done } = await reader.read();
+					if (done) break;
+					bytes += value.byteLength;
+					requireValue(bytes <= maxBytes, "LMM response exceeded its size limit.");
+					chunks.push(value);
+				}
+			} finally {
+				await reader.cancel().catch(() => {});
+				reader.releaseLock();
+			}
+			return object(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+		} catch (error) {
+			if (error instanceof LmmError) throw error;
+			if (signal.aborted) throw new LmmError("aborted", "LMM request cancelled or timed out.");
+			throw new LmmError("transport_error", "LMM network request failed. Check your connection and retry.");
+		}
+	}
+	form(path, fields, signal) {
+		return this.request(path, {
+			method: "POST",
+			signal,
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(fields)
+		}, 64e3);
+	}
+	bearer(path, access, signal) {
+		return this.request(path, {
+			headers: { authorization: `Bearer ${access}` },
+			signal
+		});
+	}
+};
+//#endregion
+//#region vendor/pi-lmm-provider/src/callback.ts
+function equal(left, right) {
+	if (left === null || left.length > 4096) return false;
+	const a = Buffer.from(left);
+	const b = Buffer.from(right);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+function reply(response, status, message) {
+	response.writeHead(status, {
+		"content-type": "text/plain; charset=utf-8",
+		"cache-control": "no-store",
+		"referrer-policy": "no-referrer",
+		"content-security-policy": "default-src 'none'; frame-ancestors 'none'",
+		"x-content-type-options": "nosniff",
+		connection: "close"
+	});
+	response.end(message);
+}
+/** Bind before returning a redirect URI. Invalid/error callbacks never settle the login. */
+async function listenCallback(issuer, state, signal, hostName = "Pi") {
+	signal.throwIfAborted();
+	let accept = () => {};
+	let reject = () => {};
+	const code = new Promise((resolve, fail) => {
+		accept = resolve;
+		reject = fail;
+	});
+	code.catch(() => {});
+	let authority = "";
+	let settled = false;
+	let closed = false;
+	const server = createServer({ maxHeaderSize: 8192 }, (request, response) => {
+		if (settled || request.method !== "GET" || request.headers.host !== authority || request.socket.remoteAddress !== "127.0.0.1" || request.url?.split("?")[0] !== "/oauth/lmm/callback") {
+			reply(response, 400, `Invalid OAuth callback. Return to ${hostName} to cancel or retry.`);
+			return;
+		}
+		const params = new URL(request.url, `http://${authority}`).searchParams;
+		const valid = [
+			"state",
+			"iss",
+			"code"
+		].every((key) => params.getAll(key).length === 1) && [...params.keys()].every((key) => [
+			"state",
+			"iss",
+			"code"
+		].includes(key)) && equal(params.get("state"), state) && params.get("iss") === issuer;
+		const returnedCode = params.get("code");
+		const errorKeys = [
+			"state",
+			"iss",
+			"error"
+		];
+		const hasError = params.has("error");
+		const errorValid = errorKeys.every((key) => params.getAll(key).length === 1) && [...params.keys()].every((key) => errorKeys.includes(key) || key === "error_description" || key === "error_uri") && params.getAll("error_description").length <= 1 && params.getAll("error_uri").length <= 1 && equal(params.get("state"), state) && params.get("iss") === issuer && /^[A-Za-z0-9._~-]{1,256}$/.test(params.get("error") ?? "");
+		if (hasError && errorValid && !params.has("code")) {
+			settled = true;
+			reply(response, 200, `Authorization was not granted. Return to ${hostName}.`);
+			reject(new LmmError("oauth_denied", "LMM authorization was denied."));
+			return;
+		}
+		if (!valid || returnedCode === null || !/^[A-Za-z0-9._~-]{1,4096}$/.test(returnedCode)) {
+			reply(response, 400, `Unverified OAuth callback. The login is still waiting in ${hostName}.`);
+			return;
+		}
+		settled = true;
+		reply(response, 200, `Authorization received. Return to ${hostName} to finish signing in.`);
+		accept(returnedCode);
+	});
+	server.requestTimeout = 5e3;
+	server.headersTimeout = 5e3;
+	server.keepAliveTimeout = 1;
+	const close = () => {
+		if (closed) return;
+		closed = true;
+		signal.removeEventListener("abort", abort);
+		server.close();
+		server.closeAllConnections();
+		if (!settled) {
+			settled = true;
+			reject(new LmmError("aborted", "LMM login cancelled or timed out."));
+		}
+	};
+	const abort = () => close();
+	signal.addEventListener("abort", abort, { once: true });
+	try {
+		await new Promise((resolve, fail) => {
+			const onError = () => fail(new LmmError("callback_unavailable", "Could not listen on the local OAuth callback address."));
+			server.once("error", onError);
+			server.listen(0, "127.0.0.1", () => {
+				server.removeListener("error", onError);
+				resolve();
+			});
+		});
+		if (signal.aborted) {
+			server.close();
+			server.closeAllConnections();
+			throw new LmmError("aborted", "LMM login cancelled or timed out.");
+		}
+		server.on("error", () => {
+			reject(new LmmError("callback_unavailable", "The local OAuth callback listener failed."));
+			close();
+		});
+		const address = server.address();
+		if (!address || typeof address === "string") throw new LmmError("callback_unavailable", "No local OAuth callback port was allocated.");
+		authority = `127.0.0.1:${address.port}`;
+		return {
+			redirectUri: `http://${authority}${CALLBACK_PATH}`,
+			code,
+			close
+		};
+	} catch (error) {
+		close();
+		throw error;
+	}
+}
+//#endregion
+//#region vendor/pi-lmm-provider/src/refresh-journal.ts
+const FIXED_FAILURE = "LMM refresh could not be safely recorded. Use /login.";
+const ALREADY_ATTEMPTED = "LMM refresh was already attempted. Use /login.";
+function refreshDigest(refresh) {
+	return createHash("sha256").update(refresh, "utf8").digest("hex");
+}
+/** Durable, credential-free fencing for one-shot refresh tokens. */
+var RefreshJournal = class {
+	directory;
+	constructor(directory) {
+		if (!directory) throw new LmmError("refresh_storage_unverified", FIXED_FAILURE);
+		this.directory = directory;
+	}
+	async begin(issuer, refresh) {
+		const digest = refreshDigest(refresh);
+		const marker = join(this.directory, `${refreshDigest(`${issuer}\n${digest}`)}.refresh`);
+		let handle;
+		try {
+			const firstCreated = await mkdir(this.directory, {
+				recursive: true,
+				mode: 448
+			});
+			handle = await open(marker, "wx", 384);
+			await handle.writeFile(JSON.stringify({
+				issuer,
+				refresh_sha256: digest
+			}) + "\n", "utf8");
+			await handle.sync();
+			await handle.close();
+			handle = void 0;
+			const directoryHandle = await open(this.directory, "r");
+			try {
+				await directoryHandle.sync();
+			} finally {
+				await directoryHandle.close();
+			}
+			if (firstCreated) {
+				const firstCreatedParent = dirname(resolve(firstCreated));
+				let parent = dirname(resolve(this.directory));
+				while (true) {
+					const parentHandle = await open(parent, "r");
+					try {
+						await parentHandle.sync();
+					} finally {
+						await parentHandle.close();
+					}
+					if (parent === firstCreatedParent || parent === dirname(parent)) break;
+					parent = dirname(parent);
+				}
+			}
+		} catch (error) {
+			await handle?.close().catch(() => {});
+			if (error.code === "EEXIST") throw new LmmError("refresh_already_attempted", ALREADY_ATTEMPTED);
+			throw new LmmError("refresh_storage_unavailable", FIXED_FAILURE);
+		}
+	}
+};
+//#endregion
+//#region vendor/pi-lmm-provider/src/oauth.ts
+const REFRESH_BLOCKED = "Automatic LMM refresh requires a configured durable refresh journal. Use /login.";
+var LmmOAuth = class {
+	http;
+	loginTimeoutMs;
+	refreshJournal;
+	clientId;
+	hostName;
+	constructor(http, loginTimeoutMs = 18e4, refreshJournalDirectory, clientId = CLIENT_ID, hostName = "Pi") {
+		this.http = http;
+		this.loginTimeoutMs = loginTimeoutMs;
+		this.refreshJournal = refreshJournalDirectory === void 0 ? void 0 : new RefreshJournal(refreshJournalDirectory);
+		requireValue(/^[a-z0-9][a-z0-9-]{0,63}$/.test(clientId), "Invalid LMM OAuth client identifier.");
+		requireValue(/^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$/.test(hostName), "Invalid LMM OAuth host name.");
+		this.clientId = clientId;
+		this.hostName = hostName;
+	}
+	async discover(signal) {
+		const [authorization, resource] = await Promise.all([this.http.request("/.well-known/oauth-authorization-server", { signal }, 64e3), this.http.request("/.well-known/oauth-protected-resource/api/oauth2", { signal }, 64e3)]);
+		requireValue(authorization.issuer === this.http.issuer && authorization.authorization_endpoint === `${this.http.resource}/authorize` && authorization.token_endpoint === `${this.http.resource}/token` && authorization.revocation_endpoint === `${this.http.resource}/revoke`, "LMM OAuth discovery issuer or endpoint does not match the configured issuer.");
+		requireValue(Array.isArray(authorization.code_challenge_methods_supported) && authorization.code_challenge_methods_supported.includes("S256"), "LMM OAuth discovery does not support the required S256 PKCE method.");
+		requireValue(Array.isArray(authorization.response_types_supported) && authorization.response_types_supported.includes("code"), "LMM OAuth discovery does not support the authorization-code flow.");
+		requireValue(authorization.authorization_response_iss_parameter_supported === true, "LMM discovery must advertise issuer-bound authorization responses.");
+		requireValue(resource.resource === this.http.resource && Array.isArray(resource.authorization_servers) && resource.authorization_servers.length === 1 && resource.authorization_servers[0] === this.http.issuer, "LMM OAuth protected-resource metadata does not match the configured resource.");
+	}
+	async login(interaction) {
+		const signal = boundedSignal(interaction.signal, this.loginTimeoutMs);
+		let callback;
+		try {
+			await this.discover(signal);
+			const verifier = randomBytes(32).toString("base64url");
+			const state = randomBytes(32).toString("base64url");
+			const challenge = createHash("sha256").update(verifier).digest("base64url");
+			callback = await listenCallback(this.http.issuer, state, signal, this.hostName);
+			const url = new URL(`${this.http.resource}/authorize`);
+			url.search = new URLSearchParams({
+				client_id: this.clientId,
+				response_type: "code",
+				redirect_uri: callback.redirectUri,
+				scope: INITIAL_SCOPES.join(" "),
+				resource: this.http.resource,
+				code_challenge: challenge,
+				code_challenge_method: "S256",
+				state
+			}).toString();
+			interaction.notify({
+				type: "auth_url",
+				url: url.href,
+				instructions: `Sign in and approve LMM in your browser, then return to ${this.hostName}. Cancel in ${this.hostName} to stop waiting.`
+			});
+			const code = await callback.code;
+			const redirectUri = callback.redirectUri;
+			callback.close();
+			callback = void 0;
+			signal.throwIfAborted();
+			const startedAt = Date.now();
+			const response = await this.http.form("/api/oauth2/token", {
+				grant_type: "authorization_code",
+				client_id: this.clientId,
+				code,
+				redirect_uri: redirectUri,
+				code_verifier: verifier,
+				resource: this.http.resource
+			}, signal);
+			return this.parseToken(response, startedAt);
+		} catch (error) {
+			if (signal.aborted || error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) throw new LmmError("aborted", "LMM login cancelled or timed out. Start /login again.");
+			throw error;
+		} finally {
+			callback?.close();
+		}
+	}
+	parseToken(response, startedAt, previous) {
+		requireValue(response.token_type === "Bearer", "LMM OAuth token response did not contain Bearer token type.");
+		const access = accessToken(response.access_token);
+		const refresh = text(response.refresh_token, 4096);
+		requireValue(!/\s/.test(refresh) && refresh !== access, "LMM OAuth token response contained an invalid refresh token.");
+		const lifetime = nonnegative(response.expires_in);
+		requireValue(Number.isSafeInteger(lifetime) && lifetime > 0 && lifetime <= 86400, "LMM OAuth token response contained an invalid expiration.");
+		const scope = parseScope(response.scope === void 0 ? previous?.scope : response.scope);
+		const scopes = new Set(scope.split(" "));
+		if (previous) {
+			const oldScopes = new Set(previous.scope.split(" "));
+			requireValue([...scopes].every((entry) => oldScopes.has(entry)), "LMM refresh tried to widen granted scope. Sign in again.");
+			requireValue(refresh !== previous.refresh, "LMM refresh did not rotate the refresh token. Sign in again.");
+		} else requireValue(APPLICATION_SCOPES.every((entry) => scopes.has(entry)), "LMM did not grant the required application scopes.");
+		return {
+			type: "oauth",
+			access,
+			refresh,
+			expires: startedAt + lifetime * 1e3,
+			lmm_issuer: this.http.issuer,
+			lmm_resource: this.http.resource,
+			lmm_session: previous?.lmm_session ?? randomUUID(),
+			scope
+		};
+	}
+	/** Native production callback: no network and no storage outside Pi. */
+	async refreshBlocked() {
+		throw new LmmError("refresh_storage_unverified", REFRESH_BLOCKED);
+	}
+	async refresh(value, signal) {
+		const current = credential(value, this.http.issuer);
+		signal.throwIfAborted();
+		if (!this.refreshJournal) throw new LmmError("refresh_storage_unverified", REFRESH_BLOCKED);
+		await this.refreshJournal.begin(this.http.issuer, current.refresh);
+		signal.throwIfAborted();
+		return this.exchangeRefresh(current, signal);
+	}
+	/** Wire-level exchange only, for tests / a future reviewed host transaction adapter. Not wired into the extension. */
+	async exchangeRefresh(value, signal) {
+		const current = credential(value, this.http.issuer);
+		const startedAt = Date.now();
+		const response = await this.http.form("/api/oauth2/token", {
+			grant_type: "refresh_token",
+			client_id: this.clientId,
+			refresh_token: current.refresh,
+			resource: this.http.resource
+		}, signal);
+		return this.parseToken(response, startedAt, current);
+	}
+	/** Access-token revocation invalidates the whole family in the fixed LMM profile. No refresh is attempted. */
+	async revoke(access, signal) {
+		await this.http.form("/api/oauth2/revoke", {
+			client_id: this.clientId,
+			token: accessToken(access),
+			token_type_hint: "access_token"
+		}, signal);
+	}
+};
+//#endregion
+//#region vendor/pi-lmm-provider/src/stream.ts
+const streams = {
+	"openai-completions": openAICompletionsApi(),
+	"openai-responses": openAIResponsesApi(),
+	"anthropic-messages": anthropicMessagesApi()
+};
+const RETRY_BASE_DELAY_MS = 250;
+const RETRY_MAX_DELAY_MS = 8e3;
+function errorText(error) {
+	if (error instanceof Error) return error.message;
+	if (typeof error === "string") return error;
+	if (error && typeof error === "object" && "errorMessage" in error && typeof error.errorMessage === "string") return error.errorMessage;
+	return "";
+}
+function errorStatus(error, message = errorText(error)) {
+	if (error && typeof error === "object") for (const key of ["status", "statusCode"]) {
+		const value = error[key];
+		if (typeof value === "number" && Number.isInteger(value)) return value;
+	}
+	const match = message.match(/\b([45]\d{2})\b/);
+	return match ? Number(match[1]) : void 0;
+}
+function isTransportFailure(error) {
+	const message = errorText(error);
+	const status = errorStatus(error, message);
+	if (status !== void 0) return status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;
+	return /network|transport|disconnect|decod(?:e|ing)|response body|fetch failed|socket|timed out|stream ended before/i.test(message);
+}
+function publicErrorMessage(error, _retries = 0, outputStarted = false) {
+	const message = errorText(error);
+	if (/\babort(?:ed|ing)\b|cancel(?:led|ed)|request aborted/i.test(message)) return "LMM request cancelled.";
+	if (/IP_ACCESS_ROUTE_REJECTED|IP access policy/i.test(message)) return "LMM request was blocked by the current IP access policy. Change network or ask the administrator to allow this IP.";
+	const status = errorStatus(error, message);
+	if (status === 401) return "LMM authorization expired or was revoked. Run /login again.";
+	if (status === 403) return "This LMM account is not allowed to use the selected model. Run /login again or choose another model.";
+	if (status === 429) return "LMM rate limit reached. Wait a moment and retry.";
+	if (status !== void 0 && status >= 500) return `LMM upstream is temporarily unavailable (HTTP ${status}). Try again shortly.`;
+	if (isTransportFailure(error)) {
+		if (outputStarted) return "LMM stream disconnected after output started. The partial request was not replayed to avoid duplicate billing; try again.";
+		return "LMM stream disconnected before completion. The request was not replayed to avoid duplicate billing; try again manually.";
+	}
+	return "LMM model request failed. Check authorization, account access, and server availability.";
+}
+async function waitForRetry(delay, signal) {
+	if (delay <= 0) return;
+	await new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", abort);
+			resolve();
+		}, delay);
+		const abort = () => {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", abort);
+			reject(signal?.reason ?? /* @__PURE__ */ new Error("aborted"));
+		};
+		signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+function bearerFromHeaders(headers) {
+	const values = Object.entries(headers ?? {}).filter(([key]) => key.toLowerCase() === "authorization").map(([, value]) => value);
+	requireValue(values.length === 1 && typeof values[0] === "string" && values[0].startsWith("Bearer "), "LMM model requests require native OAuth authorization.");
+	return accessToken(values[0].slice(7));
+}
+function errorMessage(model, aborted, error, retries = 0, outputStarted = false) {
+	return {
+		role: "assistant",
+		content: [],
+		api: model.api,
+		provider: "lmm",
+		model: model.id,
+		usage: {
+			input: 0,
+			output: 0,
+			cacheRead: 0,
+			cacheWrite: 0,
+			totalTokens: 0,
+			cost: {
+				input: 0,
+				output: 0,
+				cacheRead: 0,
+				cacheWrite: 0,
+				total: 0
+			}
+		},
+		stopReason: aborted ? "aborted" : "error",
+		errorMessage: aborted ? "LMM request cancelled." : publicErrorMessage(error, retries, outputStarted),
+		timestamp: Date.now()
+	};
+}
+function rebind(message, model) {
+	const result = {
+		...message,
+		provider: "lmm",
+		model: model.id,
+		api: model.api
+	};
+	if (result.stopReason === "error" || result.stopReason === "aborted") result.errorMessage = result.stopReason === "aborted" ? "LMM request cancelled." : publicErrorMessage(result.errorMessage);
+	return result;
+}
+function rebindEvent(event, model) {
+	if (event.type === "done") return {
+		...event,
+		message: rebind(event.message, model)
+	};
+	if (event.type === "error") return {
+		...event,
+		error: rebind(event.error, model)
+	};
+	if ("partial" in event) return {
+		...event,
+		partial: rebind(event.partial, model)
+	};
+	return event;
+}
+function createRelay(http, hooks) {
+	const run = (simple, selected, context, options = {}) => {
+		const output = createAssistantMessageEventStream();
+		(async () => {
+			let access;
+			let sent = false;
+			let attempt = 0;
+			let streamStarted = false;
+			try {
+				requireValue(options.apiKey === void 0, "An API key must not be combined with LMM OAuth.");
+				access = bearerFromHeaders(options.headers);
+				const admission = hooks.lookup(selected.id, access);
+				requireValue(admission?.model, "This LMM model is no longer admitted by the current account catalog.");
+				const { entry, model } = admission;
+				requireValue(model && selected.provider === "lmm" && selected.api === model.api);
+				if (options.maxTokens !== void 0) requireValue(Number.isSafeInteger(options.maxTokens) && options.maxTokens > 0 && options.maxTokens <= model.maxTokens, "Requested output exceeds the verified LMM model capability.");
+				const api = model.api;
+				const wire = {
+					...structuredClone(model),
+					id: entry.upstream_model,
+					headers: void 0
+				};
+				const path = api === "anthropic-messages" ? "/v1/messages" : api === "openai-responses" ? "/v1/responses" : "/v1/chat/completions";
+				const headers = {
+					authorization: `Bearer ${access}`,
+					"X-LMM-Group": entry.group_id,
+					"x-api-key": null
+				};
+				const authorizedAccess = access;
+				const guardedFetch = async (input, init) => {
+					const target = input instanceof Request ? input.url : String(input);
+					const endpoint = `${http.issuer}${path}`;
+					const sdkBeta = api === "anthropic-messages" && target === `${endpoint}?beta=true`;
+					requireValue(target === endpoint || sdkBeta, "LMM relay destination does not match its advertised protocol.");
+					const actual = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+					for (const name of [
+						"x-api-key",
+						"api-key",
+						"proxy-authorization",
+						"cookie"
+					]) actual.delete(name);
+					actual.set("authorization", `Bearer ${authorizedAccess}`);
+					actual.set("x-lmm-group", entry.group_id);
+					sent = true;
+					const destination = sdkBeta ? input instanceof Request ? new Request(endpoint, input) : endpoint : input;
+					return http.fetch(destination, {
+						...init,
+						headers: actual,
+						redirect: "error",
+						credentials: "omit"
+					});
+				};
+				const originalOnPayload = options.onPayload;
+				const wireOptions = {
+					...options,
+					apiKey: void 0,
+					headers,
+					env: {},
+					fetch: guardedFetch,
+					maxTokens: options.maxTokens ?? model.maxTokens,
+					maxRetries: 0,
+					onPayload: async (payload, payloadModel) => {
+						return {
+							...object(await originalOnPayload?.(payload, payloadModel) ?? payload),
+							model: entry.upstream_model,
+							stream: true
+						};
+					}
+				};
+				const wireContext = {
+					...context,
+					messages: context.messages.map((message) => message.role === "assistant" && message.provider === "lmm" && message.model === selected.id ? {
+						...message,
+						model: entry.upstream_model
+					} : message)
+				};
+				while (true) {
+					const source = simple ? streams[api].streamSimple(wire, wireContext, wireOptions) : streams[api].stream(wire, wireContext, wireOptions);
+					let retry = false;
+					try {
+						for await (const event of source) {
+							if (event.type === "start" || event.type !== "error" && event.type !== "done") streamStarted = true;
+							if (event.type === "error") {
+								const shouldRetry = !streamStarted && isTransportFailure(event.error) && attempt < 0;
+								const error = rebind(event.error, selected);
+								if (shouldRetry) {
+									attempt += 1;
+									await waitForRetry(Math.min(RETRY_MAX_DELAY_MS, RETRY_BASE_DELAY_MS * 2 ** (attempt - 1)), options.signal);
+									retry = true;
+									break;
+								}
+								error.errorMessage = publicErrorMessage(event.error, attempt, streamStarted);
+								output.push({
+									...event,
+									error
+								});
+								output.end(error);
+								return;
+							}
+							output.push(rebindEvent(event, selected));
+						}
+					} catch (error) {
+						if (!streamStarted && isTransportFailure(error) && attempt < 0) {
+							attempt += 1;
+							await waitForRetry(Math.min(RETRY_MAX_DELAY_MS, RETRY_BASE_DELAY_MS * 2 ** (attempt - 1)), options.signal);
+							retry = true;
+						} else throw error;
+					}
+					if (retry) continue;
+					output.end(rebind(await source.result(), selected));
+					break;
+				}
+			} catch (error) {
+				const message = errorMessage(selected, options.signal?.aborted === true, error, attempt, streamStarted);
+				if (error instanceof LmmError) message.errorMessage = error.message;
+				output.push({
+					type: "error",
+					reason: options.signal?.aborted ? "aborted" : "error",
+					error: message
+				});
+				output.end(message);
+			} finally {
+				if (sent && access) await hooks.onFinish(access).catch(() => {});
+			}
+		})();
+		return output;
+	};
+	return {
+		stream: (model, context, options) => run(false, model, context, options),
+		streamSimple: (model, context, options) => run(true, model, context, options)
+	};
+}
+//#endregion
+//#region vendor/pi-lmm-provider/src/provider.ts
+function fingerprint(access) {
+	return createHash("sha256").update(access).digest("hex");
+}
+const CACHE_MAX_AGE_MS = 864e5;
+const CACHE_FUTURE_SKEW_MS = 3e5;
+function cacheTag(value) {
+	return `lmm-session-sha256:${createHash("sha256").update(`${value.lmm_issuer}\n${value.lmm_session}`).digest("hex")}`;
+}
+function decodeNativePart(value) {
+	return value.replaceAll("%20%2F%20", " / ").replaceAll("%25", "%");
+}
+function validCost(cost) {
+	const validRates = (rates) => [
+		rates.input,
+		rates.output,
+		rates.cacheRead,
+		rates.cacheWrite
+	].every((value) => typeof value === "number" && Number.isFinite(value) && value >= 0);
+	return validRates(cost) && (cost.tiers ?? []).every((tier) => Number.isSafeInteger(tier.inputTokensAbove) && tier.inputTokensAbove >= 0 && validRates(tier));
+}
+function cachedEntry(model, updatedAt) {
+	try {
+		if (model.provider !== "lmm" || !SUPPORTED_APIS.includes(model.api)) return void 0;
+		const parts = model.id.split(" / ");
+		if (parts.length !== 2) return void 0;
+		const group = text(decodeNativePart(parts[0]));
+		const upstream = text(decodeNativePart(parts[1]), 512);
+		if (nativeModelId({
+			group,
+			upstream_model: upstream
+		}) !== model.id) return void 0;
+		if (!validCost(model.cost)) return void 0;
+		const pricing = {
+			currency: "USD",
+			unit: "million_tokens",
+			price_basis: "configured_base_rates",
+			group_multiplier: null,
+			trust_multiplier: null,
+			input: model.cost.input,
+			output: model.cost.output,
+			cache_read: model.cost.cacheRead,
+			cache_write: model.cost.cacheWrite,
+			request: null,
+			final_cost_depends_on_usage: true,
+			updated_at: updatedAt
+		};
+		const group_id = base64url(group);
+		return {
+			id: `lmm:${group_id}:${base64url(upstream)}`,
+			group_id,
+			group,
+			upstream_model: upstream,
+			name: `${group} / ${upstream}`,
+			apis: [model.api],
+			pricing,
+			native_cost: structuredClone(model.cost)
+		};
+	} catch {
+		return;
+	}
+}
+var LmmIntegration = class {
+	http;
+	oauth;
+	provider;
+	capabilities;
+	notify;
+	shutdown = new AbortController();
+	current;
+	pendingLogin;
+	revoked = /* @__PURE__ */ new Set();
+	balancePending;
+	authSnapshotPending;
+	epoch = 0;
+	constructor(options = {}) {
+		this.http = new LmmHttp(options);
+		this.oauth = new LmmOAuth(this.http, options.loginTimeoutMs, options.refreshJournalDirectory, options.clientId, options.hostName);
+		this.capabilities = options.capabilities ?? resolveKnownCapabilities;
+		this.notify = options.onStatus ?? (() => {});
+		const relay = createRelay(this.http, {
+			lookup: (id, access) => this.lookup(id, access),
+			onFinish: (access) => this.refreshBalance(access)
+		});
+		this.provider = {
+			id: "lmm",
+			name: "LMM",
+			baseUrl: this.http.issuer,
+			auth: { oauth: {
+				name: "LMM browser login",
+				login: async (interaction) => {
+					this.clear();
+					const epoch = this.epoch;
+					const issued = await this.oauth.login({
+						...interaction,
+						signal: AbortSignal.any([interaction.signal, this.shutdown.signal])
+					});
+					try {
+						const snapshot = await this.fetchSnapshot(issued, boundedSignal(interaction.signal));
+						if (epoch === this.epoch) this.pendingLogin = snapshot;
+					} catch {
+						interaction.notify({
+							type: "progress",
+							message: "LMM login succeeded, but its catalog or balance is unavailable. Use /lmm-prices to retry discovery; unknown models are not registered."
+						});
+					}
+					interaction.notify({
+						type: "progress",
+						message: `LMM uses ${options.hostName ?? "Pi"}'s native model selector. Entries without verified capabilities or truthful native pricing remain read-only. Automatic refresh is fenced by a durable local journal; signing out is local only.`
+					});
+					return issued;
+				},
+				refresh: async (value, signal) => this.oauth.refresh(value, AbortSignal.any([signal, this.shutdown.signal])),
+				toAuth: async (value) => {
+					const current = credential(value, this.http.issuer);
+					if (this.revoked.has(current.lmm_session)) throw new LmmError("revoked", "This LMM grant was revoked. Use /logout and then /login.");
+					await this.refreshSnapshotForAuth(current);
+					return {
+						headers: { authorization: `Bearer ${current.access}` },
+						baseUrl: this.http.issuer
+					};
+				}
+			} },
+			getModels: () => structuredClone(this.current?.admissions.flatMap(({ model }) => model ? [model] : []) ?? []),
+			filterModels: (models, stored) => {
+				const current = this.maybeCredential(stored);
+				return current && this.current?.session === current.lmm_session && this.current.accessHash === fingerprint(current.access) && this.current.expires > Date.now() ? models.filter((model) => this.current?.admissions.some((item) => item.model?.id === model.id)) : [];
+			},
+			refreshModels: (context) => this.refreshModels(context),
+			stream: relay.stream,
+			streamSimple: relay.streamSimple
+		};
+	}
+	maybeCredential(value) {
+		try {
+			const result = credential(value, this.http.issuer);
+			return this.revoked.has(result.lmm_session) ? void 0 : result;
+		} catch {
+			return;
+		}
+	}
+	clear() {
+		this.epoch++;
+		this.current = void 0;
+		this.pendingLogin = void 0;
+		this.balancePending = void 0;
+		this.authSnapshotPending = void 0;
+		this.notify(void 0);
+	}
+	status() {
+		if (!this.current) return this.notify(void 0);
+		const admitted = this.current.admissions.filter((item) => item.model).length;
+		this.notify(`${balanceStatus(this.current.balance, this.current.balanceStale)}${this.current.catalogStale ? " · cached models" : ""}${admitted === 0 ? " · models gated" : ""}`);
+	}
+	async fetchSnapshot(value, signal) {
+		const scope = new Set(value.scope.split(" "));
+		const snapshot = {
+			session: value.lmm_session,
+			accessHash: fingerprint(value.access),
+			expires: value.expires,
+			admissions: [],
+			catalogUpdatedAt: 0,
+			checkedAt: Date.now(),
+			catalogStale: false,
+			balanceStale: false
+		};
+		const parsed = parseCatalog(await this.http.bearer("/api/oauth2/catalog", value.access, signal), this.http.resource, value.scope);
+		snapshot.catalogUpdatedAt = parsed.updated_at;
+		if (scope.has("models:invoke")) snapshot.admissions = admitCatalog(parsed, this.http.issuer, this.capabilities);
+		else snapshot.admissions = parsed.models.map((entry) => ({
+			entry,
+			reason: "models:invoke was not granted; read-only."
+		}));
+		if (scope.has("balance:read")) try {
+			snapshot.balance = parseBalance(await this.http.bearer("/api/oauth2/balance", value.access, signal));
+		} catch {
+			snapshot.balanceStale = true;
+		}
+		return snapshot;
+	}
+	cache(snapshot, value) {
+		return {
+			models: snapshot.admissions.flatMap(({ model }) => model ? [structuredClone(model)] : []),
+			checkedAt: snapshot.checkedAt,
+			lastModified: snapshot.catalogUpdatedAt * 1e3,
+			etag: cacheTag(value)
+		};
+	}
+	restore(stored, value) {
+		const checkedAt = stored?.checkedAt;
+		if (stored?.etag !== cacheTag(value) || typeof checkedAt !== "number" || !Number.isFinite(checkedAt) || checkedAt > Date.now() + CACHE_FUTURE_SKEW_MS || Date.now() - checkedAt > CACHE_MAX_AGE_MS) return void 0;
+		const updatedAt = typeof stored.lastModified === "number" && Number.isSafeInteger(stored.lastModified) && stored.lastModified >= 0 ? Math.floor(stored.lastModified / 1e3) : Math.floor(checkedAt / 1e3);
+		const entries = stored.models.map((model) => cachedEntry(model, updatedAt));
+		if (entries.some((entry) => !entry)) return void 0;
+		const complete = entries;
+		const scope = new Set(value.scope.split(" "));
+		const admitted = complete.filter((entry) => scope.has(`group:${entry.group_id}`));
+		const admissions = scope.has("models:invoke") ? admitCatalog({
+			schema_version: 1,
+			resource: this.http.resource,
+			updated_at: updatedAt,
+			groups: [],
+			models: admitted
+		}, this.http.issuer, this.capabilities) : [];
+		for (const admission of admissions) {
+			const cached = stored.models.find((model) => model.id === admission.model?.id);
+			if (admission.model && cached) admission.model.name = text(cached.name);
+		}
+		return {
+			session: value.lmm_session,
+			accessHash: fingerprint(value.access),
+			expires: value.expires,
+			admissions,
+			catalogUpdatedAt: updatedAt,
+			checkedAt,
+			catalogStale: true,
+			balanceStale: true
+		};
+	}
+	rebind(snapshot, value) {
+		const scope = new Set(value.scope.split(" "));
+		return {
+			...snapshot,
+			session: value.lmm_session,
+			accessHash: fingerprint(value.access),
+			expires: value.expires,
+			admissions: scope.has("models:invoke") ? snapshot.admissions.filter(({ entry }) => scope.has(`group:${entry.group_id}`)) : [],
+			catalogStale: true,
+			balance: void 0,
+			balanceStale: true
+		};
+	}
+	async refreshSnapshotForAuth(value) {
+		const hash = fingerprint(value.access);
+		if (this.current?.session === value.lmm_session && this.current.accessHash === hash && this.current.expires > Date.now()) return;
+		if (this.authSnapshotPending?.hash === hash) return this.authSnapshotPending.task;
+		const fallback = this.current?.session === value.lmm_session ? this.rebind(this.current, value) : void 0;
+		const epoch = ++this.epoch;
+		const task = (async () => {
+			try {
+				const snapshot = await this.fetchSnapshot(value, boundedSignal(this.shutdown.signal));
+				if (epoch === this.epoch && !this.shutdown.signal.aborted) {
+					this.current = snapshot;
+					this.pendingLogin = void 0;
+					this.status();
+				}
+			} catch {
+				if (fallback && epoch === this.epoch && !this.shutdown.signal.aborted) {
+					this.current = fallback;
+					this.status();
+				}
+			}
+		})();
+		this.authSnapshotPending = {
+			hash,
+			task
+		};
+		try {
+			await task;
+		} finally {
+			if (this.authSnapshotPending?.task === task) this.authSnapshotPending = void 0;
+		}
+	}
+	async refreshModels(context) {
+		const value = this.maybeCredential(context.credential);
+		if (!value) {
+			await context.publish({
+				persist: null,
+				update: () => this.clear()
+			});
+			return;
+		}
+		if (!context.allowNetwork) {
+			const hash = fingerprint(value.access);
+			const snapshot = (this.pendingLogin?.session === value.lmm_session && this.pendingLogin.accessHash === hash ? this.pendingLogin : this.current?.session === value.lmm_session ? this.rebind(this.current, value) : void 0) ?? this.restore(context.stored, value);
+			await context.publish({
+				persist: snapshot ? this.cache(snapshot, value) : null,
+				update: () => {
+					if (this.current?.session !== value.lmm_session) this.epoch++;
+					this.current = snapshot;
+					this.pendingLogin = void 0;
+					this.status();
+				}
+			});
+			return;
+		}
+		const fallback = this.current?.session === value.lmm_session ? this.rebind(this.current, value) : this.restore(context.stored, value);
+		if (fallback) await context.publish({ update: () => {
+			this.current = fallback;
+			this.pendingLogin = void 0;
+			this.status();
+		} });
+		const signal = AbortSignal.any([context.signal, this.shutdown.signal]);
+		this.epoch++;
+		const epoch = this.epoch;
+		const snapshot = await this.fetchSnapshot(value, signal);
+		await context.publish({
+			persist: this.cache(snapshot, value),
+			update: () => {
+				if (epoch !== this.epoch || this.shutdown.signal.aborted) return;
+				this.current = snapshot;
+				this.pendingLogin = void 0;
+				this.status();
+			}
+		});
+	}
+	lookup(modelId, access) {
+		if (!this.current || this.current.expires <= Date.now() || this.current.accessHash !== fingerprint(access)) return void 0;
+		return this.current.admissions.find((item) => item.model?.id === modelId || item.entry.id === modelId);
+	}
+	modelForLegacyId(id) {
+		const model = this.current?.admissions.find((item) => item.entry.id === id)?.model;
+		return model ? structuredClone(model) : void 0;
+	}
+	async refreshBalance(access, signal) {
+		const hash = fingerprint(access);
+		const snapshot = this.current;
+		if (!snapshot || snapshot.accessHash !== hash) return;
+		if (this.balancePending?.hash === hash) return this.balancePending.task;
+		const epoch = this.epoch;
+		const task = (async () => {
+			try {
+				const balance = parseBalance(await this.http.bearer("/api/oauth2/balance", access, boundedSignal(AbortSignal.any([...signal ? [signal] : [], this.shutdown.signal]))));
+				if (epoch === this.epoch && this.current === snapshot) {
+					snapshot.balance = balance;
+					snapshot.balanceStale = false;
+				}
+			} catch {
+				if (epoch === this.epoch && this.current === snapshot) snapshot.balanceStale = true;
+			}
+			if (epoch === this.epoch && this.current === snapshot) this.status();
+		})();
+		this.balancePending = {
+			hash,
+			task
+		};
+		try {
+			await task;
+		} finally {
+			if (this.balancePending?.task === task) this.balancePending = void 0;
+		}
+	}
+	prices(filter = "") {
+		return this.current ? priceReport(this.current.admissions, filter) : "No account-scoped LMM catalog. Use /login, then retry /lmm-prices. No models or capabilities are guessed.";
+	}
+	async revoke(access, signal) {
+		const snapshot = this.current;
+		if (snapshot && snapshot.accessHash !== fingerprint(access)) throw new LmmError("account_changed", "LMM account changed; retry from the current account.");
+		await this.oauth.revoke(access, signal);
+		if (snapshot) this.revoked.add(snapshot.session);
+		if (this.current === snapshot) this.clear();
+	}
+	dispose() {
+		this.shutdown.abort();
+		this.clear();
+	}
+};
+//#endregion
+//#region src/web-auth.ts
+const AUTH_CHANNEL = "/api";
+const ATTEMPT_MS = 3e5;
+const fail = (code, message) => ({
+	ok: false,
+	error: {
+		code,
+		message,
+		details: {}
+	}
+});
+const ok = (value) => ({
+	ok: true,
+	value
+});
+/** Only fixed, credential-free messages may cross the browser RPC boundary. */
+function publicAuthError(error) {
+	switch (error && typeof error === "object" && "code" in error ? error.code : void 0) {
+		case "callback_unavailable": return "DSH could not listen for the browser callback on 127.0.0.1. Check the local firewall and try again.";
+		case "oauth_denied": return "LMM access was denied. Start sign-in again to retry.";
+		case "transport_error": return "DSH could not reach LMM. Check your connection and try again.";
+		case "invalid_response": return "LMM returned an invalid authorization response. Update the plugin and try again.";
+		case "NOT_COMMITTED": return "DSH did not save the LMM login. Restart DSH and try again.";
+		case "ALREADY_IN_FLIGHT": return "Another LMM sign-in is already running. Finish or cancel that attempt first.";
+		default: return "LMM sign-in failed. Try again; if it persists, check the DSH Host log.";
+	}
+}
+/** The host's authenticated Connection transport owns Host/Origin/cookie checks. */
+function mountBrowserAuth(ctx, key) {
+	ctx.inject([
+		"connection",
+		"authorization",
+		"credentials",
+		"webServer"
+	], (web) => {
+		let current;
+		const owned = (payload) => {
+			if (payload === null || typeof payload !== "object") return;
+			return "attempt" in payload && payload.attempt === current?.id ? current : void 0;
+		};
+		const view = (attempt) => ({
+			attempt: attempt.id,
+			state: attempt.state,
+			notices: attempt.notices,
+			...attempt.prompt === void 0 ? {} : { prompt: attempt.prompt },
+			...attempt.error === void 0 ? {} : { error: attempt.error }
+		});
+		const stop = () => {
+			current?.controller.abort();
+		};
+		web.effect(() => stop);
+		const dispatch = async (endpoint, payload) => {
+			if (endpoint === "status") return ok({
+				signedIn: (await web.credentials.readRecord(key))?.kind === "grant",
+				busy: current?.state === "pending"
+			});
+			if (endpoint === "begin") {
+				if (current?.state === "pending") return fail("BUSY", "LMM sign-in is already running.");
+				const attempt = {
+					id: randomUUID(),
+					state: "pending",
+					controller: new AbortController(),
+					notices: []
+				};
+				current = attempt;
+				const timer = setTimeout(() => attempt.controller.abort(), ATTEMPT_MS);
+				timer.unref();
+				web.authorization.begin({
+					key,
+					method: "oauth",
+					signal: attempt.controller.signal,
+					interaction: {
+						notify(notice) {
+							attempt.notices = [...attempt.notices.slice(-7), notice];
+						},
+						prompt(prompt) {
+							const signal = prompt.signal === void 0 ? attempt.controller.signal : AbortSignal.any([prompt.signal, attempt.controller.signal]);
+							signal.throwIfAborted();
+							return new Promise((resolve, reject) => {
+								const id = randomUUID();
+								const { signal: _signal, ...rest } = prompt;
+								attempt.prompt = {
+									...rest,
+									id
+								};
+								const clear = () => {
+									signal.removeEventListener("abort", abort);
+									if (attempt.prompt?.id === id) {
+										delete attempt.prompt;
+										delete attempt.answer;
+									}
+								};
+								const abort = () => {
+									clear();
+									reject(/* @__PURE__ */ new Error("LMM sign-in prompt withdrawn."));
+								};
+								attempt.answer = (answer) => {
+									clear();
+									resolve(answer);
+								};
+								signal.addEventListener("abort", abort, { once: true });
+							});
+						}
+					}
+				}).then((outcome) => {
+					attempt.state = outcome.status;
+				}).catch((error) => {
+					attempt.state = attempt.controller.signal.aborted ? "cancelled" : "failed";
+					if (attempt.state === "failed") attempt.error = publicAuthError(error);
+				}).finally(() => {
+					clearTimeout(timer);
+					delete attempt.prompt;
+					delete attempt.answer;
+					attempt.notices = [];
+				});
+				return ok(view(attempt));
+			}
+			if (endpoint === "logout") {
+				if (current?.state === "pending") return fail("BUSY", "Cancel sign-in before signing out.");
+				await web.credentials.deleteRecord(key);
+				return ok({ signedIn: false });
+			}
+			if (![
+				"poll",
+				"answer",
+				"cancel"
+			].includes(endpoint)) return fail("NOT_FOUND", "Unknown LMM action.");
+			const attempt = owned(payload);
+			if (attempt === void 0) return fail("NOT_FOUND", "This sign-in attempt is unavailable. Start again.");
+			if (endpoint === "answer") {
+				const body = payload;
+				const prompt = attempt.prompt;
+				if (attempt.state !== "pending" || prompt === void 0 || body.prompt !== prompt.id || typeof body.value !== "string" || body.value.length > 4096) return fail("INVALID_PROMPT", "The sign-in question has changed.");
+				if (prompt.kind === "select" && !prompt.options?.some((option) => option.id === body.value)) return fail("INVALID_ANSWER", "Choose an offered option.");
+				attempt.answer?.(body.value);
+			} else if (endpoint === "cancel") attempt.controller.abort();
+			return ok(view(attempt));
+		};
+		for (const action of [
+			"status",
+			"begin",
+			"poll",
+			"answer",
+			"cancel",
+			"logout"
+		]) web.effect(() => web.connection.fetch.register({
+			path: `${AUTH_CHANNEL}/lmm-auth/${action}`,
+			methods: ["POST"],
+			requestBody: "buffered",
+			async fetch(request) {
+				let envelope;
+				try {
+					envelope = await request.json();
+				} catch {
+					return new Response("Invalid JSON", { status: 400 });
+				}
+				if (envelope === null || typeof envelope !== "object") return new Response("Invalid request", { status: 400 });
+				const message = envelope;
+				if (message.type !== "client-request" || typeof message.rpcId !== "string" || message.rpcId.length > 256 || message.method !== `lmm-auth/${action}`) return new Response("Invalid request", { status: 400 });
+				let result;
+				try {
+					result = await dispatch(action, message.payload);
+				} catch {
+					result = fail("INTERNAL", "LMM sign-in could not complete. Please try again.");
+				}
+				return Response.json({
+					type: "server-response",
+					rpcId: message.rpcId,
+					result
+				}, { headers: { "Cache-Control": "no-store" } });
+			}
+		}));
+	});
+}
+//#endregion
+//#region src/index.ts
+const name = "dsh-lmm-provider";
+const inject = ["llm", "credentials"];
+const DSH_CLIENT_ID = "lmm-dsh";
+const RECORD_KEY = credentialKey(name, "lmm");
+const REFRESH_TTL_MS = 6e4;
+const STREAM_IDLE_TIMEOUT_MS = 3e5;
+const MAX_REQUEST_IMAGE_BYTES = 20971520;
+const REQUEST_IMAGE_PIXEL_BUDGET = 4194304;
+const REQUEST_IMAGE_MAX_BYTES = 1048576;
+async function waitWithSignal(task, signal) {
+	if (signal === void 0) return task;
+	signal.throwIfAborted();
+	let abort = () => {};
+	const aborted = new Promise((_resolve, reject) => {
+		abort = () => reject(signal.reason);
+		signal.addEventListener("abort", abort, { once: true });
+	});
+	try {
+		await Promise.race([task, aborted]);
+	} finally {
+		signal.removeEventListener("abort", abort);
+	}
+}
+function jsonImage(value) {
+	if (Array.isArray(value)) return value.map((entry) => entry === void 0 ? null : jsonImage(entry));
+	if (typeof value === "object" && value !== null && Object.getPrototypeOf(value) === Object.prototype) {
+		const result = {};
+		for (const [key, member] of Object.entries(value)) if (member !== void 0) result[key] = jsonImage(member);
+		return result;
+	}
+	return value;
+}
+function fromRecord(record) {
+	if (record === void 0) return void 0;
+	if (record.kind === "api-key") return {
+		type: "api_key",
+		...record.key === void 0 ? {} : { key: record.key },
+		...record.env === void 0 ? {} : { env: { ...record.env } }
+	};
+	return record.payload;
+}
+function toRecord(value) {
+	if (value.type === "api_key") return {
+		kind: "api-key",
+		...value.key === void 0 ? {} : { key: value.key },
+		...value.env === void 0 ? {} : { env: { ...value.env } }
+	};
+	return {
+		kind: "grant",
+		payload: jsonImage(value)
+	};
+}
+/** Bridge pi-ai's OAuth store into DSH's durable credential record. */
+function credentialStoreFrom(ctx, key = RECORD_KEY) {
+	const assertProvider = (providerId) => {
+		if (providerId !== "lmm") throw new Error(`LMM credential store does not own provider ${JSON.stringify(providerId)}.`);
+	};
+	const checkSignal = (options) => options?.signal?.throwIfAborted();
+	return {
+		async read(providerId, options) {
+			assertProvider(providerId);
+			checkSignal(options);
+			const value = fromRecord(await ctx.credentials.readRecord(key));
+			checkSignal(options);
+			return value;
+		},
+		async list(options) {
+			checkSignal(options);
+			const record = await ctx.credentials.readRecord(key);
+			checkSignal(options);
+			return record === void 0 ? [] : [{
+				providerId: "lmm",
+				type: record.kind === "api-key" ? "api_key" : "oauth"
+			}];
+		},
+		async modify(providerId, mutate, options) {
+			assertProvider(providerId);
+			checkSignal(options);
+			const stored = await ctx.credentials.modifyRecord(key, async (current) => {
+				checkSignal(options);
+				const next = await mutate(fromRecord(current));
+				checkSignal(options);
+				return next === void 0 ? void 0 : toRecord(next);
+			});
+			checkSignal(options);
+			return fromRecord(stored);
+		},
+		async delete(providerId, options) {
+			assertProvider(providerId);
+			checkSignal(options);
+			await ctx.credentials.deleteRecord(key);
+			checkSignal(options);
+		}
+	};
+}
+function relay(event, session) {
+	switch (event.type) {
+		case "info": {
+			const link = event.links?.[0];
+			session.notify({
+				message: event.message,
+				...link === void 0 ? {} : { url: link.url }
+			});
+			return;
+		}
+		case "auth_url":
+			session.notify({
+				message: event.instructions ?? "Open this page to continue signing in.",
+				url: event.url
+			});
+			return;
+		case "device_code":
+			session.notify({
+				message: "Enter this code on the verification page to finish signing in.",
+				url: event.verificationUri,
+				code: event.userCode
+			});
+			return;
+		case "progress": session.notify({ message: event.message });
+	}
+}
+function restate(prompt) {
+	const signal = prompt.signal === void 0 ? {} : { signal: prompt.signal };
+	if (prompt.type === "select") return {
+		...signal,
+		kind: "select",
+		message: prompt.message,
+		options: prompt.options
+	};
+	return {
+		...signal,
+		kind: prompt.type === "secret" ? "secret" : "text",
+		message: prompt.message,
+		...prompt.placeholder === void 0 ? {} : { placeholder: prompt.placeholder }
+	};
+}
+function lmmProfile(integration) {
+	return {
+		provider: "lmm",
+		displayName: "LMM",
+		streamIdleTimeoutMs: STREAM_IDLE_TIMEOUT_MS,
+		maxRequestImageBytes: MAX_REQUEST_IMAGE_BYTES,
+		requestImagePixelBudget: REQUEST_IMAGE_PIXEL_BUDGET,
+		requestImageMaxBytes: REQUEST_IMAGE_MAX_BYTES,
+		retryPolicy: resolveRetryPolicy(void 0, "dsh-lmm-provider retryPolicy"),
+		piProvider: integration.provider,
+		modelErrors: /* @__PURE__ */ new Map(),
+		configuredMaxTokens: /* @__PURE__ */ new Map()
+	};
+}
+var CatalogCoordinator = class {
+	pending;
+	checkedAt = 0;
+	models;
+	constructor(models) {
+		this.models = models;
+	}
+	invalidate() {
+		this.checkedAt = 0;
+	}
+	async refresh(signal, force = false, allowNetwork = true) {
+		signal?.throwIfAborted();
+		if (!force && Date.now() - this.checkedAt < REFRESH_TTL_MS) return;
+		if (this.pending === void 0) {
+			const pending = this.models.refresh({
+				providers: ["lmm"],
+				allowNetwork,
+				force: allowNetwork ? force : void 0,
+				signal: AbortSignal.timeout(3e4)
+			}).then((result) => {
+				const error = result.errors.get("lmm");
+				if (error !== void 0) throw error;
+				if (!result.aborted) this.checkedAt = Date.now();
+			}).finally(() => {
+				if (this.pending === pending) this.pending = void 0;
+			});
+			this.pending = pending;
+		}
+		await waitWithSignal(this.pending, signal);
+	}
+};
+var RefreshingAdapter = class extends LlmAdapter {
+	adapter;
+	catalog;
+	constructor(adapter, catalog) {
+		super();
+		this.adapter = adapter;
+		this.catalog = catalog;
+	}
+	providerInfo(provider) {
+		return this.adapter.providerInfo(provider);
+	}
+	providerRetryPolicy(provider) {
+		return this.adapter.providerRetryPolicy(provider);
+	}
+	async listModels(provider) {
+		await this.catalog.refresh();
+		return this.adapter.listModels(provider);
+	}
+	async resolveModel(provider, model, signal) {
+		await this.catalog.refresh(signal);
+		return this.adapter.resolveModel(provider, model, signal);
+	}
+	async prepareCall(provider, model, signal) {
+		await this.catalog.refresh(signal);
+		return this.adapter.prepareCall(provider, model, signal);
+	}
+	stream(options) {
+		return this.streamAfterRefresh(options);
+	}
+	async *streamAfterRefresh(options) {
+		await this.catalog.refresh(options.signal);
+		yield* this.adapter.stream(options);
+	}
+};
+const authContext = {
+	env: () => Promise.resolve(void 0),
+	fileExists: () => Promise.resolve(false)
+};
+/** Mount the fixed LMM route and its browser OAuth flow into DSH. */
+function apply(ctx) {
+	const integration = new LmmIntegration({
+		clientId: DSH_CLIENT_ID,
+		hostName: "DSH",
+		loginTimeoutMs: 3e5,
+		refreshJournalDirectory: join(resolveDshHome(), "lmm-refresh-journal")
+	});
+	const credentials = credentialStoreFrom(ctx);
+	const models = createModels({
+		credentials,
+		authContext
+	});
+	models.setProvider(integration.provider);
+	const catalog = new CatalogCoordinator(models);
+	const profiles = /* @__PURE__ */ new Map([["lmm", lmmProfile(integration)]]);
+	const adapter = new PiAiAdapter({
+		profiles: () => profiles,
+		resolveApiKey: () => Promise.resolve(void 0),
+		auth: {
+			credentials,
+			authContext
+		},
+		resolveAttachments: () => ctx.get("attachments")
+	});
+	const registration = ctx.llm.registerAdapter(["lmm"], new RefreshingAdapter(adapter, catalog));
+	ctx.inject(["authorization"], (authorized) => {
+		authorized.authorization.registerFlow({
+			key: RECORD_KEY,
+			label: "LMM",
+			methods: [{
+				id: "oauth",
+				label: "Sign in with LMM"
+			}],
+			async run(session) {
+				await models.login("lmm", "oauth", {
+					signal: session.signal,
+					notify: (event) => relay(event, session),
+					prompt: (prompt) => session.prompt(restate(prompt))
+				});
+				catalog.invalidate();
+				await catalog.refresh(session.signal, true, false);
+			}
+		});
+	});
+	ctx.on("credentials/record-updated", (key) => {
+		if (key === RECORD_KEY) {
+			catalog.invalidate();
+			registration.replace(["lmm"]);
+		}
+	});
+	mountBrowserAuth(ctx, RECORD_KEY);
+	ctx.effect(() => () => {
+		integration.dispose();
+	});
+}
+//#endregion
+export { DSH_CLIENT_ID, RECORD_KEY, apply, credentialStoreFrom, inject, lmmProfile, name };