@wrongstack/cli 1.0.29 → 1.0.32

package/dist/{auth-TE55JF4Z.js → auth-SUHKFFO4.js}

@@ -1,3 +1,6 @@
+import {
+  providerCloudConfig
+} from "./chunk-TXAFIERF.js";
 import {
   addCustomProvider,
   addFromCatalog,
@@ -5,6 +8,7 @@ import {
   confirm,
   createAuthAuditLogger,
   loadProviders,
+  parseAuthMenuIndex,
   providerAuthStrategiesFor,
   readKeyInput,
   renderActions,
@@ -16,13 +20,12 @@ import {
   runOAuthLoginKind,
   runOAuthLoginMenu,
   validateFamily
-} from "./chunk-2ERX3RPN.js";
+} from "./chunk-P3GRLV47.js";
 import {
   renderAuthLocalHelpToString,
   wantsLocalHelp
 } from "./chunk-YTEOAWOJ.js";
 import "./chunk-5UZBUV2H.js";
-import "./chunk-SIGUWXAA.js";
 import {
   loadConfigProviders,
   maskedKey,
@@ -30,21 +33,21 @@ import {
   normalizeKeys,
   nowIso,
   writeKeysBack
-} from "./chunk-LUMETJFO.js";
-import "./chunk-DAKVBMD4.js";
+} from "./chunk-ZYACRPLN.js";
 import {
   activeProfileConfigPath
 } from "./chunk-YMXXOOFN.js";
+import "./chunk-4BX2YDTQ.js";
 import {
   restoreFlags
 } from "./chunk-CSAPOCBP.js";
-import "./chunk-WSTVGC2C.js";
+import "./chunk-DAKVBMD4.js";
 import {
   parseAuthFlags
-} from "./chunk-Q4INH2DG.js";
+} from "./chunk-MPQCHBDJ.js";
 
 // src/subcommands/handlers/auth.ts
-import { color as color5 } from "@wrongstack/core/utils";
+import { color as color6 } from "@wrongstack/core/utils";
 import { authProfileAliasError as authProfileAliasError2 } from "@wrongstack/providers";
 
 // src/auth-menu/anthropic-oauth.ts
@@ -143,12 +146,50 @@ import {
 } from "@wrongstack/core/types";
 import { color as color2 } from "@wrongstack/core/utils";
 import { copilotBaseUrlFromToken, refreshCopilotToken } from "@wrongstack/providers";
+import { fetchCopilotModels as fetchAccountCopilotModels } from "@wrongstack/providers/oauth";
+import { isUsableCopilotChatModel } from "@wrongstack/providers/oauth";
+
+// src/auth-menu/openai-codex-oauth.ts
+import { color as color3 } from "@wrongstack/core/utils";
+import {
+  buildCodexAuthorizeUrl,
+  CODEX_BASE_URL,
+  CODEX_FALLBACK_REDIRECT_PORT,
+  CODEX_PROVIDER_ID,
+  CODEX_REDIRECT_HOST,
+  CODEX_REDIRECT_PATH,
+  CODEX_REDIRECT_PORT,
+  CODEX_SCOPE,
+  codexRedirectUri,
+  createState,
+  exchangeCodexAuthorizationCode,
+  extractAccountId,
+  generatePkce,
+  parseAuthorizationInput,
+  refreshCodexTokens,
+  resolveCodexModels
+} from "@wrongstack/providers/oauth";
+import {
+  CODEX_BASE_URL as CODEX_BASE_URL2,
+  CODEX_CATALOG_FAMILIES,
+  CODEX_PROVIDER_ID as CODEX_PROVIDER_ID2,
+  extractAccountId as extractAccountId2,
+  FALLBACK_CODEX_MODELS,
+  fallbackCodexModelIds,
+  fallbackCodexProviderModels,
+  fetchCodexModels,
+  filterCurrentCodexModelIds,
+  generatePkce as generatePkce2,
+  isCodexCatalogModel,
+  parseAuthorizationInput as parseAuthorizationInput2,
+  resolveCodexModels as resolveCodexModels2
+} from "@wrongstack/providers/oauth";
 
 // src/auth-menu/top-menu.ts
-import { color as color4 } from "@wrongstack/core/utils";
+import { color as color5 } from "@wrongstack/core/utils";
 
 // src/auth-menu/provider-menu.ts
-import { color as color3, expectDefined } from "@wrongstack/core/utils";
+import { color as color4, expectDefined } from "@wrongstack/core/utils";
 async function manageProvider(providerId, deps) {
   for (; ; ) {
     const providers = await loadProviders(deps);
@@ -161,12 +202,12 @@ async function manageProvider(providerId, deps) {
     renderProviderHeader(deps.renderer, providerId, cfg);
     renderActions(deps.renderer, keys.length);
     const raw = (await deps.reader.readLine(`
-${color3.amber("?")} ${providerId} > `)).trim();
+${color4.amber("?")} ${providerId} > `)).trim();
     if (!raw || raw === "b" || raw === "back" || raw === "q" || raw === "quit") {
       return;
     }
     const [verb = "", argRaw = ""] = raw.split(/\s+/, 2);
-    const arg = argRaw ? Number.parseInt(argRaw, 10) : Number.NaN;
+    const arg = parseAuthMenuIndex(argRaw);
     const handled = await dispatchAction(verb, arg, providerId, keys, cfg, deps);
     if (handled === "exit") return;
     if (handled === "continue") continue;
@@ -192,7 +233,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
         },
         deps.profileConfigPath
       );
-      deps.renderer.write(`  ${color3.green("\u2713")} Removed ${providerId}.
+      deps.renderer.write(`  ${color4.green("\u2713")} Removed ${providerId}.
 `);
       return "exit";
     }
@@ -216,7 +257,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
       },
       deps.profileConfigPath
     );
-    deps.renderer.write(`  ${color3.green("\u2713")} Updated ${providerId}/${target.label}.
+    deps.renderer.write(`  ${color4.green("\u2713")} Updated ${providerId}/${target.label}.
 `);
     return "continue";
   }
@@ -243,7 +284,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
       },
       deps.profileConfigPath
     );
-    deps.renderer.write(`  ${color3.green("\u2713")} Deleted ${providerId}/${target.label}.
+    deps.renderer.write(`  ${color4.green("\u2713")} Deleted ${providerId}/${target.label}.
 `);
     return "continue";
   }
@@ -262,14 +303,14 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
       },
       deps.profileConfigPath
     );
-    deps.renderer.write(`  ${color3.green("\u2713")} Active key \u2192 ${color3.bold(target.label)}.
+    deps.renderer.write(`  ${color4.green("\u2713")} Active key \u2192 ${color4.bold(target.label)}.
 `);
     return "continue";
   }
   if (verb === "f" || verb === "family") {
     const current = cfg.family ?? "";
     const ans = (await deps.reader.readLine(
-      `  ${color3.amber("?")} Family ${color3.dim(`(anthropic | openai | openai-compatible | google, empty = unset, current: ${current || "unset"})`)}: `
+      `  ${color4.amber("?")} Family ${color4.dim(`(anthropic | openai | openai-compatible | google, empty = unset, current: ${current || "unset"})`)}: `
     )).trim();
     if (ans !== "") {
       const validated = validateFamily(ans);
@@ -289,7 +330,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
         },
         deps.profileConfigPath
       );
-      deps.renderer.write(`  ${color3.green("\u2713")} family \u2192 ${validated}
+      deps.renderer.write(`  ${color4.green("\u2713")} family \u2192 ${validated}
 `);
     } else {
       await mutateConfigProviders(
@@ -302,7 +343,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
         },
         deps.profileConfigPath
       );
-      deps.renderer.write(`  ${color3.green("\u2713")} family \u2192 (unset)
+      deps.renderer.write(`  ${color4.green("\u2713")} family \u2192 (unset)
 `);
     }
     return "continue";
@@ -310,7 +351,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
   if (verb === "B" || verb === "baseurl" || verb === "base-url" || verb === "url") {
     const current = cfg.baseUrl ?? "";
     const ans = (await deps.reader.readLine(
-      `  ${color3.amber("?")} Base URL ${color3.dim(`(empty = unset, current: ${current || "unset"})`)}: `
+      `  ${color4.amber("?")} Base URL ${color4.dim(`(empty = unset, current: ${current || "unset"})`)}: `
     )).trim();
     await mutateConfigProviders(
       deps.profileConfigPath,
@@ -323,14 +364,14 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
       },
       deps.profileConfigPath
     );
-    deps.renderer.write(`  ${color3.green("\u2713")} baseUrl \u2192 ${ans || "(unset)"}
+    deps.renderer.write(`  ${color4.green("\u2713")} baseUrl \u2192 ${ans || "(unset)"}
 `);
     return "continue";
   }
   if (verb === "m" || verb === "models") {
     const current = (cfg.models ?? []).join(", ");
     const ans = (await deps.reader.readLine(
-      `  ${color3.amber("?")} Model ids ${color3.dim(`(comma-separated, empty = catalog default, current: ${current || "none"})`)}: `
+      `  ${color4.amber("?")} Model ids ${color4.dim(`(comma-separated, empty = catalog default, current: ${current || "none"})`)}: `
     )).trim();
     const list = ans ? ans.split(",").map((s) => s.trim()).filter(Boolean) : [];
     await mutateConfigProviders(
@@ -345,7 +386,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
       deps.profileConfigPath
     );
     deps.renderer.write(
-      `  ${color3.green("\u2713")} models \u2192 ${list.length === 0 ? "(catalog default)" : list.join(", ")}
+      `  ${color4.green("\u2713")} models \u2192 ${list.length === 0 ? "(catalog default)" : list.join(", ")}
 `
     );
     return "continue";
@@ -354,7 +395,7 @@ async function dispatchAction(verb, arg, providerId, keys, cfg, deps) {
   return "unknown";
 }
 function validKeyIndex(arg, max, deps, verb) {
-  if (!Number.isFinite(arg) || arg < 1 || arg > max) {
+  if (arg === void 0 || arg > max) {
     deps.renderer.writeError(`Usage: ${verb} <1-${max}>`);
     return false;
   }
@@ -368,9 +409,9 @@ async function runTopMenu(deps) {
     renderTopMenu(deps.renderer, providers);
     const ids = Object.keys(providers).sort();
     const choice = (await deps.reader.readLine(`
-${color4.amber("?")} Pick: `)).trim().toLowerCase();
+${color5.amber("?")} Pick: `)).trim().toLowerCase();
     if (!choice || choice === "q" || choice === "quit" || choice === "exit") {
-      deps.renderer.write(color4.dim("Done.\n"));
+      deps.renderer.write(color5.dim("Done.\n"));
       return 0;
     }
     if (choice === "a" || choice === "add") {
@@ -389,8 +430,8 @@ ${color4.amber("?")} Pick: `)).trim().toLowerCase();
       await runOAuthLoginMenu(deps);
       continue;
     }
-    const idx = Number.parseInt(choice, 10);
-    if (!Number.isNaN(idx) && idx >= 1 && idx <= ids.length) {
+    const idx = parseAuthMenuIndex(choice);
+    if (idx !== void 0 && idx <= ids.length) {
       const pid = ids[idx - 1];
       await manageProvider(pid, deps);
       continue;
@@ -442,6 +483,7 @@ var authCmd = async (args, deps) => {
         "  wstack auth login <strategy> --alias <account>  Sign in to an auth profile",
         "  wstack auth <saved-alias> --label <key-label>  Add a key inside an existing profile",
         "  wstack auth list | status <alias> | remove <alias>",
+        "  wstack auth cloud <alias> [--region|--project|--location|--resource-name <value>] [clear]",
         "",
         "Fallback targets are <auth-profile-alias>/<model-id>; provider type chooses the transport.",
         "Direct flags: --alias, --label, --family, --base-url, --env",
@@ -461,6 +503,41 @@ var authCmd = async (args, deps) => {
     return runTopMenu(menuDeps);
   }
   const first = flags.positional[0];
+  if (first === "cloud") {
+    try {
+      const id = flags.positional[1];
+      if (!id)
+        throw new Error(
+          "Usage: wstack auth cloud <saved-provider> [--region value|--project value|--location value|--resource-name value] [clear]"
+        );
+      const updates = {};
+      for (const [flag, field] of [
+        ["region", "region"],
+        ["project", "project"],
+        ["location", "location"],
+        ["resource-name", "resourceName"]
+      ]) {
+        const value = deps.flags?.[flag];
+        if (value !== void 0 && typeof value !== "string")
+          throw new Error(`--${flag} requires a value`);
+        if (typeof value === "string") updates[field] = value;
+      }
+      const cloud = await providerCloudConfig(
+        id,
+        flags.positional[2] === "clear" ? null : Object.keys(updates).length ? updates : void 0,
+        profileConfigPath,
+        deps.vault
+      );
+      deps.renderer.write(`${JSON.stringify({ provider: id, cloud }, null, 2)}
+`);
+      return 0;
+    } catch (error) {
+      deps.renderer.writeError(
+        error instanceof Error ? error.message : "Cloud configuration failed"
+      );
+      return 1;
+    }
+  }
   if (first === "list" || first === "ls") {
     return runAuthList(menuDeps);
   }
@@ -517,11 +594,11 @@ var authCmd = async (args, deps) => {
     deps.renderer.writeError(`Unknown OAuth login strategy "${pid}".`);
     for (const strategy of available) {
       deps.renderer.write(
-        color5.dim(`  Sign in with ${strategy.label}: `) + color5.bold(`wstack auth login ${strategy.id}`) + "\n"
+        color6.dim(`  Sign in with ${strategy.label}: `) + color6.bold(`wstack auth login ${strategy.id}`) + "\n"
       );
     }
     deps.renderer.write(
-      color5.dim("  For an API key instead: ") + color5.bold(`wstack auth ${pid}`) + "\n"
+      color6.dim("  For an API key instead: ") + color6.bold(`wstack auth ${pid}`) + "\n"
     );
     return 1;
   }
@@ -545,14 +622,14 @@ async function runAuthList(deps) {
   const ids = Object.keys(providers).sort();
   if (ids.length === 0) {
     deps.renderer.write(
-      `${color5.dim("No providers configured.")}
-${color5.dim("Run")} ${color5.bold("wstack auth")} ${color5.dim("to add one.")}
+      `${color6.dim("No providers configured.")}
+${color6.dim("Run")} ${color6.bold("wstack auth")} ${color6.dim("to add one.")}
 `
     );
     return 0;
   }
   deps.renderer.write(`
-${color5.bold("Saved providers")} ${color5.dim(`(${ids.length})`)}
+${color6.bold("Saved providers")} ${color6.dim(`(${ids.length})`)}
 
 `);
   for (const id of ids) {
@@ -560,34 +637,34 @@ ${color5.bold("Saved providers")} ${color5.dim(`(${ids.length})`)}
     if (!cfg) continue;
     const keys = normalizeKeys(cfg);
     const active = cfg.activeKey ?? keys[0]?.label;
-    const famTag = cfg.family ? `${cfg.family}` : color5.amber("no-family");
-    const aliasHint = cfg.type && cfg.type !== id ? color5.dim(` (\u2192 ${cfg.type})`) : "";
-    const modelHint = cfg.models && cfg.models.length > 0 ? color5.dim(` [${cfg.models.length} models]`) : "";
-    deps.renderer.write(`  ${color5.bold(id)}${aliasHint}
+    const famTag = cfg.family ? `${cfg.family}` : color6.amber("no-family");
+    const aliasHint = cfg.type && cfg.type !== id ? color6.dim(` (\u2192 ${cfg.type})`) : "";
+    const modelHint = cfg.models && cfg.models.length > 0 ? color6.dim(` [${cfg.models.length} models]`) : "";
+    deps.renderer.write(`  ${color6.bold(id)}${aliasHint}
 `);
     deps.renderer.write(
-      `    family:  ${famTag}  baseUrl: ${cfg.baseUrl ?? color5.dim("unset")}${modelHint}
+      `    family:  ${famTag}  baseUrl: ${cfg.baseUrl ?? color6.dim("unset")}${modelHint}
 `
     );
     if (keys.length === 0) {
-      deps.renderer.write(`    ${color5.amber("no keys")}
+      deps.renderer.write(`    ${color6.amber("no keys")}
 `);
     } else {
       deps.renderer.write(
-        `    ${color5.dim(`${keys.length} key${keys.length === 1 ? "" : "s"}:`)}
+        `    ${color6.dim(`${keys.length} key${keys.length === 1 ? "" : "s"}:`)}
 `
       );
       for (const k of keys) {
-        const marker = k.label === active ? color5.green("\u25CF") : color5.dim("\u25CB");
+        const marker = k.label === active ? color6.green("\u25CF") : color6.dim("\u25CB");
         deps.renderer.write(
-          `      ${marker} ${k.label.padEnd(18)} ${maskedKey(k.apiKey)}  ${color5.dim(k.createdAt)}
+          `      ${marker} ${k.label.padEnd(18)} ${maskedKey(k.apiKey)}  ${color6.dim(k.createdAt)}
 `
         );
       }
     }
     deps.renderer.write("\n");
   }
-  deps.renderer.write(color5.dim(`Manage: wstack auth   Add key: wstack auth <provider>
+  deps.renderer.write(color6.dim(`Manage: wstack auth   Add key: wstack auth <provider>
 `));
   return 0;
 }
@@ -603,7 +680,7 @@ async function runAuthStatus(deps, providerId) {
   if (!cfg) {
     deps.renderer.writeError(`Provider "${providerId}" not found in config.`);
     deps.renderer.write(
-      color5.dim(`Run ${color5.bold("wstack auth list")} to see saved providers.
+      color6.dim(`Run ${color6.bold("wstack auth list")} to see saved providers.
 `)
     );
     return 1;
@@ -612,32 +689,32 @@ async function runAuthStatus(deps, providerId) {
   const active = cfg.activeKey ?? keys[0]?.label;
   const lines = [
     `
-${color5.bold(providerId)} ${cfg.family ? color5.dim(`[${cfg.family}]`) : color5.amber("[no family]")}`,
+${color6.bold(providerId)} ${cfg.family ? color6.dim(`[${cfg.family}]`) : color6.amber("[no family]")}`,
     "",
-    `  type:    ${color5.cyan(cfg.type ?? providerId)}`,
-    `  family:  ${cfg.family ? color5.cyan(cfg.family) : color5.dim("unset")}`,
-    `  baseUrl: ${cfg.baseUrl ? color5.cyan(cfg.baseUrl) : color5.dim("unset")}`
+    `  type:    ${color6.cyan(cfg.type ?? providerId)}`,
+    `  family:  ${cfg.family ? color6.cyan(cfg.family) : color6.dim("unset")}`,
+    `  baseUrl: ${cfg.baseUrl ? color6.cyan(cfg.baseUrl) : color6.dim("unset")}`
   ];
   if (cfg.models?.length) {
-    lines.push(`  models:  ${color5.cyan(cfg.models.join(", "))}`);
+    lines.push(`  models:  ${color6.cyan(cfg.models.join(", "))}`);
   }
   if (cfg.envVars?.length) {
-    lines.push(`  envVars: ${color5.cyan(cfg.envVars.join(", "))}`);
+    lines.push(`  envVars: ${color6.cyan(cfg.envVars.join(", "))}`);
   }
   lines.push("");
   if (keys.length === 0) {
-    lines.push(color5.amber("  (no keys saved)"));
+    lines.push(color6.amber("  (no keys saved)"));
   } else {
-    lines.push(`  ${color5.dim("Keys:")}`);
+    lines.push(`  ${color6.dim("Keys:")}`);
     for (const k of keys) {
-      const marker = k.label === active ? color5.green("\u25CF") : color5.dim("\u25CB");
+      const marker = k.label === active ? color6.green("\u25CF") : color6.dim("\u25CB");
       lines.push(
-        `    ${marker} ${color5.bold(k.label.padEnd(18))} ${maskedKey(k.apiKey)}  ${color5.dim(k.createdAt)}`
+        `    ${marker} ${color6.bold(k.label.padEnd(18))} ${maskedKey(k.apiKey)}  ${color6.dim(k.createdAt)}`
       );
     }
   }
   lines.push("");
-  lines.push(color5.dim(`Manage: wstack auth \u2192 pick ${providerId}`));
+  lines.push(color6.dim(`Manage: wstack auth \u2192 pick ${providerId}`));
   deps.renderer.write(lines.join("\n") + "\n");
   return 0;
 }
@@ -648,19 +725,19 @@ async function runAuthRemove(deps, providerId) {
     return 1;
   }
   deps.renderer.write(
-    `${color5.amber("!")} This will remove "${providerId}" and all its saved keys.
+    `${color6.amber("!")} This will remove "${providerId}" and all its saved keys.
 `
   );
-  const answer = (await deps.reader.readLine(`  ${color5.amber("?")} Confirm removal? ${color5.dim("[y/N]")} `)).trim().toLowerCase();
+  const answer = (await deps.reader.readLine(`  ${color6.amber("?")} Confirm removal? ${color6.dim("[y/N]")} `)).trim().toLowerCase();
   if (answer !== "y" && answer !== "yes") {
-    deps.renderer.write(color5.dim("Cancelled.\n"));
+    deps.renderer.write(color6.dim("Cancelled.\n"));
     return 0;
   }
   try {
     await mutateConfigProviders(deps.profileConfigPath, deps.vault, (all) => {
       delete all[providerId];
     });
-    deps.renderer.write(`  ${color5.green("\u2713")} Removed ${color5.bold(providerId)}.
+    deps.renderer.write(`  ${color6.green("\u2713")} Removed ${color6.bold(providerId)}.
 `);
     return 0;
   } catch (err) {
@@ -671,4 +748,4 @@ async function runAuthRemove(deps, providerId) {
 export {
   authCmd
 };
-//# sourceMappingURL=auth-TE55JF4Z.js.map
+//# sourceMappingURL=auth-SUHKFFO4.js.map

package/dist/auth-menu/github-copilot-oauth.d.ts

@@ -25,40 +25,7 @@ export declare function startDeviceFlow(signal?: AbortSignal): Promise<DeviceCod
 /** Poll until the user authorizes; returns the GitHub OAuth token. */
 export declare function pollForGitHubToken(device: DeviceCode, signal: AbortSignal): Promise<string>;
 /** Shape of the fields we read from a `/models` entry (everything optional). */
-interface CopilotModelEntry {
-    id?: unknown;
-    model_picker_enabled?: unknown;
-    is_chat_default?: unknown;
-    is_chat_fallback?: unknown;
-    vendor?: unknown;
-    supported_endpoints?: unknown;
-    policy?: {
-        state?: unknown;
-    } | undefined;
-    capabilities?: {
-        type?: unknown;
-        supports?: {
-            tool_calls?: unknown;
-        } | undefined;
-    } | undefined;
-}
-/**
- * Decide whether a Copilot `/models` entry is a chat model we can actually
- * drive over this provider's wire.
- *
- * The provider POSTs to `…/chat/completions`, so the discriminators are:
- *   - `capabilities.type === 'chat'` — drops embeddings and completion-only ids.
- *   - `capabilities.supports.tool_calls` — the agent loop needs tool calling.
- *   - `supported_endpoints` (when present) must include `/chat/completions`.
- *     This is the key fix: `/responses`-only ids (the `*-picker` router models,
- *     `gpt-5.4-mini-free-auto`, `mai-code-1-flash*`) advertise themselves in the
- *     model picker but 400 on `/chat/completions`. Absent field ⇒ legacy chat
- *     model (gpt-4o, gpt-4.1) ⇒ allowed.
- *   - `policy.state !== 'disabled'` — disabled means the user hasn't enabled the
- *     model in their GitHub Copilot settings; calling it would 403.
- *   - `vendor !== 'Experimental'` — drops internal previews (trajectory-compaction).
- */
-export declare function isUsableCopilotChatModel(item: CopilotModelEntry): boolean;
+export { isUsableCopilotChatModel } from '@wrongstack/providers/oauth';
 export interface CopilotLoginOptions {
     providerId?: string;
     /**
@@ -69,5 +36,4 @@ export interface CopilotLoginOptions {
     signal?: AbortSignal | undefined;
 }
 export declare function runCopilotOAuthLogin(deps: AuthMenuDeps, opts?: CopilotLoginOptions): Promise<number>;
-export {};
 //# sourceMappingURL=github-copilot-oauth.d.ts.map

package/dist/auth-menu/index-input.d.ts

@@ -0,0 +1,3 @@
+/** Parse a one-based menu index, rejecting numeric prefixes with trailing text. */
+export declare function parseAuthMenuIndex(raw: string): number | undefined;
+//# sourceMappingURL=index-input.d.ts.map

package/dist/auth-menu/panel-flow-bridge.d.ts

@@ -0,0 +1,29 @@
+import type { ModelsRegistry, ProviderConfig, SecretScrubber, SecretVault } from '@wrongstack/core/types';
+import type { AuthFlowIo, AuthFlowResult } from '@wrongstack/tui';
+import type { AuthMenuDeps } from './types.js';
+export interface AuthPanelServiceDeps {
+    vault: SecretVault;
+    modelsRegistry: ModelsRegistry;
+    /** The sole config file read or written by auth operations. */
+    profileConfigPath: string;
+    secretScrubber?: SecretScrubber | undefined;
+    providerAuthRegistry?: AuthMenuDeps['providerAuthRegistry'];
+    /** Re-read the live provider snapshot after a successful auth mutation. */
+    onProvidersChanged?: (() => Promise<void>) | undefined;
+}
+export declare const ANSI_RE: RegExp;
+export declare function stripAnsi(text: string): string;
+/** Normalise a flow prompt ("  ? Label for this key [default]: ") for the modal. */
+export declare function cleanPrompt(prompt: string): string;
+/** Fan a multi-line renderer write out into individual trimmed log lines. */
+export declare function emitLines(io: AuthFlowIo, raw: string, prefix?: string): void;
+/** Adapt an {@link AuthFlowIo} bridge into the deps shape the flows expect. */
+export declare function flowDeps(base: AuthPanelServiceDeps, io: AuthFlowIo): AuthMenuDeps;
+export declare function isCancel(err: unknown): boolean;
+/** Run a flow, translating throws (Esc-cancel, I/O errors) into a result. */
+export declare function runFlow(run: () => Promise<boolean>, onSuccess?: (() => Promise<void>) | undefined): Promise<AuthFlowResult>;
+/** Plain (color-free) key mask: first 4 + last 4 characters. */
+export declare function plainMaskedKey(key: string): string;
+/** A model is editable when the provider lists it or defines it in `customModels`. */
+export declare function hasEditableModel(provider: ProviderConfig, modelId: string): boolean;
+//# sourceMappingURL=panel-flow-bridge.d.ts.map

package/dist/auth-menu/panel-service.d.ts

@@ -1,37 +1,6 @@
-/**
- * TUI auth-panel host — the structured, UI-agnostic surface behind the
- * interactive `/auth` panel in the Ink TUI.
- *
- * Two kinds of operations:
- *
- *   - **Direct mutations** (set active key, delete key, remove provider):
- *     plain async methods that mutate the config atomically and return an
- *     error string or `null`.
- *
- *   - **Flows** (add key, add from catalog, add custom, add local, OAuth
- *     sign-in, field edits): the existing battle-tested readline flows from
- *     this package, driven through an {@link AuthFlowIo} bridge. The bridge
- *     adapts `renderer.write*` → panel log lines (ANSI-stripped) and
- *     `reader.readLine/readSecret` → the panel's modal prompt. A rejected
- *     prompt (TUI Esc) aborts the flow before anything is saved.
- *
- * Secrets never cross into the TUI: key values are masked here, and the
- * modal prompt sends the plaintext only INTO the flow (never back out).
- */
-import type { ModelsRegistry, SecretScrubber, SecretVault } from '@wrongstack/core/types';
+import type { AuthPanelServiceDeps } from './panel-flow-bridge.js';
+export type { AuthPanelServiceDeps } from './panel-flow-bridge.js';
+export { plainMaskedKey } from './panel-flow-bridge.js';
 import type { AuthPanelHost } from '@wrongstack/tui';
-import type { AuthMenuDeps } from './types.js';
-export interface AuthPanelServiceDeps {
-    vault: SecretVault;
-    modelsRegistry: ModelsRegistry;
-    /** The sole config file read or written by auth operations. */
-    profileConfigPath: string;
-    secretScrubber?: SecretScrubber | undefined;
-    providerAuthRegistry?: AuthMenuDeps['providerAuthRegistry'];
-    /** Re-read the live provider snapshot after a successful auth mutation. */
-    onProvidersChanged?: (() => Promise<void>) | undefined;
-}
-/** Plain (color-free) key mask: first 4 + last 4 characters. */
-export declare function plainMaskedKey(key: string): string;
 export declare function createAuthPanelHost(deps: AuthPanelServiceDeps): AuthPanelHost;
 //# sourceMappingURL=panel-service.d.ts.map

package/dist/auth-menu/provider-auth-login.d.ts

@@ -3,7 +3,7 @@ import type { AuthMenuDeps } from './types.js';
 type ProviderAuthRegistrySource = Pick<AuthMenuDeps, 'providerAuthRegistry'>;
 export declare function providerAuthRegistryFor(deps: ProviderAuthRegistrySource): ProviderAuthRegistry;
 /** UI-safe strategy metadata shared by the TUI auth panel and CLI menus. */
-export declare function providerAuthStrategiesFor(deps: ProviderAuthRegistrySource): import("@wrongstack/core").ProviderAuthStrategyMetadata[];
+export declare function providerAuthStrategiesFor(deps: ProviderAuthRegistrySource): import("@wrongstack/core/types").ProviderAuthStrategyMetadata[];
 export declare function runProviderAuthLogin(deps: AuthMenuDeps, strategyId: string, opts?: {
     providerId?: string | undefined;
     signal?: AbortSignal | undefined;

package/dist/auto-discover-providers-QIL34K3U.js

@@ -0,0 +1,7 @@
+import {
+  discoverAndMergeProviders
+} from "./chunk-CFHWIFXL.js";
+export {
+  discoverAndMergeProviders
+};
+//# sourceMappingURL=auto-discover-providers-QIL34K3U.js.map