@xandreed/plugin-models 0.13.0 → 0.14.0

package/README.md

@@ -1,5 +1,5 @@
 # @xandreed/plugin-models
 
-Efferent composable agent framework, 0.13.0. Node 24 or Bun.
+Efferent composable agent framework, 0.14.0. Node 24.5 or Bun.
 
 Documentation: https://github.com/xandreeddev/efferent

package/dist/auth/anthropicOAuth.d.ts

@@ -1,5 +1,6 @@
 import { Effect, Option } from "effect";
 import { AuthError } from "@xandreed/core";
+import type { ModelsFetch } from "../ports/models-transport.port.js";
 /**
  * Anthropic OAuth (Claude Pro/Max subscription) — the full protocol:
  * authorization-code + PKCE (begin/exchange) and refresh. Constants match
@@ -21,8 +22,21 @@ export interface RefreshedTokens {
     /** Absolute expiry, epoch ms (with a 5-minute early-refresh skew baked in). */
     readonly expires: number;
 }
+/**
+ * How one token request is made, for both subscription providers. `fetch`
+ * replaces the global fetch (a test stub, or a `ModelsTransport`'s fetch, so
+ * the request goes through the models plugin's proxy); `now` is
+ * the time the new token's expiry is counted from, in epoch ms (default: the
+ * Effect `Clock`).
+ */
+export interface TokenRequestOptions {
+    readonly fetch?: ModelsFetch;
+    readonly now?: number;
+}
+/** The time a token's expiry is counted from: the caller's, or the Effect Clock's. */
+export declare const tokenTime: (options: TokenRequestOptions) => Effect.Effect<number>;
 /** Refresh an expired (or near-expiry) access token. */
-export declare const refreshAnthropicToken: (refreshToken: string) => Effect.Effect<RefreshedTokens, AuthError>;
+export declare const refreshAnthropicToken: (refreshToken: string, options?: TokenRequestOptions) => Effect.Effect<RefreshedTokens, AuthError>;
 export interface Pkce {
     readonly verifier: string;
     readonly challenge: string;
@@ -40,7 +54,7 @@ export interface OAuthBegin {
 /** Start an authorization: PKCE material + the browser URL. */
 export declare const beginAnthropicOAuth: Effect.Effect<OAuthBegin>;
 /** Exchange the authorization code for tokens. */
-export declare const exchangeAnthropicCode: (code: string, verifier: string) => Effect.Effect<RefreshedTokens, AuthError>;
+export declare const exchangeAnthropicCode: (code: string, verifier: string, options?: TokenRequestOptions) => Effect.Effect<RefreshedTokens, AuthError>;
 export interface AuthRedirect {
     readonly code: Option.Option<string>;
     readonly state: Option.Option<string>;

package/dist/auth/anthropicOAuth.js

@@ -1,5 +1,6 @@
-import { Effect, Option } from "effect";
+import { Clock, Effect, Option } from "effect";
 import { AuthError } from "@xandreed/core";
+import { redactCredentials } from "../transport/http-proxy.entity.functions.js";
 export const ANTHROPIC_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 const AUTHORIZE_URL = "https://claude.ai/oauth/authorize", TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 export const ANTHROPIC_CALLBACK_PORT = 53692, ANTHROPIC_CALLBACK_PATH = "/callback", ANTHROPIC_REDIRECT_URI = `http://localhost:${ANTHROPIC_CALLBACK_PORT}${ANTHROPIC_CALLBACK_PATH}`;
@@ -8,11 +9,13 @@ export const ANTHROPIC_OAUTH_BETA = "claude-code-20250219,oauth-2025-04-20", CLA
 const oauthError = (stage) => (detail) => new AuthError({
   provider: "anthropic",
   message: `OAuth ${stage} failed: ${detail}`
-}), postToken = (body, stage) => {
+});
+export const tokenTime = (options) => options.now === void 0 ? Clock.currentTimeMillis : Effect.succeed(options.now);
+const postToken = (body, stage, options) => {
   const fail = oauthError(stage);
   return Effect.tryPromise({
     try: async () => {
-      const res = await fetch(TOKEN_URL, {
+      const res = await (options.fetch ?? fetch)(TOKEN_URL, {
         method: "POST",
         headers: { "Content-Type": "application/json", Accept: "application/json" },
         body: JSON.stringify(body),
@@ -20,21 +23,21 @@ const oauthError = (stage) => (detail) => new AuthError({
       });
       return { ok: res.ok, status: res.status, text: await res.text() };
     },
-    catch: (e) => fail(String(e))
+    catch: (e) => fail(redactCredentials(String(e)))
   }).pipe(Effect.filterOrFail((res) => res.ok, (res) => fail(`status ${res.status}: ${res.text.slice(0, 200)}`)), Effect.flatMap((res) => Effect.try({
     try: () => JSON.parse(res.text),
     catch: () => fail("the token response was not JSON")
-  })), Effect.map((data) => ({
+  })), Effect.flatMap((data) => Effect.map(tokenTime(options), (now) => ({
     access: data.access_token,
     refresh: data.refresh_token,
-    expires: Date.now() + data.expires_in * 1000 - 300000
-  })));
+    expires: now + data.expires_in * 1000 - 300000
+  }))));
 };
-export const refreshAnthropicToken = (refreshToken) => postToken({
+export const refreshAnthropicToken = (refreshToken, options = {}) => postToken({
   grant_type: "refresh_token",
   client_id: ANTHROPIC_CLIENT_ID,
   refresh_token: refreshToken
-}, "token refresh");
+}, "token refresh", options);
 const base64url = (bytes) => btoa(Array.from(bytes, (b) => String.fromCharCode(b)).join("")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 export const generatePkce = Effect.promise(async () => {
   const verifierBytes = new Uint8Array(32);
@@ -55,14 +58,14 @@ export const generatePkce = Effect.promise(async () => {
   }).toString()}`,
   callbackPort: ANTHROPIC_CALLBACK_PORT,
   callbackPath: ANTHROPIC_CALLBACK_PATH
-})), exchangeAnthropicCode = (code, verifier) => postToken({
+})), exchangeAnthropicCode = (code, verifier, options = {}) => postToken({
   grant_type: "authorization_code",
   client_id: ANTHROPIC_CLIENT_ID,
   code,
   redirect_uri: ANTHROPIC_REDIRECT_URI,
   code_verifier: verifier,
   state: verifier
-}, "code exchange");
+}, "code exchange", options);
 const fromNullableTrimmed = (value) => Option.filter(Option.fromNullishOr(value), (v) => v.trim().length > 0);
 export const parseAuthorizationInput = (input) => {
   const value = input.trim();

package/dist/auth/credential-input.entity.d.ts

@@ -0,0 +1,34 @@
+import { Schema } from "effect";
+export declare const CredentialInput: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"api_key">;
+    readonly key: Schema.Redacted<Schema.String>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"oauth">;
+    readonly access: Schema.Redacted<Schema.String>;
+    readonly refresh: Schema.Redacted<Schema.String>;
+    /** Absolute expiry, epoch ms. */
+    readonly expires: Schema.Number;
+    readonly accountId: Schema.optionalKey<Schema.String>;
+    readonly installationId: Schema.optionalKey<Schema.String>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"local">;
+    readonly baseUrl: Schema.optionalKey<Schema.String>;
+}>]>;
+export type CredentialInput = typeof CredentialInput.Type;
+/** Credentials by provider id. */
+export declare const CredentialInputs: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"api_key">;
+    readonly key: Schema.Redacted<Schema.String>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"oauth">;
+    readonly access: Schema.Redacted<Schema.String>;
+    readonly refresh: Schema.Redacted<Schema.String>;
+    /** Absolute expiry, epoch ms. */
+    readonly expires: Schema.Number;
+    readonly accountId: Schema.optionalKey<Schema.String>;
+    readonly installationId: Schema.optionalKey<Schema.String>;
+}>, Schema.Struct<{
+    readonly type: Schema.Literal<"local">;
+    readonly baseUrl: Schema.optionalKey<Schema.String>;
+}>]>>;
+export type CredentialInputs = typeof CredentialInputs.Type;

package/dist/auth/credential-input.entity.functions.d.ts

@@ -0,0 +1,8 @@
+import type { Credential } from "@xandreed/core";
+import type { CredentialInput, CredentialInputs } from "./credential-input.entity.js";
+/** The stored form of a credential a host handed over: its secrets unwrapped. */
+export declare const toCredential: (input: CredentialInput) => Credential;
+/** A stored credential as a host receives it: its secrets `Redacted`. */
+export declare const toCredentialInput: (credential: Credential) => CredentialInput;
+/** Handed-over credentials, by provider id, in their stored form. */
+export declare const credentialsOf: (inputs: CredentialInputs) => ReadonlyMap<string, Credential>;

package/dist/auth/credential-input.entity.functions.js

@@ -0,0 +1,9 @@
+import { Match, Redacted } from "effect";
+export const toCredential = (input) => Match.value(input).pipe(Match.when({ type: "api_key" }, ({ key }) => ({ type: "api_key", key: Redacted.value(key) })), Match.when({ type: "oauth" }, ({ access, refresh, ...rest }) => ({ ...rest, access: Redacted.value(access), refresh: Redacted.value(refresh) })), Match.when({ type: "local" }, (local) => local), Match.exhaustive), toCredentialInput = (credential) => Match.value(credential).pipe(Match.when({ type: "api_key" }, ({ key }) => ({ type: "api_key", key: Redacted.make(key) })), Match.when({ type: "oauth" }, ({ type, access, refresh, expires, accountId, installationId }) => ({
+  type,
+  expires,
+  access: Redacted.make(access),
+  refresh: Redacted.make(refresh),
+  ...accountId === void 0 ? {} : { accountId },
+  ...installationId === void 0 ? {} : { installationId }
+})), Match.when({ type: "local" }, ({ type, baseUrl }) => ({ type, ...baseUrl === void 0 ? {} : { baseUrl } })), Match.exhaustive), credentialsOf = (inputs) => new Map(Object.entries(inputs).map(([provider, input]) => [provider, toCredential(input)]));

package/dist/auth/credential-input.entity.js

@@ -0,0 +1,20 @@
+import { Schema } from "effect";
+const secret = Schema.Redacted(Schema.String).annotate({
+  message: "a secret must be a Redacted value (Redacted.make(...)); JSON configuration names an environment variable in credentialEnv instead"
+}), unexpectedKey = { messageUnexpectedKey: "not a field of a credential" };
+export const CredentialInput = Schema.Union([
+  Schema.Struct({ type: Schema.Literal("api_key"), key: secret }).annotate(unexpectedKey),
+  Schema.Struct({
+    type: Schema.Literal("oauth"),
+    access: secret,
+    refresh: secret,
+    expires: Schema.Number.annotate({ message: "expires is the access token's expiry, in epoch ms" }).check(Schema.isFinite()),
+    accountId: Schema.optionalKey(Schema.String),
+    installationId: Schema.optionalKey(Schema.String)
+  }).annotate(unexpectedKey),
+  Schema.Struct({ type: Schema.Literal("local"), baseUrl: Schema.optionalKey(Schema.String) }).annotate(unexpectedKey)
+]).annotate({
+  message: 'a credential is { type: "api_key", key }, { type: "oauth", access, refresh, expires, accountId?, installationId? } or { type: "local", baseUrl? }, with Redacted secrets'
+}), CredentialInputs = Schema.Record(Schema.String, CredentialInput).annotate({
+  message: "credentials maps provider ids to credentials"
+});

package/dist/auth/credential-refresh.entity.d.ts

@@ -0,0 +1,9 @@
+import { Schema } from "effect";
+import type { Credential } from "@xandreed/core";
+/** The providers whose OAuth tokens a store can refresh: each has its token endpoint in an auth module. */
+export declare const RefreshableProvider: Schema.Literals<readonly ["anthropic", "openai-codex"]>;
+export type RefreshableProvider = typeof RefreshableProvider.Type;
+/** An OAuth subscription credential: an access token, its refresh token and its expiry (epoch ms). */
+export type OAuthCredential = Extract<Credential, {
+    readonly type: "oauth";
+}>;

package/dist/auth/credential-refresh.entity.functions.d.ts

@@ -0,0 +1,15 @@
+import { Effect } from "effect";
+import { AuthError } from "@xandreed/core";
+import type { TokenRequestOptions } from "./anthropicOAuth.js";
+import type { OAuthCredential } from "./credential-refresh.entity.js";
+/** Refresh this many ms before the recorded expiry. */
+export declare const REFRESH_SKEW_MS = 60000;
+/** Whether an OAuth credential can still be used at `now`: more than the skew before its expiry. */
+export declare const isUsableAt: (credential: OAuthCredential, now: number) => boolean;
+/**
+ * Refresh one provider's OAuth credential through that provider's token
+ * endpoint: the same credential with the new access token, refresh token
+ * and expiry (and account id, where the provider sends one). A provider
+ * with no refresh flow fails with an `AuthError` naming it.
+ */
+export declare const refreshCredential: (provider: string, credential: OAuthCredential, options?: TokenRequestOptions) => Effect.Effect<OAuthCredential, AuthError>;

package/dist/auth/credential-refresh.entity.functions.js

@@ -0,0 +1,12 @@
+import { Effect, Match, Option, Schema } from "effect";
+import { AuthError } from "@xandreed/core";
+import { refreshAnthropicToken } from "./anthropicOAuth.js";
+import { RefreshableProvider } from "./credential-refresh.entity.js";
+import { refreshOpenAiCodexToken } from "./openAiCodexOAuth.js";
+export const REFRESH_SKEW_MS = 60000, isUsableAt = (credential, now) => credential.expires > now + REFRESH_SKEW_MS, refreshCredential = (provider, credential, options = {}) => Option.match(Schema.decodeUnknownOption(RefreshableProvider)(provider), {
+  onNone: () => Effect.fail(new AuthError({
+    provider,
+    message: `the ${provider} OAuth token expired and only anthropic and openai-codex tokens can be refreshed \u2014 sign in again or use an API key`
+  })),
+  onSome: (refreshable) => Match.value(refreshable).pipe(Match.when("anthropic", () => refreshAnthropicToken(credential.refresh, options)), Match.when("openai-codex", () => refreshOpenAiCodexToken(credential.refresh, options)), Match.exhaustive).pipe(Effect.map((fresh) => ({ ...credential, ...fresh })))
+});

package/dist/auth/credential-refresh.entity.functions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/credential-refresh.entity.js

@@ -0,0 +1,2 @@
+import { Schema } from "effect";
+export const RefreshableProvider = Schema.Literals(["anthropic", "openai-codex"]);

package/dist/auth/localAuth.d.ts

@@ -3,6 +3,7 @@ import { AuthStore } from "@xandreed/core";
 export declare const authPaths: (cwd: string, home: string, directory?: string) => ReadonlyArray<string>;
 /**
  * `LocalAuthStoreLive(cwd, home)` — read-through: every call re-reads disk,
- * so a credential added mid-session applies on the next request.
+ * so a credential added mid-session applies on the next request. A token
+ * refresh goes through the `ModelsTransport` the layer is built over, if any.
  */
 export declare const LocalAuthStoreLive: (cwd: string, home: string, directory?: string, fallbackDirectory?: string) => Layer.Layer<AuthStore, never, never>;

package/dist/auth/localAuth.js

@@ -1,9 +1,9 @@
 import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { Effect, Layer, Option, Redacted } from "effect";
+import { Clock, Effect, Layer, Option, Redacted } from "effect";
 import { asJsonRecord, AuthError, AuthStore, parseJsonWarn } from "@xandreed/core";
-import { refreshAnthropicToken } from "./anthropicOAuth.js";
-import { refreshOpenAiCodexToken } from "./openAiCodexOAuth.js";
+import { isUsableAt, refreshCredential } from "./credential-refresh.entity.functions.js";
+import { ModelsTransport } from "../ports/models-transport.port.js";
 const decodeCredential = (value) => {
   if (typeof value === "string")
     return Option.some({ type: "api_key", key: value });
@@ -42,49 +42,47 @@ const decodeCredential = (value) => {
     await rename(tmp, path);
   },
   catch: (e) => new AuthError({ provider: "*", message: `auth.json write failed: ${String(e)}` })
-}), REFRESH_SKEW_MS = 60000;
+});
 export const authPaths = (cwd, home, directory = ".efferent") => [
   join(home, directory, "auth.json"),
   join(cwd, directory, "auth.json")
 ], LocalAuthStoreLive = (cwd, home, directory = ".efferent", fallbackDirectory) => {
   const paths = [...fallbackDirectory === void 0 ? [] : authPaths(cwd, home, fallbackDirectory), ...authPaths(cwd, home, directory)];
-  return Layer.succeed(AuthStore, {
-    all: Effect.gen(function* () {
-      const files = yield* Effect.forEach(paths, readAuthFile);
-      return new Map(files.flatMap((f) => [...f.entries]));
-    }),
-    get: (provider) => Effect.gen(function* () {
-      const files = yield* Effect.forEach(paths, readAuthFile), merged = new Map(files.flatMap((f) => [...f.entries]));
-      return Option.fromNullishOr(merged.get(provider));
-    }),
-    resolveKey: (provider) => Effect.gen(function* () {
-      const holder = [...yield* Effect.forEach(paths, readAuthFile)].reverse().find((f) => f.entries.has(provider)), cred = holder?.entries.get(provider);
-      if (cred === void 0)
-        return Option.none();
-      if (cred.type === "api_key")
-        return Option.some(Redacted.make(cred.key));
-      if (cred.type === "local")
-        return Option.none();
-      if (cred.expires > Date.now() + REFRESH_SKEW_MS)
-        return Option.some(Redacted.make(cred.access));
-      if (provider !== "anthropic" && provider !== "openai-codex")
-        return yield* Effect.fail(new AuthError({
-          provider,
-          message: `the ${provider} OAuth token expired and its refresh flow isn't wired on the new line \u2014 re-login or use an API key`
-        }));
-      const fresh = yield* provider === "anthropic" ? refreshAnthropicToken(cred.refresh) : refreshOpenAiCodexToken(cred.refresh), updated = { ...cred, ...fresh }, target = holder !== void 0 && authPaths(cwd, home, directory).includes(holder.path) ? holder : yield* readAuthFile(authPaths(cwd, home, directory)[0] ?? "");
-      yield* writeAuthFile(target.path, new Map([...target.entries, [provider, updated]]));
-      return Option.some(Redacted.make(fresh.access));
-    }),
-    set: (provider, credential) => Effect.gen(function* () {
-      const globalPath = authPaths(cwd, home, directory)[0] ?? "", file = yield* readAuthFile(globalPath);
-      yield* writeAuthFile(globalPath, new Map([...file.entries, [provider, credential]]));
-    }),
-    remove: (provider) => Effect.forEach(paths, (path) => Effect.gen(function* () {
-      const file = yield* readAuthFile(path);
-      if (!file.entries.has(provider))
-        return;
-      yield* writeAuthFile(path, new Map([...file.entries].filter(([p]) => p !== provider)));
-    })).pipe(Effect.asVoid)
-  });
+  return Layer.effect(AuthStore, Effect.map(Effect.serviceOption(ModelsTransport), (transport) => {
+    const tokens = Option.match(transport, { onNone: () => ({}), onSome: ({ fetch }) => ({ fetch }) });
+    return {
+      all: Effect.gen(function* () {
+        const files = yield* Effect.forEach(paths, readAuthFile);
+        return new Map(files.flatMap((f) => [...f.entries]));
+      }),
+      get: (provider) => Effect.gen(function* () {
+        const files = yield* Effect.forEach(paths, readAuthFile), merged = new Map(files.flatMap((f) => [...f.entries]));
+        return Option.fromNullishOr(merged.get(provider));
+      }),
+      resolveKey: (provider) => Effect.gen(function* () {
+        const holder = [...yield* Effect.forEach(paths, readAuthFile)].reverse().find((f) => f.entries.has(provider)), cred = holder?.entries.get(provider);
+        if (cred === void 0)
+          return Option.none();
+        if (cred.type === "api_key")
+          return Option.some(Redacted.make(cred.key));
+        if (cred.type === "local")
+          return Option.none();
+        if (isUsableAt(cred, yield* Clock.currentTimeMillis))
+          return Option.some(Redacted.make(cred.access));
+        const updated = yield* refreshCredential(provider, cred, tokens), target = holder !== void 0 && authPaths(cwd, home, directory).includes(holder.path) ? holder : yield* readAuthFile(authPaths(cwd, home, directory)[0] ?? "");
+        yield* writeAuthFile(target.path, new Map([...target.entries, [provider, updated]]));
+        return Option.some(Redacted.make(updated.access));
+      }),
+      set: (provider, credential) => Effect.gen(function* () {
+        const globalPath = authPaths(cwd, home, directory)[0] ?? "", file = yield* readAuthFile(globalPath);
+        yield* writeAuthFile(globalPath, new Map([...file.entries, [provider, credential]]));
+      }),
+      remove: (provider) => Effect.forEach(paths, (path) => Effect.gen(function* () {
+        const file = yield* readAuthFile(path);
+        if (!file.entries.has(provider))
+          return;
+        yield* writeAuthFile(path, new Map([...file.entries].filter(([p]) => p !== provider)));
+      })).pipe(Effect.asVoid)
+    };
+  }));
 };

package/dist/auth/memory-auth.adapter.d.ts

@@ -0,0 +1,27 @@
+import { Layer } from "effect";
+import { AuthStore } from "@xandreed/core";
+import type { AuthError, Credential } from "@xandreed/core";
+import type { ModelsFetch } from "../ports/models-transport.port.js";
+/** How the in-memory store reaches the OAuth token endpoints. */
+export interface MemoryAuthOptions {
+    /** The fetch token refreshes go through; default: the `ModelsTransport`'s when the layer is built over one, else the global fetch. */
+    readonly fetch?: ModelsFetch;
+}
+/**
+ * `MemoryAuthStoreLive(seed?)` — an AuthStore that never touches disk.
+ * Credentials live in memory for the layer's lifetime: the host's
+ * `HostCredentials.load` (when the host provides that service), overlaid by
+ * `seed`. `resolveKey` refreshes a near-expiry anthropic or openai-codex
+ * OAuth token in memory, one refresh per provider at a time (through the
+ * `ModelsTransport` it was built over, so through the plugin's proxy), and
+ * hands the new token to `HostCredentials.save`.
+ *
+ * A login or logout (`set`, `remove`) does not wait for a refresh's token
+ * request; it waits only while a refreshed token is committed, which
+ * includes the host's `save` of it, so a slow host store delays it that
+ * long. A refresh writes its token only if the provider still holds the
+ * credential it refreshed (compare-and-set under the provider's lock): a
+ * logout during a stalled token request stays a logout, and the host never
+ * receives the refreshed token.
+ */
+export declare const MemoryAuthStoreLive: (seed?: ReadonlyMap<string, Credential>, options?: MemoryAuthOptions) => Layer.Layer<AuthStore, AuthError>;

package/dist/auth/memory-auth.adapter.js

@@ -0,0 +1,47 @@
+import { Clock, Effect, Layer, Match, Option, Redacted, Ref, Semaphore, SynchronizedRef } from "effect";
+import { AuthStore } from "@xandreed/core";
+import { HostCredentials } from "../ports/host-credentials.port.js";
+import { ModelsTransport } from "../ports/models-transport.port.js";
+import { toCredential, toCredentialInput } from "./credential-input.entity.functions.js";
+import { isUsableAt, refreshCredential } from "./credential-refresh.entity.functions.js";
+export const MemoryAuthStoreLive = (seed = new Map, options = {}) => Layer.effect(AuthStore, Effect.gen(function* () {
+  const host = yield* Effect.serviceOption(HostCredentials), loaded = yield* Option.match(host, {
+    onNone: () => Effect.succeed(new Map),
+    onSome: (credentials) => credentials.load.pipe(Effect.map((all) => new Map([...all].map(([provider, input]) => [provider, toCredential(input)]))))
+  }), state = yield* Ref.make(new Map([...loaded, ...seed])), locks = yield* SynchronizedRef.make(new Map), transport = yield* Effect.serviceOption(ModelsTransport), tokens = Option.match(Option.orElse(Option.fromNullishOr(options.fetch), () => Option.map(transport, (found) => found.fetch)), {
+    onNone: () => ({}),
+    onSome: (fetch) => ({ fetch })
+  }), locksOf = (provider) => SynchronizedRef.modifyEffect(locks, (all) => Option.match(Option.fromNullishOr(all.get(provider)), {
+    onSome: (found) => Effect.succeed([found, all]),
+    onNone: () => Effect.all({ commit: Semaphore.make(1), refresh: Semaphore.make(1) }).pipe(Effect.map((made) => [made, new Map([...all, [provider, made]])]))
+  })), current = (provider) => Ref.get(state).pipe(Effect.map((all) => Option.fromNullishOr(all.get(provider)))), save = (provider, credential) => Option.match(host, {
+    onNone: () => Effect.void,
+    onSome: (credentials) => credentials.save(provider, Option.map(credential, toCredentialInput))
+  }), write = (provider, credential) => Ref.update(state, (all) => Option.match(credential, {
+    onNone: () => new Map([...all].filter(([key]) => key !== provider)),
+    onSome: (value) => new Map([...all, [provider, value]])
+  })), refreshing = (provider, stale) => locksOf(provider).pipe(Effect.flatMap((lock) => lock.refresh.withPermit(Effect.gen(function* () {
+    const before = yield* current(provider);
+    if (!Option.exists(before, (held) => held === stale))
+      return { _tag: "Changed" };
+    const fresh = yield* refreshCredential(provider, stale, tokens);
+    return yield* lock.commit.withPermit(Effect.gen(function* () {
+      const now = yield* current(provider);
+      if (!Option.exists(now, (held) => held === stale))
+        return { _tag: "Changed" };
+      yield* write(provider, Option.some(fresh));
+      yield* save(provider, Option.some(fresh)).pipe(Effect.catch((error) => Effect.logWarning(`the refreshed ${provider} token is kept in memory, but the host did not save it: ${error.message}`)));
+      return { _tag: "Key", key: Redacted.make(fresh.access) };
+    }));
+  }))), Effect.flatMap((refreshed) => Match.value(refreshed).pipe(Match.tag("Key", ({ key }) => Effect.succeed(Option.some(key))), Match.tag("Changed", () => resolveKey(provider)), Match.exhaustive))), resolveKey = (provider) => current(provider).pipe(Effect.flatMap(Option.match({
+    onNone: () => Effect.succeed(Option.none()),
+    onSome: (credential) => Match.value(credential).pipe(Match.when({ type: "api_key" }, ({ key }) => Effect.succeed(Option.some(Redacted.make(key)))), Match.when({ type: "local" }, () => Effect.succeed(Option.none())), Match.when({ type: "oauth" }, (oauth) => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => isUsableAt(oauth, now) ? Effect.succeed(Option.some(Redacted.make(oauth.access))) : refreshing(provider, oauth)))), Match.exhaustive)
+  })));
+  return AuthStore.of({
+    all: Ref.get(state),
+    get: current,
+    resolveKey,
+    set: (provider, credential) => locksOf(provider).pipe(Effect.flatMap((lock) => lock.commit.withPermit(save(provider, Option.some(credential)).pipe(Effect.andThen(write(provider, Option.some(credential))))))),
+    remove: (provider) => locksOf(provider).pipe(Effect.flatMap((lock) => lock.commit.withPermit(current(provider).pipe(Effect.flatMap((held) => Option.isNone(held) ? Effect.void : save(provider, Option.none()).pipe(Effect.andThen(write(provider, Option.none()))))))))
+  });
+}));

package/dist/auth/memory-auth.adapter.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/openAiCodexOAuth.d.ts

@@ -1,5 +1,6 @@
 import { Effect, Option } from "effect";
 import { AuthError } from "@xandreed/core";
+import type { TokenRequestOptions } from "./anthropicOAuth.js";
 /** ChatGPT Plus/Pro OAuth protocol used by the OpenAI Codex subscription. */
 export declare const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 export declare const OPENAI_CODEX_CALLBACK_PORT = 1455;
@@ -21,5 +22,5 @@ export interface OpenAiCodexOAuthBegin {
 /** Extract the subscription account lane without exposing the token. */
 export declare const openAiCodexAccountId: (accessToken: string) => Option.Option<string>;
 export declare const beginOpenAiCodexOAuth: Effect.Effect<OpenAiCodexOAuthBegin>;
-export declare const exchangeOpenAiCodexCode: (code: string, verifier: string) => Effect.Effect<OpenAiCodexTokens, AuthError>;
-export declare const refreshOpenAiCodexToken: (refreshToken: string) => Effect.Effect<OpenAiCodexTokens, AuthError>;
+export declare const exchangeOpenAiCodexCode: (code: string, verifier: string, options?: TokenRequestOptions) => Effect.Effect<OpenAiCodexTokens, AuthError>;
+export declare const refreshOpenAiCodexToken: (refreshToken: string, options?: TokenRequestOptions) => Effect.Effect<OpenAiCodexTokens, AuthError>;

package/dist/auth/openAiCodexOAuth.js

@@ -1,6 +1,7 @@
 import { Effect, Result, Option } from "effect";
 import { AuthError } from "@xandreed/core";
-import { generatePkce } from "./anthropicOAuth.js";
+import { generatePkce, tokenTime } from "./anthropicOAuth.js";
+import { redactCredentials } from "../transport/http-proxy.entity.functions.js";
 export const OPENAI_CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize", TOKEN_URL = "https://auth.openai.com/oauth/token";
 export const OPENAI_CODEX_CALLBACK_PORT = 1455, OPENAI_CODEX_CALLBACK_PATH = "/auth/callback", OPENAI_CODEX_REDIRECT_URI = `http://localhost:${OPENAI_CODEX_CALLBACK_PORT}${OPENAI_CODEX_CALLBACK_PATH}`;
@@ -18,9 +19,9 @@ export const openAiCodexAccountId = (accessToken) => {
     return Option.filter(Option.fromNullishOr(typeof accountId === "string" ? accountId : void 0), (value) => value.length > 0);
   }));
 };
-const postToken = (body, stage) => Effect.tryPromise({
+const postToken = (body, stage, options) => Effect.tryPromise({
   try: async () => {
-    const response = await fetch(TOKEN_URL, {
+    const response = await (options.fetch ?? fetch)(TOKEN_URL, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams(body),
@@ -28,16 +29,16 @@ const postToken = (body, stage) => Effect.tryPromise({
     });
     return { ok: response.ok, status: response.status, text: await response.text() };
   },
-  catch: (error) => oauthError(stage, String(error))
+  catch: (error) => oauthError(stage, redactCredentials(String(error)))
 }).pipe(Effect.filterOrFail((response) => response.ok, (response) => oauthError(stage, `status ${response.status}: ${response.text.slice(0, 200)}`)), Effect.flatMap((response) => Effect.try({
   try: () => JSON.parse(response.text),
   catch: () => oauthError(stage, "the token response was not JSON")
-})), Effect.filterOrFail((token) => typeof token.access_token === "string" && typeof token.refresh_token === "string" && typeof token.expires_in === "number", () => oauthError(stage, "the token response omitted required fields")), Effect.map((token) => ({
+})), Effect.filterOrFail((token) => typeof token.access_token === "string" && typeof token.refresh_token === "string" && typeof token.expires_in === "number", () => oauthError(stage, "the token response omitted required fields")), Effect.flatMap((token) => Effect.map(tokenTime(options), (now) => ({
   access: token.access_token,
   refresh: token.refresh_token,
-  expires: Date.now() + token.expires_in * 1000,
+  expires: now + token.expires_in * 1000,
   ...Option.match(openAiCodexAccountId(token.access_token), { onNone: () => ({}), onSome: (accountId) => ({ accountId }) })
-})));
+}))));
 export const beginOpenAiCodexOAuth = Effect.gen(function* () {
   const pkce = yield* generatePkce, stateBytes = new Uint8Array(16);
   crypto.getRandomValues(stateBytes);
@@ -55,4 +56,4 @@ export const beginOpenAiCodexOAuth = Effect.gen(function* () {
     originator: "pi"
   }).forEach(([key, value]) => url.searchParams.set(key, value));
   return { verifier: pkce.verifier, state, authorizeUrl: url.toString(), callbackPort: OPENAI_CODEX_CALLBACK_PORT, callbackPath: OPENAI_CODEX_CALLBACK_PATH };
-}), exchangeOpenAiCodexCode = (code, verifier) => postToken({ grant_type: "authorization_code", client_id: OPENAI_CODEX_CLIENT_ID, code, code_verifier: verifier, redirect_uri: OPENAI_CODEX_REDIRECT_URI }, "code exchange"), refreshOpenAiCodexToken = (refreshToken) => postToken({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: OPENAI_CODEX_CLIENT_ID }, "token refresh");
+}), exchangeOpenAiCodexCode = (code, verifier, options = {}) => postToken({ grant_type: "authorization_code", client_id: OPENAI_CODEX_CLIENT_ID, code, code_verifier: verifier, redirect_uri: OPENAI_CODEX_REDIRECT_URI }, "code exchange", options), refreshOpenAiCodexToken = (refreshToken, options = {}) => postToken({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: OPENAI_CODEX_CLIENT_ID }, "token refresh", options);

package/dist/index.d.ts

@@ -1,20 +1,37 @@
 export { ANTHROPIC_OAUTH_BETA, beginAnthropicOAuth, CLAUDE_CODE_SYSTEM, exchangeAnthropicCode, generatePkce, parseAuthorizationInput, refreshAnthropicToken, } from "./auth/anthropicOAuth.js";
-export type { AuthRedirect, OAuthBegin, Pkce, RefreshedTokens } from "./auth/anthropicOAuth.js";
+export type { AuthRedirect, OAuthBegin, Pkce, RefreshedTokens, TokenRequestOptions } from "./auth/anthropicOAuth.js";
 export { beginOpenAiCodexOAuth, exchangeOpenAiCodexCode, OPENAI_CODEX_CALLBACK_PATH, OPENAI_CODEX_CALLBACK_PORT, OPENAI_CODEX_CLIENT_ID, OPENAI_CODEX_REDIRECT_URI, openAiCodexAccountId, refreshOpenAiCodexToken, } from "./auth/openAiCodexOAuth.js";
 export type { OpenAiCodexOAuthBegin, OpenAiCodexTokens } from "./auth/openAiCodexOAuth.js";
 export { authPaths, LocalAuthStoreLive } from "./auth/localAuth.js";
+export { MemoryAuthStoreLive } from "./auth/memory-auth.adapter.js";
+export type { MemoryAuthOptions } from "./auth/memory-auth.adapter.js";
+export { CredentialInput, CredentialInputs } from "./auth/credential-input.entity.js";
+export { credentialsOf, toCredential, toCredentialInput } from "./auth/credential-input.entity.functions.js";
+export { RefreshableProvider } from "./auth/credential-refresh.entity.js";
+export type { OAuthCredential } from "./auth/credential-refresh.entity.js";
+export { isUsableAt, REFRESH_SKEW_MS, refreshCredential } from "./auth/credential-refresh.entity.functions.js";
+export { HostCredentials } from "./ports/host-credentials.port.js";
 export { LocalSettingsStoreLive } from "./settings/localSettings.js";
+export { MemorySettingsStoreLive } from "./settings/memory-settings.adapter.js";
+export { RoleField, SettingValue } from "./settings/settings-value.entity.js";
+export { applyRole, applySetting, coerceSettingValue, ROLE_FIELDS, roleSelection, settingsFromRecord } from "./settings/settings-value.entity.functions.js";
 export { roleModelView } from "./settings/roleView.js";
-export { fromChatCompletion, makeCompatLanguageModel, toChatMessages, toChatTools, } from "./llm/compat.js";
-export type { CompatConfig } from "./llm/compat.js";
+export { fromChatCompletion, makeCompatLanguageModel, promptWithImageLabels, toChatMessages, toChatTools, } from "./llm/compat.js";
+export type { ChatMessageOptions, CompatConfig } from "./llm/compat.js";
+export type { UsageReading } from "./llm/sse.js";
 export { makeOpenAiCodexLanguageModel, OPENAI_CODEX_API_URL, toOpenAiCodexRequestBody } from "./llm/openAiCodex.js";
-export { normalizeOpenAiCodexWebSocketEvent, openAiCodexUuidV7, OpenAiCodexWebSocketHttpClient } from "./llm/openAiCodexWebSocket.js";
-export { buildProvider, chatCompletionsUrl, OPENCODE_CHAT_URL, OPENCODE_RESPONSES_API_URL, prependClaudeCode, usesOpenCodeResponses, withAnthropicCacheBreakpoints, } from "./llm/providers.js";
+export { makeOpenAiCodexWebSocketHttpClient, normalizeOpenAiCodexWebSocketEvent, openAiCodexRefusal, openAiCodexUuidV7, OpenAiCodexWebSocketHttpClient } from "./llm/openAiCodexWebSocket.js";
+export { buildProvider, chatCompletionsUrl, endpointOwnKey, OPENCODE_CHAT_URL, OPENCODE_RESPONSES_API_URL, prependClaudeCode, usesOpenCodeResponses, withAnthropicCacheBreakpoints, } from "./llm/providers.js";
 export { classifyLlmError, LLM_REQUEST_TIMEOUT_MS, MAX_HONORED_RETRY_AFTER_MS, rejectEmptyResponse, retryableLlm, } from "./llm/retry.js";
 export type { ErrorClass } from "./llm/retry.js";
 export { generateWith, LanguageModelLive, LanguageModelSelectionLive } from "./llm/router.js";
-export { configuredModelCatalog, ConfiguredModelCatalogLive, reasoningEffortsFor, } from "./llm/modelCatalog.js";
+export { configuredModelCatalog, ConfiguredModelCatalogLive, imageInputFor, reasoningEffortsFor, } from "./llm/modelCatalog.js";
 export type { ReasoningEffort } from "./llm/modelCatalog.js";
 export { UtilityLlmLive } from "./llm/utilityLlm.js";
 export { modelsPlugin, default } from "./plugin.adapter.js";
 export { CurrentModelEndpoints, ModelEndpoint, ModelEndpoints } from "./ports/model-endpoints.port.js";
+export { ModelsTransport } from "./ports/models-transport.port.js";
+export type { ModelsFetch, WebSocketProxy } from "./ports/models-transport.port.js";
+export { ModelsTransportLive, transportFetch } from "./transport/models-transport.adapter.js";
+export { BUN_WEBSOCKET_PROXY_VERSION, HttpProxyOptions, NODE_WEBSOCKET_PROXY_VERSION, NoProxyRule, PROXY_VARIABLES, ProxyConfig, ProxyEnvironment, ProxyInvalid, ProxyUnsupported, ProxyUrlOption, } from "./transport/http-proxy.entity.js";
+export { bypassesProxy, isLoopback, parseNoProxy, proxyFor, redactCredentials, resolveProxy } from "./transport/http-proxy.entity.functions.js";

package/dist/index.js

@@ -18,19 +18,30 @@ export {
   refreshOpenAiCodexToken
 } from "./auth/openAiCodexOAuth.js";
 export { authPaths, LocalAuthStoreLive } from "./auth/localAuth.js";
+export { MemoryAuthStoreLive } from "./auth/memory-auth.adapter.js";
+export { CredentialInput, CredentialInputs } from "./auth/credential-input.entity.js";
+export { credentialsOf, toCredential, toCredentialInput } from "./auth/credential-input.entity.functions.js";
+export { RefreshableProvider } from "./auth/credential-refresh.entity.js";
+export { isUsableAt, REFRESH_SKEW_MS, refreshCredential } from "./auth/credential-refresh.entity.functions.js";
+export { HostCredentials } from "./ports/host-credentials.port.js";
 export { LocalSettingsStoreLive } from "./settings/localSettings.js";
+export { MemorySettingsStoreLive } from "./settings/memory-settings.adapter.js";
+export { RoleField, SettingValue } from "./settings/settings-value.entity.js";
+export { applyRole, applySetting, coerceSettingValue, ROLE_FIELDS, roleSelection, settingsFromRecord } from "./settings/settings-value.entity.functions.js";
 export { roleModelView } from "./settings/roleView.js";
 export {
   fromChatCompletion,
   makeCompatLanguageModel,
+  promptWithImageLabels,
   toChatMessages,
   toChatTools
 } from "./llm/compat.js";
 export { makeOpenAiCodexLanguageModel, OPENAI_CODEX_API_URL, toOpenAiCodexRequestBody } from "./llm/openAiCodex.js";
-export { normalizeOpenAiCodexWebSocketEvent, openAiCodexUuidV7, OpenAiCodexWebSocketHttpClient } from "./llm/openAiCodexWebSocket.js";
+export { makeOpenAiCodexWebSocketHttpClient, normalizeOpenAiCodexWebSocketEvent, openAiCodexRefusal, openAiCodexUuidV7, OpenAiCodexWebSocketHttpClient } from "./llm/openAiCodexWebSocket.js";
 export {
   buildProvider,
   chatCompletionsUrl,
+  endpointOwnKey,
   OPENCODE_CHAT_URL,
   OPENCODE_RESPONSES_API_URL,
   prependClaudeCode,
@@ -48,8 +59,24 @@ export { generateWith, LanguageModelLive, LanguageModelSelectionLive } from "./l
 export {
   configuredModelCatalog,
   ConfiguredModelCatalogLive,
+  imageInputFor,
   reasoningEffortsFor
 } from "./llm/modelCatalog.js";
 export { UtilityLlmLive } from "./llm/utilityLlm.js";
 export { modelsPlugin, default } from "./plugin.adapter.js";
 export { CurrentModelEndpoints, ModelEndpoint, ModelEndpoints } from "./ports/model-endpoints.port.js";
+export { ModelsTransport } from "./ports/models-transport.port.js";
+export { ModelsTransportLive, transportFetch } from "./transport/models-transport.adapter.js";
+export {
+  BUN_WEBSOCKET_PROXY_VERSION,
+  HttpProxyOptions,
+  NODE_WEBSOCKET_PROXY_VERSION,
+  NoProxyRule,
+  PROXY_VARIABLES,
+  ProxyConfig,
+  ProxyEnvironment,
+  ProxyInvalid,
+  ProxyUnsupported,
+  ProxyUrlOption
+} from "./transport/http-proxy.entity.js";
+export { bypassesProxy, isLoopback, parseNoProxy, proxyFor, redactCredentials, resolveProxy } from "./transport/http-proxy.entity.functions.js";