@xiaoso/dsh-tool-plus 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/anthropic-sCMH7JID.mjs

@@ -0,0 +1,262 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { r as __exportAll } from "./fs-promises-shim-B-9cMxz5.mjs";
+import { V as ProviderHttpError, c as OAuthError } from "./error-yCSG0mGC.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-DDSrZ6l_.mjs";
+import { t as generatePKCE } from "./pkce-BlQikGPu.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/claude-code-fingerprint.ts
+/**
+* Cowork inference-fingerprint constants, kept in a leaf module so consumers
+* outside the provider (`registry/oauth/anthropic`, `usage/claude`) don't
+* import the heavy `providers/anthropic` module.
+*
+* That import edge was a live init cycle: `providers/anthropic` → `stream` →
+* `registry` → `registry/oauth/anthropic` → back into the still-initializing
+* provider module.
+*/
+/** Claude runtime version bundled by the current Cowork desktop release. */
+const claudeCodeVersion = "2.1.220";
+/** User-Agent emitted by Cowork's `claude-desktop` inference entrypoint. */
+const coworkUserAgent = `claude-cli/${claudeCodeVersion} (external, claude-desktop)`;
+/** Identity block prepended by Cowork's Claude runtime. */
+const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+/** Cowork's per-request output-token ceiling. */
+const CLAUDE_CODE_MAX_OUTPUT_TOKENS = 64e3;
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/anthropic.ts
+/**
+* Anthropic OAuth flow (Claude Pro/Max)
+*/
+var anthropic_exports = /* @__PURE__ */ __exportAll({
+	ANTHROPIC_OAUTH_GRANT_TTL_MS: () => ANTHROPIC_OAUTH_GRANT_TTL_MS,
+	AnthropicOAuthFlow: () => AnthropicOAuthFlow,
+	loginAnthropic: () => loginAnthropic,
+	refreshAnthropicToken: () => refreshAnthropicToken
+});
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
+const BOOTSTRAP_URL = "https://api.anthropic.com/api/claude_cli/bootstrap";
+const CLAUDE_CODE_BOOTSTRAP_MODEL = "claude-opus-4-8";
+const CLAUDE_CODE_BOOTSTRAP_USER_AGENT = `claude-code/${claudeCodeVersion}`;
+const CALLBACK_PORT = 54545;
+const CALLBACK_PATH = "/callback";
+const SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+function formatErrorDetails(error) {
+	if (error instanceof Error) {
+		const details = [`${error.name}: ${error.message}`];
+		const errorWithCode = error;
+		if (errorWithCode.code) details.push(`code=${errorWithCode.code}`);
+		if (typeof errorWithCode.errno !== "undefined") details.push(`errno=${String(errorWithCode.errno)}`);
+		if (typeof error.cause !== "undefined") details.push(`cause=${formatErrorDetails(error.cause)}`);
+		if (error.stack) details.push(`stack=${error.stack}`);
+		return details.join("; ");
+	}
+	return String(error);
+}
+async function postJson(url, body, fetchImpl, extraHeaders) {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: {
+			...extraHeaders,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	return responseBody;
+}
+function nonEmpty(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseOAuthTokenResponse(responseBody, operation) {
+	try {
+		return JSON.parse(responseBody);
+	} catch (error) {
+		throw new OAuthError(`Anthropic ${operation} returned invalid JSON. url=${TOKEN_URL}; body=${responseBody}; details=${formatErrorDetails(error)}`, {
+			kind: "validation",
+			provider: "anthropic",
+			cause: error
+		});
+	}
+}
+/**
+* Lift the OAuth response's `account: { uuid, email_address }` and
+* `organization: { uuid, name }` blocks onto {@link OAuthCredentials} so
+* downstream identity propagation (e.g. `metadata.user_id.account_uuid`,
+* usage tracking, org-scoped credential identity) works without a separate
+* `/api/oauth/profile` round-trip. Returns `undefined` for any field the
+* response omits or carries as a non-string / empty value.
+*/
+function extractAccountFromTokenResponse(data) {
+	return {
+		accountId: nonEmpty(data.account?.uuid),
+		email: nonEmpty(data.account?.email_address),
+		orgId: nonEmpty(data.organization?.uuid),
+		orgName: nonEmpty(data.organization?.name)
+	};
+}
+async function fetchBootstrapIdentity(accessToken, fetchImpl) {
+	const url = `${BOOTSTRAP_URL}?entrypoint=cli&model=${encodeURIComponent(CLAUDE_CODE_BOOTSTRAP_MODEL)}`;
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers: {
+			Accept: "application/json, text/plain, */*",
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json",
+			"User-Agent": CLAUDE_CODE_BOOTSTRAP_USER_AGENT,
+			"anthropic-beta": "oauth-2025-04-20"
+		},
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	let data;
+	try {
+		data = JSON.parse(responseBody);
+	} catch (error) {
+		throw new OAuthError(`Anthropic bootstrap returned invalid JSON. url=${url}; body=${responseBody}; details=${formatErrorDetails(error)}`, {
+			kind: "validation",
+			provider: "anthropic",
+			cause: error
+		});
+	}
+	return {
+		accountId: nonEmpty(data.oauth_account?.account_uuid),
+		email: nonEmpty(data.oauth_account?.account_email),
+		orgId: nonEmpty(data.oauth_account?.organization_uuid),
+		orgName: nonEmpty(data.oauth_account?.organization_name)
+	};
+}
+/**
+* Resolve account (and optionally organization) identity for a token
+* response. `includeOrg` is login-only: the org an access token is scoped to
+* is captured once when the credential is created and deliberately never
+* refreshed afterwards — rewriting identity during background token
+* refreshes could silently re-key stored credentials.
+*/
+async function resolveAccountIdentity(data, fetchImpl, options) {
+	const identity = extractAccountFromTokenResponse(data);
+	const orgSatisfied = !options?.includeOrg || identity.orgId !== void 0;
+	if (identity.accountId && identity.email && orgSatisfied) return identity;
+	try {
+		const bootstrap = await fetchBootstrapIdentity(data.access_token, fetchImpl);
+		return {
+			accountId: identity.accountId ?? bootstrap.accountId,
+			email: identity.email ?? bootstrap.email,
+			orgId: identity.orgId ?? bootstrap.orgId,
+			orgName: identity.orgName ?? bootstrap.orgName
+		};
+	} catch {
+		return identity;
+	}
+}
+var AnthropicOAuthFlow = class extends OAuthCallbackFlow {
+	#verifier = "";
+	#challenge = "";
+	#fetch;
+	constructor(ctrl) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const pkce = await generatePKCE();
+		this.#verifier = pkce.verifier;
+		this.#challenge = pkce.challenge;
+		const authParams = new URLSearchParams({
+			code: "true",
+			client_id: CLIENT_ID,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: SCOPES,
+			code_challenge: this.#challenge,
+			code_challenge_method: "S256",
+			state
+		});
+		return {
+			url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+			instructions: "Complete login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		};
+	}
+	async exchangeToken(code, state, redirectUri) {
+		let exchangeCode = code;
+		let exchangeState = state;
+		const codeFragmentIndex = code.indexOf("#");
+		if (codeFragmentIndex >= 0) {
+			exchangeCode = code.slice(0, codeFragmentIndex);
+			const codeFragmentState = code.slice(codeFragmentIndex + 1);
+			if (codeFragmentState.length > 0) exchangeState = codeFragmentState;
+		}
+		let responseBody;
+		try {
+			responseBody = await postJson(TOKEN_URL, {
+				grant_type: "authorization_code",
+				client_id: CLIENT_ID,
+				code: exchangeCode,
+				state: exchangeState,
+				redirect_uri: redirectUri,
+				code_verifier: this.#verifier
+			}, this.#fetch);
+		} catch (error) {
+			throw new OAuthError(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; response_type=authorization_code; details=${formatErrorDetails(error)}`, {
+				kind: "token-exchange",
+				provider: "anthropic",
+				cause: error
+			});
+		}
+		const tokenData = parseOAuthTokenResponse(responseBody, "token exchange");
+		const { accountId, email, orgId, orgName } = await resolveAccountIdentity(tokenData, this.#fetch, { includeOrg: true });
+		return {
+			refresh: tokenData.refresh_token,
+			access: tokenData.access_token,
+			expires: Date.now() + tokenData.expires_in * 1e3 - 3e5,
+			accountId,
+			email,
+			orgId,
+			orgName
+		};
+	}
+};
+/**
+* Login with Anthropic OAuth
+*/
+async function loginAnthropic(ctrl) {
+	return new AnthropicOAuthFlow(ctrl).login();
+}
+/**
+* Refresh Anthropic OAuth token
+*/
+async function refreshAnthropicToken(refreshToken, fetchOverride) {
+	const fetchImpl = fetchOverride ?? fetch;
+	let responseBody;
+	try {
+		responseBody = await postJson(TOKEN_URL, {
+			grant_type: "refresh_token",
+			client_id: CLIENT_ID,
+			refresh_token: refreshToken
+		}, fetchImpl, {
+			"anthropic-beta": "oauth-2025-04-20",
+			"User-Agent": "anthropic-sdk-typescript/0.94.0 userOAuthProvider"
+		});
+	} catch (error) {
+		throw new OAuthError(`Anthropic token refresh request failed. url=${TOKEN_URL}; details=${formatErrorDetails(error)}`, {
+			kind: "token-refresh",
+			provider: "anthropic",
+			cause: error
+		});
+	}
+	const data = parseOAuthTokenResponse(responseBody, "token refresh");
+	const { accountId, email } = await resolveAccountIdentity(data, fetchImpl);
+	return {
+		refresh: data.refresh_token || refreshToken,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1e3 - 3e5,
+		accountId,
+		email
+	};
+}
+//#endregion
+export { coworkUserAgent as a, claudeCodeVersion as i, CLAUDE_CODE_MAX_OUTPUT_TOKENS as n, claudeCodeSystemInstruction as r, anthropic_exports as t };

package/lib/anthropic-tTntD8BD.mjs

@@ -0,0 +1,262 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { r as __exportAll } from "./fs-promises-shim-Bx0fpxuk.mjs";
+import { V as ProviderHttpError, c as OAuthError } from "./error-Dd8DIqs-.mjs";
+import { t as OAuthCallbackFlow } from "./callback-server-CQ5Jo8F-.mjs";
+import { t as generatePKCE } from "./pkce-BlQikGPu.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/claude-code-fingerprint.ts
+/**
+* Cowork inference-fingerprint constants, kept in a leaf module so consumers
+* outside the provider (`registry/oauth/anthropic`, `usage/claude`) don't
+* import the heavy `providers/anthropic` module.
+*
+* That import edge was a live init cycle: `providers/anthropic` → `stream` →
+* `registry` → `registry/oauth/anthropic` → back into the still-initializing
+* provider module.
+*/
+/** Claude runtime version bundled by the current Cowork desktop release. */
+const claudeCodeVersion = "2.1.220";
+/** User-Agent emitted by Cowork's `claude-desktop` inference entrypoint. */
+const coworkUserAgent = `claude-cli/${claudeCodeVersion} (external, claude-desktop)`;
+/** Identity block prepended by Cowork's Claude runtime. */
+const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
+/** Cowork's per-request output-token ceiling. */
+const CLAUDE_CODE_MAX_OUTPUT_TOKENS = 64e3;
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/anthropic.ts
+/**
+* Anthropic OAuth flow (Claude Pro/Max)
+*/
+var anthropic_exports = /* @__PURE__ */ __exportAll({
+	ANTHROPIC_OAUTH_GRANT_TTL_MS: () => ANTHROPIC_OAUTH_GRANT_TTL_MS,
+	AnthropicOAuthFlow: () => AnthropicOAuthFlow,
+	loginAnthropic: () => loginAnthropic,
+	refreshAnthropicToken: () => refreshAnthropicToken
+});
+const decode = (s) => atob(s);
+const CLIENT_ID = decode("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
+const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
+const TOKEN_URL = "https://api.anthropic.com/v1/oauth/token";
+const BOOTSTRAP_URL = "https://api.anthropic.com/api/claude_cli/bootstrap";
+const CLAUDE_CODE_BOOTSTRAP_MODEL = "claude-opus-4-8";
+const CLAUDE_CODE_BOOTSTRAP_USER_AGENT = `claude-code/${claudeCodeVersion}`;
+const CALLBACK_PORT = 54545;
+const CALLBACK_PATH = "/callback";
+const SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+function formatErrorDetails(error) {
+	if (error instanceof Error) {
+		const details = [`${error.name}: ${error.message}`];
+		const errorWithCode = error;
+		if (errorWithCode.code) details.push(`code=${errorWithCode.code}`);
+		if (typeof errorWithCode.errno !== "undefined") details.push(`errno=${String(errorWithCode.errno)}`);
+		if (typeof error.cause !== "undefined") details.push(`cause=${formatErrorDetails(error.cause)}`);
+		if (error.stack) details.push(`stack=${error.stack}`);
+		return details.join("; ");
+	}
+	return String(error);
+}
+async function postJson(url, body, fetchImpl, extraHeaders) {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: {
+			...extraHeaders,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	return responseBody;
+}
+function nonEmpty(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseOAuthTokenResponse(responseBody, operation) {
+	try {
+		return JSON.parse(responseBody);
+	} catch (error) {
+		throw new OAuthError(`Anthropic ${operation} returned invalid JSON. url=${TOKEN_URL}; body=${responseBody}; details=${formatErrorDetails(error)}`, {
+			kind: "validation",
+			provider: "anthropic",
+			cause: error
+		});
+	}
+}
+/**
+* Lift the OAuth response's `account: { uuid, email_address }` and
+* `organization: { uuid, name }` blocks onto {@link OAuthCredentials} so
+* downstream identity propagation (e.g. `metadata.user_id.account_uuid`,
+* usage tracking, org-scoped credential identity) works without a separate
+* `/api/oauth/profile` round-trip. Returns `undefined` for any field the
+* response omits or carries as a non-string / empty value.
+*/
+function extractAccountFromTokenResponse(data) {
+	return {
+		accountId: nonEmpty(data.account?.uuid),
+		email: nonEmpty(data.account?.email_address),
+		orgId: nonEmpty(data.organization?.uuid),
+		orgName: nonEmpty(data.organization?.name)
+	};
+}
+async function fetchBootstrapIdentity(accessToken, fetchImpl) {
+	const url = `${BOOTSTRAP_URL}?entrypoint=cli&model=${encodeURIComponent(CLAUDE_CODE_BOOTSTRAP_MODEL)}`;
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers: {
+			Accept: "application/json, text/plain, */*",
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json",
+			"User-Agent": CLAUDE_CODE_BOOTSTRAP_USER_AGENT,
+			"anthropic-beta": "oauth-2025-04-20"
+		},
+		signal: AbortSignal.timeout(3e4)
+	});
+	const responseBody = await response.text();
+	if (!response.ok) throw new ProviderHttpError(`HTTP request failed. status=${response.status}; url=${url}; body=${responseBody}`, response.status);
+	let data;
+	try {
+		data = JSON.parse(responseBody);
+	} catch (error) {
+		throw new OAuthError(`Anthropic bootstrap returned invalid JSON. url=${url}; body=${responseBody}; details=${formatErrorDetails(error)}`, {
+			kind: "validation",
+			provider: "anthropic",
+			cause: error
+		});
+	}
+	return {
+		accountId: nonEmpty(data.oauth_account?.account_uuid),
+		email: nonEmpty(data.oauth_account?.account_email),
+		orgId: nonEmpty(data.oauth_account?.organization_uuid),
+		orgName: nonEmpty(data.oauth_account?.organization_name)
+	};
+}
+/**
+* Resolve account (and optionally organization) identity for a token
+* response. `includeOrg` is login-only: the org an access token is scoped to
+* is captured once when the credential is created and deliberately never
+* refreshed afterwards — rewriting identity during background token
+* refreshes could silently re-key stored credentials.
+*/
+async function resolveAccountIdentity(data, fetchImpl, options) {
+	const identity = extractAccountFromTokenResponse(data);
+	const orgSatisfied = !options?.includeOrg || identity.orgId !== void 0;
+	if (identity.accountId && identity.email && orgSatisfied) return identity;
+	try {
+		const bootstrap = await fetchBootstrapIdentity(data.access_token, fetchImpl);
+		return {
+			accountId: identity.accountId ?? bootstrap.accountId,
+			email: identity.email ?? bootstrap.email,
+			orgId: identity.orgId ?? bootstrap.orgId,
+			orgName: identity.orgName ?? bootstrap.orgName
+		};
+	} catch {
+		return identity;
+	}
+}
+var AnthropicOAuthFlow = class extends OAuthCallbackFlow {
+	#verifier = "";
+	#challenge = "";
+	#fetch;
+	constructor(ctrl) {
+		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
+		this.#fetch = ctrl.fetch ?? fetch;
+	}
+	async generateAuthUrl(state, redirectUri) {
+		const pkce = await generatePKCE();
+		this.#verifier = pkce.verifier;
+		this.#challenge = pkce.challenge;
+		const authParams = new URLSearchParams({
+			code: "true",
+			client_id: CLIENT_ID,
+			response_type: "code",
+			redirect_uri: redirectUri,
+			scope: SCOPES,
+			code_challenge: this.#challenge,
+			code_challenge_method: "S256",
+			state
+		});
+		return {
+			url: `${AUTHORIZE_URL}?${authParams.toString()}`,
+			instructions: "Complete login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted."
+		};
+	}
+	async exchangeToken(code, state, redirectUri) {
+		let exchangeCode = code;
+		let exchangeState = state;
+		const codeFragmentIndex = code.indexOf("#");
+		if (codeFragmentIndex >= 0) {
+			exchangeCode = code.slice(0, codeFragmentIndex);
+			const codeFragmentState = code.slice(codeFragmentIndex + 1);
+			if (codeFragmentState.length > 0) exchangeState = codeFragmentState;
+		}
+		let responseBody;
+		try {
+			responseBody = await postJson(TOKEN_URL, {
+				grant_type: "authorization_code",
+				client_id: CLIENT_ID,
+				code: exchangeCode,
+				state: exchangeState,
+				redirect_uri: redirectUri,
+				code_verifier: this.#verifier
+			}, this.#fetch);
+		} catch (error) {
+			throw new OAuthError(`Token exchange request failed. url=${TOKEN_URL}; redirect_uri=${redirectUri}; response_type=authorization_code; details=${formatErrorDetails(error)}`, {
+				kind: "token-exchange",
+				provider: "anthropic",
+				cause: error
+			});
+		}
+		const tokenData = parseOAuthTokenResponse(responseBody, "token exchange");
+		const { accountId, email, orgId, orgName } = await resolveAccountIdentity(tokenData, this.#fetch, { includeOrg: true });
+		return {
+			refresh: tokenData.refresh_token,
+			access: tokenData.access_token,
+			expires: Date.now() + tokenData.expires_in * 1e3 - 3e5,
+			accountId,
+			email,
+			orgId,
+			orgName
+		};
+	}
+};
+/**
+* Login with Anthropic OAuth
+*/
+async function loginAnthropic(ctrl) {
+	return new AnthropicOAuthFlow(ctrl).login();
+}
+/**
+* Refresh Anthropic OAuth token
+*/
+async function refreshAnthropicToken(refreshToken, fetchOverride) {
+	const fetchImpl = fetchOverride ?? fetch;
+	let responseBody;
+	try {
+		responseBody = await postJson(TOKEN_URL, {
+			grant_type: "refresh_token",
+			client_id: CLIENT_ID,
+			refresh_token: refreshToken
+		}, fetchImpl, {
+			"anthropic-beta": "oauth-2025-04-20",
+			"User-Agent": "anthropic-sdk-typescript/0.94.0 userOAuthProvider"
+		});
+	} catch (error) {
+		throw new OAuthError(`Anthropic token refresh request failed. url=${TOKEN_URL}; details=${formatErrorDetails(error)}`, {
+			kind: "token-refresh",
+			provider: "anthropic",
+			cause: error
+		});
+	}
+	const data = parseOAuthTokenResponse(responseBody, "token refresh");
+	const { accountId, email } = await resolveAccountIdentity(data, fetchImpl);
+	return {
+		refresh: data.refresh_token || refreshToken,
+		access: data.access_token,
+		expires: Date.now() + data.expires_in * 1e3 - 3e5,
+		accountId,
+		email
+	};
+}
+//#endregion
+export { coworkUserAgent as a, claudeCodeVersion as i, CLAUDE_CODE_MAX_OUTPUT_TOKENS as n, claudeCodeSystemInstruction as r, anthropic_exports as t };

package/lib/api-key-login-BzqNdM2y.mjs

@@ -0,0 +1,157 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { V as ProviderHttpError, _ as OnPromptRequiredError, h as LoginCancelledError, m as ApiKeyRequiredError } from "./error-Dd8DIqs-.mjs";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/api-key-validation.ts
+const VALIDATION_TIMEOUT_MS = 15e3;
+function normalizeAnthropicCompatibleBaseUrl(baseUrl) {
+	const trimmed = baseUrl.trim().replace(/\/+$/, "");
+	return trimmed.endsWith("/v1") ? trimmed.slice(0, -3) : trimmed;
+}
+function resolveValidationHeaders(headers) {
+	return typeof headers === "function" ? headers() : headers;
+}
+async function createApiKeyValidationError(provider, response) {
+	let details = "";
+	try {
+		details = (await response.text()).trim();
+	} catch {}
+	const message = details ? `${provider} API key validation failed (${response.status}): ${details}` : `${provider} API key validation failed (${response.status})`;
+	return new ProviderHttpError(message, response.status, { headers: response.headers });
+}
+/**
+* Validate an API key against an OpenAI-compatible chat completions endpoint.
+*
+* Performs a minimal request to verify credentials and endpoint access.
+*/
+async function validateOpenAICompatibleApiKey(options) {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const response = await (options.fetch ?? fetch)(`${options.baseUrl}/chat/completions`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${options.apiKey}`
+		},
+		body: JSON.stringify({
+			model: options.model,
+			messages: [{
+				role: "user",
+				content: "ping"
+			}],
+			max_tokens: 1,
+			temperature: 0
+		}),
+		signal
+	});
+	if (response.ok) return;
+	throw await createApiKeyValidationError(options.provider, response);
+}
+/**
+* Validate an API key against an Anthropic-compatible messages endpoint.
+*/
+async function validateAnthropicCompatibleApiKey(options) {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const baseUrl = normalizeAnthropicCompatibleBaseUrl(options.baseUrl);
+	const response = await (options.fetch ?? fetch)(`${baseUrl}/v1/messages`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"anthropic-version": "2023-06-01",
+			"x-api-key": options.apiKey
+		},
+		body: JSON.stringify({
+			model: options.model,
+			messages: [{
+				role: "user",
+				content: "ping"
+			}],
+			max_tokens: 1
+		}),
+		signal
+	});
+	if (response.ok) return;
+	throw await createApiKeyValidationError(options.provider, response);
+}
+/**
+* Validate an API key against a provider models endpoint.
+*
+* Useful for providers where access to specific models may vary by plan and
+* should not block key validation.
+*/
+async function validateApiKeyAgainstModelsEndpoint(options) {
+	const timeoutSignal = AbortSignal.timeout(VALIDATION_TIMEOUT_MS);
+	const signal = options.signal ? AbortSignal.any([options.signal, timeoutSignal]) : timeoutSignal;
+	const response = await (options.fetch ?? fetch)(options.modelsUrl, {
+		method: "GET",
+		headers: {
+			...resolveValidationHeaders(options.headers) ?? {},
+			Authorization: `Bearer ${options.apiKey}`
+		},
+		signal
+	});
+	if (response.ok) return;
+	throw await createApiKeyValidationError(options.provider, response);
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/api-key-login.ts
+/**
+* Shared factory for API-key-paste "login" flows.
+*
+* Several providers (Cerebras, Synthetic, Moonshot, Together, NanoGPT, ZenMux)
+* don't actually implement OAuth — they just ask the user to paste an API key,
+* optionally validate it, and return the trimmed key.
+*/
+function createApiKeyLogin(config) {
+	return async function login(options) {
+		if (!options.onPrompt) throw new OnPromptRequiredError(config.providerLabel);
+		if (config.authUrl && config.instructions) options.onAuth?.({
+			url: config.authUrl,
+			instructions: config.instructions
+		});
+		const apiKey = config.emptyKeyFallback === void 0 ? await options.onPrompt({
+			message: config.promptMessage,
+			placeholder: config.placeholder
+		}) : await options.onPrompt({
+			message: config.promptMessage,
+			placeholder: config.placeholder,
+			allowEmpty: true
+		});
+		if (options.signal?.aborted) throw new LoginCancelledError();
+		const trimmed = apiKey.trim();
+		if (!trimmed) {
+			if (config.emptyKeyFallback !== void 0) return config.emptyKeyFallback;
+			throw new ApiKeyRequiredError();
+		}
+		if (config.validation) {
+			options.onProgress?.("Validating API key...");
+			if (config.validation.kind === "chat-completions") await validateOpenAICompatibleApiKey({
+				provider: config.validation.provider,
+				apiKey: trimmed,
+				baseUrl: config.validation.baseUrl,
+				model: config.validation.model,
+				signal: options.signal,
+				fetch: options.fetch
+			});
+			else if (config.validation.kind === "anthropic-messages") await validateAnthropicCompatibleApiKey({
+				provider: config.validation.provider,
+				apiKey: trimmed,
+				baseUrl: config.validation.baseUrl,
+				model: config.validation.model,
+				signal: options.signal,
+				fetch: options.fetch
+			});
+			else await validateApiKeyAgainstModelsEndpoint({
+				provider: config.validation.provider,
+				apiKey: trimmed,
+				modelsUrl: typeof config.validation.modelsUrl === "function" ? config.validation.modelsUrl() : config.validation.modelsUrl,
+				headers: config.validation.headers,
+				signal: options.signal,
+				fetch: options.fetch
+			});
+		}
+		return trimmed;
+	};
+}
+//#endregion
+export { validateApiKeyAgainstModelsEndpoint as n, validateOpenAICompatibleApiKey as r, createApiKeyLogin as t };