@xiaoso/dsh-tool-plus 0.1.16 → 0.1.17-beta.0

package/lib/snowflake-B_jap6lz.mjs

@@ -0,0 +1,666 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { H as $env, k as warn } from "./src-BhinCSpi.mjs";
+import { _ as LoginCancelledError, h as OAuthError, t as ConfigurationError } from "./error-8LVo7tug.mjs";
+import { i as auth } from "./cascade-BWjRTD1q.mjs";
+import { NativeOAuthCallback } from "@oh-my-pi/pi-natives";
+import * as os from "node:os";
+//#region node_modules/.pnpm/@oh-my-pi+pi-catalog@18.12.6/node_modules/@oh-my-pi/pi-catalog/src/compat/auth.ts
+/**
+* Typed accessors over the compiled auth stratum (`rules/auth/*.kdl`): per
+* provider display metadata, env-var fallbacks and the declarative login /
+* refresh flow that `@oh-my-pi/pi-ai`'s registry engines interpret.
+*/
+const providers = auth.providers;
+const byId = Object.fromEntries(providers.map((p) => [p.id, p]));
+/** Every compiled auth provider in `/login` display order. */
+function authProviders() {
+	return providers;
+}
+/** The compiled auth policy for one provider id, if declared. */
+function authPolicyFor(provider) {
+	return byId[provider];
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/native-scheme-callback.ts
+/** Connect OAuth's AbortSignals to the native, recoverable desktop callback receiver. */
+async function createNativeSchemeCallbackReceiver(scheme, options = {}) {
+	options.signal?.throwIfAborted();
+	const receiver = new NativeOAuthCallback({ scheme });
+	const cancel = () => receiver.cancel();
+	const detach = () => options.signal?.removeEventListener("abort", cancel);
+	options.signal?.addEventListener("abort", cancel, { once: true });
+	try {
+		if (!await receiver.start()) {
+			await receiver.dispose();
+			detach();
+			return;
+		}
+		options.signal?.throwIfAborted();
+	} catch (error) {
+		try {
+			await receiver.dispose();
+		} catch (cleanupError) {
+			throw new AggregateError([error, cleanupError], "Native OAuth setup and recovery both failed");
+		} finally {
+			detach();
+		}
+		throw error;
+	}
+	return {
+		async dispose() {
+			try {
+				await receiver.dispose();
+			} finally {
+				detach();
+			}
+		},
+		async waitForCallback(signal, timeoutMs) {
+			signal?.throwIfAborted();
+			signal?.addEventListener("abort", cancel, { once: true });
+			try {
+				return await receiver.waitForCallback(timeoutMs);
+			} finally {
+				signal?.removeEventListener("abort", cancel);
+			}
+		}
+	};
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/oauth.html
+var oauth_default = "<!doctype html>\n<html lang=\"en\">\n	<head>\n		<meta charset=\"UTF-8\" />\n		<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n		<meta name=\"color-scheme\" content=\"dark light\" />\n		<title>omp · authentication</title>\n		<style>\n			:root {\n				--bg: #000;\n				--card: #0b0b0d;\n				--ink-1: #f4f4f5;\n				--ink-2: #b4b4bb;\n				--ink-3: #7a7a83;\n				--line-1: rgb(255 255 255 / 0.07);\n				--line-2: rgb(255 255 255 / 0.12);\n				--top-lit: rgb(255 255 255 / 0.22);\n				--accent-a: #22d3ee;\n				--accent-b: #f472b6;\n				--accent-gradient: linear-gradient(135deg, var(--accent-a), var(--accent-b));\n				--ok: #4ade80;\n				--ok-soft: rgb(74 222 128 / 0.12);\n				--bad: #f87171;\n				--bad-soft: rgb(248 113 113 / 0.12);\n				--pending: #a1a1aa;\n				--pending-soft: rgb(161 161 170 / 0.12);\n				--glow-a: rgb(34 211 238 / 0.1);\n				--glow-b: rgb(244 114 182 / 0.08);\n				--shadow: 0 30px 60px -20px rgb(0 0 0 / 0.8);\n				--btn-bg: #f4f4f5;\n				--btn-fg: #000;\n				--r-control: 8px;\n				--r-panel: 16px;\n				--sans: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, sans-serif;\n				--mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;\n				color-scheme: dark;\n			}\n\n			@media (prefers-color-scheme: light) {\n				:root {\n					--bg: #fafafa;\n					--card: #fff;\n					--ink-1: #111113;\n					--ink-2: #4b4b52;\n					--ink-3: #83838b;\n					--line-1: rgb(0 0 0 / 0.08);\n					--line-2: rgb(0 0 0 / 0.12);\n					--top-lit: rgb(0 0 0 / 0.04);\n					--accent-a: #0891b2;\n					--accent-b: #db2777;\n					--ok: #16a34a;\n					--ok-soft: rgb(22 163 74 / 0.1);\n					--bad: #dc2626;\n					--bad-soft: rgb(220 38 38 / 0.1);\n					--pending: #71717a;\n					--pending-soft: rgb(113 113 122 / 0.1);\n					--glow-a: rgb(8 145 178 / 0.08);\n					--glow-b: rgb(219 39 119 / 0.06);\n					--shadow: 0 20px 50px -24px rgb(0 0 0 / 0.18);\n					--btn-bg: #111113;\n					--btn-fg: #fff;\n					color-scheme: light;\n				}\n			}\n\n			* {\n				box-sizing: border-box;\n			}\n\n			body {\n				margin: 0;\n				min-height: 100vh;\n				display: flex;\n				align-items: center;\n				justify-content: center;\n				padding: 1.5rem;\n				font-family: var(--sans);\n				background: var(--bg);\n				color: var(--ink-1);\n				-webkit-font-smoothing: antialiased;\n				overflow-x: clip;\n			}\n\n			/* ambient glow */\n			.glow {\n				position: fixed;\n				inset: 0;\n				pointer-events: none;\n				background:\n					radial-gradient(ellipse 50vw 40vh at 38% 30%, var(--glow-a), transparent 70%),\n					radial-gradient(ellipse 50vw 40vh at 64% 64%, var(--glow-b), transparent 70%);\n			}\n\n			.container {\n				position: relative;\n				width: 100%;\n				max-width: 400px;\n				padding: 2rem 2rem 1.75rem;\n				background: var(--card);\n				border: 1px solid var(--line-1);\n				border-radius: var(--r-panel);\n				box-shadow: var(--shadow);\n				overflow: hidden;\n				animation: rise 0.5s cubic-bezier(0.16, 1, 0.3, 1) both;\n			}\n			/* top-lit hairline */\n			.container::before {\n				content: \"\";\n				position: absolute;\n				top: 0;\n				left: 12%;\n				right: 12%;\n				height: 1px;\n				background: linear-gradient(90deg, transparent, var(--top-lit), transparent);\n			}\n			@keyframes rise {\n				from {\n					opacity: 0;\n					transform: translateY(8px);\n				}\n			}\n\n			.brand {\n				display: flex;\n				align-items: center;\n				gap: 0.6rem;\n				margin-bottom: 1.75rem;\n			}\n			.omp-mark {\n				flex: none;\n				display: block;\n			}\n			.wordmark {\n				font-size: 13px;\n				font-weight: 600;\n				letter-spacing: -0.01em;\n			}\n			.wordmark-sub {\n				margin-left: auto;\n				font-family: var(--mono);\n				font-size: 12px;\n				color: var(--ink-3);\n			}\n\n			.status {\n				display: inline-flex;\n				align-items: center;\n				gap: 0.45rem;\n				padding: 0.22rem 0.6rem 0.22rem 0.5rem;\n				margin-bottom: 1rem;\n				border-radius: 999px;\n				font-size: 12px;\n				font-weight: 500;\n				color: var(--pending);\n				background: var(--pending-soft);\n			}\n			.status-dot {\n				width: 7px;\n				height: 7px;\n				border-radius: 50%;\n				background: currentColor;\n			}\n			.status-word {\n				display: none;\n			}\n			.container:not(.success):not(.error) .status-pending,\n			.success .status-success,\n			.error .status-error {\n				display: inline;\n			}\n			.container:not(.success):not(.error) .status-dot {\n				animation: pulse 1.4s ease-in-out infinite;\n			}\n			@keyframes pulse {\n				50% {\n					opacity: 0.35;\n				}\n			}\n			.success .status {\n				color: var(--ok);\n				background: var(--ok-soft);\n			}\n			.error .status {\n				color: var(--bad);\n				background: var(--bad-soft);\n			}\n\n			h1 {\n				margin: 0 0 0.5rem;\n				font-size: 1.35rem;\n				font-weight: 600;\n				letter-spacing: -0.02em;\n				line-height: 1.25;\n				text-wrap: balance;\n			}\n			p {\n				margin: 0 0 1.5rem;\n				font-size: 0.9rem;\n				line-height: 1.6;\n				color: var(--ink-2);\n			}\n			p:last-of-type:not(:has(+ .btn)) {\n				margin-bottom: 0.25rem;\n			}\n			.error p {\n				font-family: var(--mono);\n				font-size: 0.8rem;\n				padding: 0.6rem 0.75rem;\n				border: 1px solid var(--line-1);\n				border-radius: var(--r-control);\n				overflow-wrap: anywhere;\n			}\n\n			.btn {\n				display: inline-flex;\n				align-items: center;\n				justify-content: center;\n				width: 100%;\n				padding: 0.6rem 1rem;\n				font: inherit;\n				font-size: 0.875rem;\n				font-weight: 500;\n				color: var(--btn-fg);\n				background: var(--btn-bg);\n				border: none;\n				border-radius: var(--r-control);\n				cursor: pointer;\n				transition: opacity 0.15s;\n			}\n			.btn:hover {\n				opacity: 0.86;\n			}\n			.btn:focus-visible {\n				outline: 2px solid var(--accent-a);\n				outline-offset: 2px;\n			}\n			.error .btn {\n				color: var(--ink-1);\n				background: transparent;\n				border: 1px solid var(--line-2);\n			}\n\n			/* auto-close progress */\n			.timer {\n				position: absolute;\n				left: 0;\n				bottom: 0;\n				height: 2px;\n				width: 100%;\n				background: var(--accent-gradient);\n				transform-origin: left;\n				transform: scaleX(0);\n			}\n			.countdown .timer {\n				animation: countdown 3s linear forwards;\n			}\n			@keyframes countdown {\n				from {\n					transform: scaleX(1);\n				}\n				to {\n					transform: scaleX(0);\n				}\n			}\n\n			@media (prefers-reduced-motion: reduce) {\n				.container,\n				.countdown .timer,\n				.status-dot {\n					animation: none !important;\n				}\n			}\n		</style>\n	</head>\n	<body>\n		<span aria-hidden=\"true\" class=\"glow\"></span>\n		<div id=\"app\" class=\"container\">\n			<div class=\"brand\">\n				<svg class=\"omp-mark\" viewBox=\"0 0 64 64\" width=\"24\" height=\"24\" aria-hidden=\"true\">\n					<defs>\n						<linearGradient id=\"omp-mark-grad\" x1=\"0\" y1=\"0\" x2=\"1\" y2=\"1\">\n							<stop offset=\"0\" stop-color=\"oklch(0.7 0.24 340)\" />\n							<stop offset=\".5\" stop-color=\"oklch(0.62 0.21 295)\" />\n							<stop offset=\"1\" stop-color=\"oklch(0.81 0.14 200)\" />\n						</linearGradient>\n					</defs>\n					<path fill=\"url(#omp-mark-grad)\" d=\"M10 14h44v9H43v33h-9V23h-9v22h-9V23H10z\" />\n				</svg>\n				<span class=\"wordmark\">omp</span>\n				<span class=\"wordmark-sub\">oauth</span>\n			</div>\n\n			<div class=\"status\" role=\"status\">\n				<span aria-hidden=\"true\" class=\"status-dot\"></span>\n				<span class=\"status-word status-pending\">Waiting</span>\n				<span class=\"status-word status-success\">Connected</span>\n				<span class=\"status-word status-error\">Failed</span>\n			</div>\n\n			<h1 id=\"title\">Authentication</h1>\n			<p id=\"message\"></p>\n			<button onclick=\"window.close()\" class=\"btn\">Close window</button>\n			<span aria-hidden=\"true\" class=\"timer\"></span>\n		</div>\n\n		<script id=\"server-state\" type=\"application/json\">\n			__OAUTH_STATE__\n		<\/script>\n\n		<script>\n			let serverState;\n			try {\n				serverState = JSON.parse(document.getElementById(\"server-state\").textContent);\n			} catch {\n				const params = new URLSearchParams(window.location.search);\n				serverState = {\n					ok: params.get(\"ok\") === \"1\",\n					error: params.get(\"error\") || \"Authentication failed\",\n				};\n			}\n\n			const app = document.getElementById(\"app\");\n			const title = document.getElementById(\"title\");\n			const message = document.getElementById(\"message\");\n\n			if (serverState.ok) {\n				const closeButton = document.querySelector(\".btn\");\n				app.classList.add(\"success\", \"countdown\");\n				title.textContent = \"Authentication successful\";\n				message.textContent = \"You have successfully logged in.\";\n				window.close();\n				setTimeout(() => {\n					app.classList.remove(\"countdown\");\n					closeButton.remove();\n					message.innerHTML = \"You have successfully logged in.<br>Please close this tab manually.\";\n				}, 300);\n			} else {\n				app.classList.add(\"error\");\n				title.textContent = \"Authentication failed\";\n				message.textContent = serverState.error || \"An error occurred\";\n			}\n		<\/script>\n	</body>\n</html>\n";
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/callback-server.ts
+/**
+* Abstract base class for OAuth flows with local callback servers.
+*
+* Handles:
+* - Port allocation (tries expected port, falls back to random)
+* - Callback server setup and request handling
+* - Common OAuth flow logic
+*
+* Providers extend this and implement:
+* - generateAuthUrl(): Build provider-specific authorization URL
+* - exchangeToken(): Exchange authorization code for tokens
+*/
+const DEFAULT_TIMEOUT = 3e5;
+const DEFAULT_HOSTNAME = "localhost";
+const CALLBACK_PATH = "/callback";
+const IPV4_LOOPBACK = "127.0.0.1";
+const IPV6_LOOPBACK = "::1";
+/**
+* How many times a random-port bind may be redrawn when the ephemeral port it
+* landed on is already held on {@link IPV6_LOOPBACK} by that exact address.
+* Small on purpose: each redraw picks a fresh port, so a repeat collision is
+* vanishingly unlikely.
+*/
+const IPV6_COMPANION_ATTEMPTS = 4;
+/**
+* Path served by {@link OAuthCallbackFlow} that 302-redirects to the pending
+* authorization URL. Kept out of {@link OAuthCallbackFlowOptions} because it
+* lives on the loopback callback server alongside {@link CALLBACK_PATH} and
+* must never clash with a provider-registered redirect URI (all known
+* providers register `/callback`-shaped paths).
+*/
+const LAUNCH_PATH = "/launch";
+/**
+* Whether a failed bind means "another process already holds this port".
+* Bun surfaces `EADDRINUSE` on the error's `code` where the platform reports
+* it, and otherwise only in the message, so both are checked.
+*/
+function isAddressInUse(error) {
+	const code = error?.code;
+	if (typeof code === "string") return code === "EADDRINUSE";
+	return error instanceof Error && /EADDRINUSE|in use/i.test(error.message);
+}
+/** Keep JSON data inside the template's script element; JSON.parse restores the original text. */
+function serializeCallbackState(state) {
+	return JSON.stringify(state).replaceAll("<", "\\u003c");
+}
+/**
+* Whether this host exposes an IPv6 loopback (`::1`) the companion listener can
+* bind. A kernel with IPv6 disabled (`ipv6.disable=1`) lists no internal IPv6
+* address, and the `::1` companion bind there fails with a generic Bun error
+* {@link isAddressInUse} cannot distinguish from a real collision — Bun reuses
+* its "Is port X in use?" message for every listen failure (oven-sh/bun#7187) —
+* so the dual-bind path must be skipped up front rather than misread as a
+* conflict (issue #8814).
+*/
+function ipv6LoopbackAvailable() {
+	const interfaces = os.networkInterfaces();
+	for (const name in interfaces) {
+		const addresses = interfaces[name];
+		if (!addresses) continue;
+		for (const address of addresses) if (address.internal && address.family === "IPv6") return true;
+	}
+	return false;
+}
+function parseNativeCallback(input, redirectUri, expectedState) {
+	let callback;
+	let expected;
+	try {
+		callback = new URL(input);
+		expected = new URL(redirectUri);
+	} catch {
+		throw new OAuthError("OAuth application callback was not a valid URL", { kind: "device-auth" });
+	}
+	if (callback.protocol !== expected.protocol || callback.host !== expected.host || callback.pathname !== expected.pathname) throw new OAuthError("OAuth application returned an unexpected callback target", { kind: "device-auth" });
+	const state = callback.searchParams.get("state") ?? "";
+	if (expectedState && state !== expectedState) throw new OAuthError("State mismatch - possible CSRF attack", { kind: "device-auth" });
+	const error = callback.searchParams.get("error");
+	if (error) {
+		const description = callback.searchParams.get("error_description") || error;
+		throw new OAuthError(`Authorization failed: ${description}`, { kind: "device-auth" });
+	}
+	const code = callback.searchParams.get("code") ?? callback.searchParams.get("authCode");
+	if (!code) throw new OAuthError("OAuth application callback omitted the authorization code", { kind: "device-auth" });
+	return {
+		code,
+		state
+	};
+}
+/**
+* Abstract base class for OAuth flows with local callback servers.
+*/
+var OAuthCallbackFlow = class {
+	ctrl;
+	preferredPort;
+	callbackPath;
+	callbackHostname;
+	redirectUri;
+	allowPortFallback;
+	#manualInputOnly;
+	#nativeScheme;
+	#callbackResolve;
+	#callbackReject;
+	/**
+	* Authorization URL the `/launch` route currently redirects to. Set by
+	* {@link login} after {@link generateAuthUrl} and before {@link OAuthController.onAuth}
+	* fires, cleared when the server stops. `undefined` before the flow reaches
+	* that point and after it finishes, so `/launch` returns 503 rather than
+	* a stale URL.
+	*/
+	#pendingAuthUrl;
+	constructor(ctrl, preferredPortOrOptions, callbackPath = CALLBACK_PATH) {
+		this.ctrl = ctrl;
+		if (typeof preferredPortOrOptions === "number") {
+			this.preferredPort = preferredPortOrOptions;
+			this.callbackPath = callbackPath;
+			this.callbackHostname = DEFAULT_HOSTNAME;
+			this.allowPortFallback = true;
+			this.#manualInputOnly = false;
+			this.#nativeScheme = false;
+			return;
+		}
+		this.preferredPort = preferredPortOrOptions.preferredPort;
+		this.callbackPath = preferredPortOrOptions.callbackPath ?? CALLBACK_PATH;
+		this.callbackHostname = preferredPortOrOptions.callbackHostname ?? DEFAULT_HOSTNAME;
+		this.redirectUri = preferredPortOrOptions.redirectUri;
+		this.allowPortFallback = preferredPortOrOptions.allowPortFallback ?? true;
+		this.#manualInputOnly = preferredPortOrOptions.manualInputOnly ?? false;
+		this.#nativeScheme = preferredPortOrOptions.nativeScheme ?? false;
+	}
+	/**
+	* Generate CSRF state token. Override if provider needs custom state generation.
+	*/
+	generateState() {
+		const bytes = /* @__PURE__ */ new Uint8Array(16);
+		crypto.getRandomValues(bytes);
+		return Array.from(bytes).map((value) => value.toString(16).padStart(2, "0")).join("");
+	}
+	#loginCancelledError() {
+		return new LoginCancelledError(`OAuth callback cancelled: ${this.ctrl.signal?.reason}`);
+	}
+	#throwIfCancelled() {
+		if (this.ctrl.signal?.aborted) throw this.#loginCancelledError();
+	}
+	/**
+	* Execute the OAuth login flow.
+	*/
+	async login() {
+		const state = this.generateState();
+		this.#throwIfCancelled();
+		const { server, redirectUri, launchUrl } = this.#manualInputOnly ? {
+			server: void 0,
+			redirectUri: this.#buildRedirectUri(),
+			launchUrl: void 0
+		} : await this.#startCallbackServer(state);
+		const receiverAbort = new AbortController();
+		let receiver;
+		let nativeCallback;
+		try {
+			this.#throwIfCancelled();
+			if (this.#nativeScheme) {
+				const redirect = new URL(redirectUri);
+				if (redirect.protocol !== "http:" && redirect.protocol !== "https:") try {
+					receiver = await createNativeSchemeCallbackReceiver(redirect.protocol.slice(0, -1), { signal: this.ctrl.signal });
+				} catch (error) {
+					this.#throwIfCancelled();
+					this.#reportNativeWarning("Native OAuth callback setup failed; paste the authorization code instead", error);
+				}
+			}
+			this.#throwIfCancelled();
+			if (receiver) {
+				nativeCallback = receiver.waitForCallback(receiverAbort.signal).then((input) => parseNativeCallback(input, redirectUri, state));
+				nativeCallback.catch(() => void 0);
+			}
+			const { url: authUrl, instructions } = await this.generateAuthUrl(state, redirectUri);
+			this.#throwIfCancelled();
+			this.#pendingAuthUrl = authUrl;
+			this.ctrl.onAuth?.({
+				url: authUrl,
+				launchUrl,
+				instructions
+			});
+			this.#throwIfCancelled();
+			this.ctrl.onProgress?.(receiver || !this.#manualInputOnly ? "Waiting for browser authentication..." : "Waiting for pasted authorization code...");
+			this.#throwIfCancelled();
+			let callback;
+			try {
+				callback = await this.#waitForCallback(state, nativeCallback);
+			} catch (error) {
+				this.#throwIfCancelled();
+				throw error;
+			}
+			this.#throwIfCancelled();
+			receiverAbort.abort("OAuth callback received");
+			await nativeCallback?.catch(() => void 0);
+			this.ctrl.onProgress?.("Exchanging authorization code for tokens...");
+			this.#throwIfCancelled();
+			return await this.exchangeToken(callback.code, state, redirectUri);
+		} finally {
+			this.#pendingAuthUrl = void 0;
+			receiverAbort.abort("OAuth login finished");
+			await nativeCallback?.catch(() => void 0);
+			if (receiver) try {
+				await receiver.dispose();
+			} catch (error) {
+				this.#reportNativeWarning("Native OAuth callback cleanup failed; recovery information was retained", error);
+			}
+			server?.stop();
+		}
+	}
+	/**
+	* Surface native callback failures without allowing reporting hooks to
+	* replace the login result they are meant to describe.
+	*/
+	#reportNativeWarning(message, error) {
+		const warning = `${message}: ${error instanceof Error ? error.message : String(error)}`;
+		warn(warning, { error });
+		try {
+			this.ctrl.onProgress?.(warning);
+		} catch (progressError) {
+			warn("OAuth progress callback failed while reporting a native callback warning", { error: progressError });
+		}
+	}
+	#buildRedirectUri() {
+		return this.redirectUri ?? `http://${this.callbackHostname}:${this.preferredPort}${this.callbackPath}`;
+	}
+	/**
+	* Start callback server, trying preferred port first, falling back to random.
+	* `launchUrl` is `undefined` when the caller configured `callbackPath` to
+	* collide with {@link LAUNCH_PATH} — the callback handler resolves the real
+	* callback in that case, so advertising a self-redirecting URL would be
+	* incorrect.
+	*/
+	async #startCallbackServer(expectedState) {
+		try {
+			const server = this.#createServer(this.preferredPort, expectedState);
+			const actualPort = this.#resolveServerPort(server);
+			const launchUrl = this.#launchUrlIfSafe(actualPort);
+			if (this.redirectUri) return {
+				server,
+				redirectUri: this.redirectUri,
+				launchUrl
+			};
+			return {
+				server,
+				redirectUri: `http://${this.callbackHostname}:${actualPort}${this.callbackPath}`,
+				launchUrl
+			};
+		} catch (cause) {
+			if (this.redirectUri) throw new ConfigurationError(`OAuth callback port ${this.preferredPort} is in use, but oauth.redirectUri (${this.redirectUri}) requires this exact port. Free port ${this.preferredPort} (e.g. stop the process bound to it) and retry, or change oauth.redirectUri to point at an available port.`, { cause });
+			if (!this.allowPortFallback) throw new ConfigurationError(`OAuth callback port ${this.preferredPort} is in use. The OAuth provider validates redirect URIs against its registered callback, so falling back to a random port would be rejected. Free port ${this.preferredPort} (e.g. stop the process bound to it) and retry, or set oauth.callbackPort/oauth.redirectUri to a port the provider has registered.`, { cause });
+			const server = this.#createServer(0, expectedState);
+			const actualPort = this.#resolveServerPort(server);
+			const redirectUri = `http://${this.callbackHostname}:${actualPort}${this.callbackPath}`;
+			const launchUrl = this.#launchUrlIfSafe(actualPort);
+			this.ctrl.onProgress?.(`Preferred port ${this.preferredPort} unavailable, using port ${actualPort}`);
+			return {
+				server,
+				redirectUri,
+				launchUrl
+			};
+		}
+	}
+	/**
+	* Read the numeric port a callback server bound to. `Bun.Server.port` is
+	* declared `number | undefined` because Unix-socket servers have no port,
+	* but every callback flow uses TCP; a missing port here indicates a
+	* configuration error rather than a fallback case.
+	*/
+	#resolveServerPort(server) {
+		const port = server.port;
+		if (typeof port !== "number") throw new ConfigurationError("OAuth callback server bound to a non-TCP endpoint; expected a numeric port. Check `oauth.callbackPort`/`oauth.redirectUri`.");
+		return port;
+	}
+	/**
+	* Build the `/launch` URL served by the callback server bound to `port`, or
+	* `undefined` when it must not be advertised:
+	* - the configured `callbackPath` (or a `redirectUri` whose pathname
+	*   resolves to {@link LAUNCH_PATH}) would collide with the launch route;
+	* - the flow's `redirectUri` never returns to this loopback server: fixed
+	*   non-loopback hosts, or custom schemes like GitLab Duo's `vscode://`
+	*   URI — which `new URL` parses without complaint, so a scheme/host check
+	*   is required, not just the parse failure path. Advertising a localhost
+	*   `/launch` target for such flows misrepresents the callback endpoint
+	*   and hands remote users a URL that resolves nowhere.
+	* Kept short (~30 chars) so UIs can advertise it as a
+	* viewport-truncation-safe copy target for the full authorization URL.
+	*/
+	#launchUrlIfSafe(port) {
+		if (this.callbackPath === LAUNCH_PATH) return void 0;
+		if (this.redirectUri) try {
+			const parsed = new URL(this.redirectUri);
+			if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return void 0;
+			if (parsed.hostname !== "localhost" && parsed.hostname !== "127.0.0.1" && parsed.hostname !== "[::1]") return;
+			if (parsed.pathname === LAUNCH_PATH) return void 0;
+		} catch {
+			return;
+		}
+		return `http://${this.callbackHostname}:${port}${LAUNCH_PATH}`;
+	}
+	/**
+	* Create the HTTP listener(s) for the OAuth callback.
+	*
+	* `localhost` is not a single endpoint: it resolves to both
+	* {@link IPV4_LOOPBACK} and {@link IPV6_LOOPBACK}, and clients commonly try
+	* `::1` first. Binding only the IPv4 literal hands the authorization code to
+	* whatever holds the IPv6 loopback on the same port — a dev server on
+	* `*:3000` is the common case — which answers from its own routes while this
+	* flow waits out the full {@link DEFAULT_TIMEOUT}. Nothing detects it either:
+	* a specific-address bind coexists with another process's wildcard bind, so
+	* `Bun.serve` reports the port as free and the random-port fallback in
+	* {@link #startCallbackServer} never runs.
+	*
+	* Binding both loopback literals fixes the delivery rather than dodging it:
+	* the kernel routes a connection to the most specific matching bind, so our
+	* `::1` listener receives `localhost` traffic that would otherwise reach a
+	* process bound to the `::` wildcard. Both listeners answer the same routes,
+	* so which family the client resolves stops mattering.
+	*
+	* A genuine collision — another process on exactly this loopback address and
+	* port — still raises EADDRINUSE and reaches the caller's in-use policy. A
+	* host that cannot bind `::1` at all (IPv6 disabled, address unavailable) is
+	* not a collision: the IPv4 listener is the only reachable endpoint there, so
+	* it serves alone.
+	*/
+	#createServer(port, expectedState) {
+		if (this.callbackHostname !== DEFAULT_HOSTNAME) return this.#serve(this.callbackHostname, port, expectedState);
+		const dualStack = ipv6LoopbackAvailable();
+		for (let attempt = 0;; attempt++) {
+			const primary = this.#serve(IPV4_LOOPBACK, port, expectedState);
+			const boundPort = primary.port;
+			if (typeof boundPort !== "number") return primary;
+			if (!dualStack) return primary;
+			let companion;
+			try {
+				companion = this.#serve(IPV6_LOOPBACK, boundPort, expectedState);
+			} catch (cause) {
+				if (!isAddressInUse(cause)) return primary;
+				primary.stop(true);
+				if (port !== 0 || attempt >= IPV6_COMPANION_ATTEMPTS) throw cause;
+				continue;
+			}
+			return {
+				get port() {
+					return primary.port;
+				},
+				stop: (closeActiveConnections) => {
+					companion.stop(closeActiveConnections);
+					return primary.stop(closeActiveConnections);
+				}
+			};
+		}
+	}
+	/** Bind one loopback listener serving the callback and launch routes. */
+	#serve(hostname, port, expectedState) {
+		return Bun.serve({
+			hostname,
+			port,
+			reusePort: false,
+			fetch: (req) => this.#handleCallback(req, expectedState)
+		});
+	}
+	/**
+	* Handle OAuth callback HTTP request. Two routes on the same loopback server:
+	* - `callbackPath` (default `/callback`) — the provider redirect target.
+	* - {@link LAUNCH_PATH} (`/launch`) — 302 to the pending authorization URL so
+	*   viewport-safe copy targets can survive TUI truncation.
+	*
+	* `callbackPath` wins any collision: an OMP config that pins the provider
+	* redirect at `/launch` (via `oauth.callbackPath` or a loopback
+	* `oauth.redirectUri`) must resolve the callback normally rather than
+	* self-redirect. `#startCallbackServer` also suppresses `launchUrl` in that
+	* case, so the launch route is never advertised when it would collide.
+	*/
+	#handleCallback(req, expectedState) {
+		const url = new URL(req.url);
+		if (url.pathname !== this.callbackPath) {
+			if (url.pathname === LAUNCH_PATH) {
+				const pending = this.#pendingAuthUrl;
+				if (!pending) return new Response("OAuth launch URL is no longer active", { status: 503 });
+				return Response.redirect(pending, 302);
+			}
+			return new Response("Not Found", { status: 404 });
+		}
+		const code = url.searchParams.get("code");
+		const state = url.searchParams.get("state") || "";
+		const error = url.searchParams.get("error") || "";
+		const errorDescription = url.searchParams.get("error_description") || error;
+		let resultState;
+		if (error) resultState = {
+			ok: false,
+			error: `Authorization failed: ${errorDescription}`
+		};
+		else if (!code) resultState = {
+			ok: false,
+			error: "Missing authorization code"
+		};
+		else if (expectedState && state !== expectedState) resultState = {
+			ok: false,
+			error: "State mismatch - possible CSRF attack"
+		};
+		else resultState = {
+			ok: true,
+			code,
+			state
+		};
+		if (resultState.ok) {
+			const resolve = this.#callbackResolve;
+			queueMicrotask(() => {
+				resolve?.({
+					code: resultState.code,
+					state: resultState.state
+				});
+			});
+		} else if (error && (!expectedState || state === expectedState)) {
+			const reject = this.#callbackReject;
+			const message = resultState.error ?? `Authorization failed: ${errorDescription}`;
+			queueMicrotask(() => {
+				reject?.(new OAuthError(message, { kind: "device-auth" }));
+			});
+		}
+		return new Response(oauth_default.replaceAll("__OAUTH_STATE__", () => serializeCallbackState(resultState)), {
+			status: resultState.ok ? 200 : 500,
+			headers: { "Content-Type": "text/html" }
+		});
+	}
+	/**
+	* Wait for OAuth callback or manual input (whichever comes first).
+	*/
+	#waitForCallback(expectedState, nativeCallback) {
+		const timeoutSignal = AbortSignal.timeout(DEFAULT_TIMEOUT);
+		const settledSignal = new AbortController();
+		const signals = this.ctrl.signal ? [
+			this.ctrl.signal,
+			timeoutSignal,
+			settledSignal.signal
+		] : [timeoutSignal, settledSignal.signal];
+		const signal = AbortSignal.any(signals);
+		if (signal.aborted) return Promise.reject(this.#loginCancelledError());
+		const callback = Promise.withResolvers();
+		this.#callbackResolve = callback.resolve;
+		this.#callbackReject = callback.reject;
+		signal.addEventListener("abort", () => {
+			this.#callbackResolve = void 0;
+			this.#callbackReject = void 0;
+			callback.reject(new LoginCancelledError(`OAuth callback cancelled: ${signal.reason}`));
+		}, { once: true });
+		const callbackPromise = callback.promise;
+		const candidates = [callbackPromise];
+		if (nativeCallback) candidates.push(nativeCallback);
+		if (this.ctrl.onManualCodeInput) {
+			const requestManualInput = this.ctrl.onManualCodeInput;
+			const manualPromise = (async () => {
+				while (true) {
+					const result = await Promise.race([callbackPromise, requestManualInput(signal).then((input) => {
+						const parsed = parseCallbackInput(input);
+						if (!parsed.code) return null;
+						if (expectedState && parsed.state && parsed.state !== expectedState) return null;
+						return {
+							code: parsed.code,
+							state: parsed.state ?? ""
+						};
+					})]);
+					if (result) return result;
+				}
+			})();
+			candidates.push(manualPromise);
+		}
+		return Promise.race(candidates).finally(() => {
+			this.#callbackResolve = void 0;
+			this.#callbackReject = void 0;
+			settledSignal.abort("OAuth callback settled");
+		});
+	}
+};
+/**
+* Parse a redirect URL or code string to extract code and state.
+*/
+function parseCallbackInput(input) {
+	const value = input.trim();
+	if (!value) return {};
+	try {
+		const url = new URL(value);
+		return {
+			code: url.searchParams.get("code") ?? void 0,
+			state: url.searchParams.get("state") ?? void 0
+		};
+	} catch {}
+	if (value.includes("code=")) {
+		const params = new URLSearchParams(value.replace(/^[?#]/, ""));
+		return {
+			code: params.get("code") ?? void 0,
+			state: params.get("state") ?? void 0
+		};
+	}
+	const [code, state] = value.split("#", 2);
+	return {
+		code,
+		state
+	};
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@18.12.6/node_modules/@oh-my-pi/pi-ai/src/registry/snowflake.ts
+const SNOWFLAKE_ACCOUNT_ORIGIN_PLACEHOLDER = "https://snowflake-account.invalid";
+const INVALID_ACCOUNT_MESSAGE = "Paste your Snowflake account identifier (orgname-accountname) or account URL";
+const DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+const LEGACY_SNOWSIGHT_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d+$/;
+function isDnsLabel(label) {
+	return label.length <= 63 && DNS_LABEL.test(label);
+}
+/** Normalize account identifiers and Snowsight links without accepting arbitrary credential-receiving hosts. */
+function normalizeSnowflakeAccountUrl(input) {
+	const value = input.trim();
+	if (!value) throw new ConfigurationError("Snowflake account is required: run /login snowflake or set SNOWFLAKE_ACCOUNT");
+	const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(value);
+	if (scheme && scheme[1].toLowerCase() !== "https") throw new ConfigurationError("Snowflake account URL must use https");
+	if (value.includes("\\")) throw new ConfigurationError(INVALID_ACCOUNT_MESSAGE);
+	let host;
+	if (scheme) {
+		const url = /^https:\/\/([^/?#]+)(.*)$/i.exec(value);
+		if (!url) throw new ConfigurationError(INVALID_ACCOUNT_MESSAGE);
+		host = url[1].toLowerCase().replaceAll("_", "-");
+		if (host.endsWith(":443")) host = host.slice(0, -4);
+		if (host === "app.snowflake.com") {
+			const segments = url[2].split(/[?#]/, 1)[0].split("/");
+			const org = segments[1]?.toLowerCase().replaceAll("_", "-") ?? "";
+			const account = segments[2]?.toLowerCase().replaceAll("_", "-") ?? "";
+			if (!isDnsLabel(org) || !isDnsLabel(account)) throw new ConfigurationError(INVALID_ACCOUNT_MESSAGE);
+			if (LEGACY_SNOWSIGHT_REGION.test(org)) throw new ConfigurationError("Legacy Snowsight links don't identify the account host; paste your account identifier (orgname-accountname) or account URL");
+			host = `${org}-${account}.snowflakecomputing.com`;
+		}
+	} else {
+		if (/[/?#]/.test(value)) throw new ConfigurationError(INVALID_ACCOUNT_MESSAGE);
+		host = value.toLowerCase().replaceAll("_", "-");
+		if (host.endsWith(":443")) host = host.slice(0, -4);
+		if (!host.endsWith(".snowflakecomputing.com") && !host.endsWith(".snowflakecomputing.cn")) host += ".snowflakecomputing.com";
+	}
+	if (host.endsWith(".snowflakecomputing.cn")) throw new ConfigurationError("Snowflake Cortex REST API is not available in China-region accounts (.snowflakecomputing.cn)");
+	if (!host.endsWith(".snowflakecomputing.com") || host.length === 23 || !host.split(".").every(isDnsLabel)) throw new ConfigurationError(INVALID_ACCOUNT_MESSAGE);
+	return `https://${host}`;
+}
+const INVALID_CREDENTIAL_MESSAGE = "Invalid Snowflake credential; run /login snowflake again";
+/** Decode the registry's structured OAuth key; malformed JSON must never become a bearer token. */
+function parseSnowflakeCredential(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	if (!trimmed.startsWith("{")) return { token: trimmed };
+	let credential;
+	try {
+		credential = JSON.parse(trimmed);
+	} catch {
+		throw new ConfigurationError(INVALID_CREDENTIAL_MESSAGE);
+	}
+	if (!credential || typeof credential !== "object" || !("token" in credential) || typeof credential.token !== "string" || !credential.token.trim() || !("enterpriseUrl" in credential) || typeof credential.enterpriseUrl !== "string" || !credential.enterpriseUrl.trim()) throw new ConfigurationError(INVALID_CREDENTIAL_MESSAGE);
+	let accountUrl;
+	try {
+		accountUrl = normalizeSnowflakeAccountUrl(credential.enterpriseUrl);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : String(error);
+		throw new ConfigurationError(`Invalid Snowflake credential account: ${reason}; run /login snowflake again`);
+	}
+	return {
+		token: credential.token.trim(),
+		accountUrl
+	};
+}
+const snowflakeTransport = { prepareRequest: (model, options) => {
+	const credential = parseSnowflakeCredential(options.apiKey?.trim() || $env.SNOWFLAKE_PAT || "");
+	if (!credential) return {
+		model,
+		options
+	};
+	let baseUrl = model.baseUrl;
+	if (baseUrl === SNOWFLAKE_ACCOUNT_ORIGIN_PLACEHOLDER || baseUrl.startsWith(`${SNOWFLAKE_ACCOUNT_ORIGIN_PLACEHOLDER}/`)) baseUrl = (credential.accountUrl ?? normalizeSnowflakeAccountUrl($env.SNOWFLAKE_ACCOUNT ?? "")) + baseUrl.slice(33);
+	else if (credential.accountUrl) {
+		let origin;
+		try {
+			origin = new URL(baseUrl).origin;
+		} catch {}
+		if (origin !== credential.accountUrl) throw new ConfigurationError("Snowflake OAuth account does not match the model endpoint");
+	}
+	return {
+		model: baseUrl === model.baseUrl ? model : {
+			...model,
+			baseUrl
+		},
+		options: {
+			...options,
+			apiKey: credential.token
+		}
+	};
+} };
+//#endregion
+export { authProviders as a, authPolicyFor as i, snowflakeTransport as n, OAuthCallbackFlow as r, normalizeSnowflakeAccountUrl as t };