@xopcai/xopc 0.0.101 → 0.0.103

package/dist/src/agent/memory/dreaming/rem-patterns.js

@@ -4,8 +4,8 @@ import { DREAMING_DIR_RELATIVE, DREAMS_MD_FILENAME, MS_PER_DAY } from "./constan
 import { isoDay } from "./utils.js";
 import { bumpEntryPhaseSignal, loadDreamingStore, saveDreamingStore } from "./short-term-store.js";
 import "./last-run.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/rem-patterns.ts
 init_logger();
 const log = createLogger("Dreaming:REM");

package/dist/src/agent/memory/dreaming/short-term-store.js

@@ -2,9 +2,9 @@ import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { SHORT_TERM_PROMOTION_LOCK_RELATIVE, SHORT_TERM_RECALL_STORE_RELATIVE } from "./constants.js";
 import { buildEntryKey, clamp01, isoDay, normalizeMemoryPath } from "./utils.js";
-import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/short-term-store.ts
 init_logger();
 const log = createLogger("Dreaming:Store");

package/dist/src/agent/memory/dreaming/utils.js

@@ -1,7 +1,7 @@
 import { DEFAULT_DEEP_CRON, DIVERSITY_WEIGHT, MS_PER_DAY, REINFORCEMENT_WEIGHT } from "./constants.js";
-import path from "node:path";
 import { createHash } from "node:crypto";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/utils.ts
 /** Normalize a workspace-relative memory path: forward slashes, no odd ../ escapes at start. */
 function normalizeMemoryPath(rel) {

package/dist/src/agent/memory/memory-flush.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 //#region src/agent/memory/memory-flush.ts
 init_logger();
 const log = createLogger("MemoryFlush");

package/dist/src/agent/memory/plugin-discovery.js

@@ -1,5 +1,5 @@
-import { dirname, join } from "node:path";
 import { readdir, stat } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region src/agent/memory/plugin-discovery.ts
 async function discoverMemoryPlugins() {

package/dist/src/agent/models/manager.js

@@ -1,6 +1,6 @@
-import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { getAllModels, getDefaultModelSync, init_providers, resolveModel } from "../../providers/index.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed, maybeRetryTurnAfterTransientLlmFailure } from "../orchestration/llm-turn-retry.js";

package/dist/src/agent/prompt/service-prompt-builder.js

@@ -1,6 +1,6 @@
-import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { DEFAULT_USER_FILENAME } from "../context/workspace.js";
 import { resolveSystemPromptBuildParams } from "./system-prompt-params.js";
@@ -9,8 +9,8 @@ import { createSkillConfigManager } from "../skills/config.js";
 import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { selectSkillsVisibleInPrompt } from "../skills/format-skills-prompt.js";
-import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 //#region src/agent/prompt/service-prompt-builder.ts
 /**
 * System Prompt Builder - Builds the complete system prompt

package/dist/src/agent/reply/post-compaction-context.js

@@ -1,7 +1,7 @@
 import { init_agent_scope, resolveAgentProfileDir } from "../agent-scope.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
-import { join, resolve } from "node:path";
 import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
 //#region src/agent/reply/post-compaction-context.ts
 init_agent_scope();
 const MAX_CONTEXT_CHARS = 1800;

package/dist/src/agent/reply/workspace-boundary-read.js

@@ -1,5 +1,5 @@
-import { resolve } from "node:path";
 import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
 //#region src/agent/reply/workspace-boundary-read.ts
 /**
 * Read a file relative to workspace root with path traversal guard and byte cap.

package/dist/src/agent/sandbox/path-policy.js

@@ -1,6 +1,6 @@
-import { homedir } from "node:os";
-import { isAbsolute, normalize, resolve, sep } from "node:path";
 import { realpathSync } from "node:fs";
+import { isAbsolute, normalize, resolve, sep } from "node:path";
+import { homedir } from "node:os";
 //#region src/agent/sandbox/path-policy.ts
 /**
 * Path safety validation for sandbox isolation.

package/dist/src/agent/service.js

@@ -1,9 +1,9 @@
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
-import { createLogger } from "../utils/logger/index.js";
-import { init_logger } from "../utils/logger.js";
 import { extractTextContent } from "./context/workspace.js";
 import { getWorkflowProgressBroker } from "./workflow/progress-broker.js";
 import "./workflow/index.js";
@@ -60,8 +60,8 @@ import { parseOutboundSessionKey } from "./service/parse-outbound-session-key.js
 import { cleanTrailingErrors } from "./memory/message-sanitizer.js";
 import { MemoryFlushService } from "./memory/memory-flush.js";
 import { tryApplySessionTranscriptHygiene } from "./transcript/transcript-hygiene.js";
-import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 //#region src/agent/service.ts
 init_schema();
 init_logger();

package/dist/src/agent/session/session-inspector.js

@@ -1,6 +1,6 @@
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { resolveEffectiveReasoningLevel, resolveEffectiveThinkingLevel } from "../../session/thinking-resolve.js";
 import { effectiveWorkspacePathForSession } from "../../session/session-workspace.js";
 import "../../session/index.js";

package/dist/src/agent/skills/config.js

@@ -1,7 +1,7 @@
 import { __toCommonJS } from "../../../_virtual/_rolldown/runtime.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { init_installer, installer_exports } from "./installer.js";
 import { join } from "path";
 import { existsSync, readFileSync } from "fs";

package/dist/src/agent/skills/hub-hash.js

@@ -1,6 +1,6 @@
-import { join, relative } from "node:path";
-import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
+import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
 //#region src/agent/skills/hub-hash.ts
 /**
 * Deterministic content hash for a skill directory (for hub lock / drift detection).

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/skills/hub-pull.js

@@ -4,9 +4,9 @@ import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { getSkillsLockEntry, recordSkillsHubInstall } from "./hub-lock.js";
 import { installSkillFromZip, isValidSkillId } from "./managed-store.js";
 import { computeSkillTreeHashSync } from "./hub-hash.js";
-import { tmpdir } from "node:os";
-import { basename, join, normalize, resolve, sep } from "node:path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, join, normalize, resolve, sep } from "node:path";
+import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { fetch } from "undici";

package/dist/src/agent/skills/index.js

@@ -1,6 +1,6 @@
-import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { findInstallSpec, getDefaultInstallerPreferences, hasBinary, init_installer, installSkill } from "./installer.js";

package/dist/src/agent/skills/managed-store.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { loadSkillsLock } from "./hub-lock.js";
-import { dirname, join, resolve, sep } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve, sep } from "node:path";
 import AdmZip from "adm-zip";
 //#region src/agent/skills/managed-store.ts
 /**

package/dist/src/agent/skills/scanner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { join } from "path";
 import { readFile, readdir } from "fs/promises";
+import { join } from "path";
 //#region src/agent/skills/scanner.ts
 /**
 * Skill security scanner — scans skill directories for potentially dangerous code patterns.

package/dist/src/agent/skills/skill-manage-ops.js

@@ -2,9 +2,9 @@ import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
+import { mkdir, writeFile } from "fs/promises";
 import { join, resolve, sep } from "path";
 import { existsSync, realpathSync } from "fs";
-import { mkdir, writeFile } from "fs/promises";
 //#region src/agent/skills/skill-manage-ops.ts
 /**
 * Shared logic for the skill_manage agent tool (create / edit / patch / delete / write_file / remove_file).

package/dist/src/agent/skills/skill-manager.js

@@ -1,6 +1,6 @@
-import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths, resolveBundledSkillsDir } from "../../config/paths.js";
 import { createSkillConfigManager, isSkillEnabled } from "./config.js";
 import { formatSkillsForPrompt, selectSkillsVisibleInPrompt } from "./format-skills-prompt.js";

package/dist/src/agent/tools/dreaming-tool.js

@@ -3,8 +3,8 @@ import { init_logger } from "../../utils/logger.js";
 import { SHORT_TERM_PROMOTION_LOCK_RELATIVE, SHORT_TERM_RECALL_STORE_RELATIVE } from "../memory/dreaming/constants.js";
 import { loadDreamingStore, saveDreamingStore } from "../memory/dreaming/short-term-store.js";
 import { resolveDreamingConfig } from "../memory/dreaming/config.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/dreaming-tool.ts
 init_logger();

package/dist/src/agent/tools/factory.js

@@ -1,6 +1,6 @@
-import { init_session_key, parseSessionKey } from "../../routing/session-key.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_session_key, parseSessionKey } from "../../routing/session-key.js";
 import { createReadFileTool } from "./read.js";
 import { createWriteFileTool } from "./write.js";
 import { createEditFileTool } from "./edit.js";

package/dist/src/agent/tools/image-generate-tool.js

@@ -4,9 +4,9 @@ import { isFailoverError } from "../failover-error.js";
 import { imageAssetFromDataUrl, imageFileExtensionForMimeType, mimeTypeFromFileName, parseImageDataUrl, sniffImageMimeType } from "../image/generation/image-assets.js";
 import { getImageGenerationProvider } from "../image/generation/provider-registry.js";
 import { generateImage, listImageGenerationProvidersSummary } from "../image/generation/runtime.js";
-import path from "node:path";
 import { randomBytes } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/image-generate-tool.ts
 const DEFAULT_COUNT = 1;

package/dist/src/agent/tools/send-media.js

@@ -1,7 +1,7 @@
 import { checkFileSafety } from "../prompt/safety.js";
 import { resolvePathUnderWorkspace } from "./tool-paths.js";
-import { basename } from "node:path";
 import { readFile } from "fs/promises";
+import { basename } from "node:path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/send-media.ts
 const SendMediaSchema = Type.Object({
@@ -22,8 +22,7 @@ function detectMediaType(filePath) {
 		"png",
 		"gif",
 		"webp",
-		"bmp",
-		"svg"
+		"bmp"
 	];
 	const videoExts = [
 		"mp4",

package/dist/src/agent/tools/send-media.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-media.js","names":[],"sources":["../../../../src/agent/tools/send-media.ts"],"sourcesContent":["// Send media tool - allows sending local files as media\nimport { Type } from '@sinclair/typebox';\nimport { readFile } from 'fs/promises';\nimport { basename } from 'node:path';\nimport { AgentTool, type AgentToolResult } from '@earendil-works/pi-agent-core';\nimport { checkFileSafety } from '../prompt/safety.js';\nimport { resolvePathUnderWorkspace } from './tool-paths.js';\nimport type { MessageBus, OutboundMessage } from '../../infra/bus/index.js';\n\nconst SendMediaSchema = Type.Object({\n  filePath: Type.String({\n    description:\n      'File to send. Relative paths are under the current agent workspace; absolute paths are used as given.',\n  }),\n  mediaType: Type.Optional(Type.Enum({\n    photo: 'photo',\n    video: 'video',\n    audio: 'audio',\n    document: 'document',\n  }, { description: 'Type of media to send (auto-detected if not specified)' })),\n  caption: Type.Optional(Type.String({ description: 'Caption for the media' })),\n});\n\ninterface MessageContext {\n  channel: string;\n  chatId: string;\n}\n\ntype SendMediaParams = {\n  filePath: string;\n  mediaType?: 'photo' | 'video' | 'audio' | 'document';\n  caption?: string;\n};\n\n// Detect media type from file extension\nfunction detectMediaType(filePath: string): 'photo' | 'video' | 'audio' | 'document' {\n  const ext = filePath.split('.').pop()?.toLowerCase();\n  const imageExts = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp', 'svg'];\n  const videoExts = ['mp4', 'mov', 'avi', 'webm', 'mkv'];\n  const audioExts = ['mp3', 'wav', 'ogg', 'm4a', 'flac'];\n\n  if (imageExts.includes(ext || '')) return 'photo';\n  if (videoExts.includes(ext || '')) return 'video';\n  if (audioExts.includes(ext || '')) return 'audio';\n  return 'document';\n}\n\n// Detect MIME type from file extension\nfunction detectMimeType(filePath: string): string {\n  const ext = filePath.split('.').pop()?.toLowerCase();\n  const mimeMap: Record<string, string> = {\n    jpg: 'image/jpeg',\n    jpeg: 'image/jpeg',\n    png: 'image/png',\n    gif: 'image/gif',\n    webp: 'image/webp',\n    bmp: 'image/bmp',\n    svg: 'image/svg+xml',\n    mp4: 'video/mp4',\n    mov: 'video/quicktime',\n    avi: 'video/x-msvideo',\n    webm: 'video/webm',\n    mp3: 'audio/mpeg',\n    wav: 'audio/wav',\n    ogg: 'audio/ogg',\n    m4a: 'audio/mp4',\n    flac: 'audio/flac',\n    pdf: 'application/pdf',\n    doc: 'application/msword',\n    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',\n    txt: 'text/plain',\n    zip: 'application/zip',\n    rar: 'application/x-rar-compressed',\n  };\n  return mimeMap[ext || ''] || 'application/octet-stream';\n}\n\nexport function createSendMediaTool(\n  workspace: string,\n  bus: MessageBus,\n  getContext: () => MessageContext | null,\n): AgentTool {\n  return {\n    name: 'send_media',\n    description:\n      'Send a media file (photo, video, audio, document) to the current conversation. Relative paths resolve to the current agent workspace (same as read_file).',\n    parameters: SendMediaSchema,\n    label: '📎 Send Media',\n\n    async execute(\n      _toolCallId: string,\n      params: any,\n      _signal?: AbortSignal,\n    ): Promise<AgentToolResult<{}>> {\n      const p = params as SendMediaParams;\n      const ctx = getContext();\n      if (!ctx) {\n        return {\n          content: [{ type: 'text', text: 'Error: No active conversation context' }],\n          details: {},\n        };\n      }\n\n      const resolved = resolvePathUnderWorkspace(p.filePath, workspace);\n      const safety = checkFileSafety('read', resolved);\n      if (!safety.allowed) {\n        return {\n          content: [{ type: 'text', text: `🚫 ${safety.message}` }],\n          details: {},\n        };\n      }\n\n      try {\n        const fileBuffer = await readFile(resolved);\n        const base64 = fileBuffer.toString('base64');\n        const mimeType = detectMimeType(resolved);\n        const mediaType = p.mediaType || detectMediaType(resolved);\n\n        // Create data URL\n        const dataUrl = `data:${mimeType};base64,${base64}`;\n\n        const msg: OutboundMessage = {\n          channel: ctx.channel,\n          chat_id: ctx.chatId,\n          content: p.caption || '',\n          mediaUrl: dataUrl,\n          mediaType,\n        };\n\n        await bus.publishOutbound(msg);\n\n        const fileName = basename(resolved);\n        return {\n          content: [{ type: 'text', text: `✅ Media sent: ${fileName} (${mediaType})` }],\n          details: { filePath: resolved, mediaType },\n        };\n      } catch (error) {\n        const errorMessage = error instanceof Error ? error.message : String(error);\n        return {\n          content: [{ type: 'text', text: `Error sending media: ${errorMessage}` }],\n          details: { error: errorMessage },\n        };\n      }\n    },\n  } as any;\n}\n"],"mappings":";;;;;;AASA,MAAM,kBAAkB,KAAK,OAAO;CAClC,UAAU,KAAK,OAAO,EACpB,aACE,yGACH,CAAC;CACF,WAAW,KAAK,SAAS,KAAK,KAAK;EACjC,OAAO;EACP,OAAO;EACP,OAAO;EACP,UAAU;EACX,EAAE,EAAE,aAAa,0DAA0D,CAAC,CAAC;CAC9E,SAAS,KAAK,SAAS,KAAK,OAAO,EAAE,aAAa,yBAAyB,CAAC,CAAC;CAC9E,CAAC;AAcF,SAAS,gBAAgB,UAA4D;CACnF,MAAM,MAAM,SAAS,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa;CACpD,MAAM,YAAY;EAAC;EAAO;EAAQ;EAAO;EAAO;EAAQ;EAAO;EAAM;CACrE,MAAM,YAAY;EAAC;EAAO;EAAO;EAAO;EAAQ;EAAM;CACtD,MAAM,YAAY;EAAC;EAAO;EAAO;EAAO;EAAO;EAAO;AAEtD,KAAI,UAAU,SAAS,OAAO,GAAG,CAAE,QAAO;AAC1C,KAAI,UAAU,SAAS,OAAO,GAAG,CAAE,QAAO;AAC1C,KAAI,UAAU,SAAS,OAAO,GAAG,CAAE,QAAO;AAC1C,QAAO;;AAIT,SAAS,eAAe,UAA0B;AA0BhD,QAAO;EAvBL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,KAAK;EAEO,CAzBF,SAAS,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAyB9B,OAAO;;AAG/B,SAAgB,oBACd,WACA,KACA,YACW;AACX,QAAO;EACL,MAAM;EACN,aACE;EACF,YAAY;EACZ,OAAO;EAEP,MAAM,QACJ,aACA,QACA,SAC8B;GAC9B,MAAM,IAAI;GACV,MAAM,MAAM,YAAY;AACxB,OAAI,CAAC,IACH,QAAO;IACL,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM;KAAyC,CAAC;IAC1E,SAAS,EAAE;IACZ;GAGH,MAAM,WAAW,0BAA0B,EAAE,UAAU,UAAU;GACjE,MAAM,SAAS,gBAAgB,QAAQ,SAAS;AAChD,OAAI,CAAC,OAAO,QACV,QAAO;IACL,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM,MAAM,OAAO;KAAW,CAAC;IACzD,SAAS,EAAE;IACZ;AAGH,OAAI;IAEF,MAAM,UAAS,MADU,SAAS,SAAS,EACjB,SAAS,SAAS;IAC5C,MAAM,WAAW,eAAe,SAAS;IACzC,MAAM,YAAY,EAAE,aAAa,gBAAgB,SAAS;IAG1D,MAAM,UAAU,QAAQ,SAAS,UAAU;IAE3C,MAAM,MAAuB;KAC3B,SAAS,IAAI;KACb,SAAS,IAAI;KACb,SAAS,EAAE,WAAW;KACtB,UAAU;KACV;KACD;AAED,UAAM,IAAI,gBAAgB,IAAI;AAG9B,WAAO;KACL,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,iBAFjB,SAAS,SAEiC,CAAC,IAAI,UAAU;MAAI,CAAC;KAC7E,SAAS;MAAE,UAAU;MAAU;MAAW;KAC3C;YACM,OAAO;IACd,MAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAC3E,WAAO;KACL,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,wBAAwB;MAAgB,CAAC;KACzE,SAAS,EAAE,OAAO,cAAc;KACjC;;;EAGN"}
+{"version":3,"file":"send-media.js","names":[],"sources":["../../../../src/agent/tools/send-media.ts"],"sourcesContent":["// Send media tool - allows sending local files as media\nimport { Type } from '@sinclair/typebox';\nimport { readFile } from 'fs/promises';\nimport { basename } from 'node:path';\nimport { AgentTool, type AgentToolResult } from '@earendil-works/pi-agent-core';\nimport { checkFileSafety } from '../prompt/safety.js';\nimport { resolvePathUnderWorkspace } from './tool-paths.js';\nimport type { MessageBus, OutboundMessage } from '../../infra/bus/index.js';\n\nconst SendMediaSchema = Type.Object({\n  filePath: Type.String({\n    description:\n      'File to send. Relative paths are under the current agent workspace; absolute paths are used as given.',\n  }),\n  mediaType: Type.Optional(Type.Enum({\n    photo: 'photo',\n    video: 'video',\n    audio: 'audio',\n    document: 'document',\n  }, { description: 'Type of media to send (auto-detected if not specified)' })),\n  caption: Type.Optional(Type.String({ description: 'Caption for the media' })),\n});\n\ninterface MessageContext {\n  channel: string;\n  chatId: string;\n}\n\ntype SendMediaParams = {\n  filePath: string;\n  mediaType?: 'photo' | 'video' | 'audio' | 'document';\n  caption?: string;\n};\n\n// Detect media type from file extension\nfunction detectMediaType(filePath: string): 'photo' | 'video' | 'audio' | 'document' {\n  const ext = filePath.split('.').pop()?.toLowerCase();\n  const imageExts = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp'];\n  const videoExts = ['mp4', 'mov', 'avi', 'webm', 'mkv'];\n  const audioExts = ['mp3', 'wav', 'ogg', 'm4a', 'flac'];\n\n  if (imageExts.includes(ext || '')) return 'photo';\n  if (videoExts.includes(ext || '')) return 'video';\n  if (audioExts.includes(ext || '')) return 'audio';\n  return 'document';\n}\n\n// Detect MIME type from file extension\nfunction detectMimeType(filePath: string): string {\n  const ext = filePath.split('.').pop()?.toLowerCase();\n  const mimeMap: Record<string, string> = {\n    jpg: 'image/jpeg',\n    jpeg: 'image/jpeg',\n    png: 'image/png',\n    gif: 'image/gif',\n    webp: 'image/webp',\n    bmp: 'image/bmp',\n    svg: 'image/svg+xml',\n    mp4: 'video/mp4',\n    mov: 'video/quicktime',\n    avi: 'video/x-msvideo',\n    webm: 'video/webm',\n    mp3: 'audio/mpeg',\n    wav: 'audio/wav',\n    ogg: 'audio/ogg',\n    m4a: 'audio/mp4',\n    flac: 'audio/flac',\n    pdf: 'application/pdf',\n    doc: 'application/msword',\n    docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',\n    txt: 'text/plain',\n    zip: 'application/zip',\n    rar: 'application/x-rar-compressed',\n  };\n  return mimeMap[ext || ''] || 'application/octet-stream';\n}\n\nexport function createSendMediaTool(\n  workspace: string,\n  bus: MessageBus,\n  getContext: () => MessageContext | null,\n): AgentTool {\n  return {\n    name: 'send_media',\n    description:\n      'Send a media file (photo, video, audio, document) to the current conversation. Relative paths resolve to the current agent workspace (same as read_file).',\n    parameters: SendMediaSchema,\n    label: '📎 Send Media',\n\n    async execute(\n      _toolCallId: string,\n      params: any,\n      _signal?: AbortSignal,\n    ): Promise<AgentToolResult<{}>> {\n      const p = params as SendMediaParams;\n      const ctx = getContext();\n      if (!ctx) {\n        return {\n          content: [{ type: 'text', text: 'Error: No active conversation context' }],\n          details: {},\n        };\n      }\n\n      const resolved = resolvePathUnderWorkspace(p.filePath, workspace);\n      const safety = checkFileSafety('read', resolved);\n      if (!safety.allowed) {\n        return {\n          content: [{ type: 'text', text: `🚫 ${safety.message}` }],\n          details: {},\n        };\n      }\n\n      try {\n        const fileBuffer = await readFile(resolved);\n        const base64 = fileBuffer.toString('base64');\n        const mimeType = detectMimeType(resolved);\n        const mediaType = p.mediaType || detectMediaType(resolved);\n\n        // Create data URL\n        const dataUrl = `data:${mimeType};base64,${base64}`;\n\n        const msg: OutboundMessage = {\n          channel: ctx.channel,\n          chat_id: ctx.chatId,\n          content: p.caption || '',\n          mediaUrl: dataUrl,\n          mediaType,\n        };\n\n        await bus.publishOutbound(msg);\n\n        const fileName = basename(resolved);\n        return {\n          content: [{ type: 'text', text: `✅ Media sent: ${fileName} (${mediaType})` }],\n          details: { filePath: resolved, mediaType },\n        };\n      } catch (error) {\n        const errorMessage = error instanceof Error ? error.message : String(error);\n        return {\n          content: [{ type: 'text', text: `Error sending media: ${errorMessage}` }],\n          details: { error: errorMessage },\n        };\n      }\n    },\n  } as any;\n}\n"],"mappings":";;;;;;AASA,MAAM,kBAAkB,KAAK,OAAO;CAClC,UAAU,KAAK,OAAO,EACpB,aACE,yGACH,CAAC;CACF,WAAW,KAAK,SAAS,KAAK,KAAK;EACjC,OAAO;EACP,OAAO;EACP,OAAO;EACP,UAAU;EACX,EAAE,EAAE,aAAa,0DAA0D,CAAC,CAAC;CAC9E,SAAS,KAAK,SAAS,KAAK,OAAO,EAAE,aAAa,yBAAyB,CAAC,CAAC;CAC9E,CAAC;AAcF,SAAS,gBAAgB,UAA4D;CACnF,MAAM,MAAM,SAAS,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa;CACpD,MAAM,YAAY;EAAC;EAAO;EAAQ;EAAO;EAAO;EAAQ;EAAM;CAC9D,MAAM,YAAY;EAAC;EAAO;EAAO;EAAO;EAAQ;EAAM;CACtD,MAAM,YAAY;EAAC;EAAO;EAAO;EAAO;EAAO;EAAO;AAEtD,KAAI,UAAU,SAAS,OAAO,GAAG,CAAE,QAAO;AAC1C,KAAI,UAAU,SAAS,OAAO,GAAG,CAAE,QAAO;AAC1C,KAAI,UAAU,SAAS,OAAO,GAAG,CAAE,QAAO;AAC1C,QAAO;;AAIT,SAAS,eAAe,UAA0B;AA0BhD,QAAO;EAvBL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,MAAM;EACN,KAAK;EACL,KAAK;EACL,KAAK;EAEO,CAzBF,SAAS,MAAM,IAAI,CAAC,KAAK,EAAE,aAAa,IAyB9B,OAAO;;AAG/B,SAAgB,oBACd,WACA,KACA,YACW;AACX,QAAO;EACL,MAAM;EACN,aACE;EACF,YAAY;EACZ,OAAO;EAEP,MAAM,QACJ,aACA,QACA,SAC8B;GAC9B,MAAM,IAAI;GACV,MAAM,MAAM,YAAY;AACxB,OAAI,CAAC,IACH,QAAO;IACL,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM;KAAyC,CAAC;IAC1E,SAAS,EAAE;IACZ;GAGH,MAAM,WAAW,0BAA0B,EAAE,UAAU,UAAU;GACjE,MAAM,SAAS,gBAAgB,QAAQ,SAAS;AAChD,OAAI,CAAC,OAAO,QACV,QAAO;IACL,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM,MAAM,OAAO;KAAW,CAAC;IACzD,SAAS,EAAE;IACZ;AAGH,OAAI;IAEF,MAAM,UAAS,MADU,SAAS,SAAS,EACjB,SAAS,SAAS;IAC5C,MAAM,WAAW,eAAe,SAAS;IACzC,MAAM,YAAY,EAAE,aAAa,gBAAgB,SAAS;IAG1D,MAAM,UAAU,QAAQ,SAAS,UAAU;IAE3C,MAAM,MAAuB;KAC3B,SAAS,IAAI;KACb,SAAS,IAAI;KACb,SAAS,EAAE,WAAW;KACtB,UAAU;KACV;KACD;AAED,UAAM,IAAI,gBAAgB,IAAI;AAG9B,WAAO;KACL,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,iBAFjB,SAAS,SAEiC,CAAC,IAAI,UAAU;MAAI,CAAC;KAC7E,SAAS;MAAE,UAAU;MAAU;MAAW;KAC3C;YACM,OAAO;IACd,MAAM,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAC3E,WAAO;KACL,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,wBAAwB;MAAgB,CAAC;KACzE,SAAS,EAAE,OAAO,cAAc;KACjC;;;EAGN"}

package/dist/src/agent/tools/skill-manage-tool.js

@@ -2,9 +2,9 @@ import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { createSkillConfigManager } from "../skills/config.js";
 import { applyPatchToContent, atomicWriteUtf8, effectiveAgentWritePolicy, ensureCategorySegment, isPathInsideDir, maxSkillMdChars, maxSupportFileBytes, mutatableSkillOrNull, resolveCreateSkillDir, scanSkillDirOrError, validateSkillMdContent, validateSkillNameSegment, validateSupportingRelativePath } from "../skills/skill-manage-ops.js";
+import { readFile, rm } from "fs/promises";
 import { join } from "path";
 import { existsSync, rmSync } from "fs";
-import { readFile, rm } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/skill-manage-tool.ts
 init_paths();

package/dist/src/agent/tools/workflow-tool.js

@@ -1,6 +1,6 @@
-import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { parseWorkflowScript } from "../workflow/parser.js";
 import "../workflow/index.js";
 import { Type } from "@sinclair/typebox";

package/dist/src/agent/tools/write.js

@@ -1,8 +1,8 @@
 import { checkFileSafety } from "../prompt/safety.js";
 import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
-import { dirname } from "path";
 import { mkdir, writeFile } from "fs/promises";
+import { dirname } from "path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/write.ts
 const MAX_FILE_SIZE = 10 * 1024 * 1024;

package/dist/src/agent/workflow/catalog.js

@@ -1,8 +1,8 @@
 import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { BUILTIN_WORKFLOWS } from "./builtins/index.js";
 import { parseWorkflowScript } from "./parser.js";
-import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 //#region src/agent/workflow/catalog.ts
 /**
 * Catalog for named workflows.

package/dist/src/auth/credentials.d.ts

@@ -81,6 +81,13 @@ export declare class CredentialResolver {
      * Load the raw OAuth token record, including expired tokens for status UIs.
      */
     loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null>;
+    /**
+     * List persisted OAuth tokens without exposing access/refresh values.
+     */
+    listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & {
+        hasAccess: boolean;
+        hasRefresh: boolean;
+    }>>;
     /**
      * Save OAuth token for a provider.
      */

package/dist/src/auth/credentials.js

@@ -1,11 +1,11 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
+import { mkdir, readFile, readdir, rm } from "fs/promises";
 import { dirname, join } from "path";
-import { mkdir, readFile, rm } from "fs/promises";
 //#region src/auth/credentials.ts
 function getCredentialResolver(options) {
 	return new CredentialResolver(options);
@@ -186,6 +186,36 @@ var init_credentials = __esmMin((() => {
 			}
 		}
 		/**
+		* List persisted OAuth tokens without exposing access/refresh values.
+		*/
+		async listOAuthTokens() {
+			const oauthDir = join(this.credentialsDir, "oauth");
+			let files;
+			try {
+				files = await readdir(oauthDir);
+			} catch {
+				return [];
+			}
+			const tokens = [];
+			for (const file of files) {
+				if (!file.endsWith(".json")) continue;
+				try {
+					const content = await readFile(join(oauthDir, file), "utf-8");
+					const token = JSON.parse(content);
+					if (token.type !== "oauth" || !token.provider) continue;
+					const { access, refresh, ...safe } = token;
+					tokens.push({
+						...safe,
+						hasAccess: Boolean(access?.trim()),
+						hasRefresh: Boolean(refresh?.trim())
+					});
+				} catch {
+					continue;
+				}
+			}
+			return tokens.sort((a, b) => a.provider.localeCompare(b.provider));
+		}
+		/**
 		* Save OAuth token for a provider.
 		*/
 		async saveOAuthToken(provider, token) {
@@ -214,7 +244,10 @@ var init_credentials = __esmMin((() => {
 		*/
 		async deleteProviderCredential(provider) {
 			const normalizedProvider = provider.toLowerCase();
-			await this.deleteProfile(`${normalizedProvider}:default`);
+			const file = await this.loadAuthProfilesFile();
+			await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });
+			for (const [profileId, profile] of Object.entries(file.profiles)) if (profile.provider === normalizedProvider) delete file.profiles[profileId];
+			await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));
 			await this.deleteOAuthToken(normalizedProvider);
 		}
 		async loadFromAgentCredentials(provider) {

package/dist/src/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    await this.deleteProfile(`${normalizedProvider}:default`);\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAwaA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBArbsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;AACjD,SAAM,KAAK,cAAc,GAAG,mBAAmB,UAAU;AACzD,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm, readdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * List persisted OAuth tokens without exposing access/refresh values.\n   */\n  async listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }>> {\n    const oauthDir = join(this.credentialsDir, 'oauth');\n    let files: string[];\n    try {\n      files = await readdir(oauthDir);\n    } catch {\n      return [];\n    }\n\n    const tokens: Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }> = [];\n    for (const file of files) {\n      if (!file.endsWith('.json')) continue;\n      try {\n        const content = await readFile(join(oauthDir, file), 'utf-8');\n        const token = JSON.parse(content) as OAuthToken;\n        if (token.type !== 'oauth' || !token.provider) continue;\n        const { access, refresh, ...safe } = token;\n        tokens.push({ ...safe, hasAccess: Boolean(access?.trim()), hasRefresh: Boolean(refresh?.trim()) });\n      } catch {\n        continue;\n      }\n    }\n    return tokens.sort((a, b) => a.provider.localeCompare(b.provider));\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const file = await this.loadAuthProfilesFile();\n    await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });\n    for (const [profileId, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        delete file.profiles[profileId];\n      }\n    }\n    await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AA2cA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBAxdsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,kBAAwH;GAC5H,MAAM,WAAW,KAAK,KAAK,gBAAgB,QAAQ;GACnD,IAAI;AACJ,OAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;WACzB;AACN,WAAO,EAAE;;GAGX,MAAM,SAAsG,EAAE;AAC9G,QAAK,MAAM,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,QAAQ,CAAE;AAC7B,QAAI;KACF,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,EAAE,QAAQ;KAC7D,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,SAAI,MAAM,SAAS,WAAW,CAAC,MAAM,SAAU;KAC/C,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;AACrC,YAAO,KAAK;MAAE,GAAG;MAAM,WAAW,QAAQ,QAAQ,MAAM,CAAC;MAAE,YAAY,QAAQ,SAAS,MAAM,CAAC;MAAE,CAAC;YAC5F;AACN;;;AAGJ,UAAO,OAAO,MAAM,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,SAAS,CAAC;;;;;EAMpE,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,SAAM,MAAM,QAAQ,yBAAyB,CAAC,EAAE,EAAE,WAAW,MAAM,CAAC;AACpE,QAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,KAAK,SAAS,CAC9D,KAAI,QAAQ,aAAa,mBACvB,QAAO,KAAK,SAAS;AAGzB,SAAM,gBAAgB,yBAAyB,EAAE,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC/E,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}

package/dist/src/auth/index.d.ts

@@ -1,3 +1,3 @@
 export * from './credentials.js';
 export { anthropicOAuthProvider } from './oauth/anthropic.js';
-export type { OAuthLoginCallbacks } from './oauth/types.js';
+export type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './oauth/types.js';

package/dist/src/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/auth/index.ts"],"sourcesContent":["export * from './credentials.js';\nexport { anthropicOAuthProvider } from './oauth/anthropic.js';\nexport type { OAuthLoginCallbacks } from './oauth/types.js';\n"],"mappings":""}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/auth/index.ts"],"sourcesContent":["export * from './credentials.js';\nexport { anthropicOAuthProvider } from './oauth/anthropic.js';\nexport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './oauth/types.js';\n"],"mappings":""}

package/dist/src/auth/oauth/github-copilot.d.ts

@@ -1,4 +1,4 @@
 /**
- * GitHub Copilot OAuth — delegated to @earendil-works/pi-ai (device code flow).
+ * GitHub Copilot OAuth device code flow.
  */
 export { githubCopilotOAuthProvider, getGitHubCopilotBaseUrl, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken, } from '@earendil-works/pi-ai/oauth';

package/dist/src/auth/oauth/google-antigravity.d.ts

@@ -1,6 +1,4 @@
 /**
  * Google Antigravity OAuth.
- * Implementation is vendored under `vendor-pi-google/` — upstream removed these exports from
- * `@earendil-works/pi-ai/oauth` while keeping the same OAuth credential shape.
  */
-export { antigravityOAuthProvider as googleAntigravityOAuthProvider, loginAntigravity, refreshAntigravityToken, } from './vendor-pi-google/google-antigravity.js';
+export { antigravityOAuthProvider as googleAntigravityOAuthProvider, loginAntigravity, refreshAntigravityToken, } from './google-oauth/google-antigravity.js';

package/dist/src/auth/oauth/google-antigravity.js

@@ -1,2 +1,2 @@
-import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./vendor-pi-google/google-antigravity.js";
+import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-oauth/google-antigravity.js";
 export { antigravityOAuthProvider as googleAntigravityOAuthProvider, loginAntigravity, refreshAntigravityToken };

package/dist/src/auth/oauth/google-gemini-cli.d.ts

@@ -1,6 +1,4 @@
 /**
  * Google Gemini CLI (Cloud Code Assist) OAuth.
- * Implementation is vendored under `vendor-pi-google/` — upstream removed these exports from
- * `@earendil-works/pi-ai/oauth` while keeping the same OAuth credential shape.
  */
-export { geminiCliOAuthProvider as googleGeminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken, } from './vendor-pi-google/google-gemini-cli.js';
+export { geminiCliOAuthProvider as googleGeminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken, } from './google-oauth/google-gemini-cli.js';

package/dist/src/auth/oauth/google-gemini-cli.js

@@ -1,2 +1,2 @@
-import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./vendor-pi-google/google-gemini-cli.js";
+import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-oauth/google-gemini-cli.js";
 export { geminiCliOAuthProvider as googleGeminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken };