anypick 1.0.0 → 1.1.0

package/dist/providers/kiro.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kiro.js","names":[],"sources":["../../src/providers/kiro.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { join } from 'node:path';\nimport { homedir } from 'node:os';\nimport type {\n  Account,\n  AccountMeta,\n  CredentialInput,\n  CredentialInputField,\n  LiveAuthStatus,\n  Provider,\n  ProxyContext,\n  ProxyHandle,\n  ProxyStatus,\n  SnapshotMeta,\n  SourceAdapter,\n} from '../types';\nimport { kiroAccountAdapter, poolAdapterFor } from '../sources/account-adapters';\nimport { KIRO_PROXY_BINARIES, resolveKiroProxyCommand } from '../sources/kiro-proxy-bin';\nimport {\n  copyFileSafe,\n  ensureDir,\n  pathExists,\n  readJsonFile,\n  removePath,\n  restoreRequiredFile,\n  writeJsonFile,\n} from '../utils/fs';\nimport { AnyPickError } from '../utils/errors';\nimport {\n  clearKiroSecrets,\n  kiroSecretIdentity,\n  readKiroSecrets,\n  writeKiroSecrets,\n  type KiroSecrets,\n} from './kiro-secret-store';\nimport {\n  readExternalProxyLogs,\n  startExternalProxy,\n  statusExternalProxy,\n  stopExternalProxy,\n} from './proxy-process';\nimport { snapshotMatchesLiveByFiles } from './auth-fingerprint';\nimport { rolesFromLiveDiscovery } from './model-policy';\n\n/**\n * AWS Kiro (CLI + IDE social/Builder ID session tokens)\n *\n * A Kiro login has two possible homes and a machine can hold both:\n *   - kiro-cli 2.x keeps it in a secret store (see `kiro-secret-store.ts`)\n *   - the Kiro IDE and older kiro-cli write ~/.aws/sso/cache/*.json\n *\n * The IDE's filenames are SHA-1 hashes of the SSO session, not the two names\n * kiro-cli used, so files are recognised by *shape* rather than by name — that\n * also skips the client-registration files sitting in the same directory, which\n * carry a clientId but no token.\n *\n * Compatibility proxy: `kirolink` (Anthropic + OpenAI → Kiro API).\n */\n\n/** Snapshot member holding the secret store; never a token file itself. */\nconst SECRETS_FILE = 'kiro-secret-store.json';\n\n/**\n * Snapshot member holding a user-supplied Kiro API key. Its presence is what\n * makes the account `proxy-only`: nothing on this machine reads it, only the\n * proxy this account starts.\n */\nconst API_KEY_FILE = 'kiro-api-key.json';\n\ntype ApiKeySnapshot = { kiroApiKey: string; apiRegion?: string };\n\n/** Mirrors kirolink's own floor for `KIROLINK_KIRO_API_KEY`. */\nconst MIN_API_KEY_BYTES = 16;\n\n/**\n * Kiro runtime regions kirolink knows about, mirroring its own setup wizard.\n * The region selects the data-plane host (`runtime.<region>.kiro.dev`), so a\n * wrong one starts fine and then fails every request — offer the list rather\n * than a text box.\n */\nconst API_REGIONS = ['us-east-1', 'eu-central-1', 'ap-southeast-1', 'ap-northeast-1'] as const;\n\nconst DEFAULT_PORT = 4119;\n\ntype TokenFile = { name: string; path: string; expiresAt: number };\n\n/**\n * True for an SSO cache entry that carries a credential.\n *\n * Deliberately just \"has an access token\": that is already enough to exclude\n * the client-registration files sharing the directory, which hold a clientId\n * and an expiry but never a token. Demanding more — a profileArn, a parseable\n * expiry — would risk rejecting a real Kiro IDE token whose shape differs, and\n * failing to see a login is the bug this scan exists to fix.\n */\nfunction looksLikeToken(data: Record<string, unknown>): boolean {\n  const accessToken = data.accessToken ?? data.access_token;\n  return typeof accessToken === 'string' && accessToken.length > 0;\n}\n\nexport class KiroProvider implements Provider {\n  readonly id = 'kiro';\n  readonly name = 'AWS Kiro';\n  readonly shortName = 'Kiro';\n  readonly description =\n    'Manages the kiro-cli secret store and ~/.aws/sso/cache (+ optional kirolink proxy)';\n  readonly defaultProxyPort = DEFAULT_PORT;\n  readonly proxyCompatibility = 'Anthropic + OpenAI API';\n\n  roleDefaults(): Record<string, string> {\n    return rolesFromLiveDiscovery();\n  }\n\n  roleFriendlyModels(): readonly string[] {\n    return [\n      'claude-sonnet-5',\n      'claude-opus-5',\n      'claude-haiku-4-5',\n      'claude-sonnet',\n      'claude-opus',\n      'claude-haiku',\n    ];\n  }\n\n  constructor(private readonly home = homedir()) {}\n\n  sourceAdapter(account: Account): SourceAdapter {\n    return kiroAccountAdapter(account);\n  }\n\n  poolSourceAdapter(): SourceAdapter {\n    // Kiro is served by the external `kirolink` bridge, not the builtin proxy.\n    return poolAdapterFor(this.id, this, { proxyTransport: 'managed_external_proxy' });\n  }\n\n  private get cacheDir(): string {\n    return process.env.KIRO_SSO_CACHE_DIR ?? join(this.home, '.aws', 'sso', 'cache');\n  }\n\n  private livePath(file: string): string {\n    return join(this.cacheDir, file);\n  }\n\n  /** Cache entries that carry a credential, freshest first. */\n  private async liveTokenFiles(): Promise<TokenFile[]> {\n    const { readdir } = await import('node:fs/promises');\n    let entries: string[];\n    try {\n      entries = await readdir(this.cacheDir);\n    } catch {\n      return [];\n    }\n\n    const found: TokenFile[] = [];\n    for (const name of entries) {\n      if (!name.endsWith('.json')) {\n        continue;\n      }\n      const path = this.livePath(name);\n      try {\n        const data = await readJsonFile<Record<string, unknown>>(path);\n        if (!looksLikeToken(data)) {\n          continue;\n        }\n        const raw = data.expiresAt ?? data.expires_at;\n        const at = typeof raw === 'string' ? new Date(raw).getTime() : Number.NaN;\n        found.push({ name, path, expiresAt: Number.isFinite(at) ? at : 0 });\n      } catch {\n        // Unreadable or not JSON: not a credential.\n      }\n    }\n    return found.sort((a, b) => b.expiresAt - a.expiresAt);\n  }\n\n  /** Token files a snapshot carries, by their original cache-dir names. */\n  private async snapshotTokenFiles(srcDir: string): Promise<string[]> {\n    const { readdir } = await import('node:fs/promises');\n    try {\n      return (await readdir(srcDir)).filter(\n        (name) => name !== SECRETS_FILE && name !== API_KEY_FILE,\n      );\n    } catch {\n      return [];\n    }\n  }\n\n  async detectLive(): Promise<LiveAuthStatus> {\n    const [secrets, files] = await Promise.all([readKiroSecrets(this.home), this.liveTokenFiles()]);\n\n    const where: string[] = [];\n    if (Object.keys(secrets).length > 0) {\n      where.push('kiro-cli secret store');\n    }\n    where.push(...files.map((file) => file.name));\n\n    if (where.length === 0) {\n      return { present: false };\n    }\n\n    const identity =\n      kiroSecretIdentity(secrets) ?? (await identityFrom(files.map((file) => file.path)));\n\n    return { present: true, identity, details: where.join(', ') };\n  }\n\n  async snapshotMatchesLive(snapshotDir: string): Promise<boolean> {\n    // An API key is never on disk as a Kiro login, and its snapshot carries no\n    // token files — which the file comparison below would read as a vacuous\n    // match, marking every api-key account live.\n    if (await readApiKeyFile(join(snapshotDir, API_KEY_FILE))) {\n      return false;\n    }\n\n    const snapshotSecrets = await readSecretsFile(join(snapshotDir, SECRETS_FILE));\n    if (snapshotSecrets) {\n      // The secret store is what kiro-cli actually reads, so when a snapshot has\n      // one it decides the answer on its own — a leftover cache file from an\n      // older login must not make a live account look stale, or the reverse.\n      return sameSecrets(snapshotSecrets, await readKiroSecrets(this.home));\n    }\n\n    const names = await this.snapshotTokenFiles(snapshotDir);\n    return snapshotMatchesLiveByFiles(\n      names.map((name) => ({\n        name,\n        livePath: this.livePath(name),\n        snapshotPath: join(snapshotDir, name),\n      })),\n    );\n  }\n\n  readonly credentialInputs = ['api-key'] as const;\n\n  credentialInputFields(kind: string): readonly CredentialInputField[] {\n    if (kind !== 'api-key') {\n      return [];\n    }\n    return [{ name: 'region', label: 'API region', choices: API_REGIONS, default: API_REGIONS[0] }];\n  }\n\n  /**\n   * Save a Kiro API key (`ksk_…`) as an account. There is no live login to read\n   * and nothing to restore later: the key only ever reaches the Kiro runtime\n   * through `kirolink`, which this account's proxy starts in `api-key` mode.\n   */\n  async backupInput(input: CredentialInput, destDir: string): Promise<SnapshotMeta> {\n    if (input.kind !== 'api-key') {\n      throw new AnyPickError(\n        `AWS Kiro does not accept a ${input.kind} credential.`,\n        'UNSUPPORTED_CREDENTIAL_INPUT',\n      );\n    }\n    const kiroApiKey = input.secret.trim();\n    if (!kiroApiKey) {\n      throw new AnyPickError('The Kiro API key is empty.', 'INVALID_CREDENTIAL');\n    }\n    // kirolink refuses a shorter key, and it refuses it at proxy start — which\n    // is long after the point where the user could still see what they typed.\n    if (Buffer.byteLength(kiroApiKey) < MIN_API_KEY_BYTES) {\n      throw new AnyPickError(\n        `That Kiro API key is too short to be valid (needs at least ${MIN_API_KEY_BYTES} characters).`,\n        {\n          code: 'INVALID_CREDENTIAL',\n          suggestions: ['Copy the whole key, including its ksk_ prefix.'],\n        },\n      );\n    }\n\n    const apiRegion = input.options?.region?.trim() || undefined;\n    // The region becomes a hostname (`runtime.<region>.kiro.dev`), so a shape\n    // kirolink would refuse has to fail here. At proxy start it is a line in a\n    // log file nobody is watching.\n    if (apiRegion && !/^[a-z0-9-]+$/u.test(apiRegion)) {\n      throw new AnyPickError(`\"${apiRegion}\" is not a valid Kiro API region.`, {\n        code: 'INVALID_CREDENTIAL',\n        suggestions: [`Known regions: ${API_REGIONS.join(', ')}.`],\n      });\n    }\n    await ensureDir(destDir);\n    const snapshot: ApiKeySnapshot = { kiroApiKey, apiRegion };\n    await writeJsonFile(join(destDir, API_KEY_FILE), snapshot);\n\n    return { identity: apiKeyIdentity(kiroApiKey), credentialKind: 'proxy-only' };\n  }\n\n  async backup(\n    destDir: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    await ensureDir(destDir);\n    const [secrets, files] = await Promise.all([readKiroSecrets(this.home), this.liveTokenFiles()]);\n\n    let saved = 0;\n    if (Object.keys(secrets).length > 0) {\n      await writeJsonFile(join(destDir, SECRETS_FILE), secrets);\n      saved += 1;\n    }\n\n    const copied: string[] = [];\n    for (const file of files) {\n      if (await copyFileSafe(file.path, join(destDir, file.name))) {\n        saved += 1;\n        copied.push(join(destDir, file.name));\n      }\n    }\n\n    const identity = kiroSecretIdentity(secrets) ?? (await identityFrom(copied));\n\n    if (saved === 0) {\n      throw new AnyPickError(\n        `No Kiro login found in the kiro-cli secret store or ${this.cacheDir}. Run kiro-cli login first.`,\n        'NO_LIVE_AUTH',\n      );\n    }\n\n    return { identity };\n  }\n\n  async restore(srcDir: string): Promise<void> {\n    // Core already skips restore for a proxy-only account; this also holds for\n    // any other caller, because writing an empty secret store and pruning the\n    // cache would wipe a real login to activate a key that never lived there.\n    if (await readApiKeyFile(join(srcDir, API_KEY_FILE))) {\n      return;\n    }\n\n    const secrets = await readSecretsFile(join(srcDir, SECRETS_FILE));\n    const names = await this.snapshotTokenFiles(srcDir);\n    if (!secrets && names.length === 0) {\n      throw new AnyPickError(`Kiro snapshot has no credentials in ${srcDir}`, 'EMPTY_SNAPSHOT');\n    }\n\n    // Another account's cache file left in place would still be picked up — the\n    // proxy chooses by expiry, not by name — so the switch has to remove what it\n    // is not restoring rather than just overwriting.\n    for (const file of await this.liveTokenFiles()) {\n      if (!names.includes(file.name)) {\n        await removePath(file.path);\n      }\n    }\n\n    await ensureDir(this.cacheDir);\n    for (const name of names) {\n      await restoreRequiredFile(join(srcDir, name), this.livePath(name), name);\n    }\n\n    await writeKiroSecrets(secrets ?? {}, this.home);\n  }\n\n  async describeSnapshot(\n    srcDir: string,\n  ): Promise<Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes'>>> {\n    const apiKey = await readApiKeyFile(join(srcDir, API_KEY_FILE));\n    if (apiKey) {\n      return { identity: apiKeyIdentity(apiKey.kiroApiKey) };\n    }\n\n    const secrets = await readSecretsFile(join(srcDir, SECRETS_FILE));\n    const names = await this.snapshotTokenFiles(srcDir);\n    const identity =\n      (secrets ? kiroSecretIdentity(secrets) : undefined) ??\n      (await identityFrom(names.map((name) => join(srcDir, name))));\n    return identity ? { identity } : {};\n  }\n\n  /**\n   * Remove the local Kiro login only — does NOT call AWS/Kiro logout.\n   */\n  async clearLive(): Promise<void> {\n    for (const file of await this.liveTokenFiles()) {\n      await removePath(file.path);\n    }\n    await clearKiroSecrets(this.home);\n  }\n\n  // ── Proxy (kirolink) ────────────────────────────────────────────\n\n  async startProxy(ctx: ProxyContext): Promise<ProxyHandle> {\n    // Force kirolink onto the credential this binding activated. Left to its own\n    // saved config it may run in a mode against an unrelated Kiro credential, so\n    // the proxy would serve a different identity than the account the user\n    // bound — silently, since it still starts and answers /health. These are\n    // environment overrides, which kirolink applies for the run without writing\n    // them back, so a bare `kirolink` outside AnyPick keeps the user's own mode.\n    const apiKey = await readApiKeyFile(join(ctx.snapshotDir, API_KEY_FILE));\n    const authMode: Record<string, string> = apiKey\n      ? {\n          KIROLINK_AUTH: 'api-key',\n          KIROLINK_KIRO_API_KEY: apiKey.kiroApiKey,\n          ...(apiKey.apiRegion ? { KIROLINK_API_REGION: apiKey.apiRegion } : {}),\n        }\n      : { KIROLINK_AUTH: 'cli' };\n\n    const tokenPath = apiKey ? undefined : await this.resolveTokenPath();\n\n    // Discovery is shared with the capability gate (spec §19.5) so a machine\n    // that classified `managed_external_proxy` cannot then fail to spawn:\n    //   - KIROLINK_BIN  : explicit binary override (full path or alias)\n    //   - KIROLINK_JS   : run a JS entry via `node` (no shebang exec needed)\n    //   - PATH + derived package-manager / user-local bin dirs otherwise\n    const env = () => ({\n      ...process.env,\n      ...authMode,\n      ...(tokenPath ? { KIRO_PROXY_TOKEN_PATH: tokenPath } : {}),\n    });\n    const command = resolveKiroProxyCommand();\n\n    if (command?.kind === 'node-entry') {\n      return startExternalProxy(ctx, {\n        label: 'Kiro',\n        binaries: ['node'],\n        defaultPort: DEFAULT_PORT,\n        compatibility: this.proxyCompatibility,\n        buildArgs: (_c, port, host) => [command.entry, '-p', String(port), '--host', host],\n        env,\n      });\n    }\n\n    return startExternalProxy(ctx, {\n      label: 'Kiro',\n      // A resolved path is passed as the sole binary so `startExternalProxy`\n      // spawns exactly what the gate saw; the name list is the fallback when\n      // discovery returned nothing (its error names all the tried names).\n      binaries: command ? [command.path] : [...KIRO_PROXY_BINARIES],\n      defaultPort: DEFAULT_PORT,\n      compatibility: this.proxyCompatibility,\n      buildArgs: (_c, port, host) => ['-p', String(port), '--host', host],\n      env,\n    });\n  }\n\n  async stopProxy(ctx: ProxyContext): Promise<void> {\n    await stopExternalProxy(ctx);\n  }\n\n  async proxyStatus(ctx: ProxyContext): Promise<ProxyStatus> {\n    const status = await statusExternalProxy(ctx, {\n      compatibility: this.proxyCompatibility,\n    });\n    // Fill endpoint from defaults when running but port was defaulted\n    if (status.running && !status.endpoint) {\n      const host = ctx.config.host ?? '127.0.0.1';\n      const port = ctx.config.port ?? DEFAULT_PORT;\n      status.endpoint = `http://${host}:${port}`;\n    }\n    return status;\n  }\n\n  async readProxyLogs(ctx: ProxyContext, lines?: number): Promise<string> {\n    return readExternalProxyLogs(ctx, lines);\n  }\n\n  /**\n   * Pin the proxy to a cache file only when the secret store is empty. A pin is\n   * an override that stops kirolink searching, so pinning while kiro-cli holds\n   * the real login would force the proxy onto a stale file.\n   */\n  private async resolveTokenPath(): Promise<string | undefined> {\n    if (Object.keys(await readKiroSecrets(this.home)).length > 0) {\n      return undefined;\n    }\n    const [freshest] = await this.liveTokenFiles();\n    return freshest?.path;\n  }\n}\n\nasync function readApiKeyFile(path: string): Promise<ApiKeySnapshot | null> {\n  if (!(await pathExists(path))) {\n    return null;\n  }\n  try {\n    const data = await readJsonFile<Record<string, unknown>>(path);\n    if (typeof data.kiroApiKey !== 'string' || !data.kiroApiKey) {\n      return null;\n    }\n    return {\n      kiroApiKey: data.kiroApiKey,\n      apiRegion: typeof data.apiRegion === 'string' ? data.apiRegion : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * A stable name for an API key that does not disclose it. A key carries no\n * email, and the raw value must not become an account identity — identities are\n * printed, exported, and stored in meta.\n */\nfunction apiKeyIdentity(kiroApiKey: string): string {\n  return `api-key:${createHash('sha256').update(kiroApiKey).digest('hex').slice(0, 12)}`;\n}\n\nasync function readSecretsFile(path: string): Promise<KiroSecrets | null> {\n  if (!(await pathExists(path))) {\n    return null;\n  }\n  try {\n    const data = await readJsonFile<Record<string, unknown>>(path);\n    const secrets: KiroSecrets = {};\n    for (const [key, value] of Object.entries(data)) {\n      if (typeof value === 'string') {\n        secrets[key] = value;\n      }\n    }\n    return secrets;\n  } catch {\n    return null;\n  }\n}\n\nfunction sameSecrets(a: KiroSecrets, b: KiroSecrets): boolean {\n  const keys = Object.keys(a);\n  return keys.length === Object.keys(b).length && keys.every((key) => a[key] === b[key]);\n}\n\n/**\n * A name for the account a token file belongs to, or undefined when the file\n * carries nothing identifying.\n *\n * The placeholder for \"a token with no identity in it\" is applied by\n * `identityFrom` rather than here: cache filenames are content hashes, so the\n * scan order is arbitrary, and returning the placeholder early would let it win\n * over a real identity sitting in the next file.\n */\nasync function tryIdentity(path: string): Promise<string | undefined> {\n  try {\n    const data = await readJsonFile<Record<string, unknown>>(path);\n    for (const key of ['email', 'username', 'startUrl', 'clientId', 'provider']) {\n      if (typeof data[key] === 'string' && data[key]) {\n        return data[key];\n      }\n    }\n    const arn = data.profileArn ?? data.profile_arn;\n    if (typeof arn === 'string') {\n      return arn.split('/').pop() ?? undefined;\n    }\n  } catch {\n    // ignore\n  }\n  return undefined;\n}\n\n/** The best identity across some token files, falling back to a placeholder. */\nasync function identityFrom(paths: string[]): Promise<string | undefined> {\n  for (const path of paths) {\n    const identity = await tryIdentity(path);\n    if (identity) {\n      return identity;\n    }\n  }\n  return paths.length > 0 ? 'session-token' : undefined;\n}\n\nexport const kiroProvider = new KiroProvider();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,IAAM,eAAe;;;;;;AAOrB,IAAM,eAAe;;AAKrB,IAAM,oBAAoB;;;;;;;AAQ1B,IAAM,cAAc;CAAC;CAAa;CAAgB;CAAkB;AAAgB;AAEpF,IAAM,eAAe;;;;;;;;;;AAarB,SAAS,eAAe,MAAwC;CAC9D,MAAM,cAAc,KAAK,eAAe,KAAK;CAC7C,OAAO,OAAO,gBAAgB,YAAY,YAAY,SAAS;AACjE;AAEA,IAAa,eAAb,MAA8C;CAwBf;CAvB7B,KAAc;CACd,OAAgB;CAChB,YAAqB;CACrB,cACE;CACF,mBAA4B;CAC5B,qBAA8B;CAE9B,eAAuC;EACrC,OAAO,uBAAuB;CAChC;CAEA,qBAAwC;EACtC,OAAO;GACL;GACA;GACA;GACA;GACA;GACA;EACF;CACF;CAEA,YAAY,OAAwB,QAAQ,GAAG;EAAlB,KAAA,OAAA;CAAmB;CAEhD,cAAc,SAAiC;EAC7C,OAAO,mBAAmB,OAAO;CACnC;CAEA,oBAAmC;EAEjC,OAAO,eAAe,KAAK,IAAI,MAAM,EAAE,gBAAgB,yBAAyB,CAAC;CACnF;CAEA,IAAY,WAAmB;EAC7B,OAAO,QAAQ,IAAI,sBAAsB,KAAK,KAAK,MAAM,QAAQ,OAAO,OAAO;CACjF;CAEA,SAAiB,MAAsB;EACrC,OAAO,KAAK,KAAK,UAAU,IAAI;CACjC;;CAGA,MAAc,iBAAuC;EACnD,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,KAAK,QAAQ;EACvC,QAAQ;GACN,OAAO,CAAC;EACV;EAEA,MAAM,QAAqB,CAAC;EAC5B,KAAK,MAAM,QAAQ,SAAS;GAC1B,IAAI,CAAC,KAAK,SAAS,OAAO,GACxB;GAEF,MAAM,OAAO,KAAK,SAAS,IAAI;GAC/B,IAAI;IACF,MAAM,OAAO,MAAM,aAAsC,IAAI;IAC7D,IAAI,CAAC,eAAe,IAAI,GACtB;IAEF,MAAM,MAAM,KAAK,aAAa,KAAK;IACnC,MAAM,KAAK,OAAO,QAAQ,WAAW,IAAI,KAAK,GAAG,CAAC,CAAC,QAAQ,IAAI;IAC/D,MAAM,KAAK;KAAE;KAAM;KAAM,WAAW,OAAO,SAAS,EAAE,IAAI,KAAK;IAAE,CAAC;GACpE,QAAQ,CAER;EACF;EACA,OAAO,MAAM,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;CACvD;;CAGA,MAAc,mBAAmB,QAAmC;EAClE,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,IAAI;GACF,QAAQ,MAAM,QAAQ,MAAM,EAAA,CAAG,QAC5B,SAAS,SAAS,gBAAgB,SAAS,YAC9C;EACF,QAAQ;GACN,OAAO,CAAC;EACV;CACF;CAEA,MAAM,aAAsC;EAC1C,MAAM,CAAC,SAAS,SAAS,MAAM,QAAQ,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC,CAAC;EAE9F,MAAM,QAAkB,CAAC;EACzB,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAChC,MAAM,KAAK,uBAAuB;EAEpC,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;EAE5C,IAAI,MAAM,WAAW,GACnB,OAAO,EAAE,SAAS,MAAM;EAM1B,OAAO;GAAE,SAAS;GAAM,UAFtB,mBAAmB,OAAO,KAAM,MAAM,aAAa,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;GAEjD,SAAS,MAAM,KAAK,IAAI;EAAE;CAC9D;CAEA,MAAM,oBAAoB,aAAuC;EAI/D,IAAI,MAAM,eAAe,KAAK,aAAa,YAAY,CAAC,GACtD,OAAO;EAGT,MAAM,kBAAkB,MAAM,gBAAgB,KAAK,aAAa,YAAY,CAAC;EAC7E,IAAI,iBAIF,OAAO,YAAY,iBAAiB,MAAM,gBAAgB,KAAK,IAAI,CAAC;EAItE,OAAO,4BACL,MAFkB,KAAK,mBAAmB,WAAW,EAAA,CAE/C,KAAK,UAAU;GACnB;GACA,UAAU,KAAK,SAAS,IAAI;GAC5B,cAAc,KAAK,aAAa,IAAI;EACtC,EAAE,CACJ;CACF;CAEA,mBAA4B,CAAC,SAAS;CAEtC,sBAAsB,MAA+C;EACnE,IAAI,SAAS,WACX,OAAO,CAAC;EAEV,OAAO,CAAC;GAAE,MAAM;GAAU,OAAO;GAAc,SAAS;GAAa,SAAS,YAAY;EAAG,CAAC;CAChG;;;;;;CAOA,MAAM,YAAY,OAAwB,SAAwC;EAChF,IAAI,MAAM,SAAS,WACjB,MAAM,IAAI,aACR,8BAA8B,MAAM,KAAK,eACzC,8BACF;EAEF,MAAM,aAAa,MAAM,OAAO,KAAK;EACrC,IAAI,CAAC,YACH,MAAM,IAAI,aAAa,8BAA8B,oBAAoB;EAI3E,IAAI,OAAO,WAAW,UAAU,IAAI,mBAClC,MAAM,IAAI,aACR,8DAA8D,kBAAkB,gBAChF;GACE,MAAM;GACN,aAAa,CAAC,gDAAgD;EAChE,CACF;EAGF,MAAM,YAAY,MAAM,SAAS,QAAQ,KAAK,KAAK,KAAA;EAInD,IAAI,aAAa,CAAC,gBAAgB,KAAK,SAAS,GAC9C,MAAM,IAAI,aAAa,IAAI,UAAU,oCAAoC;GACvE,MAAM;GACN,aAAa,CAAC,kBAAkB,YAAY,KAAK,IAAI,EAAE,EAAE;EAC3D,CAAC;EAEH,MAAM,UAAU,OAAO;EACvB,MAAM,WAA2B;GAAE;GAAY;EAAU;EACzD,MAAM,cAAc,KAAK,SAAS,YAAY,GAAG,QAAQ;EAEzD,OAAO;GAAE,UAAU,eAAe,UAAU;GAAG,gBAAgB;EAAa;CAC9E;CAEA,MAAM,OACJ,SACqE;EACrE,MAAM,UAAU,OAAO;EACvB,MAAM,CAAC,SAAS,SAAS,MAAM,QAAQ,IAAI,CAAC,gBAAgB,KAAK,IAAI,GAAG,KAAK,eAAe,CAAC,CAAC;EAE9F,IAAI,QAAQ;EACZ,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAAG;GACnC,MAAM,cAAc,KAAK,SAAS,YAAY,GAAG,OAAO;GACxD,SAAS;EACX;EAEA,MAAM,SAAmB,CAAC;EAC1B,KAAK,MAAM,QAAQ,OACjB,IAAI,MAAM,aAAa,KAAK,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG;GAC3D,SAAS;GACT,OAAO,KAAK,KAAK,SAAS,KAAK,IAAI,CAAC;EACtC;EAGF,MAAM,WAAW,mBAAmB,OAAO,KAAM,MAAM,aAAa,MAAM;EAE1E,IAAI,UAAU,GACZ,MAAM,IAAI,aACR,uDAAuD,KAAK,SAAS,8BACrE,cACF;EAGF,OAAO,EAAE,SAAS;CACpB;CAEA,MAAM,QAAQ,QAA+B;EAI3C,IAAI,MAAM,eAAe,KAAK,QAAQ,YAAY,CAAC,GACjD;EAGF,MAAM,UAAU,MAAM,gBAAgB,KAAK,QAAQ,YAAY,CAAC;EAChE,MAAM,QAAQ,MAAM,KAAK,mBAAmB,MAAM;EAClD,IAAI,CAAC,WAAW,MAAM,WAAW,GAC/B,MAAM,IAAI,aAAa,uCAAuC,UAAU,gBAAgB;EAM1F,KAAK,MAAM,QAAQ,MAAM,KAAK,eAAe,GAC3C,IAAI,CAAC,MAAM,SAAS,KAAK,IAAI,GAC3B,MAAM,WAAW,KAAK,IAAI;EAI9B,MAAM,UAAU,KAAK,QAAQ;EAC7B,KAAK,MAAM,QAAQ,OACjB,MAAM,oBAAoB,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI;EAGzE,MAAM,iBAAiB,WAAW,CAAC,GAAG,KAAK,IAAI;CACjD;CAEA,MAAM,iBACJ,QACqE;EACrE,MAAM,SAAS,MAAM,eAAe,KAAK,QAAQ,YAAY,CAAC;EAC9D,IAAI,QACF,OAAO,EAAE,UAAU,eAAe,OAAO,UAAU,EAAE;EAGvD,MAAM,UAAU,MAAM,gBAAgB,KAAK,QAAQ,YAAY,CAAC;EAChE,MAAM,QAAQ,MAAM,KAAK,mBAAmB,MAAM;EAClD,MAAM,YACH,UAAU,mBAAmB,OAAO,IAAI,KAAA,MACxC,MAAM,aAAa,MAAM,KAAK,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC;EAC7D,OAAO,WAAW,EAAE,SAAS,IAAI,CAAC;CACpC;;;;CAKA,MAAM,YAA2B;EAC/B,KAAK,MAAM,QAAQ,MAAM,KAAK,eAAe,GAC3C,MAAM,WAAW,KAAK,IAAI;EAE5B,MAAM,iBAAiB,KAAK,IAAI;CAClC;CAIA,MAAM,WAAW,KAAyC;EAOxD,MAAM,SAAS,MAAM,eAAe,KAAK,IAAI,aAAa,YAAY,CAAC;EACvE,MAAM,WAAmC,SACrC;GACE,eAAe;GACf,uBAAuB,OAAO;GAC9B,GAAI,OAAO,YAAY,EAAE,qBAAqB,OAAO,UAAU,IAAI,CAAC;EACtE,IACA,EAAE,eAAe,MAAM;EAE3B,MAAM,YAAY,SAAS,KAAA,IAAY,MAAM,KAAK,iBAAiB;EAOnE,MAAM,aAAa;GACjB,GAAG,QAAQ;GACX,GAAG;GACH,GAAI,YAAY,EAAE,uBAAuB,UAAU,IAAI,CAAC;EAC1D;EACA,MAAM,UAAU,wBAAwB;EAExC,IAAI,SAAS,SAAS,cACpB,OAAO,mBAAmB,KAAK;GAC7B,OAAO;GACP,UAAU,CAAC,MAAM;GACjB,aAAa;GACb,eAAe,KAAK;GACpB,YAAY,IAAI,MAAM,SAAS;IAAC,QAAQ;IAAO;IAAM,OAAO,IAAI;IAAG;IAAU;GAAI;GACjF;EACF,CAAC;EAGH,OAAO,mBAAmB,KAAK;GAC7B,OAAO;GAIP,UAAU,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,mBAAmB;GAC5D,aAAa;GACb,eAAe,KAAK;GACpB,YAAY,IAAI,MAAM,SAAS;IAAC;IAAM,OAAO,IAAI;IAAG;IAAU;GAAI;GAClE;EACF,CAAC;CACH;CAEA,MAAM,UAAU,KAAkC;EAChD,MAAM,kBAAkB,GAAG;CAC7B;CAEA,MAAM,YAAY,KAAyC;EACzD,MAAM,SAAS,MAAM,oBAAoB,KAAK,EAC5C,eAAe,KAAK,mBACtB,CAAC;EAED,IAAI,OAAO,WAAW,CAAC,OAAO,UAG5B,OAAO,WAAW,UAFL,IAAI,OAAO,QAAQ,YAEC,GADpB,IAAI,OAAO,QAAQ;EAGlC,OAAO;CACT;CAEA,MAAM,cAAc,KAAmB,OAAiC;EACtE,OAAO,sBAAsB,KAAK,KAAK;CACzC;;;;;;CAOA,MAAc,mBAAgD;EAC5D,IAAI,OAAO,KAAK,MAAM,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,GACzD;EAEF,MAAM,CAAC,YAAY,MAAM,KAAK,eAAe;EAC7C,OAAO,UAAU;CACnB;AACF;AAEA,eAAe,eAAe,MAA8C;CAC1E,IAAI,CAAE,MAAM,WAAW,IAAI,GACzB,OAAO;CAET,IAAI;EACF,MAAM,OAAO,MAAM,aAAsC,IAAI;EAC7D,IAAI,OAAO,KAAK,eAAe,YAAY,CAAC,KAAK,YAC/C,OAAO;EAET,OAAO;GACL,YAAY,KAAK;GACjB,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,KAAA;EACnE;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;;;;AAOA,SAAS,eAAe,YAA4B;CAClD,OAAO,WAAW,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACrF;AAEA,eAAe,gBAAgB,MAA2C;CACxE,IAAI,CAAE,MAAM,WAAW,IAAI,GACzB,OAAO;CAET,IAAI;EACF,MAAM,OAAO,MAAM,aAAsC,IAAI;EAC7D,MAAM,UAAuB,CAAC;EAC9B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,GAC5C,IAAI,OAAO,UAAU,UACnB,QAAQ,OAAO;EAGnB,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,YAAY,GAAgB,GAAyB;CAC5D,MAAM,OAAO,OAAO,KAAK,CAAC;CAC1B,OAAO,KAAK,WAAW,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,QAAQ,EAAE,SAAS,EAAE,IAAI;AACvF;;;;;;;;;;AAWA,eAAe,YAAY,MAA2C;CACpE,IAAI;EACF,MAAM,OAAO,MAAM,aAAsC,IAAI;EAC7D,KAAK,MAAM,OAAO;GAAC;GAAS;GAAY;GAAY;GAAY;EAAU,GACxE,IAAI,OAAO,KAAK,SAAS,YAAY,KAAK,MACxC,OAAO,KAAK;EAGhB,MAAM,MAAM,KAAK,cAAc,KAAK;EACpC,IAAI,OAAO,QAAQ,UACjB,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,KAAA;CAEnC,QAAQ,CAER;AAEF;;AAGA,eAAe,aAAa,OAA8C;CACxE,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,WAAW,MAAM,YAAY,IAAI;EACvC,IAAI,UACF,OAAO;CAEX;CACA,OAAO,MAAM,SAAS,IAAI,kBAAkB,KAAA;AAC9C;AAEA,IAAa,eAAe,IAAI,aAAa"}

package/dist/providers/model-policy.d.ts

@@ -1,15 +0,0 @@
-/**
- * Shared model-policy helpers for providers whose model catalog is account- or
- * upstream-specific.
- *
- * These providers front a proxy that exposes `/v1/models`, so the authoritative
- * list is only knowable at runtime. Declaring the four Claude-Code roles with
- * empty values says "this role applies, fill it from live discovery" — which is
- * meaningfully different from omitting the key (role does not apply) and from
- * inventing a plausible-looking id the account may not be entitled to.
- */
-/** Role ids Claude Code exposes. Other clients use `default` only. */
-export declare const CLAUDE_ROLE_IDS: readonly ['default', 'sonnet', 'opus', 'haiku'];
-/** Four roles, all awaiting live discovery. */
-export declare function rolesFromLiveDiscovery(): Record<string, string>;
-//# sourceMappingURL=model-policy.d.ts.map

package/dist/providers/model-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"model-policy.d.ts","sourceRoot":"","sources":["../../src/providers/model-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,sEAAsE;AACtE,eAAO,MAAM,eAAe,YAAI,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAE/E,+CAA+C;AAC/C,wBAAgB,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE/D"}

package/dist/providers/model-policy.js

@@ -1,26 +0,0 @@
-//#region src/providers/model-policy.ts
-/**
-* Shared model-policy helpers for providers whose model catalog is account- or
-* upstream-specific.
-*
-* These providers front a proxy that exposes `/v1/models`, so the authoritative
-* list is only knowable at runtime. Declaring the four Claude-Code roles with
-* empty values says "this role applies, fill it from live discovery" — which is
-* meaningfully different from omitting the key (role does not apply) and from
-* inventing a plausible-looking id the account may not be entitled to.
-*/
-/** Role ids Claude Code exposes. Other clients use `default` only. */
-var CLAUDE_ROLE_IDS = [
-	"default",
-	"sonnet",
-	"opus",
-	"haiku"
-];
-/** Four roles, all awaiting live discovery. */
-function rolesFromLiveDiscovery() {
-	return Object.fromEntries(CLAUDE_ROLE_IDS.map((r) => [r, ""]));
-}
-//#endregion
-export { CLAUDE_ROLE_IDS, rolesFromLiveDiscovery };
-
-//# sourceMappingURL=model-policy.js.map

package/dist/providers/model-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"model-policy.js","names":[],"sources":["../../src/providers/model-policy.ts"],"sourcesContent":["/**\n * Shared model-policy helpers for providers whose model catalog is account- or\n * upstream-specific.\n *\n * These providers front a proxy that exposes `/v1/models`, so the authoritative\n * list is only knowable at runtime. Declaring the four Claude-Code roles with\n * empty values says \"this role applies, fill it from live discovery\" — which is\n * meaningfully different from omitting the key (role does not apply) and from\n * inventing a plausible-looking id the account may not be entitled to.\n */\n\n/** Role ids Claude Code exposes. Other clients use `default` only. */\nexport const CLAUDE_ROLE_IDS = ['default', 'sonnet', 'opus', 'haiku'] as const;\n\n/** Four roles, all awaiting live discovery. */\nexport function rolesFromLiveDiscovery(): Record<string, string> {\n  return Object.fromEntries(CLAUDE_ROLE_IDS.map((r) => [r, '']));\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAa,kBAAkB;CAAC;CAAW;CAAU;CAAQ;AAAO;;AAGpE,SAAgB,yBAAiD;CAC/D,OAAO,OAAO,YAAY,gBAAgB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AAC/D"}

package/dist/providers/opencode-auth.d.ts

@@ -1,67 +0,0 @@
-/**
- * OpenCode auth.json helpers.
- *
- * OpenCode is a multi-provider CLI (like Codex), not just API keys.
- * Each key in auth.json is a provider id with one of:
- *
- *   oauth:     { type: "oauth", access, refresh, expires, accountId? }
- *   api:       { type: "api", key, metadata? }
- *   wellknown: { type: "wellknown", key, token }
- *
- * ChatGPT Plus/Pro OAuth uses the same OpenAI client_id as Codex.
- * Zen/Go are just `type: "api"` entries under opencode / opencode-go.
- */
-export type OpenCodeAuthEntry = OpenCodeOauthAuth | OpenCodeApiAuth | OpenCodeWellKnownAuth;
-export interface OpenCodeOauthAuth {
-    type: 'oauth';
-    access: string;
-    refresh: string;
-    expires: number;
-    accountId?: string;
-    enterpriseUrl?: string;
-    methodID?: string;
-    metadata?: Record<string, unknown>;
-    [k: string]: unknown;
-}
-export interface OpenCodeApiAuth {
-    type: 'api';
-    key: string;
-    metadata?: Record<string, string>;
-    [k: string]: unknown;
-}
-export interface OpenCodeWellKnownAuth {
-    type: 'wellknown';
-    key: string;
-    token: string;
-    [k: string]: unknown;
-}
-export declare function isAuthEntry(v: unknown): v is OpenCodeAuthEntry;
-export declare function listAuthEntries(data: Record<string, unknown>): Array<{
-    provider: string;
-    entry: OpenCodeAuthEntry;
-}>;
-export declare function hasAnyAuth(data: Record<string, unknown>): boolean;
-/** Summarize credentials for status lines: "openai:oauth, opencode-go:api". */
-export declare function summarizeAuth(data: Record<string, unknown>): string | undefined;
-/**
- * Best-effort identity for display (email / account / short summary).
- * Prefer OAuth email from JWT, then accountId.
- * For API-key bags, do NOT join provider ids as identity — that drifts and
- * breaks live matching. Use a stable short label instead.
- */
-export declare function extractOpenCodeIdentity(data: Record<string, unknown>): string | undefined;
-/** Improve JWT decode for OpenCode (padding-safe base64). */
-export declare function emailFromJwtRobust(token: string | undefined): string | undefined;
-export declare function emailFromJwt(token: string | undefined): string | undefined;
-/**
- * Refresh OpenCode OAuth entries in-place.
- * OpenAI ChatGPT OAuth uses Codex client_id / token URL.
- * Other oauth providers without a known refresh path are left untouched.
- */
-export declare function refreshOpenCodeAuth(data: Record<string, unknown>, fetchFn?: typeof fetch): Promise<{
-    data: Record<string, unknown>;
-    refreshed: string[];
-    skipped: string[];
-    identity?: string;
-}>;
-//# sourceMappingURL=opencode-auth.d.ts.map

package/dist/providers/opencode-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"opencode-auth.d.ts","sourceRoot":"","sources":["../../src/providers/opencode-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,eAAe,GAAG,qBAAqB,CAAC;AAE5F,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,iBAAiB,CAM9D;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAQvD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAEjE;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAM/E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAwCzF;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAmChF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAuB1E;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC,CAsCD"}

package/dist/providers/opencode-auth.js

@@ -1,146 +0,0 @@
-//#region src/providers/opencode-auth.ts
-function isAuthEntry(v) {
-	if (!v || typeof v !== "object") return false;
-	const t = v.type;
-	return t === "oauth" || t === "api" || t === "wellknown";
-}
-function listAuthEntries(data) {
-	const out = [];
-	for (const [provider, raw] of Object.entries(data)) if (isAuthEntry(raw)) out.push({
-		provider,
-		entry: raw
-	});
-	return out;
-}
-function hasAnyAuth(data) {
-	return listAuthEntries(data).length > 0;
-}
-/** Summarize credentials for status lines: "openai:oauth, opencode-go:api". */
-function summarizeAuth(data) {
-	const entries = listAuthEntries(data);
-	if (entries.length === 0) return;
-	return entries.map((e) => `${e.provider}:${e.entry.type}`).join(", ");
-}
-/**
-* Best-effort identity for display (email / account / short summary).
-* Prefer OAuth email from JWT, then accountId.
-* For API-key bags, do NOT join provider ids as identity — that drifts and
-* breaks live matching. Use a stable short label instead.
-*/
-function extractOpenCodeIdentity(data) {
-	const entries = listAuthEntries(data);
-	for (const { provider, entry } of entries) {
-		if (entry.type !== "oauth") continue;
-		const email = emailFromJwtRobust(entry.access) ?? emailFromJwt(entry.access) ?? (typeof entry.metadata?.email === "string" ? entry.metadata.email : void 0);
-		if (email) return email;
-		if (entry.accountId) return `${provider}:${entry.accountId.slice(0, 12)}`;
-	}
-	for (const { provider, entry } of entries) if (entry.type === "oauth" && entry.accountId) return `${provider}:${entry.accountId.slice(0, 12)}`;
-	if (entries.length === 0) return;
-	if (entries.every((e) => e.entry.type === "api")) {
-		if (entries.length === 1) return entries[0].provider;
-		return `${entries.length} api keys`;
-	}
-	return `${entries.length} credentials`;
-}
-/** Improve JWT decode for OpenCode (padding-safe base64). */
-function emailFromJwtRobust(token) {
-	if (!token) return;
-	try {
-		const parts = token.split(".");
-		if (parts.length < 2 || !parts[1]) return;
-		let b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
-		const pad = b64.length % 4;
-		if (pad) b64 += "=".repeat(4 - pad);
-		const payload = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
-		if (typeof payload.email === "string" && payload.email.trim()) return payload.email.trim();
-		if (typeof payload.preferred_username === "string" && payload.preferred_username.trim()) return payload.preferred_username.trim();
-		const profile = payload["https://api.openai.com/profile"];
-		if (profile && typeof profile === "object") {
-			const email = profile.email;
-			if (typeof email === "string" && email.trim()) return email.trim();
-		}
-	} catch {}
-}
-function emailFromJwt(token) {
-	if (!token) return;
-	try {
-		const parts = token.split(".");
-		if (parts.length < 2) return;
-		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-		if (typeof payload.email === "string") return payload.email;
-		if (typeof payload.preferred_username === "string") return payload.preferred_username;
-	} catch {}
-}
-/**
-* Refresh OpenCode OAuth entries in-place.
-* OpenAI ChatGPT OAuth uses Codex client_id / token URL.
-* Other oauth providers without a known refresh path are left untouched.
-*/
-async function refreshOpenCodeAuth(data, fetchFn = fetch) {
-	const next = { ...data };
-	const refreshed = [];
-	const skipped = [];
-	for (const [provider, raw] of Object.entries(data)) {
-		if (!isAuthEntry(raw) || raw.type !== "oauth") continue;
-		if (provider === "openai" || looksLikeOpenAiOauth(raw)) {
-			next[provider] = await refreshOpenAiOauth(raw, fetchFn);
-			refreshed.push(provider);
-			continue;
-		}
-		skipped.push(provider);
-	}
-	if (refreshed.length === 0 && skipped.length > 0) throw new Error(`No refreshable OAuth in OpenCode auth (found: ${skipped.join(", ")}). Re-login: opencode auth login`);
-	if (refreshed.length === 0) throw new Error("No OAuth credentials to refresh. API keys don't need refresh. Login: opencode auth login");
-	return {
-		data: next,
-		refreshed,
-		skipped,
-		identity: extractOpenCodeIdentity(next)
-	};
-}
-function looksLikeOpenAiOauth(entry) {
-	if (typeof entry.methodID === "string" && entry.methodID.includes("chatgpt")) return true;
-	try {
-		const parts = entry.access.split(".");
-		if (parts.length < 2) return false;
-		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-		return Boolean(payload.iss?.includes("openai") || payload.iss?.includes("auth0"));
-	} catch {
-		return false;
-	}
-}
-async function refreshOpenAiOauth(entry, fetchFn) {
-	const { CODEX_OAUTH_TOKEN_URL, CODEX_OAUTH_CLIENT_ID } = await import("./codex-refresh.js");
-	if (!entry.refresh) throw new Error("OpenAI OAuth entry has no refresh token");
-	const res = await fetchFn(CODEX_OAUTH_TOKEN_URL, {
-		method: "POST",
-		headers: {
-			"content-type": "application/x-www-form-urlencoded",
-			accept: "application/json",
-			"user-agent": "anypick-opencode/0.8"
-		},
-		body: new URLSearchParams({
-			grant_type: "refresh_token",
-			refresh_token: entry.refresh,
-			client_id: CODEX_OAUTH_CLIENT_ID
-		})
-	});
-	if (!res.ok) {
-		const text = await res.text().catch(() => "");
-		throw new Error(`OpenCode OpenAI OAuth refresh failed (${res.status}): ${text.slice(0, 240)}`);
-	}
-	const data = await res.json();
-	if (!data.access_token) throw new Error("OpenAI OAuth refresh returned no access_token");
-	return {
-		...entry,
-		type: "oauth",
-		access: data.access_token,
-		refresh: data.refresh_token ?? entry.refresh,
-		expires: Date.now() + (data.expires_in ?? 3600) * 1e3
-	};
-}
-//#endregion
-export { emailFromJwt, emailFromJwtRobust, extractOpenCodeIdentity, hasAnyAuth, isAuthEntry, listAuthEntries, refreshOpenCodeAuth, summarizeAuth };
-
-//# sourceMappingURL=opencode-auth.js.map

package/dist/providers/opencode-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"opencode-auth.js","names":[],"sources":["../../src/providers/opencode-auth.ts"],"sourcesContent":["/**\n * OpenCode auth.json helpers.\n *\n * OpenCode is a multi-provider CLI (like Codex), not just API keys.\n * Each key in auth.json is a provider id with one of:\n *\n *   oauth:     { type: \"oauth\", access, refresh, expires, accountId? }\n *   api:       { type: \"api\", key, metadata? }\n *   wellknown: { type: \"wellknown\", key, token }\n *\n * ChatGPT Plus/Pro OAuth uses the same OpenAI client_id as Codex.\n * Zen/Go are just `type: \"api\"` entries under opencode / opencode-go.\n */\n\nexport type OpenCodeAuthEntry = OpenCodeOauthAuth | OpenCodeApiAuth | OpenCodeWellKnownAuth;\n\nexport interface OpenCodeOauthAuth {\n  type: 'oauth';\n  access: string;\n  refresh: string;\n  expires: number;\n  accountId?: string;\n  enterpriseUrl?: string;\n  methodID?: string;\n  metadata?: Record<string, unknown>;\n  [k: string]: unknown;\n}\n\nexport interface OpenCodeApiAuth {\n  type: 'api';\n  key: string;\n  metadata?: Record<string, string>;\n  [k: string]: unknown;\n}\n\nexport interface OpenCodeWellKnownAuth {\n  type: 'wellknown';\n  key: string;\n  token: string;\n  [k: string]: unknown;\n}\n\nexport function isAuthEntry(v: unknown): v is OpenCodeAuthEntry {\n  if (!v || typeof v !== 'object') {\n    return false;\n  }\n  const t = (v as { type?: unknown }).type;\n  return t === 'oauth' || t === 'api' || t === 'wellknown';\n}\n\nexport function listAuthEntries(\n  data: Record<string, unknown>,\n): Array<{ provider: string; entry: OpenCodeAuthEntry }> {\n  const out: Array<{ provider: string; entry: OpenCodeAuthEntry }> = [];\n  for (const [provider, raw] of Object.entries(data)) {\n    if (isAuthEntry(raw)) {\n      out.push({ provider, entry: raw });\n    }\n  }\n  return out;\n}\n\nexport function hasAnyAuth(data: Record<string, unknown>): boolean {\n  return listAuthEntries(data).length > 0;\n}\n\n/** Summarize credentials for status lines: \"openai:oauth, opencode-go:api\". */\nexport function summarizeAuth(data: Record<string, unknown>): string | undefined {\n  const entries = listAuthEntries(data);\n  if (entries.length === 0) {\n    return undefined;\n  }\n  return entries.map((e) => `${e.provider}:${e.entry.type}`).join(', ');\n}\n\n/**\n * Best-effort identity for display (email / account / short summary).\n * Prefer OAuth email from JWT, then accountId.\n * For API-key bags, do NOT join provider ids as identity — that drifts and\n * breaks live matching. Use a stable short label instead.\n */\nexport function extractOpenCodeIdentity(data: Record<string, unknown>): string | undefined {\n  const entries = listAuthEntries(data);\n\n  // Prefer openai oauth email\n  for (const { provider, entry } of entries) {\n    if (entry.type !== 'oauth') {\n      continue;\n    }\n    const email =\n      emailFromJwtRobust(entry.access) ??\n      emailFromJwt(entry.access) ??\n      (typeof entry.metadata?.email === 'string' ? entry.metadata.email : undefined);\n    if (email) {\n      return email;\n    }\n    if (entry.accountId) {\n      return `${provider}:${entry.accountId.slice(0, 12)}`;\n    }\n  }\n\n  // Any oauth with accountId\n  for (const { provider, entry } of entries) {\n    if (entry.type === 'oauth' && entry.accountId) {\n      return `${provider}:${entry.accountId.slice(0, 12)}`;\n    }\n  }\n\n  if (entries.length === 0) {\n    return undefined;\n  }\n\n  // API-only (or mixed without oauth email): stable short label, not a provider dump.\n  const apiOnly = entries.every((e) => e.entry.type === 'api');\n  if (apiOnly) {\n    if (entries.length === 1) {\n      return entries[0].provider;\n    }\n    return `${entries.length} api keys`;\n  }\n  return `${entries.length} credentials`;\n}\n\n/** Improve JWT decode for OpenCode (padding-safe base64). */\nexport function emailFromJwtRobust(token: string | undefined): string | undefined {\n  if (!token) {\n    return undefined;\n  }\n  try {\n    const parts = token.split('.');\n    if (parts.length < 2 || !parts[1]) {\n      return undefined;\n    }\n    let b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');\n    const pad = b64.length % 4;\n    if (pad) {\n      b64 += '='.repeat(4 - pad);\n    }\n    const payload = JSON.parse(Buffer.from(b64, 'base64').toString('utf8')) as Record<\n      string,\n      unknown\n    >;\n    if (typeof payload.email === 'string' && payload.email.trim()) {\n      return payload.email.trim();\n    }\n    if (typeof payload.preferred_username === 'string' && payload.preferred_username.trim()) {\n      return payload.preferred_username.trim();\n    }\n    const profile = payload['https://api.openai.com/profile'];\n    if (profile && typeof profile === 'object') {\n      const email = (profile as { email?: unknown }).email;\n      if (typeof email === 'string' && email.trim()) {\n        return email.trim();\n      }\n    }\n  } catch {\n    // ignore\n  }\n  return undefined;\n}\n\nexport function emailFromJwt(token: string | undefined): string | undefined {\n  if (!token) {\n    return undefined;\n  }\n  try {\n    const parts = token.split('.');\n    if (parts.length < 2) {\n      return undefined;\n    }\n    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')) as Record<\n      string,\n      unknown\n    >;\n    if (typeof payload.email === 'string') {\n      return payload.email;\n    }\n    if (typeof payload.preferred_username === 'string') {\n      return payload.preferred_username;\n    }\n  } catch {\n    // ignore\n  }\n  return undefined;\n}\n\n/**\n * Refresh OpenCode OAuth entries in-place.\n * OpenAI ChatGPT OAuth uses Codex client_id / token URL.\n * Other oauth providers without a known refresh path are left untouched.\n */\nexport async function refreshOpenCodeAuth(\n  data: Record<string, unknown>,\n  fetchFn: typeof fetch = fetch,\n): Promise<{\n  data: Record<string, unknown>;\n  refreshed: string[];\n  skipped: string[];\n  identity?: string;\n}> {\n  const next = { ...data };\n  const refreshed: string[] = [];\n  const skipped: string[] = [];\n\n  for (const [provider, raw] of Object.entries(data)) {\n    if (!isAuthEntry(raw) || raw.type !== 'oauth') {\n      continue;\n    }\n\n    // OpenAI ChatGPT OAuth (same as Codex)\n    if (provider === 'openai' || looksLikeOpenAiOauth(raw)) {\n      const updated = await refreshOpenAiOauth(raw, fetchFn);\n      next[provider] = updated;\n      refreshed.push(provider);\n      continue;\n    }\n\n    skipped.push(provider);\n  }\n\n  if (refreshed.length === 0 && skipped.length > 0) {\n    throw new Error(\n      `No refreshable OAuth in OpenCode auth (found: ${skipped.join(', ')}). Re-login: opencode auth login`,\n    );\n  }\n  if (refreshed.length === 0) {\n    throw new Error(\n      \"No OAuth credentials to refresh. API keys don't need refresh. Login: opencode auth login\",\n    );\n  }\n\n  return {\n    data: next,\n    refreshed,\n    skipped,\n    identity: extractOpenCodeIdentity(next),\n  };\n}\n\nfunction looksLikeOpenAiOauth(entry: OpenCodeOauthAuth): boolean {\n  // methodID from opencode binary: chatgpt-browser / chatgpt-headless\n  if (typeof entry.methodID === 'string' && entry.methodID.includes('chatgpt')) {\n    return true;\n  }\n  // access token JWT iss\n  try {\n    const parts = entry.access.split('.');\n    if (parts.length < 2) {\n      return false;\n    }\n    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')) as {\n      iss?: string;\n    };\n    return Boolean(payload.iss?.includes('openai') || payload.iss?.includes('auth0'));\n  } catch {\n    return false;\n  }\n}\n\nasync function refreshOpenAiOauth(\n  entry: OpenCodeOauthAuth,\n  fetchFn: typeof fetch,\n): Promise<OpenCodeOauthAuth> {\n  const { CODEX_OAUTH_TOKEN_URL, CODEX_OAUTH_CLIENT_ID } = await import('./codex-refresh');\n\n  if (!entry.refresh) {\n    throw new Error('OpenAI OAuth entry has no refresh token');\n  }\n\n  const body = new URLSearchParams({\n    grant_type: 'refresh_token',\n    refresh_token: entry.refresh,\n    client_id: CODEX_OAUTH_CLIENT_ID,\n  });\n\n  const res = await fetchFn(CODEX_OAUTH_TOKEN_URL, {\n    method: 'POST',\n    headers: {\n      'content-type': 'application/x-www-form-urlencoded',\n      accept: 'application/json',\n      'user-agent': 'anypick-opencode/0.8',\n    },\n    body,\n  });\n\n  if (!res.ok) {\n    const text = await res.text().catch(() => '');\n    throw new Error(`OpenCode OpenAI OAuth refresh failed (${res.status}): ${text.slice(0, 240)}`);\n  }\n\n  const data = (await res.json()) as {\n    access_token?: string;\n    refresh_token?: string;\n    expires_in?: number;\n    id_token?: string;\n  };\n\n  if (!data.access_token) {\n    throw new Error('OpenAI OAuth refresh returned no access_token');\n  }\n\n  return {\n    ...entry,\n    type: 'oauth',\n    access: data.access_token,\n    refresh: data.refresh_token ?? entry.refresh,\n    expires: Date.now() + (data.expires_in ?? 3600) * 1000,\n  };\n}\n"],"mappings":";AA0CA,SAAgB,YAAY,GAAoC;CAC9D,IAAI,CAAC,KAAK,OAAO,MAAM,UACrB,OAAO;CAET,MAAM,IAAK,EAAyB;CACpC,OAAO,MAAM,WAAW,MAAM,SAAS,MAAM;AAC/C;AAEA,SAAgB,gBACd,MACuD;CACvD,MAAM,MAA6D,CAAC;CACpE,KAAK,MAAM,CAAC,UAAU,QAAQ,OAAO,QAAQ,IAAI,GAC/C,IAAI,YAAY,GAAG,GACjB,IAAI,KAAK;EAAE;EAAU,OAAO;CAAI,CAAC;CAGrC,OAAO;AACT;AAEA,SAAgB,WAAW,MAAwC;CACjE,OAAO,gBAAgB,IAAI,CAAC,CAAC,SAAS;AACxC;;AAGA,SAAgB,cAAc,MAAmD;CAC/E,MAAM,UAAU,gBAAgB,IAAI;CACpC,IAAI,QAAQ,WAAW,GACrB;CAEF,OAAO,QAAQ,KAAK,MAAM,GAAG,EAAE,SAAS,GAAG,EAAE,MAAM,MAAM,CAAC,CAAC,KAAK,IAAI;AACtE;;;;;;;AAQA,SAAgB,wBAAwB,MAAmD;CACzF,MAAM,UAAU,gBAAgB,IAAI;CAGpC,KAAK,MAAM,EAAE,UAAU,WAAW,SAAS;EACzC,IAAI,MAAM,SAAS,SACjB;EAEF,MAAM,QACJ,mBAAmB,MAAM,MAAM,KAC/B,aAAa,MAAM,MAAM,MACxB,OAAO,MAAM,UAAU,UAAU,WAAW,MAAM,SAAS,QAAQ,KAAA;EACtE,IAAI,OACF,OAAO;EAET,IAAI,MAAM,WACR,OAAO,GAAG,SAAS,GAAG,MAAM,UAAU,MAAM,GAAG,EAAE;CAErD;CAGA,KAAK,MAAM,EAAE,UAAU,WAAW,SAChC,IAAI,MAAM,SAAS,WAAW,MAAM,WAClC,OAAO,GAAG,SAAS,GAAG,MAAM,UAAU,MAAM,GAAG,EAAE;CAIrD,IAAI,QAAQ,WAAW,GACrB;CAKF,IADgB,QAAQ,OAAO,MAAM,EAAE,MAAM,SAAS,KAClD,GAAS;EACX,IAAI,QAAQ,WAAW,GACrB,OAAO,QAAQ,EAAE,CAAC;EAEpB,OAAO,GAAG,QAAQ,OAAO;CAC3B;CACA,OAAO,GAAG,QAAQ,OAAO;AAC3B;;AAGA,SAAgB,mBAAmB,OAA+C;CAChF,IAAI,CAAC,OACH;CAEF,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,GAAG;EAC7B,IAAI,MAAM,SAAS,KAAK,CAAC,MAAM,IAC7B;EAEF,IAAI,MAAM,MAAM,EAAE,CAAC,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EACvD,MAAM,MAAM,IAAI,SAAS;EACzB,IAAI,KACF,OAAO,IAAI,OAAO,IAAI,GAAG;EAE3B,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,SAAS,MAAM,CAAC;EAItE,IAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,GAC1D,OAAO,QAAQ,MAAM,KAAK;EAE5B,IAAI,OAAO,QAAQ,uBAAuB,YAAY,QAAQ,mBAAmB,KAAK,GACpF,OAAO,QAAQ,mBAAmB,KAAK;EAEzC,MAAM,UAAU,QAAQ;EACxB,IAAI,WAAW,OAAO,YAAY,UAAU;GAC1C,MAAM,QAAS,QAAgC;GAC/C,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,GAC1C,OAAO,MAAM,KAAK;EAEtB;CACF,QAAQ,CAER;AAEF;AAEA,SAAgB,aAAa,OAA+C;CAC1E,IAAI,CAAC,OACH;CAEF,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,GAAG;EAC7B,IAAI,MAAM,SAAS,GACjB;EAEF,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,MAAM,IAAI,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAI9E,IAAI,OAAO,QAAQ,UAAU,UAC3B,OAAO,QAAQ;EAEjB,IAAI,OAAO,QAAQ,uBAAuB,UACxC,OAAO,QAAQ;CAEnB,QAAQ,CAER;AAEF;;;;;;AAOA,eAAsB,oBACpB,MACA,UAAwB,OAMvB;CACD,MAAM,OAAO,EAAE,GAAG,KAAK;CACvB,MAAM,YAAsB,CAAC;CAC7B,MAAM,UAAoB,CAAC;CAE3B,KAAK,MAAM,CAAC,UAAU,QAAQ,OAAO,QAAQ,IAAI,GAAG;EAClD,IAAI,CAAC,YAAY,GAAG,KAAK,IAAI,SAAS,SACpC;EAIF,IAAI,aAAa,YAAY,qBAAqB,GAAG,GAAG;GAEtD,KAAK,YAAY,MADK,mBAAmB,KAAK,OAAO;GAErD,UAAU,KAAK,QAAQ;GACvB;EACF;EAEA,QAAQ,KAAK,QAAQ;CACvB;CAEA,IAAI,UAAU,WAAW,KAAK,QAAQ,SAAS,GAC7C,MAAM,IAAI,MACR,iDAAiD,QAAQ,KAAK,IAAI,EAAE,iCACtE;CAEF,IAAI,UAAU,WAAW,GACvB,MAAM,IAAI,MACR,0FACF;CAGF,OAAO;EACL,MAAM;EACN;EACA;EACA,UAAU,wBAAwB,IAAI;CACxC;AACF;AAEA,SAAS,qBAAqB,OAAmC;CAE/D,IAAI,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,SAAS,SAAS,GACzE,OAAO;CAGT,IAAI;EACF,MAAM,QAAQ,MAAM,OAAO,MAAM,GAAG;EACpC,IAAI,MAAM,SAAS,GACjB,OAAO;EAET,MAAM,UAAU,KAAK,MAAM,OAAO,KAAK,MAAM,IAAI,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EAG9E,OAAO,QAAQ,QAAQ,KAAK,SAAS,QAAQ,KAAK,QAAQ,KAAK,SAAS,OAAO,CAAC;CAClF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAe,mBACb,OACA,SAC4B;CAC5B,MAAM,EAAE,uBAAuB,0BAA0B,MAAM,OAAO;CAEtE,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,MAAM,yCAAyC;CAS3D,MAAM,MAAM,MAAM,QAAQ,uBAAuB;EAC/C,QAAQ;EACR,SAAS;GACP,gBAAgB;GAChB,QAAQ;GACR,cAAc;EAChB;EACA,MAAA,IAbe,gBAAgB;GAC/B,YAAY;GACZ,eAAe,MAAM;GACrB,WAAW;EACb,CASE;CACF,CAAC;CAED,IAAI,CAAC,IAAI,IAAI;EACX,MAAM,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,EAAE;EAC5C,MAAM,IAAI,MAAM,yCAAyC,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,GAAG;CAC/F;CAEA,MAAM,OAAQ,MAAM,IAAI,KAAK;CAO7B,IAAI,CAAC,KAAK,cACR,MAAM,IAAI,MAAM,+CAA+C;CAGjE,OAAO;EACL,GAAG;EACH,MAAM;EACN,QAAQ,KAAK;EACb,SAAS,KAAK,iBAAiB,MAAM;EACrC,SAAS,KAAK,IAAI,KAAK,KAAK,cAAc,QAAQ;CACpD;AACF"}

package/dist/providers/opencode-cli-entry.d.ts

@@ -1,36 +0,0 @@
-/**
- * Path to the built CLI (`dist/cli.js`) for detached re-exec.
- * Prefer this only when the parent is already a compiled package entry.
- */
-export declare function resolveCliEntry(): string;
-export interface AnyPickCliLaunch {
-    command: string;
-    args: string[];
-    /** CLI entry file (`.ts` in dev, `dist/cli.js` in package). */
-    entry: string;
-    /** True when the child is supervised by `tsx watch` (dev hot-reload). */
-    watch: boolean;
-}
-export interface ResolveAnyPickCliLaunchOptions {
-    /**
-     * Force watch on/off. Default: on for TypeScript entries unless
-     * `ANYPICK_DEV_WATCH=0` (matches `scripts/dev.mjs`).
-     */
-    watch?: boolean;
-}
-/**
- * How to re-exec the AnyPick CLI as a detached child.
- *
- * When the parent is running TypeScript via `pnpm dev` / tray-from-source,
- * spawn through `tsx watch` so edits under `src/` restart the child without a
- * manual stop/start. Package installs (`dist/cli.js`) stay plain Node — no
- * watch, no tsx dependency at runtime.
- *
- * The recorded pid is the long-lived `tsx watch` supervisor (stable across
- * reloads). `ANYPICK_INSTANCE_ID` is in the env and survives each restart so
- * health identity checks keep matching.
- */
-export declare function resolveAnyPickCliLaunch(subArgs: string[], opts?: ResolveAnyPickCliLaunchOptions): AnyPickCliLaunch;
-/** Same policy as `scripts/dev.mjs` for long-running supervisors. */
-export declare function shouldWatchDetachedDev(): boolean;
-//# sourceMappingURL=opencode-cli-entry.d.ts.map

package/dist/providers/opencode-cli-entry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"opencode-cli-entry.d.ts","sourceRoot":"","sources":["../../src/providers/opencode-cli-entry.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAWxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,GAAE,8BAAmC,GACxC,gBAAgB,CAoClB;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,IAAI,OAAO,CAShD"}

package/dist/providers/opencode-cli-entry.js

@@ -1,90 +0,0 @@
-import { createRequire } from "node:module";
-import { existsSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-//#region src/providers/opencode-cli-entry.ts
-/**
-* Path to the built CLI (`dist/cli.js`) for detached re-exec.
-* Prefer this only when the parent is already a compiled package entry.
-*/
-function resolveCliEntry() {
-	const here = fileURLToPath(new URL(".", import.meta.url));
-	const primary = join(here, "..", "cli.js");
-	if (existsSync(primary)) return primary;
-	const fromSrc = join(here, "..", "..", "dist", "cli.js");
-	if (existsSync(fromSrc)) return fromSrc;
-	return primary;
-}
-/**
-* How to re-exec the AnyPick CLI as a detached child.
-*
-* When the parent is running TypeScript via `pnpm dev` / tray-from-source,
-* spawn through `tsx watch` so edits under `src/` restart the child without a
-* manual stop/start. Package installs (`dist/cli.js`) stay plain Node — no
-* watch, no tsx dependency at runtime.
-*
-* The recorded pid is the long-lived `tsx watch` supervisor (stable across
-* reloads). `ANYPICK_INSTANCE_ID` is in the env and survives each restart so
-* health identity checks keep matching.
-*/
-function resolveAnyPickCliLaunch(subArgs, opts = {}) {
-	const tsEntry = preferTypeScriptCliEntry();
-	if (tsEntry) {
-		if (opts.watch ?? shouldWatchDetachedDev()) return {
-			command: process.execPath,
-			args: [
-				resolveTsxCli(),
-				"watch",
-				"--clear-screen=false",
-				"--exclude",
-				"**/dist/**",
-				"--exclude",
-				"**/node_modules/**",
-				tsEntry,
-				...subArgs
-			],
-			entry: tsEntry,
-			watch: true
-		};
-		return {
-			command: process.execPath,
-			args: [
-				"--import",
-				"tsx",
-				tsEntry,
-				...subArgs
-			],
-			entry: tsEntry,
-			watch: false
-		};
-	}
-	const cli = resolveCliEntry();
-	return {
-		command: process.execPath,
-		args: [cli, ...subArgs],
-		entry: cli,
-		watch: false
-	};
-}
-/** Same policy as `scripts/dev.mjs` for long-running supervisors. */
-function shouldWatchDetachedDev() {
-	if (process.env.ANYPICK_DEV_WATCH === "0") return false;
-	if (process.env.ANYPICK_DEV_WATCH === "1") return true;
-	return true;
-}
-function preferTypeScriptCliEntry() {
-	const candidates = [process.env.ANYPICK_TRAY_CLI_ENTRY, process.argv[1]];
-	for (const raw of candidates) {
-		if (typeof raw !== "string" || !raw.trim()) continue;
-		const entry = resolve(raw.trim());
-		if ((entry.endsWith(".ts") || entry.endsWith(".tsx")) && existsSync(entry)) return entry;
-	}
-	return null;
-}
-function resolveTsxCli() {
-	return createRequire(import.meta.url).resolve("tsx/cli");
-}
-//#endregion
-export { resolveAnyPickCliLaunch, resolveCliEntry, shouldWatchDetachedDev };
-
-//# sourceMappingURL=opencode-cli-entry.js.map

package/dist/providers/opencode-cli-entry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"opencode-cli-entry.js","names":[],"sources":["../../src/providers/opencode-cli-entry.ts"],"sourcesContent":["import { existsSync } from 'node:fs';\nimport { createRequire } from 'node:module';\nimport { join, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\n/**\n * Path to the built CLI (`dist/cli.js`) for detached re-exec.\n * Prefer this only when the parent is already a compiled package entry.\n */\nexport function resolveCliEntry(): string {\n  const here = fileURLToPath(new URL('.', import.meta.url));\n  const primary = join(here, '..', 'cli.js');\n  if (existsSync(primary)) {\n    return primary;\n  }\n  const fromSrc = join(here, '..', '..', 'dist', 'cli.js');\n  if (existsSync(fromSrc)) {\n    return fromSrc;\n  }\n  return primary;\n}\n\nexport interface AnyPickCliLaunch {\n  command: string;\n  args: string[];\n  /** CLI entry file (`.ts` in dev, `dist/cli.js` in package). */\n  entry: string;\n  /** True when the child is supervised by `tsx watch` (dev hot-reload). */\n  watch: boolean;\n}\n\nexport interface ResolveAnyPickCliLaunchOptions {\n  /**\n   * Force watch on/off. Default: on for TypeScript entries unless\n   * `ANYPICK_DEV_WATCH=0` (matches `scripts/dev.mjs`).\n   */\n  watch?: boolean;\n}\n\n/**\n * How to re-exec the AnyPick CLI as a detached child.\n *\n * When the parent is running TypeScript via `pnpm dev` / tray-from-source,\n * spawn through `tsx watch` so edits under `src/` restart the child without a\n * manual stop/start. Package installs (`dist/cli.js`) stay plain Node — no\n * watch, no tsx dependency at runtime.\n *\n * The recorded pid is the long-lived `tsx watch` supervisor (stable across\n * reloads). `ANYPICK_INSTANCE_ID` is in the env and survives each restart so\n * health identity checks keep matching.\n */\nexport function resolveAnyPickCliLaunch(\n  subArgs: string[],\n  opts: ResolveAnyPickCliLaunchOptions = {},\n): AnyPickCliLaunch {\n  const tsEntry = preferTypeScriptCliEntry();\n  if (tsEntry) {\n    const watch = opts.watch ?? shouldWatchDetachedDev();\n    if (watch) {\n      return {\n        command: process.execPath,\n        args: [\n          resolveTsxCli(),\n          'watch',\n          '--clear-screen=false',\n          '--exclude',\n          '**/dist/**',\n          '--exclude',\n          '**/node_modules/**',\n          tsEntry,\n          ...subArgs,\n        ],\n        entry: tsEntry,\n        watch: true,\n      };\n    }\n    return {\n      command: process.execPath,\n      args: ['--import', 'tsx', tsEntry, ...subArgs],\n      entry: tsEntry,\n      watch: false,\n    };\n  }\n  const cli = resolveCliEntry();\n  return {\n    command: process.execPath,\n    args: [cli, ...subArgs],\n    entry: cli,\n    watch: false,\n  };\n}\n\n/** Same policy as `scripts/dev.mjs` for long-running supervisors. */\nexport function shouldWatchDetachedDev(): boolean {\n  if (process.env.ANYPICK_DEV_WATCH === '0') {\n    return false;\n  }\n  if (process.env.ANYPICK_DEV_WATCH === '1') {\n    return true;\n  }\n  // TypeScript entry implies local dev (`pnpm dev` / tray from source).\n  return true;\n}\n\nfunction preferTypeScriptCliEntry(): string | null {\n  const candidates = [process.env.ANYPICK_TRAY_CLI_ENTRY, process.argv[1]];\n  for (const raw of candidates) {\n    if (typeof raw !== 'string' || !raw.trim()) {\n      continue;\n    }\n    const entry = resolve(raw.trim());\n    if ((entry.endsWith('.ts') || entry.endsWith('.tsx')) && existsSync(entry)) {\n      return entry;\n    }\n  }\n  return null;\n}\n\nfunction resolveTsxCli(): string {\n  const require = createRequire(import.meta.url);\n  return require.resolve('tsx/cli');\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,kBAA0B;CACxC,MAAM,OAAO,cAAc,IAAI,IAAI,KAAK,OAAO,KAAK,GAAG,CAAC;CACxD,MAAM,UAAU,KAAK,MAAM,MAAM,QAAQ;CACzC,IAAI,WAAW,OAAO,GACpB,OAAO;CAET,MAAM,UAAU,KAAK,MAAM,MAAM,MAAM,QAAQ,QAAQ;CACvD,IAAI,WAAW,OAAO,GACpB,OAAO;CAET,OAAO;AACT;;;;;;;;;;;;;AA+BA,SAAgB,wBACd,SACA,OAAuC,CAAC,GACtB;CAClB,MAAM,UAAU,yBAAyB;CACzC,IAAI,SAAS;EAEX,IADc,KAAK,SAAS,uBAAuB,GAEjD,OAAO;GACL,SAAS,QAAQ;GACjB,MAAM;IACJ,cAAc;IACd;IACA;IACA;IACA;IACA;IACA;IACA;IACA,GAAG;GACL;GACA,OAAO;GACP,OAAO;EACT;EAEF,OAAO;GACL,SAAS,QAAQ;GACjB,MAAM;IAAC;IAAY;IAAO;IAAS,GAAG;GAAO;GAC7C,OAAO;GACP,OAAO;EACT;CACF;CACA,MAAM,MAAM,gBAAgB;CAC5B,OAAO;EACL,SAAS,QAAQ;EACjB,MAAM,CAAC,KAAK,GAAG,OAAO;EACtB,OAAO;EACP,OAAO;CACT;AACF;;AAGA,SAAgB,yBAAkC;CAChD,IAAI,QAAQ,IAAI,sBAAsB,KACpC,OAAO;CAET,IAAI,QAAQ,IAAI,sBAAsB,KACpC,OAAO;CAGT,OAAO;AACT;AAEA,SAAS,2BAA0C;CACjD,MAAM,aAAa,CAAC,QAAQ,IAAI,wBAAwB,QAAQ,KAAK,EAAE;CACvE,KAAK,MAAM,OAAO,YAAY;EAC5B,IAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAK,GACvC;EAEF,MAAM,QAAQ,QAAQ,IAAI,KAAK,CAAC;EAChC,KAAK,MAAM,SAAS,KAAK,KAAK,MAAM,SAAS,MAAM,MAAM,WAAW,KAAK,GACvE,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,gBAAwB;CAE/B,OADgB,cAAc,OAAO,KAAK,GACnC,CAAA,CAAQ,QAAQ,SAAS;AAClC"}

package/dist/providers/opencode-proxy/abort.d.ts

@@ -1,8 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-export declare function linkClientAbort(req: IncomingMessage, res: ServerResponse): {
-    signal: AbortSignal;
-    dispose: () => void;
-};
-export declare function isAbortError(err: unknown): boolean;
-export declare function describeAbort(signal: AbortSignal, err: unknown): string;
-//# sourceMappingURL=abort.d.ts.map

package/dist/providers/opencode-proxy/abort.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"abort.d.ts","sourceRoot":"","sources":["../../../src/providers/opencode-proxy/abort.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,GAClB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CA2B9C;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAkBlD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAiBvE"}

package/dist/providers/opencode-proxy/abort.js

@@ -1,42 +0,0 @@
-import { UPSTREAM_TIMEOUT_MS } from "./constants.js";
-//#region src/providers/opencode-proxy/abort.ts
-function linkClientAbort(req, res) {
-	const ac = new AbortController();
-	const timer = setTimeout(() => ac.abort(/* @__PURE__ */ new Error(`upstream timeout after ${UPSTREAM_TIMEOUT_MS}ms`)), UPSTREAM_TIMEOUT_MS);
-	timer.unref?.();
-	const onClientGone = () => {
-		if (!ac.signal.aborted) ac.abort(/* @__PURE__ */ new Error("client disconnected"));
-	};
-	req.once("aborted", onClientGone);
-	const onResClose = () => {
-		if (!res.writableFinished) onClientGone();
-	};
-	res.once("close", onResClose);
-	return {
-		signal: ac.signal,
-		dispose: () => {
-			clearTimeout(timer);
-			req.removeListener("aborted", onClientGone);
-			res.removeListener("close", onResClose);
-		}
-	};
-}
-function isAbortError(err) {
-	if (!err || typeof err !== "object") return false;
-	const value = err;
-	if (value.name === "AbortError" || value.name === "TimeoutError") return true;
-	if (value.code === "ABORT_ERR" || value.code === "STREAM_IDLE") return true;
-	if (typeof value.message === "string" && /aborted|abort|disconnect|client gone|STREAM_IDLE|upstream timeout/i.test(value.message)) return true;
-	return value.cause ? isAbortError(value.cause) : false;
-}
-function describeAbort(signal, err) {
-	const reason = signal.aborted ? signal.reason : err;
-	const message = reason instanceof Error ? reason.message : typeof reason === "string" ? reason : err instanceof Error ? err.message : String(reason ?? "aborted");
-	if (/client disconnected|client gone/i.test(message)) return "client disconnected (Claude cancelled the request)";
-	if (/upstream timeout|stream idle|STREAM_IDLE/i.test(message)) return message;
-	return message && !/^this operation was aborted$/i.test(message) ? message : "request aborted";
-}
-//#endregion
-export { describeAbort, isAbortError, linkClientAbort };
-
-//# sourceMappingURL=abort.js.map

package/dist/providers/opencode-proxy/abort.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"abort.js","names":[],"sources":["../../../src/providers/opencode-proxy/abort.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http';\nimport { UPSTREAM_TIMEOUT_MS } from './constants';\n\nexport function linkClientAbort(\n  req: IncomingMessage,\n  res: ServerResponse,\n): { signal: AbortSignal; dispose: () => void } {\n  const ac = new AbortController();\n  const timer = setTimeout(\n    () => ac.abort(new Error(`upstream timeout after ${UPSTREAM_TIMEOUT_MS}ms`)),\n    UPSTREAM_TIMEOUT_MS,\n  );\n  timer.unref?.();\n  const onClientGone = () => {\n    if (!ac.signal.aborted) {\n      ac.abort(new Error('client disconnected'));\n    }\n  };\n  req.once('aborted', onClientGone);\n  const onResClose = () => {\n    if (!res.writableFinished) {\n      onClientGone();\n    }\n  };\n  res.once('close', onResClose);\n  return {\n    signal: ac.signal,\n    dispose: () => {\n      clearTimeout(timer);\n      req.removeListener('aborted', onClientGone);\n      res.removeListener('close', onResClose);\n    },\n  };\n}\n\nexport function isAbortError(err: unknown): boolean {\n  if (!err || typeof err !== 'object') {\n    return false;\n  }\n  const value = err as { name?: string; code?: string; message?: string; cause?: unknown };\n  if (value.name === 'AbortError' || value.name === 'TimeoutError') {\n    return true;\n  }\n  if (value.code === 'ABORT_ERR' || value.code === 'STREAM_IDLE') {\n    return true;\n  }\n  if (\n    typeof value.message === 'string' &&\n    /aborted|abort|disconnect|client gone|STREAM_IDLE|upstream timeout/i.test(value.message)\n  ) {\n    return true;\n  }\n  return value.cause ? isAbortError(value.cause) : false;\n}\n\nexport function describeAbort(signal: AbortSignal, err: unknown): string {\n  const reason: unknown = signal.aborted ? (signal.reason as unknown) : err;\n  const message =\n    reason instanceof Error\n      ? reason.message\n      : typeof reason === 'string'\n        ? reason\n        : err instanceof Error\n          ? err.message\n          : String(reason ?? 'aborted');\n  if (/client disconnected|client gone/i.test(message)) {\n    return 'client disconnected (Claude cancelled the request)';\n  }\n  if (/upstream timeout|stream idle|STREAM_IDLE/i.test(message)) {\n    return message;\n  }\n  return message && !/^this operation was aborted$/i.test(message) ? message : 'request aborted';\n}\n"],"mappings":";;AAGA,SAAgB,gBACd,KACA,KAC8C;CAC9C,MAAM,KAAK,IAAI,gBAAgB;CAC/B,MAAM,QAAQ,iBACN,GAAG,sBAAM,IAAI,MAAM,0BAA0B,oBAAoB,GAAG,CAAC,GAC3E,mBACF;CACA,MAAM,QAAQ;CACd,MAAM,qBAAqB;EACzB,IAAI,CAAC,GAAG,OAAO,SACb,GAAG,sBAAM,IAAI,MAAM,qBAAqB,CAAC;CAE7C;CACA,IAAI,KAAK,WAAW,YAAY;CAChC,MAAM,mBAAmB;EACvB,IAAI,CAAC,IAAI,kBACP,aAAa;CAEjB;CACA,IAAI,KAAK,SAAS,UAAU;CAC5B,OAAO;EACL,QAAQ,GAAG;EACX,eAAe;GACb,aAAa,KAAK;GAClB,IAAI,eAAe,WAAW,YAAY;GAC1C,IAAI,eAAe,SAAS,UAAU;EACxC;CACF;AACF;AAEA,SAAgB,aAAa,KAAuB;CAClD,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,OAAO;CAET,MAAM,QAAQ;CACd,IAAI,MAAM,SAAS,gBAAgB,MAAM,SAAS,gBAChD,OAAO;CAET,IAAI,MAAM,SAAS,eAAe,MAAM,SAAS,eAC/C,OAAO;CAET,IACE,OAAO,MAAM,YAAY,YACzB,qEAAqE,KAAK,MAAM,OAAO,GAEvF,OAAO;CAET,OAAO,MAAM,QAAQ,aAAa,MAAM,KAAK,IAAI;AACnD;AAEA,SAAgB,cAAc,QAAqB,KAAsB;CACvE,MAAM,SAAkB,OAAO,UAAW,OAAO,SAAqB;CACtE,MAAM,UACJ,kBAAkB,QACd,OAAO,UACP,OAAO,WAAW,WAChB,SACA,eAAe,QACb,IAAI,UACJ,OAAO,UAAU,SAAS;CACpC,IAAI,mCAAmC,KAAK,OAAO,GACjD,OAAO;CAET,IAAI,4CAA4C,KAAK,OAAO,GAC1D,OAAO;CAET,OAAO,WAAW,CAAC,gCAAgC,KAAK,OAAO,IAAI,UAAU;AAC/E"}

package/dist/providers/opencode-proxy/anthropic-handler.d.ts

@@ -1,4 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { OpenCodeRuntime } from './runtime.js';
-export declare function handleAnthropicMessages(runtime: OpenCodeRuntime, req: IncomingMessage, res: ServerResponse, log: (line: string) => void): Promise<void>;
-//# sourceMappingURL=anthropic-handler.d.ts.map

package/dist/providers/opencode-proxy/anthropic-handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"anthropic-handler.d.ts","sourceRoot":"","sources":["../../../src/providers/opencode-proxy/anthropic-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AASjD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC,CAsGf"}