nexgenk 1.0.0 → 1.1.0

package/dist/main.mjs

@@ -994,9 +994,9 @@ var init_token_cache = __esmMin((() => {
 	};
 }));
 // ../../node_modules/.pnpm/@anthropic-ai+sdk@0.95.2_zod@4.3.6/node_modules/@anthropic-ai/sdk/internal/utils/env.mjs
-var readEnv$2;
+var readEnv$3;
 var init_env$3 = __esmMin((() => {
-	readEnv$2 = (env) => {
+	readEnv$3 = (env) => {
 		if (typeof globalThis.process !== "undefined") return globalThis.process.env?.[env]?.trim() || void 0;
 		if (typeof globalThis.Deno !== "undefined") return globalThis.Deno.env?.get?.(env)?.trim() || void 0;
 	};
@@ -1120,24 +1120,24 @@ var init_credentials$3 = __esmMin((() => {
 			configRaw = null;
 		}
 		if (configRaw === null) {
-			const organizationId = readEnv$2("ANTHROPIC_ORGANIZATION_ID");
-			const identityTokenFile = readEnv$2("ANTHROPIC_IDENTITY_TOKEN_FILE");
-			const federationRuleId = readEnv$2("ANTHROPIC_FEDERATION_RULE_ID");
+			const organizationId = readEnv$3("ANTHROPIC_ORGANIZATION_ID");
+			const identityTokenFile = readEnv$3("ANTHROPIC_IDENTITY_TOKEN_FILE");
+			const federationRuleId = readEnv$3("ANTHROPIC_FEDERATION_RULE_ID");
 			if (federationRuleId && organizationId) return {
 				fromFile: false,
 				config: {
 					organization_id: organizationId,
-					workspace_id: readEnv$2("ANTHROPIC_WORKSPACE_ID"),
-					base_url: readEnv$2("ANTHROPIC_BASE_URL"),
+					workspace_id: readEnv$3("ANTHROPIC_WORKSPACE_ID"),
+					base_url: readEnv$3("ANTHROPIC_BASE_URL"),
 					authentication: {
 						type: "oidc_federation",
 						federation_rule_id: federationRuleId,
-						service_account_id: readEnv$2("ANTHROPIC_SERVICE_ACCOUNT_ID"),
+						service_account_id: readEnv$3("ANTHROPIC_SERVICE_ACCOUNT_ID"),
 						identity_token: identityTokenFile ? {
 							source: "file",
 							path: identityTokenFile
 						} : void 0,
-						scope: readEnv$2("ANTHROPIC_SCOPE")
+						scope: readEnv$3("ANTHROPIC_SCOPE")
 					}
 				}
 			};
@@ -1152,20 +1152,20 @@ var init_credentials$3 = __esmMin((() => {
 		if (!config.authentication) throw new Error(`config file ${configPath} is missing "authentication"`);
 		const authType = config.authentication.type;
 		if (authType !== "oidc_federation" && authType !== "user_oauth") throw new Error(`authentication.type "${authType}" is not a known authentication type`);
-		config.organization_id ?? (config.organization_id = readEnv$2("ANTHROPIC_ORGANIZATION_ID"));
-		config.workspace_id ?? (config.workspace_id = readEnv$2("ANTHROPIC_WORKSPACE_ID"));
-		config.base_url ?? (config.base_url = readEnv$2("ANTHROPIC_BASE_URL"));
-		(_a = config.authentication).scope ?? (_a.scope = readEnv$2("ANTHROPIC_SCOPE"));
+		config.organization_id ?? (config.organization_id = readEnv$3("ANTHROPIC_ORGANIZATION_ID"));
+		config.workspace_id ?? (config.workspace_id = readEnv$3("ANTHROPIC_WORKSPACE_ID"));
+		config.base_url ?? (config.base_url = readEnv$3("ANTHROPIC_BASE_URL"));
+		(_a = config.authentication).scope ?? (_a.scope = readEnv$3("ANTHROPIC_SCOPE"));
 		if (config.authentication.type === "oidc_federation") {
 			if (!config.authentication.identity_token) {
-				const identityTokenFile = readEnv$2("ANTHROPIC_IDENTITY_TOKEN_FILE");
+				const identityTokenFile = readEnv$3("ANTHROPIC_IDENTITY_TOKEN_FILE");
 				if (identityTokenFile) config.authentication.identity_token = {
 					source: "file",
 					path: identityTokenFile
 				};
 			}
-			if (!config.authentication.federation_rule_id) config.authentication.federation_rule_id = readEnv$2("ANTHROPIC_FEDERATION_RULE_ID") ?? "";
-			(_b = config.authentication).service_account_id ?? (_b.service_account_id = readEnv$2("ANTHROPIC_SERVICE_ACCOUNT_ID"));
+			if (!config.authentication.federation_rule_id) config.authentication.federation_rule_id = readEnv$3("ANTHROPIC_FEDERATION_RULE_ID") ?? "";
+			(_b = config.authentication).service_account_id ?? (_b.service_account_id = readEnv$3("ANTHROPIC_SERVICE_ACCOUNT_ID"));
 		}
 		return {
 			config,
@@ -1184,18 +1184,18 @@ var init_credentials$3 = __esmMin((() => {
 	getRootConfigPath = async () => {
 		if (!supportsLocalConfigFiles()) return null;
 		const path = await import("node:path");
-		const configDir = readEnv$2("ANTHROPIC_CONFIG_DIR");
+		const configDir = readEnv$3("ANTHROPIC_CONFIG_DIR");
 		if (configDir) return configDir;
 		if (getPlatformHeaders$1()["X-Stainless-OS"] === "Windows") {
-			const appData = readEnv$2("APPDATA");
+			const appData = readEnv$3("APPDATA");
 			if (appData) return path.join(appData, "Anthropic");
-			const userProfile = readEnv$2("USERPROFILE");
+			const userProfile = readEnv$3("USERPROFILE");
 			if (userProfile) return path.join(userProfile, "AppData", "Roaming", "Anthropic");
 			return null;
 		}
-		const xdgConfigHome = readEnv$2("XDG_CONFIG_HOME");
+		const xdgConfigHome = readEnv$3("XDG_CONFIG_HOME");
 		if (xdgConfigHome) return path.join(xdgConfigHome, "anthropic");
-		const home = readEnv$2("HOME");
+		const home = readEnv$3("HOME");
 		if (home) return path.join(home, ".config", "anthropic");
 		return null;
 	};
@@ -1206,7 +1206,7 @@ var init_credentials$3 = __esmMin((() => {
 	getActiveProfileName = async () => {
 		const rootConfigPath = await getRootConfigPath();
 		if (!rootConfigPath) return null;
-		const profileName = readEnv$2("ANTHROPIC_PROFILE");
+		const profileName = readEnv$3("ANTHROPIC_PROFILE");
 		if (profileName) return profileName;
 		const fs = await import("node:fs");
 		const filePath = (await import("node:path")).join(rootConfigPath, "active_config");
@@ -1484,9 +1484,9 @@ function resolveIdentityTokenProvider(auth) {
 		if (!auth.identity_token.path) throw new WorkloadIdentityError(`identity_token.source "file" requires a non-empty path`);
 		return identityTokenFromFile(auth.identity_token.path);
 	}
-	const tokenFile = readEnv$2("ANTHROPIC_IDENTITY_TOKEN_FILE");
+	const tokenFile = readEnv$3("ANTHROPIC_IDENTITY_TOKEN_FILE");
 	if (tokenFile) return identityTokenFromFile(tokenFile);
-	const tokenValue = readEnv$2("ANTHROPIC_IDENTITY_TOKEN");
+	const tokenValue = readEnv$3("ANTHROPIC_IDENTITY_TOKEN");
 	if (tokenValue) return identityTokenFromValue(tokenValue);
 	return null;
 }
@@ -7231,12 +7231,12 @@ var init_client$4 = __esmMin((() => {
 		* @param {Record<string, string | undefined>} opts.defaultQuery - Default query parameters to include with every request to the API.
 		* @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
 		*/
-		constructor({ baseURL = readEnv$2("ANTHROPIC_BASE_URL"), apiKey, authToken, webhookKey = readEnv$2("ANTHROPIC_WEBHOOK_SIGNING_KEY") ?? null, ...opts } = {}) {
+		constructor({ baseURL = readEnv$3("ANTHROPIC_BASE_URL"), apiKey, authToken, webhookKey = readEnv$3("ANTHROPIC_WEBHOOK_SIGNING_KEY") ?? null, ...opts } = {}) {
 			_BaseAnthropic_instances.add(this);
 			this._requestAuthFlags = /* @__PURE__ */ new WeakMap();
 			_BaseAnthropic_encoder.set(this, void 0);
-			if (apiKey === void 0) apiKey = opts.profile != null ? null : readEnv$2("ANTHROPIC_API_KEY") ?? null;
-			if (authToken === void 0) authToken = opts.profile != null ? null : readEnv$2("ANTHROPIC_AUTH_TOKEN") ?? null;
+			if (apiKey === void 0) apiKey = opts.profile != null ? null : readEnv$3("ANTHROPIC_API_KEY") ?? null;
+			if (authToken === void 0) authToken = opts.profile != null ? null : readEnv$3("ANTHROPIC_AUTH_TOKEN") ?? null;
 			if (opts.profile != null && (opts.credentials != null || opts.config != null)) throw new TypeError("Pass at most one of `profile`, `credentials`, or `config`.");
 			const options = {
 				apiKey,
@@ -7252,12 +7252,12 @@ var init_client$4 = __esmMin((() => {
 			this.logger = options.logger ?? console;
 			const defaultLogLevel = "warn";
 			this.logLevel = defaultLogLevel;
-			this.logLevel = parseLogLevel$3(options.logLevel, "ClientOptions.logLevel", this) ?? parseLogLevel$3(readEnv$2("ANTHROPIC_LOG"), "process.env['ANTHROPIC_LOG']", this) ?? defaultLogLevel;
+			this.logLevel = parseLogLevel$3(options.logLevel, "ClientOptions.logLevel", this) ?? parseLogLevel$3(readEnv$3("ANTHROPIC_LOG"), "process.env['ANTHROPIC_LOG']", this) ?? defaultLogLevel;
 			this.fetchOptions = options.fetchOptions;
 			this.maxRetries = options.maxRetries ?? 2;
 			this.fetch = options.fetch ?? getDefaultFetch$2();
 			__classPrivateFieldSet$1(this, _BaseAnthropic_encoder, FallbackEncoder$2, "f");
-			const customHeadersEnv = readEnv$2("ANTHROPIC_CUSTOM_HEADERS");
+			const customHeadersEnv = readEnv$3("ANTHROPIC_CUSTOM_HEADERS");
 			if (customHeadersEnv) {
 				const parsed = {};
 				for (const line of customHeadersEnv.split("\n")) {
@@ -31381,7 +31381,7 @@ function getApiKeyFromEnv() {
 	if (envGoogleApiKey && envGeminiApiKey) console.warn("Both GOOGLE_API_KEY and GEMINI_API_KEY are set. Using GOOGLE_API_KEY.");
 	return envGoogleApiKey || envGeminiApiKey || void 0;
 }
-var import_p_retry, import_src$2, _defaultBaseGeminiUrl, _defaultBaseVertexUrl, BaseModule, Language, Outcome, FunctionResponseScheduling, Type, Environment, AuthType, HttpElementLocation, ApiSpec, PhishBlockThreshold, Behavior, DynamicRetrievalConfigMode, FunctionCallingConfigMode, ThinkingLevel, PersonGeneration, ProminentPeople, HarmCategory, HarmBlockMethod, HarmBlockThreshold, FinishReason, HarmProbability, HarmSeverity, UrlRetrievalStatus, BlockedReason, TrafficType, Modality, ModelStage, MediaResolution, TuningMode, AdapterSize, JobState, TuningJobState, AggregationMetric, PairwiseChoice, TuningTask, DocumentState, PartMediaResolutionLevel, ToolType, ResourceScope, ServiceTier, FeatureSelectionPreference, EmbeddingApiType, SafetyFilterLevel, ImagePromptLanguage, MaskReferenceMode, ControlReferenceType, SubjectReferenceType, EditMode, SegmentMode, VideoGenerationReferenceType, VideoGenerationMaskMode, VideoCompressionQuality, TuningMethod, FileState, FileSource, TurnCompleteReason, MediaModality, VadSignalType, VoiceActivityType, StartSensitivity, EndSensitivity, ActivityHandling, TurnCoverage, Scale, MusicGenerationMode, LiveMusicPlaybackControl, HttpResponse, GenerateContentResponse, EmbedContentResponse, GenerateImagesResponse, EditImageResponse, UpscaleImageResponse, RecontextImageResponse, SegmentImageResponse, ListModelsResponse, DeleteModelResponse, CountTokensResponse, ComputeTokensResponse, GenerateVideosOperation, ListTuningJobsResponse, CancelTuningJobResponse, DeleteCachedContentResponse, ListCachedContentsResponse, ListDocumentsResponse, ListFileSearchStoresResponse, UploadToFileSearchStoreResumableResponse, ImportFileOperation, ListFilesResponse, CreateFileResponse, DeleteFileResponse, RegisterFilesResponse, ListBatchJobsResponse, LiveServerMessage, LiveMusicServerMessage, UploadToFileSearchStoreOperation, PagedItem, Pager, Batches$1, Caches, Chats, Chat$1, ApiError, Files$3, CONTENT_TYPE_HEADER, SERVER_TIMEOUT_HEADER, USER_AGENT_HEADER, GOOGLE_API_CLIENT_HEADER, LIBRARY_LABEL, VERTEX_AI_API_DEFAULT_VERSION, GOOGLE_AI_API_DEFAULT_VERSION, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_HTTP_STATUS_CODES, ApiClient, MCP_LABEL, hasMcpToolUsageFromMcpToTool, McpCallableTool, LiveMusic, LiveMusicSession, FUNCTION_RESPONSE_REQUIRES_ID, Live, defaultLiveSendClientContentParamerters, Session$1, DEFAULT_MAX_REMOTE_CALLS, Models$1, Operations, Tokens, Documents, FileSearchStores, uuid4Internal, uuid4$1, castToError$1, GeminiNextGenAPIClientError, APIError$1, APIUserAbortError$1, APIConnectionError$2, APIConnectionTimeoutError$1, BadRequestError$1, AuthenticationError$1, PermissionDeniedError$1, NotFoundError$1, ConflictError$1, UnprocessableEntityError$1, RateLimitError$1, InternalServerError$1, startsWithSchemeRegexp$1, isAbsoluteURL$1, isArrayInternal, isReadonlyArray$1, validatePositiveInteger$1, safeJSON$1, sleep$1$1, FallbackEncoder$1, VERSION$1, checkFileSupport$1, isAsyncIterable$2, isBlobLike$1, isFileLike$1, isResponseLike$1, APIResource$1, EMPTY$4, createPathTagFunction$1, path$2, BaseInteractions, Interactions, encodeUTF8_$1, decodeUTF8_$1, LineDecoder$1, levelNumbers$1, parseLogLevel$2, noopLogger$3, cachedLoggers$1, formatRequestDetails$1, Stream$2, SSEDecoder$1, APIPromise$1, brand_privateNullableHeaders$1, buildHeaders$1, readEnv$1, _a$4, BaseGeminiNextGenAPIClient, GeminiNextGenAPIClient, GOOGLE_API_KEY_HEADER, REQUIRED_VERTEX_AI_SCOPE, NodeAuth, NodeDownloader, NodeWebSocketFactory, NodeWebSocket, Tunings, MAX_CHUNK_SIZE, MAX_RETRY_COUNT, INITIAL_RETRY_DELAY_MS, DELAY_MULTIPLIER, X_GOOG_UPLOAD_STATUS_HEADER_FIELD, NodeUploader, NodeFiles, LANGUAGE_LABEL_PREFIX, GoogleGenAI;
+var import_p_retry, import_src$2, _defaultBaseGeminiUrl, _defaultBaseVertexUrl, BaseModule, Language, Outcome, FunctionResponseScheduling, Type, Environment, AuthType, HttpElementLocation, ApiSpec, PhishBlockThreshold, Behavior, DynamicRetrievalConfigMode, FunctionCallingConfigMode, ThinkingLevel, PersonGeneration, ProminentPeople, HarmCategory, HarmBlockMethod, HarmBlockThreshold, FinishReason, HarmProbability, HarmSeverity, UrlRetrievalStatus, BlockedReason, TrafficType, Modality, ModelStage, MediaResolution, TuningMode, AdapterSize, JobState, TuningJobState, AggregationMetric, PairwiseChoice, TuningTask, DocumentState, PartMediaResolutionLevel, ToolType, ResourceScope, ServiceTier, FeatureSelectionPreference, EmbeddingApiType, SafetyFilterLevel, ImagePromptLanguage, MaskReferenceMode, ControlReferenceType, SubjectReferenceType, EditMode, SegmentMode, VideoGenerationReferenceType, VideoGenerationMaskMode, VideoCompressionQuality, TuningMethod, FileState, FileSource, TurnCompleteReason, MediaModality, VadSignalType, VoiceActivityType, StartSensitivity, EndSensitivity, ActivityHandling, TurnCoverage, Scale, MusicGenerationMode, LiveMusicPlaybackControl, HttpResponse, GenerateContentResponse, EmbedContentResponse, GenerateImagesResponse, EditImageResponse, UpscaleImageResponse, RecontextImageResponse, SegmentImageResponse, ListModelsResponse, DeleteModelResponse, CountTokensResponse, ComputeTokensResponse, GenerateVideosOperation, ListTuningJobsResponse, CancelTuningJobResponse, DeleteCachedContentResponse, ListCachedContentsResponse, ListDocumentsResponse, ListFileSearchStoresResponse, UploadToFileSearchStoreResumableResponse, ImportFileOperation, ListFilesResponse, CreateFileResponse, DeleteFileResponse, RegisterFilesResponse, ListBatchJobsResponse, LiveServerMessage, LiveMusicServerMessage, UploadToFileSearchStoreOperation, PagedItem, Pager, Batches$1, Caches, Chats, Chat$1, ApiError, Files$3, CONTENT_TYPE_HEADER, SERVER_TIMEOUT_HEADER, USER_AGENT_HEADER, GOOGLE_API_CLIENT_HEADER, LIBRARY_LABEL, VERTEX_AI_API_DEFAULT_VERSION, GOOGLE_AI_API_DEFAULT_VERSION, DEFAULT_RETRY_ATTEMPTS, DEFAULT_RETRY_HTTP_STATUS_CODES, ApiClient, MCP_LABEL, hasMcpToolUsageFromMcpToTool, McpCallableTool, LiveMusic, LiveMusicSession, FUNCTION_RESPONSE_REQUIRES_ID, Live, defaultLiveSendClientContentParamerters, Session$1, DEFAULT_MAX_REMOTE_CALLS, Models$1, Operations, Tokens, Documents, FileSearchStores, uuid4Internal, uuid4$1, castToError$1, GeminiNextGenAPIClientError, APIError$1, APIUserAbortError$1, APIConnectionError$2, APIConnectionTimeoutError$1, BadRequestError$1, AuthenticationError$1, PermissionDeniedError$1, NotFoundError$1, ConflictError$1, UnprocessableEntityError$1, RateLimitError$1, InternalServerError$1, startsWithSchemeRegexp$1, isAbsoluteURL$1, isArrayInternal, isReadonlyArray$1, validatePositiveInteger$1, safeJSON$1, sleep$1$1, FallbackEncoder$1, VERSION$1, checkFileSupport$1, isAsyncIterable$2, isBlobLike$1, isFileLike$1, isResponseLike$1, APIResource$1, EMPTY$4, createPathTagFunction$1, path$2, BaseInteractions, Interactions, encodeUTF8_$1, decodeUTF8_$1, LineDecoder$1, levelNumbers$1, parseLogLevel$2, noopLogger$3, cachedLoggers$1, formatRequestDetails$1, Stream$2, SSEDecoder$1, APIPromise$1, brand_privateNullableHeaders$1, buildHeaders$1, readEnv$2, _a$4, BaseGeminiNextGenAPIClient, GeminiNextGenAPIClient, GOOGLE_API_KEY_HEADER, REQUIRED_VERTEX_AI_SCOPE, NodeAuth, NodeDownloader, NodeWebSocketFactory, NodeWebSocket, Tunings, MAX_CHUNK_SIZE, MAX_RETRY_COUNT, INITIAL_RETRY_DELAY_MS, DELAY_MULTIPLIER, X_GOOG_UPLOAD_STATUS_HEADER_FIELD, NodeUploader, NodeFiles, LANGUAGE_LABEL_PREFIX, GoogleGenAI;
 var init_node$9 = __esmMin((() => {
 	import_p_retry = /* @__PURE__ */ __toESM(require_p_retry(), 1);
 	import_src$2 = require_src$1();
@@ -37887,7 +37887,7 @@ var init_node$9 = __esmMin((() => {
 			nulls: nullHeaders
 		};
 	};
-	readEnv$1 = (env) => {
+	readEnv$2 = (env) => {
 		var _a, _b, _c, _d, _e, _f;
 		if (typeof globalThis.process !== "undefined") return (_c = (_b = (_a = globalThis.process.env) === null || _a === void 0 ? void 0 : _a[env]) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : void 0;
 		if (typeof globalThis.Deno !== "undefined") return (_f = (_e = (_d = globalThis.Deno.env) === null || _d === void 0 ? void 0 : _d.get) === null || _e === void 0 ? void 0 : _e.call(_d, env)) === null || _f === void 0 ? void 0 : _f.trim();
@@ -37908,7 +37908,7 @@ var init_node$9 = __esmMin((() => {
 		*/
 		constructor(_b) {
 			var _c, _d, _e, _f, _g, _h, _j;
-			var { baseURL = readEnv$1("GEMINI_NEXT_GEN_API_BASE_URL"), apiKey = (_c = readEnv$1("GEMINI_API_KEY")) !== null && _c !== void 0 ? _c : null, apiVersion = "v1beta" } = _b, opts = __rest(_b, [
+			var { baseURL = readEnv$2("GEMINI_NEXT_GEN_API_BASE_URL"), apiKey = (_c = readEnv$2("GEMINI_API_KEY")) !== null && _c !== void 0 ? _c : null, apiVersion = "v1beta" } = _b, opts = __rest(_b, [
 				"baseURL",
 				"apiKey",
 				"apiVersion"
@@ -37922,7 +37922,7 @@ var init_node$9 = __esmMin((() => {
 			this.logger = (_e = options.logger) !== null && _e !== void 0 ? _e : console;
 			const defaultLogLevel = "warn";
 			this.logLevel = defaultLogLevel;
-			this.logLevel = (_g = (_f = parseLogLevel$2(options.logLevel, "ClientOptions.logLevel", this)) !== null && _f !== void 0 ? _f : parseLogLevel$2(readEnv$1("GEMINI_NEXT_GEN_API_LOG"), "process.env['GEMINI_NEXT_GEN_API_LOG']", this)) !== null && _g !== void 0 ? _g : defaultLogLevel;
+			this.logLevel = (_g = (_f = parseLogLevel$2(options.logLevel, "ClientOptions.logLevel", this)) !== null && _f !== void 0 ? _f : parseLogLevel$2(readEnv$2("GEMINI_NEXT_GEN_API_LOG"), "process.env['GEMINI_NEXT_GEN_API_LOG']", this)) !== null && _g !== void 0 ? _g : defaultLogLevel;
 			this.fetchOptions = options.fetchOptions;
 			this.maxRetries = (_h = options.maxRetries) !== null && _h !== void 0 ? _h : 2;
 			this.fetch = (_j = options.fetch) !== null && _j !== void 0 ? _j : getDefaultFetch$1();
@@ -41447,10 +41447,10 @@ function finalizeChatCompletion(snapshot, params) {
 					tool_calls: tool_calls.map((tool_call, i) => {
 						const { function: fn, type, id, ...toolRest } = tool_call;
 						const { arguments: args, name, ...fnRest } = fn || {};
-						if (id == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].id\n${str$2(snapshot)}`);
-						if (type == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].type\n${str$2(snapshot)}`);
-						if (name == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.name\n${str$2(snapshot)}`);
-						if (args == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.arguments\n${str$2(snapshot)}`);
+						if (id == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].id\n${str$3(snapshot)}`);
+						if (type == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].type\n${str$3(snapshot)}`);
+						if (name == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.name\n${str$3(snapshot)}`);
+						if (args == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.arguments\n${str$3(snapshot)}`);
 						return {
 							...toolRest,
 							id,
@@ -41483,7 +41483,7 @@ function finalizeChatCompletion(snapshot, params) {
 		...system_fingerprint ? { system_fingerprint } : {}
 	}, params);
 }
-function str$2(x) {
+function str$3(x) {
 	return JSON.stringify(x);
 }
 var _ChatCompletionStream_instances, _ChatCompletionStream_params, _ChatCompletionStream_choiceEventStates, _ChatCompletionStream_currentChatCompletionSnapshot, _ChatCompletionStream_beginRequest, _ChatCompletionStream_getChoiceEventState, _ChatCompletionStream_addChunk, _ChatCompletionStream_emitToolCallDoneEvent, _ChatCompletionStream_emitContentDoneEvents, _ChatCompletionStream_endRequest, _ChatCompletionStream_getAutoParseableResponseFormat, _ChatCompletionStream_accumulateChatCompletion, ChatCompletionStream;
@@ -42581,9 +42581,9 @@ var init_base64 = __esmMin((() => {
 	};
 }));
 // ../../node_modules/.pnpm/openai@6.34.0_ws@8.20.0_zod@4.3.6/node_modules/openai/internal/utils/env.mjs
-var readEnv;
+var readEnv$1;
 var init_env$2 = __esmMin((() => {
-	readEnv = (env) => {
+	readEnv$1 = (env) => {
 		if (typeof globalThis.process !== "undefined") return globalThis.process.env?.[env]?.trim() ?? void 0;
 		if (typeof globalThis.Deno !== "undefined") return globalThis.Deno.env?.get?.(env)?.trim();
 	};
@@ -45748,7 +45748,7 @@ var init_client$3 = __esmMin((() => {
 		* @param {Record<string, string | undefined>} opts.defaultQuery - Default query parameters to include with every request to the API.
 		* @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
 		*/
-		constructor({ baseURL = readEnv("OPENAI_BASE_URL"), apiKey = readEnv("OPENAI_API_KEY"), organization = readEnv("OPENAI_ORG_ID") ?? null, project = readEnv("OPENAI_PROJECT_ID") ?? null, webhookSecret = readEnv("OPENAI_WEBHOOK_SECRET") ?? null, workloadIdentity, ...opts } = {}) {
+		constructor({ baseURL = readEnv$1("OPENAI_BASE_URL"), apiKey = readEnv$1("OPENAI_API_KEY"), organization = readEnv$1("OPENAI_ORG_ID") ?? null, project = readEnv$1("OPENAI_PROJECT_ID") ?? null, webhookSecret = readEnv$1("OPENAI_WEBHOOK_SECRET") ?? null, workloadIdentity, ...opts } = {}) {
 			_OpenAI_instances.add(this);
 			_OpenAI_encoder.set(this, void 0);
 			/**
@@ -45822,7 +45822,7 @@ var init_client$3 = __esmMin((() => {
 			this.logger = options.logger ?? console;
 			const defaultLogLevel = "warn";
 			this.logLevel = defaultLogLevel;
-			this.logLevel = parseLogLevel$1(options.logLevel, "ClientOptions.logLevel", this) ?? parseLogLevel$1(readEnv("OPENAI_LOG"), "process.env['OPENAI_LOG']", this) ?? defaultLogLevel;
+			this.logLevel = parseLogLevel$1(options.logLevel, "ClientOptions.logLevel", this) ?? parseLogLevel$1(readEnv$1("OPENAI_LOG"), "process.env['OPENAI_LOG']", this) ?? defaultLogLevel;
 			this.fetchOptions = options.fetchOptions;
 			this.maxRetries = options.maxRetries ?? 2;
 			this.fetch = options.fetch ?? getDefaultFetch();
@@ -57968,7 +57968,7 @@ function applyEnvModelConfig(config, env = process.env) {
 	const maxContextRaw = trimmed$2(env["NEXGEN_MODEL_MAX_CONTEXT_SIZE"]);
 	const maxContextSize = maxContextRaw === void 0 ? DEFAULT_MAX_CONTEXT_SIZE$1 : parsePositiveInt$4(maxContextRaw, "NEXGEN_MODEL_MAX_CONTEXT_SIZE");
 	const type = parseProviderType(trimmed$2(env["NEXGEN_MODEL_PROVIDER_TYPE"]));
-	const baseUrl = trimmed$2(env["NEXGEN_MODEL_BASE_URL"]) ?? DEFAULT_BASE_URL[type];
+	const baseUrl = trimmed$2(env["NEXGEN_MODEL_BASE_URL"]) ?? DEFAULT_BASE_URL$1[type];
 	const provider = {
 		type,
 		apiKey,
@@ -58037,7 +58037,7 @@ function rawThinking(config) {
 	const raw = config.raw?.["thinking"];
 	return typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : void 0;
 }
-var ENV_MODEL_PROVIDER_KEY$1, ENV_MODEL_ALIAS_KEY$1, ALLOWED_TYPES, DEFAULT_BASE_URL, DEFAULT_MAX_CONTEXT_SIZE$1, DEFAULT_CAPABILITIES$1;
+var ENV_MODEL_PROVIDER_KEY$1, ENV_MODEL_ALIAS_KEY$1, ALLOWED_TYPES, DEFAULT_BASE_URL$1, DEFAULT_MAX_CONTEXT_SIZE$1, DEFAULT_CAPABILITIES$1;
 var init_env_model = __esmMin((() => {
 	init_errors$43();
 	init_resolve$1();
@@ -58049,7 +58049,7 @@ var init_env_model = __esmMin((() => {
 		"anthropic",
 		"openai"
 	];
-	DEFAULT_BASE_URL = {
+	DEFAULT_BASE_URL$1 = {
 		nexgenk: "https://ia.nexgen.systems/v1",
 		openai: "https://api.openai.com/v1"
 	};
@@ -58702,7 +58702,7 @@ function tokenFromWire(wire) {
 }
 var init_types$28 = __esmMin((() => {}));
 // ../../packages/nexgen-auth/src/utils.ts
-function isRecord$25(value) {
+function isRecord$26(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var init_utils$4 = __esmMin((() => {}));
@@ -58757,7 +58757,7 @@ var init_storage = __esmMin((() => {
 			} catch {
 				return;
 			}
-			if (!isRecord$25(parsed)) return void 0;
+			if (!isRecord$26(parsed)) return void 0;
 			return tokenFromWire(parsed);
 		}
 		async save(name, token) {
@@ -58810,7 +58810,7 @@ function extractApiErrorMessage(value) {
 		}
 		return;
 	}
-	if (!isRecord$25(value)) return void 0;
+	if (!isRecord$26(value)) return void 0;
 	for (const key of DIRECT_ERROR_KEYS) {
 		const message = stringField$7(value, key);
 		if (message !== void 0) return message;
@@ -58818,7 +58818,7 @@ function extractApiErrorMessage(value) {
 	const error = value["error"];
 	const errorString = nonEmptyString$6(error);
 	if (errorString !== void 0) return errorString;
-	if (isRecord$25(error)) for (const key of NESTED_ERROR_KEYS) {
+	if (isRecord$26(error)) for (const key of NESTED_ERROR_KEYS) {
 		const message = stringField$7(error, key);
 		if (message !== void 0) return message;
 	}
@@ -58907,7 +58907,7 @@ async function postForm(url, params, deviceHeaders, options) {
 	let data = {};
 	try {
 		const parsed = await response.json();
-		if (isRecord$25(parsed)) data = parsed;
+		if (isRecord$26(parsed)) data = parsed;
 	} catch {}
 	return {
 		status,
@@ -60827,7 +60827,7 @@ function formatDuration$1(totalSeconds) {
 	return parts.length > 0 ? parts.join(" ") : "0s";
 }
 function parseManagedUsagePayload(payload) {
-	if (!isRecord$25(payload)) return {
+	if (!isRecord$26(payload)) return {
 		usages: {},
 		extraUsage: null
 	};
@@ -60837,7 +60837,7 @@ function parseManagedUsagePayload(payload) {
 	};
 }
 function parseQuotaUsages(raw) {
-	if (!isRecord$25(raw)) return {};
+	if (!isRecord$26(raw)) return {};
 	return {
 		limit5h: parseQuotaEntry(raw["limit_5h"]),
 		limit7d: parseQuotaEntry(raw["limit_7d"]),
@@ -60846,7 +60846,7 @@ function parseQuotaUsages(raw) {
 	};
 }
 function parseQuotaEntry(raw) {
-	if (!isRecord$25(raw)) return void 0;
+	if (!isRecord$26(raw)) return void 0;
 	const usedRatio = ratioValue(raw["used_ratio"]);
 	if (usedRatio === void 0) return void 0;
 	const resetAt = raw["reset_time"];
@@ -60861,7 +60861,7 @@ function fixedPointToCents(value) {
 	return Math.round(cents);
 }
 function parseMoney(raw) {
-	if (!isRecord$25(raw)) return null;
+	if (!isRecord$26(raw)) return null;
 	const cents = intValue(raw["priceInCents"]);
 	if (cents === null) return null;
 	return {
@@ -60870,9 +60870,9 @@ function parseMoney(raw) {
 	};
 }
 function parseBoosterWallet(raw) {
-	if (!isRecord$25(raw)) return null;
+	if (!isRecord$26(raw)) return null;
 	const balance = raw["balance"];
-	if (!isRecord$25(balance)) return null;
+	if (!isRecord$26(balance)) return null;
 	if (balance["type"] !== "BOOSTER") return null;
 	const amountRaw = intValue(balance["amount"]);
 	if (amountRaw === null || amountRaw <= 0) return null;
@@ -61000,8 +61000,8 @@ function userExtras(existing, remoteOwnedFields) {
 	return out;
 }
 function mergeRefreshedModelAlias(existing, remote, remoteOwnedFields) {
-	const current = isRecord$25(existing) ? existing : {};
-	const overrides = cloneOverrides(isRecord$25(current["overrides"]) ? current["overrides"] : void 0);
+	const current = isRecord$26(existing) ? existing : {};
+	const overrides = cloneOverrides(isRecord$26(current["overrides"]) ? current["overrides"] : void 0);
 	return {
 		...userExtras(current, remoteOwnedFields),
 		...remote,
@@ -61064,7 +61064,7 @@ function capabilitiesForModel$1(model) {
 function defaultBaseUrl(baseUrl) {
 	return (baseUrl ?? nexgenkCodeBaseUrl()).replace(/\/+$/, "");
 }
-function normalizeBaseUrl(baseUrl) {
+function normalizeBaseUrl$1(baseUrl) {
 	return baseUrl.replace(/\/+$/, "");
 }
 function normalizeEndpoint(value) {
@@ -61131,7 +61131,7 @@ function resolveNexgenCodeRuntimeAuth(options) {
 	const envBaseUrl = nexgenkCodeEnvBaseUrl(env);
 	const envOAuthHost = nexgenkCodeEnvOAuthHost(env);
 	const hasEnvOverride = envBaseUrl !== void 0 || envOAuthHost !== void 0;
-	const baseUrl = envBaseUrl !== void 0 ? normalizeBaseUrl(envBaseUrl) : options.configuredBaseUrl;
+	const baseUrl = envBaseUrl !== void 0 ? normalizeBaseUrl$1(envBaseUrl) : options.configuredBaseUrl;
 	const expected = resolveNexgenCodeOAuthRef({
 		oauthHost: hasEnvOverride ? envOAuthHost : options.configuredOAuthRef?.oauthHost,
 		baseUrl
@@ -61159,7 +61159,7 @@ function resolveNexgenCodeLoginAuth(options) {
 	const envBaseUrl = nexgenkCodeEnvBaseUrl(env);
 	const envOAuthHost = nexgenkCodeEnvOAuthHost(env);
 	const hasOverride = options.requestedBaseUrl !== void 0 || options.requestedOAuthHost !== void 0 || envBaseUrl !== void 0 || envOAuthHost !== void 0;
-	const baseUrl = options.requestedBaseUrl !== void 0 ? normalizeBaseUrl(options.requestedBaseUrl) : envBaseUrl !== void 0 ? normalizeBaseUrl(envBaseUrl) : options.configuredBaseUrl;
+	const baseUrl = options.requestedBaseUrl !== void 0 ? normalizeBaseUrl$1(options.requestedBaseUrl) : envBaseUrl !== void 0 ? normalizeBaseUrl$1(envBaseUrl) : options.configuredBaseUrl;
 	const oauthHost = options.requestedOAuthHost ?? envOAuthHost;
 	if (hasOverride) return {
 		baseUrl,
@@ -61184,19 +61184,19 @@ function resolveNexgenCodeLoginAuth(options) {
 	};
 }
 function toModelInfo$1(item) {
-	if (!isRecord$25(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
+	if (!isRecord$26(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
 	const rawLimit = item["limit"];
-	const limit = isRecord$25(rawLimit) ? rawLimit : void 0;
+	const limit = isRecord$26(rawLimit) ? rawLimit : void 0;
 	const contextLength = Number(limit?.["context"]);
 	if (!Number.isInteger(contextLength) || contextLength <= 0) throw new Error(`NexgenK model "${item["id"]}" must include a positive limit.context.`);
 	const displayName = item["display_name"];
 	const normalizedDisplayName = typeof displayName === "string" && displayName.length > 0 ? displayName : void 0;
 	const supportsToolUse = Object.hasOwn(item, "supports_tool_use") ? Boolean(item["supports_tool_use"]) : true;
 	const rawModalities = item["modalities"];
-	const inputModalities = isRecord$25(rawModalities) ? parseStringArray(rawModalities["input"]) : void 0;
+	const inputModalities = isRecord$26(rawModalities) ? parseStringArray(rawModalities["input"]) : void 0;
 	const reasoning = parseModelReasoning(item["reasoning"]);
 	const rawTools = item["tools"];
-	const supportsDynamicTools = isRecord$25(rawTools) && rawTools["dynamic_load"] === true;
+	const supportsDynamicTools = isRecord$26(rawTools) && rawTools["dynamic_load"] === true;
 	return {
 		id: item["id"],
 		contextLength,
@@ -61222,7 +61222,7 @@ function toModelInfo$1(item) {
 * that is not listed in `valid` is dropped.
 */
 function parseModelReasoning(value) {
-	if (!isRecord$25(value)) return {
+	if (!isRecord$26(value)) return {
 		supportsReasoning: false,
 		supportsThinkingType: "no",
 		supportEfforts: void 0,
@@ -61231,7 +61231,7 @@ function parseModelReasoning(value) {
 	const rawType = value["type"];
 	const supportsThinkingType = rawType === "only" || rawType === "both" ? rawType : rawType === "none" ? "no" : void 0;
 	const rawEffort = value["effort"];
-	const effort = isRecord$25(rawEffort) ? rawEffort : void 0;
+	const effort = isRecord$26(rawEffort) ? rawEffort : void 0;
 	const supportEfforts = effort !== void 0 ? parseStringArray(effort["valid"]) : void 0;
 	const rawDefault = effort?.["default"];
 	const parsedDefault = typeof rawDefault === "string" && rawDefault.length > 0 ? rawDefault : void 0;
@@ -61294,7 +61294,7 @@ async function fetchManagedNexgenCodeModels(options) {
 		throw new Error(message);
 	}
 	const payload = await response.json();
-	if (!isRecord$25(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${baseUrl}.`);
+	if (!isRecord$26(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${baseUrl}.`);
 	return payload["data"].map((item) => toModelInfo$1(item)).filter((item) => item !== void 0);
 }
 /**
@@ -61331,10 +61331,10 @@ function applyManagedNexgenCodeConfig(config, options) {
 		apiKeyEnv: "NEXGEN_API_KEY"
 	};
 	const upstreamKeys = new Set(options.models.map((m) => managedModelKey(m.id)));
-	for (const [key, model] of Object.entries(existingModels)) if (isRecord$25(model) && model["provider"] === "managed:nexgenk" && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, model] of Object.entries(existingModels)) if (isRecord$26(model) && model["provider"] === "managed:nexgenk" && !upstreamKeys.has(key)) delete existingModels[key];
 	for (const model of options.models) {
 		const key = managedModelKey(model.id);
-		existingModels[key] = mergeRefreshedModelAlias(isRecord$25(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(NEXGEN_PROVIDER_NAME, model), MANAGED_NEXGEN_MODEL_FIELDS);
+		existingModels[key] = mergeRefreshedModelAlias(isRecord$26(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(NEXGEN_PROVIDER_NAME, model), MANAGED_NEXGEN_MODEL_FIELDS);
 	}
 	config.models = existingModels;
 	config.defaultModel = selectedDefault.modelKey;
@@ -61370,10 +61370,10 @@ function applyManagedApiKeyProviderModels(config, providerId, models, aliasPrefi
 	for (const model of models) assertPositiveContextLength(model);
 	const existingModels = config.models ?? {};
 	const upstreamKeys = new Set(models.map((m) => `${aliasPrefix}${m.id}`));
-	for (const [key, model] of Object.entries(existingModels)) if (isRecord$25(model) && model["provider"] === providerId && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, model] of Object.entries(existingModels)) if (isRecord$26(model) && model["provider"] === providerId && !upstreamKeys.has(key)) delete existingModels[key];
 	for (const model of models) {
 		const key = `${aliasPrefix}${model.id}`;
-		existingModels[key] = mergeRefreshedModelAlias(isRecord$25(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(providerId, model), MANAGED_NEXGEN_MODEL_FIELDS);
+		existingModels[key] = mergeRefreshedModelAlias(isRecord$26(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(providerId, model), MANAGED_NEXGEN_MODEL_FIELDS);
 	}
 	config.models = existingModels;
 }
@@ -61382,7 +61382,7 @@ function applyManagedNexgenCodeLogoutConfig(config) {
 	let removedDefaultModel = false;
 	const existingModels = config.models ?? {};
 	for (const [key, model] of Object.entries(existingModels)) {
-		if (!isRecord$25(model) || model["provider"] !== "managed:nexgenk") continue;
+		if (!isRecord$26(model) || model["provider"] !== "managed:nexgenk") continue;
 		delete existingModels[key];
 		if (config.defaultModel === key) removedDefaultModel = true;
 	}
@@ -61421,7 +61421,7 @@ function selectDefaultModel(config, models, options) {
 function canPreserveDefaultModel(existingModels, defaultModel, managedModels) {
 	if (managedModels.has(defaultModel)) return true;
 	const existing = existingModels[defaultModel];
-	return isRecord$25(existing) && existing["provider"] !== "managed:nexgenk";
+	return isRecord$26(existing) && existing["provider"] !== "managed:nexgenk";
 }
 function clearManagedNexgenCodeConfig(config) {
 	const removedProvider = Object.hasOwn(config.providers, NEXGEN_PROVIDER_NAME);
@@ -61429,7 +61429,7 @@ function clearManagedNexgenCodeConfig(config) {
 	const removedModels = [];
 	const models = config.models;
 	if (models !== void 0) for (const [key, model] of Object.entries(models)) {
-		if (!isRecord$25(model) || model["provider"] !== "managed:nexgenk") continue;
+		if (!isRecord$26(model) || model["provider"] !== "managed:nexgenk") continue;
 		delete models[key];
 		removedModels.push(key);
 	}
@@ -62003,7 +62003,7 @@ function nexgenkCodeUserInfoUrl() {
 * string, is malformed; every other field degrades independently.
 */
 function parseManagedUserInfoPayload(payload) {
-	if (!isRecord$25(payload)) return null;
+	if (!isRecord$26(payload)) return null;
 	const userId = stringField$6(payload, "user_id");
 	if (userId === void 0) return null;
 	return {
@@ -62027,7 +62027,7 @@ function parseManagedUserInfoPayload(payload) {
 	};
 }
 function parsePhone(raw) {
-	if (!isRecord$25(raw)) return void 0;
+	if (!isRecord$26(raw)) return void 0;
 	const countryCode = stringField$6(raw, "country_code") ?? "";
 	const number = stringField$6(raw, "number") ?? "";
 	if (countryCode === "" && number === "") return void 0;
@@ -62192,7 +62192,7 @@ async function fetchChatTitle(url, accessToken, chatContent, opts = {}) {
 	}
 }
 function parseChatTitle(payload) {
-	if (!isRecord$25(payload)) return void 0;
+	if (!isRecord$26(payload)) return void 0;
 	const value = payload["title"];
 	if (typeof value !== "string") return void 0;
 	const title = value.trim();
@@ -62391,7 +62391,7 @@ function isOpenPlatformId(id) {
 	return OPEN_PLATFORMS.some((p) => p.id === id);
 }
 function toModelInfo(item) {
-	if (!isRecord$25(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
+	if (!isRecord$26(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
 	const contextLength = Number(item["context_length"]);
 	if (!Number.isInteger(contextLength) || contextLength <= 0) throw new Error(`Model "${item["id"]}" must include a positive context_length.`);
 	const displayName = item["display_name"];
@@ -62440,7 +62440,7 @@ async function fetchOpenPlatformModels(platform, apiKey, fetchImpl = fetch, sign
 	});
 	if (!res.ok) throw new OpenPlatformApiError(await readApiErrorMessage(res, `Failed to list models (HTTP ${res.status}).`), res.status);
 	const payload = await res.json();
-	if (!isRecord$25(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${platform.baseUrl}.`);
+	if (!isRecord$26(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${platform.baseUrl}.`);
 	return payload["data"].map((item) => toModelInfo(item)).filter((item) => item !== void 0);
 }
 function filterModelsByPrefix(models, platform) {
@@ -62460,10 +62460,10 @@ function applyOpenPlatformConfig(config, options) {
 	};
 	const existingModels = config.models ?? {};
 	const upstreamKeys = new Set(options.models.map((m) => `${providerKey}/${m.id}`));
-	for (const [key, model] of Object.entries(existingModels)) if (isRecord$25(model) && model["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, model] of Object.entries(existingModels)) if (isRecord$26(model) && model["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
 	for (const model of options.models) {
 		const aliasKey = `${providerKey}/${model.id}`;
-		existingModels[aliasKey] = mergeRefreshedModelAlias(isRecord$25(existingModels[aliasKey]) ? existingModels[aliasKey] : {}, {
+		existingModels[aliasKey] = mergeRefreshedModelAlias(isRecord$26(existingModels[aliasKey]) ? existingModels[aliasKey] : {}, {
 			provider: providerKey,
 			model: model.id,
 			maxContextSize: model.contextLength,
@@ -62594,17 +62594,17 @@ var init_provider_credential = __esmMin((() => {}));
 * is owned by a given registry URL.
 */
 function customRegistrySourceUrl(provider) {
-	if (!isRecord$25(provider)) return void 0;
+	if (!isRecord$26(provider)) return void 0;
 	const candidate = provider["source"];
-	if (!isRecord$25(candidate) || candidate["kind"] !== "apiJson") return void 0;
+	if (!isRecord$26(candidate) || candidate["kind"] !== "apiJson") return void 0;
 	const url = candidate["url"];
 	return typeof url === "string" && url.length > 0 ? url : void 0;
 }
 function readCustomRegistrySource$1(provider) {
-	if (!isRecord$25(provider)) return void 0;
+	if (!isRecord$26(provider)) return void 0;
 	const candidate = provider["source"];
 	const url = customRegistrySourceUrl(provider);
-	const apiKey = isRecord$25(candidate) ? candidate["apiKey"] : void 0;
+	const apiKey = isRecord$26(candidate) ? candidate["apiKey"] : void 0;
 	if (url === void 0 || typeof apiKey !== "string") return void 0;
 	return {
 		kind: "apiJson",
@@ -62650,14 +62650,14 @@ function isValidRetirementAt(value) {
 	return value === void 0 || value === null || typeof value === "string" && RFC3339_PATTERN.test(value) && Number.isFinite(Date.parse(value));
 }
 function toModelEntry(value) {
-	if (!isRecord$25(value)) return void 0;
+	if (!isRecord$26(value)) return void 0;
 	const id = value["id"];
 	if (typeof id !== "string" || id.length === 0) return void 0;
 	const entry = { id };
 	const name = value["name"];
 	if (typeof name === "string" && name.length > 0) entry.name = name;
 	const limit = value["limit"];
-	if (isRecord$25(limit)) {
+	if (isRecord$26(limit)) {
 		const context = limit["context"];
 		const output = limit["output"];
 		const parsedLimit = {};
@@ -62672,7 +62672,7 @@ function toModelEntry(value) {
 	const defaultEffort = value["default_effort"];
 	if (typeof defaultEffort === "string" && defaultEffort.length > 0) entry.default_effort = defaultEffort;
 	const modalities = value["modalities"];
-	if (isRecord$25(modalities)) {
+	if (isRecord$26(modalities)) {
 		const input = toStringArrayOrUndefined(modalities["input"]);
 		const output = toStringArrayOrUndefined(modalities["output"]);
 		if (input !== void 0 || output !== void 0) entry.modalities = {
@@ -62682,7 +62682,7 @@ function toModelEntry(value) {
 	}
 	const rawUpgrade = value["upgrade"];
 	if (rawUpgrade !== void 0 && rawUpgrade !== null) {
-		if (!isRecord$25(rawUpgrade)) throw new Error(`Invalid upgrade for model "${id}": expected an object.`);
+		if (!isRecord$26(rawUpgrade)) throw new Error(`Invalid upgrade for model "${id}": expected an object.`);
 		const targetModel = nonEmptyString$5(rawUpgrade["model"]);
 		if (targetModel === void 0) throw new Error(`Invalid upgrade for model "${id}": expected a non-empty target model.`);
 		const migrationMarkdown = rawUpgrade["migration_markdown"];
@@ -62698,7 +62698,7 @@ function toModelEntry(value) {
 	return entry;
 }
 function toProviderEntry(value) {
-	if (!isRecord$25(value)) return void 0;
+	if (!isRecord$26(value)) return void 0;
 	const id = value["id"];
 	const name = value["name"];
 	const api = value["api"];
@@ -62708,7 +62708,7 @@ function toProviderEntry(value) {
 	if (typeof name !== "string" || name.length === 0) return void 0;
 	if (typeof api !== "string" || api.length === 0) return void 0;
 	if (!isAllowedProviderType(type)) return void 0;
-	if (!isRecord$25(models)) return void 0;
+	if (!isRecord$26(models)) return void 0;
 	const parsedModels = {};
 	for (const [key, raw] of Object.entries(models)) {
 		const modelEntry = toModelEntry(raw);
@@ -62746,7 +62746,7 @@ async function fetchCustomRegistry(source, options = {}) {
 		throw new CustomRegistryApiError(message, response.status);
 	}
 	const payload = await response.json();
-	if (!isRecord$25(payload)) throw new Error(`Unexpected custom registry response at ${source.url}: expected a JSON object keyed by provider id.`);
+	if (!isRecord$26(payload)) throw new Error(`Unexpected custom registry response at ${source.url}: expected a JSON object keyed by provider id.`);
 	const out = {};
 	for (const [key, raw] of Object.entries(payload)) {
 		const entry = toProviderEntry(raw);
@@ -62807,8 +62807,8 @@ function resolveCapabilities(model) {
 */
 function retainedApiKeyEnv(existing, entry, source) {
 	assertCustomRegistryProviderId(entry.id);
-	if (isRecord$25(existing) && existing["oauth"] !== void 0) throw new Error(oauthManagedProviderMessage(entry.id));
-	if (!isRecord$25(existing) || readCustomRegistrySource$1(existing)?.url !== source.url) return;
+	if (isRecord$26(existing) && existing["oauth"] !== void 0) throw new Error(oauthManagedProviderMessage(entry.id));
+	if (!isRecord$26(existing) || readCustomRegistrySource$1(existing)?.url !== source.url) return;
 	const apiKeyEnv = nonEmptyString$5(existing["apiKeyEnv"]);
 	if (apiKeyEnv !== void 0 && normalizedEndpoint(existing["baseUrl"]) !== normalizedEndpoint(entry.api)) throw new Error(`Custom registry provider "${entry.id}" changed endpoint while api_key_env is configured. Remove api_key_env, re-import the registry, verify the new endpoint, then restore api_key_env.`);
 	return apiKeyEnv;
@@ -62829,14 +62829,14 @@ function applyCustomRegistryProvider(config, entry, source, priorProviders) {
 	};
 	const existingModels = config.models ?? {};
 	const upstreamKeys = new Set(Object.keys(entry.models).map((modelKey) => `${providerKey}/${modelKey}`));
-	for (const [key, alias] of Object.entries(existingModels)) if (isRecord$25(alias) && alias["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, alias] of Object.entries(existingModels)) if (isRecord$26(alias) && alias["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
 	const modelEntries = Object.entries(entry.models);
 	for (const [modelKey, model] of modelEntries) {
 		const aliasKey = `${providerKey}/${modelKey}`;
 		const maxContextSize = resolveMaxContextSize(model);
 		const capabilities = resolveCapabilities(model);
 		const displayName = typeof model.name === "string" && model.name.length > 0 ? model.name : model.id;
-		const existing = isRecord$25(existingModels[aliasKey]) ? existingModels[aliasKey] : {};
+		const existing = isRecord$26(existingModels[aliasKey]) ? existingModels[aliasKey] : {};
 		const upgrade = model.upgrade;
 		const target = upgrade === void 0 ? void 0 : modelEntries.find(([, candidate]) => candidate.id === upgrade.model);
 		const targetAlias = target === void 0 || target[1].id === model.id ? void 0 : `${providerKey}/${target[0]}`;
@@ -62867,7 +62867,7 @@ function removeCustomRegistryProvider(config, providerId) {
 	let removedDefault = false;
 	const existingModels = config.models ?? {};
 	for (const [key, alias] of Object.entries(existingModels)) {
-		if (!isRecord$25(alias) || alias["provider"] !== providerId) continue;
+		if (!isRecord$26(alias) || alias["provider"] !== providerId) continue;
 		delete existingModels[key];
 		if (config.defaultModel === key) removedDefault = true;
 	}
@@ -62882,7 +62882,7 @@ function removeCustomRegistryProvider(config, providerId) {
 */
 function declaredUpgradeTarget(config, alias) {
 	const model = alias === void 0 ? void 0 : config.models?.[alias];
-	return isRecord$25(model) && isRecord$25(model["upgrade"]) ? nonEmptyString$5(model["upgrade"]["model"]) : void 0;
+	return isRecord$26(model) && isRecord$26(model["upgrade"]) ? nonEmptyString$5(model["upgrade"]["model"]) : void 0;
 }
 /**
 * Surfaces the credential env var each entry declares via its `env` field, as
@@ -62922,10 +62922,10 @@ function removeCustomRegistryEntries(config, entries, source) {
 		previousDefaultProvider: config["defaultProvider"]
 	};
 	for (const [providerId, provider] of Object.entries(config.providers)) {
-		if (!isRecord$25(provider)) continue;
+		if (!isRecord$26(provider)) continue;
 		if (provider["oauth"] !== void 0 || isReservedProviderId(providerId)) continue;
 		const existingSource = provider["source"];
-		const sameRegistry = isRecord$25(existingSource) && existingSource["kind"] === "apiJson" && existingSource["url"] === source.url;
+		const sameRegistry = isRecord$26(existingSource) && existingSource["kind"] === "apiJson" && existingSource["url"] === source.url;
 		if (surviving.has(providerId) || sameRegistry) removeCustomRegistryProvider(config, providerId);
 	}
 	return removal;
@@ -62933,12 +62933,12 @@ function removeCustomRegistryEntries(config, entries, source) {
 function customRegistryReplacementKeys(config, entries, source) {
 	const providerIds = new Set(Object.values(entries).map((entry) => entry.id));
 	for (const [providerId, provider] of Object.entries(config.providers)) {
-		if (!isRecord$25(provider)) continue;
+		if (!isRecord$26(provider)) continue;
 		if (provider["oauth"] !== void 0 || isReservedProviderId(providerId)) continue;
 		if (customRegistrySourceUrl(provider) === source.url) providerIds.add(providerId);
 	}
 	const modelIds = /* @__PURE__ */ new Set();
-	for (const [modelId, model] of Object.entries(config.models ?? {})) if (isRecord$25(model) && providerIds.has(String(model["provider"]))) modelIds.add(modelId);
+	for (const [modelId, model] of Object.entries(config.models ?? {})) if (isRecord$26(model) && providerIds.has(String(model["provider"]))) modelIds.add(modelId);
 	for (const entry of Object.values(entries)) for (const modelId of Object.keys(entry.models)) modelIds.add(`${entry.id}/${modelId}`);
 	return {
 		providers: [...providerIds],
@@ -63266,7 +63266,7 @@ function resolveProviderApiKey(provider, providerName) {
 		if (value === void 0) throw new Error(apiKeyEnvMissingMessage(providerName, declared.apiKeyEnv));
 		return value;
 	}
-	if (isRecord$25(provider.env)) {
+	if (isRecord$26(provider.env)) {
 		const fromEnv = nonEmptyString$5(provider.env["NEXGEN_API_KEY"]);
 		if (fromEnv !== void 0) {
 			if (provider.oauth !== void 0) throw new Error(credentialConflictMessage("Provider", providerName, "apiKey", "oauth"));
@@ -111182,7 +111182,7 @@ function dump$1(input, options) {
 	if (writeNode(state, 0, value, true, true)) return state.dump + "\n";
 	return "";
 }
-var common, exception, snippet, TYPE_CONSTRUCTOR_OPTIONS, YAML_NODE_KINDS, type$2, schema, str$1, seq, map, failsafe, _null, bool, int, YAML_FLOAT_PATTERN, SCIENTIFIC_WITHOUT_DOT, float, json, core, YAML_DATE_REGEXP, YAML_TIMESTAMP_REGEXP, timestamp$1, merge, BASE64_MAP, binary, _hasOwnProperty$3, _toString$2, omap, _toString$1, pairs, _hasOwnProperty$2, set$1, _default, _hasOwnProperty$1, CONTEXT_FLOW_IN, CONTEXT_FLOW_OUT, CONTEXT_BLOCK_IN, CONTEXT_BLOCK_OUT, CHOMPING_CLIP, CHOMPING_STRIP, CHOMPING_KEEP, PATTERN_NON_PRINTABLE, PATTERN_NON_ASCII_LINE_BREAKS, PATTERN_FLOW_INDICATORS, PATTERN_TAG_HANDLE, PATTERN_TAG_URI, simpleEscapeCheck, simpleEscapeMap, i$1, directiveHandlers, loader, _toString, _hasOwnProperty, CHAR_BOM, CHAR_TAB, CHAR_LINE_FEED, CHAR_CARRIAGE_RETURN, CHAR_SPACE, CHAR_EXCLAMATION, CHAR_DOUBLE_QUOTE, CHAR_SHARP, CHAR_PERCENT, CHAR_AMPERSAND, CHAR_SINGLE_QUOTE, CHAR_ASTERISK, CHAR_COMMA, CHAR_MINUS, CHAR_COLON, CHAR_EQUALS, CHAR_GREATER_THAN, CHAR_QUESTION, CHAR_COMMERCIAL_AT, CHAR_LEFT_SQUARE_BRACKET, CHAR_RIGHT_SQUARE_BRACKET, CHAR_GRAVE_ACCENT, CHAR_LEFT_CURLY_BRACKET, CHAR_VERTICAL_LINE, CHAR_RIGHT_CURLY_BRACKET, ESCAPE_SEQUENCES, DEPRECATED_BOOLEANS_SYNTAX, DEPRECATED_BASE60_SYNTAX, QUOTING_TYPE_SINGLE, QUOTING_TYPE_DOUBLE, STYLE_PLAIN, STYLE_SINGLE, STYLE_LITERAL, STYLE_FOLDED, STYLE_DOUBLE, dumper, load;
+var common, exception, snippet, TYPE_CONSTRUCTOR_OPTIONS, YAML_NODE_KINDS, type$2, schema, str$2, seq, map, failsafe, _null, bool, int, YAML_FLOAT_PATTERN, SCIENTIFIC_WITHOUT_DOT, float, json, core, YAML_DATE_REGEXP, YAML_TIMESTAMP_REGEXP, timestamp$1, merge, BASE64_MAP, binary, _hasOwnProperty$3, _toString$2, omap, _toString$1, pairs, _hasOwnProperty$2, set$1, _default, _hasOwnProperty$1, CONTEXT_FLOW_IN, CONTEXT_FLOW_OUT, CONTEXT_BLOCK_IN, CONTEXT_BLOCK_OUT, CHOMPING_CLIP, CHOMPING_STRIP, CHOMPING_KEEP, PATTERN_NON_PRINTABLE, PATTERN_NON_ASCII_LINE_BREAKS, PATTERN_FLOW_INDICATORS, PATTERN_TAG_HANDLE, PATTERN_TAG_URI, simpleEscapeCheck, simpleEscapeMap, i$1, directiveHandlers, loader, _toString, _hasOwnProperty, CHAR_BOM, CHAR_TAB, CHAR_LINE_FEED, CHAR_CARRIAGE_RETURN, CHAR_SPACE, CHAR_EXCLAMATION, CHAR_DOUBLE_QUOTE, CHAR_SHARP, CHAR_PERCENT, CHAR_AMPERSAND, CHAR_SINGLE_QUOTE, CHAR_ASTERISK, CHAR_COMMA, CHAR_MINUS, CHAR_COLON, CHAR_EQUALS, CHAR_GREATER_THAN, CHAR_QUESTION, CHAR_COMMERCIAL_AT, CHAR_LEFT_SQUARE_BRACKET, CHAR_RIGHT_SQUARE_BRACKET, CHAR_GRAVE_ACCENT, CHAR_LEFT_CURLY_BRACKET, CHAR_VERTICAL_LINE, CHAR_RIGHT_CURLY_BRACKET, ESCAPE_SEQUENCES, DEPRECATED_BOOLEANS_SYNTAX, DEPRECATED_BASE60_SYNTAX, QUOTING_TYPE_SINGLE, QUOTING_TYPE_DOUBLE, STYLE_PLAIN, STYLE_SINGLE, STYLE_LITERAL, STYLE_FOLDED, STYLE_DOUBLE, dumper, load;
 var init_js_yaml = __esmMin((() => {
 	common = {
 		isNothing,
@@ -111243,7 +111243,7 @@ var init_js_yaml = __esmMin((() => {
 		return result;
 	};
 	schema = Schema$1;
-	str$1 = new type$2("tag:yaml.org,2002:str", {
+	str$2 = new type$2("tag:yaml.org,2002:str", {
 		kind: "scalar",
 		construct: function(data) {
 			return data !== null ? data : "";
@@ -111262,7 +111262,7 @@ var init_js_yaml = __esmMin((() => {
 		}
 	});
 	failsafe = new schema({ explicit: [
-		str$1,
+		str$2,
 		seq,
 		map
 	] });
@@ -111606,7 +111606,7 @@ function parseSkillText(options) {
 		throw error;
 	}
 	const frontmatter = parsed.data ?? {};
-	if (!isRecord$24(frontmatter)) throw new SkillParseError(`Frontmatter in ${options.skillMdPath} must be a mapping at the top level`);
+	if (!isRecord$25(frontmatter)) throw new SkillParseError(`Frontmatter in ${options.skillMdPath} must be a mapping at the top level`);
 	const metadata = normalizeMetadata(frontmatter);
 	if (!isSupportedSkillType(metadata.type)) throw new UnsupportedSkillTypeError(metadata.type ?? String(frontmatter["type"]));
 	const name = nonEmptyString$4(metadata.name);
@@ -111654,7 +111654,7 @@ function descriptionFromBody$1(body) {
 function nonEmptyString$4(value) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
-function isRecord$24(value) {
+function isRecord$25(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var SkillParseError, UnsupportedSkillTypeError, FENCE, METADATA_ALIASES;
@@ -112197,10 +112197,10 @@ async function readMcpJson(fs, filePath, options = {}) {
 	}
 }
 function parseMcpJsonServers(data) {
-	if (!isRecord$23(data)) throw new Error("expected a JSON object");
+	if (!isRecord$24(data)) throw new Error("expected a JSON object");
 	if (!("mcpServers" in data)) return {};
 	const raw = data["mcpServers"];
-	if (!isRecord$23(raw)) throw new Error("\"mcpServers\" must be an object");
+	if (!isRecord$24(raw)) throw new Error("\"mcpServers\" must be an object");
 	return Object.fromEntries(Object.entries(raw).map(([name, value]) => [name, McpServerConfigSchema.parse(value)]));
 }
 function normalizeMcpServers(servers, options) {
@@ -112221,7 +112221,7 @@ function mapValuesToPath(servers, path) {
 	for (const name of Object.keys(servers)) origins[name] = path;
 	return origins;
 }
-function isRecord$23(value) {
+function isRecord$24(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isFileNotFound(error) {
@@ -122943,7 +122943,7 @@ function configError(message, cause) {
 function describeError$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-function isRecord$22(value) {
+function isRecord$23(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var IMcpConfigStore, CONFIG_SCOPE$1, MCP_CONFIG_KEY, textEncoder$6, textDecoder$6, McpConfigStore, NO_ABORT$5;
@@ -123054,9 +123054,9 @@ var init_configStore = __esmMin((() => {
 			} catch (error) {
 				throw configError(`Invalid JSON in ${this.path}: ${describeError$1(error)}`, error);
 			}
-			if (!isRecord$22(parsed)) throw configError(`Invalid MCP config in ${this.path}: expected a JSON object`);
+			if (!isRecord$23(parsed)) throw configError(`Invalid MCP config in ${this.path}: expected a JSON object`);
 			const rawServersValue = parsed["mcpServers"];
-			if (rawServersValue !== void 0 && !isRecord$22(rawServersValue)) throw configError(`Invalid MCP config in ${this.path}: "mcpServers" must be an object`);
+			if (rawServersValue !== void 0 && !isRecord$23(rawServersValue)) throw configError(`Invalid MCP config in ${this.path}: "mcpServers" must be an object`);
 			const rawServers = rawServersValue ?? {};
 			const servers = Object.entries(rawServers).map(([name, value]) => parseServer(name, value));
 			return {
@@ -123967,7 +123967,7 @@ function parseAgentFileText(options) {
 	}
 	const frontmatter = parsed.data;
 	if (frontmatter === null) throw new AgentFileParseError(`Missing frontmatter in ${options.path}`);
-	if (!isRecord$21(frontmatter)) throw new AgentFileParseError(`Frontmatter in ${options.path} must be a mapping at the top level`);
+	if (!isRecord$22(frontmatter)) throw new AgentFileParseError(`Frontmatter in ${options.path} must be a mapping at the top level`);
 	const nameField = frontmatter["name"];
 	if (nameField !== void 0 && nameField !== null && typeof nameField !== "string") throw new AgentFileParseError(`Frontmatter field "name" in ${options.path} must be a non-empty string`);
 	const name = nonEmptyString$3(nameField) ?? deriveNameFromPath(options.path);
@@ -124023,7 +124023,7 @@ function deriveNameFromPath(filePath) {
 function nonEmptyString$3(value) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
-function isRecord$21(value) {
+function isRecord$22(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var AgentFileParseError, AGENT_NAME_PATTERN;
@@ -179733,12 +179733,12 @@ function legacyStatusToCurrent$1(task) {
 	return task.status;
 }
 function isReadablePersistedTask$1(obj) {
-	return isRecord$20(obj) && (typeof obj["taskId"] === "string" || typeof obj["task_id"] === "string");
+	return isRecord$21(obj) && (typeof obj["taskId"] === "string" || typeof obj["task_id"] === "string");
 }
 function isLegacyPersistedTask$1(task) {
 	return "task_id" in task;
 }
-function isRecord$20(value) {
+function isRecord$21(value) {
 	return typeof value === "object" && value !== null;
 }
 function optionalNonEmptyString$1(value) {
@@ -192132,7 +192132,7 @@ function normalizeNexgenToolSchema(schema) {
 }
 function ensureNexgenPropertyTypes(schema) {
 	const normalized = cloneJsonValue(schema);
-	if (!isRecord$19(normalized)) throw new SyntaxRequestFormatError("JSON Schema root must normalize to an object.");
+	if (!isRecord$20(normalized)) throw new SyntaxRequestFormatError("JSON Schema root must normalize to an object.");
 	recurseSchema(normalized);
 	return normalized;
 }
@@ -192193,7 +192193,7 @@ function resolveLocalJsonPointer(root, ref) {
 	let current = root;
 	for (const rawPart of ref.slice(2).split("/")) {
 		const part = unescapeJsonPointerPart(rawPart);
-		if (isRecord$19(current)) {
+		if (isRecord$20(current)) {
 			if (!hasOwn$1(current, part)) return { found: false };
 			current = current[part];
 		} else if (Array.isArray(current)) {
@@ -192215,20 +192215,20 @@ function parseJsonPointerArrayIndex(part) {
 	return Number(part);
 }
 function recurseSchema(node) {
-	if (!isRecord$19(node)) return;
+	if (!isRecord$20(node)) return;
 	visitChildSchemas(node, normalizeProperty);
 }
 function visitChildSchemas(node, visit) {
 	for (const { key, kind } of CHILD_SCHEMA_SLOTS) {
 		const value = node[key];
 		if (kind === "single") {
-			if (isRecord$19(value)) visit(value);
+			if (isRecord$20(value)) visit(value);
 		} else if (kind === "array") {
 			if (Array.isArray(value)) for (const item of value) visit(item);
 		} else if (kind === "map") {
-			if (isRecord$19(value)) for (const item of Object.values(value)) visit(item);
+			if (isRecord$20(value)) for (const item of Object.values(value)) visit(item);
 		} else if (kind === "schema-or-array") {
-			if (isRecord$19(value)) visit(value);
+			if (isRecord$20(value)) visit(value);
 			else if (Array.isArray(value)) for (const item of value) visit(item);
 		}
 	}
@@ -192240,7 +192240,7 @@ function childSchemaKeysForParentType(parentType) {
 	});
 }
 function normalizeProperty(node) {
-	if (!isRecord$19(node)) return;
+	if (!isRecord$20(node)) return;
 	if (!hasOwn$1(node, "type") && !hasAnyKey(node, TYPE_COMPLETION_SKIP_KEYS)) {
 		const enumValues = node["enum"];
 		if (Array.isArray(enumValues) && enumValues.length > 0) node["type"] = inferTypeFromValues(enumValues);
@@ -192324,14 +192324,14 @@ function hasAnyKey(obj, keys) {
 }
 function cloneJsonValue(value) {
 	if (Array.isArray(value)) return value.map((item) => cloneJsonValue(item));
-	if (isRecord$19(value)) {
+	if (isRecord$20(value)) {
 		const cloned = {};
 		for (const [key, child] of Object.entries(value)) cloned[key] = cloneJsonValue(child);
 		return cloned;
 	}
 	return value;
 }
-function isRecord$19(value) {
+function isRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasOwn$1(obj, key) {
@@ -201623,15 +201623,15 @@ async function seedDefaultModelWhenUnset$1(config, alias) {
 }
 function registryKeyFromExisting(providers, url) {
 	for (const provider of Object.values(providers)) {
-		if (!isRecord$18(provider)) continue;
+		if (!isRecord$19(provider)) continue;
 		const source = provider["source"];
-		if (isRecord$18(source) && source["kind"] === "apiJson" && source["url"] === url) {
+		if (isRecord$19(source) && source["kind"] === "apiJson" && source["url"] === url) {
 			const key = source["apiKey"];
 			if (typeof key === "string" && key.length > 0) return key;
 		}
 	}
 }
-function isRecord$18(value) {
+function isRecord$19(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function truncateUpstreamMessage(err, limit = 300) {
@@ -201988,7 +201988,7 @@ var init_types$20 = __esmMin((() => {
 function parseCommandText(input) {
 	const { text, commandPath, pluginId } = input;
 	const parsed = parseFrontmatter(text);
-	const frontmatter = isRecord$17(parsed.data) ? parsed.data : {};
+	const frontmatter = isRecord$18(parsed.data) ? parsed.data : {};
 	const baseName = input.fallbackName ?? nodePath.basename(commandPath).replace(/\.md$/i, "");
 	const name = nonEmptyString$2(frontmatter["name"]) ?? baseName;
 	const body = parsed.body.trim();
@@ -202025,7 +202025,7 @@ function descriptionFromBody(body) {
 	if (firstLine === void 0) return "No description provided.";
 	return firstLine.length > 240 ? `${firstLine.slice(0, 239)}…` : firstLine;
 }
-function isRecord$17(value) {
+function isRecord$18(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var init_commands$1 = __esmMin((() => {
@@ -204879,7 +204879,7 @@ function parsePluginMarketplace(raw, location) {
 	} catch (error) {
 		throw new Error(`Plugin marketplace is not valid JSON: ${formatParseError(error)}`, { cause: error });
 	}
-	if (!isRecord$16(parsed)) throw new TypeError("Plugin marketplace must be an object.");
+	if (!isRecord$17(parsed)) throw new TypeError("Plugin marketplace must be an object.");
 	const rawPlugins = parsed["plugins"];
 	if (!Array.isArray(rawPlugins)) throw new TypeError("Plugin marketplace must contain a \"plugins\" array.");
 	return {
@@ -204925,7 +204925,7 @@ async function readMarketplaceText(location, fetchImpl) {
 	return response.text();
 }
 function parseMarketplaceEntry(value, index, location) {
-	if (!isRecord$16(value)) throw new TypeError(`Plugin marketplace entry ${index + 1} must be an object.`);
+	if (!isRecord$17(value)) throw new TypeError(`Plugin marketplace entry ${index + 1} must be an object.`);
 	const id = requiredString(value, "id", index);
 	validateMarketplaceEntryType(value, id);
 	const source = stringField$4(value, "source") ?? stringField$4(value, "url") ?? stringField$4(value, "downloadUrl");
@@ -205053,7 +205053,7 @@ function stringArrayField(value, field) {
 	const out = raw.filter((item) => typeof item === "string").map((item) => item.trim()).filter((item) => item.length > 0);
 	return out.length > 0 ? out : void 0;
 }
-function isRecord$16(value) {
+function isRecord$17(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function formatParseError(error) {
@@ -210968,7 +210968,7 @@ function killProcess(proc) {
 		proc.kill("SIGKILL");
 	}, KILL_GRACE_MS$1).unref();
 }
-function isRecord$15(value) {
+function isRecord$16(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorMessage$17(error) {
@@ -210985,7 +210985,7 @@ var init_runHook = __esmMin((() => {
 		if (typeof value === "string") return value;
 		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
 	}, string().optional());
-	HookSpecificOutputSchema = preprocess((value) => isRecord$15(value) ? value : void 0, looseObject({
+	HookSpecificOutputSchema = preprocess((value) => isRecord$16(value) ? value : void 0, looseObject({
 		message: OptionalStringSchema,
 		permissionDecision: unknown().optional(),
 		permissionDecisionReason: unknown().optional()
@@ -289226,10 +289226,6 @@ function regionResolver() {
 	});
 	return resolver;
 }
-function regionForBareLogin(ref) {
-	if (ref === void 0) return currentNexgenRegion();
-	return ref.key === "oauth/nexgenk" ? "mainland-cn" : void 0;
-}
 function currentNexgenRegionResolution() {
 	return regionResolver().current();
 }
@@ -289442,7 +289438,7 @@ var init_paths$1 = __esmMin((() => {
 	siblingMcpJson = (tgt) => join(tgt, "mcp.migrated-from-nexgenk-cli.json");
 }));
 // ../../packages/migration-legacy/src/source-config.ts
-function isRecord$14(value) {
+function isRecord$15(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isEnoent$1(error) {
@@ -289463,7 +289459,7 @@ async function readSourceConfig(sourceHome) {
 		const parsed = parse$9(tomlText);
 		return {
 			kind: "toml",
-			parsed: isRecord$14(parsed) ? parsed : {}
+			parsed: isRecord$15(parsed) ? parsed : {}
 		};
 	} catch {
 		return {
@@ -289486,7 +289482,7 @@ async function readSourceConfig(sourceHome) {
 		const parsed = JSON.parse(jsonText);
 		return {
 			kind: "json",
-			parsed: isRecord$14(parsed) ? parsed : {}
+			parsed: isRecord$15(parsed) ? parsed : {}
 		};
 	} catch {
 		return {
@@ -289902,10 +289898,10 @@ async function detectMigration(opts) {
 	const oauthCredentials = new Set(credentialFiles.map((n) => n.slice(0, -5)).filter((n) => n.length > 0));
 	if (sourceConfig.kind === "toml" || sourceConfig.kind === "json") {
 		const providers = sourceConfig.parsed["providers"];
-		if (isRecord$13(providers)) for (const prov of Object.values(providers)) {
-			if (!isRecord$13(prov)) continue;
+		if (isRecord$14(providers)) for (const prov of Object.values(providers)) {
+			if (!isRecord$14(prov)) continue;
 			const oauth = prov["oauth"];
-			if (!isRecord$13(oauth)) continue;
+			if (!isRecord$14(oauth)) continue;
 			const key = oauth["key"];
 			if (typeof key !== "string" || key === "") continue;
 			const name = key.split("/").pop();
@@ -290009,7 +290005,7 @@ async function detectMigration(opts) {
 function unknownWorkdirReason$1() {
 	return "No local workdir mapping was found for this legacy session bucket; nexgenk.json may be missing, unreadable, or not list the workdir.";
 }
-function isRecord$13(value) {
+function isRecord$14(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function dirHasEntries(dir) {
@@ -290028,11 +290024,11 @@ async function detectMcpOauthServers(src) {
 	}
 	try {
 		const parsed = JSON.parse(text);
-		if (!isRecord$13(parsed)) return [];
+		if (!isRecord$14(parsed)) return [];
 		const servers = parsed["mcpServers"];
-		if (!isRecord$13(servers)) return [];
+		if (!isRecord$14(servers)) return [];
 		const out = [];
-		for (const [name, server] of Object.entries(servers)) if (isRecord$13(server) && server["auth"] === "oauth") out.push(name);
+		for (const [name, server] of Object.entries(servers)) if (isRecord$14(server) && server["auth"] === "oauth") out.push(name);
 		return out;
 	} catch {
 		return [];
@@ -290210,7 +290206,7 @@ var init_stub_detect = __esmMin((() => {
 	init_dist$8();
 }));
 // ../../packages/migration-legacy/src/steps/config.ts
-function isRecord$12(value) {
+function isRecord$13(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function emptyResult$1() {
@@ -290246,20 +290242,20 @@ function filterRegisteredExperimentalFlags(value) {
 * and its (already type-mapped) `type` is one the kosong runtime can construct. */
 function providerIsSupported(prov) {
 	const transformed = providersFromToml({ x: prov });
-	const entry = isRecord$12(transformed) ? transformed["x"] : void 0;
+	const entry = isRecord$13(transformed) ? transformed["x"] : void 0;
 	if (entry === void 0) return false;
 	try {
 		ProviderConfigSchema.parse(entry);
 	} catch {
 		return false;
 	}
-	const type = isRecord$12(entry) ? entry["type"] : void 0;
+	const type = isRecord$13(entry) ? entry["type"] : void 0;
 	return typeof type === "string" && SUPPORTED_PROVIDER_TYPES.has(type);
 }
 /** True when the nexgenk-cli model entry validates against nexgenk's v2 schema. */
 function modelIsSupported(mod) {
 	const transformed = modelsFromToml({ x: mod });
-	const entry = isRecord$12(transformed) ? transformed["x"] : void 0;
+	const entry = isRecord$13(transformed) ? transformed["x"] : void 0;
 	if (entry === void 0) return false;
 	try {
 		ModelRecordSchema.parse(entry);
@@ -290271,7 +290267,7 @@ function modelIsSupported(mod) {
 /** Order-insensitive deep-equality key, so re-ordered tables are not conflicts. */
 function stableKey(value) {
 	if (Array.isArray(value)) return `[${value.map(stableKey).join(",")}]`;
-	if (isRecord$12(value)) return `{${Object.keys(value).toSorted().map((k) => `${JSON.stringify(k)}:${stableKey(value[k])}`).join(",")}}`;
+	if (isRecord$13(value)) return `{${Object.keys(value).toSorted().map((k) => `${JSON.stringify(k)}:${stableKey(value[k])}`).join(",")}}`;
 	return JSON.stringify(value) ?? "null";
 }
 function deepEqual(a, b) {
@@ -290279,11 +290275,11 @@ function deepEqual(a, b) {
 }
 function mapLegacyProviderTypes(parsed) {
 	const providers = parsed["providers"];
-	if (!isRecord$12(providers)) return parsed;
+	if (!isRecord$13(providers)) return parsed;
 	let changed = false;
 	const mapped = {};
 	for (const [name, prov] of Object.entries(providers)) {
-		if (!isRecord$12(prov)) {
+		if (!isRecord$13(prov)) {
 			mapped[name] = prov;
 			continue;
 		}
@@ -290312,8 +290308,8 @@ function mergeConfig(target, migrated) {
 	const merged = { ...target };
 	const conflicts = [];
 	for (const [key, value] of Object.entries(migrated)) {
-		if ((key === "providers" || key === "models") && isRecord$12(value)) {
-			const section = isRecord$12(merged[key]) ? { ...merged[key] } : {};
+		if ((key === "providers" || key === "models") && isRecord$13(value)) {
+			const section = isRecord$13(merged[key]) ? { ...merged[key] } : {};
 			for (const [name, entry] of Object.entries(value)) if (section[name] === void 0) section[name] = entry;
 			else if (!deepEqual(section[name], entry)) conflicts.push(`${key}.${name}`);
 			merged[key] = section;
@@ -290348,18 +290344,18 @@ async function migrateConfigStep(input) {
 	if (targetText === void 0 || targetText === "# ~/.nexgenk/config.toml\n# Runtime settings for NexgenK.\n# This file starts empty so built-in defaults can apply.\n# Login will populate managed Nexgen provider and model entries.\n") targetMode = "overwrite";
 	else try {
 		const tp = parse$9(targetText);
-		targetParsed = isRecord$12(tp) ? tp : {};
+		targetParsed = isRecord$13(tp) ? tp : {};
 		targetMode = "merge";
 	} catch {
 		targetMode = "sibling";
 	}
-	const availableProviderNames = new Set(isRecord$12(targetParsed["providers"]) ? Object.keys(targetParsed["providers"]) : []);
-	const availableModelNames = new Set(isRecord$12(targetParsed["models"]) ? Object.keys(targetParsed["models"]) : []);
+	const availableProviderNames = new Set(isRecord$13(targetParsed["providers"]) ? Object.keys(targetParsed["providers"]) : []);
+	const availableModelNames = new Set(isRecord$13(targetParsed["models"]) ? Object.keys(targetParsed["models"]) : []);
 	const droppedProviders = [];
 	const keptProviders = {};
-	if (isRecord$12(parsed["providers"])) for (const [name, prov] of Object.entries(parsed["providers"])) if (isRecord$12(prov) && providerIsSupported(prov)) keptProviders[name] = prov;
+	if (isRecord$13(parsed["providers"])) for (const [name, prov] of Object.entries(parsed["providers"])) if (isRecord$13(prov) && providerIsSupported(prov)) keptProviders[name] = prov;
 	else droppedProviders.push(name);
-	const targetProviders = isRecord$12(targetParsed["providers"]) ? targetParsed["providers"] : {};
+	const targetProviders = isRecord$13(targetParsed["providers"]) ? targetParsed["providers"] : {};
 	const conflictedProviderNames = /* @__PURE__ */ new Set();
 	for (const [name, prov] of Object.entries(keptProviders)) {
 		const targetProv = targetProviders[name];
@@ -290367,8 +290363,8 @@ async function migrateConfigStep(input) {
 	}
 	const droppedModels = [];
 	const keptModels = {};
-	if (isRecord$12(parsed["models"])) for (const [name, mod] of Object.entries(parsed["models"])) {
-		if (!isRecord$12(mod) || !modelIsSupported(mod)) {
+	if (isRecord$13(parsed["models"])) for (const [name, mod] of Object.entries(parsed["models"])) {
+		if (!isRecord$13(mod) || !modelIsSupported(mod)) {
 			droppedModels.push(name);
 			continue;
 		}
@@ -290416,17 +290412,17 @@ async function migrateConfigStep(input) {
 			continue;
 		}
 		if (k === "default_model" && typeof v === "string" && keptModels[v] === void 0 && !availableModelNames.has(v)) continue;
-		if (k === "loop_control" && isRecord$12(v)) {
+		if (k === "loop_control" && isRecord$13(v)) {
 			const filteredLoopControl = filterFields(v, LOOP_CONTROL_FIELDS_TO_KEEP);
 			if (filteredLoopControl !== void 0) migratedTop[k] = filteredLoopControl;
 			continue;
 		}
-		if (k === "background" && isRecord$12(v)) {
+		if (k === "background" && isRecord$13(v)) {
 			const filteredBackground = filterFields(v, BACKGROUND_FIELDS_TO_KEEP);
 			if (filteredBackground !== void 0) migratedTop[k] = filteredBackground;
 			continue;
 		}
-		if (k === "experimental" && isRecord$12(v)) {
+		if (k === "experimental" && isRecord$13(v)) {
 			const filteredExperimental = filterRegisteredExperimentalFlags(v);
 			if (filteredExperimental !== void 0) migratedTop[k] = filteredExperimental;
 			continue;
@@ -290587,7 +290583,7 @@ function emptyResult(sourceUnreadable) {
 function isEnoent(error) {
 	return typeof error === "object" && error !== null && error.code === "ENOENT";
 }
-function isRecord$11(value) {
+function isRecord$12(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function migrateMcpStep(input) {
@@ -290604,9 +290600,9 @@ async function migrateMcpStep(input) {
 		return emptyResult(true);
 	}
 	const srcServers = {};
-	if (isRecord$11(sourceJson)) {
+	if (isRecord$12(sourceJson)) {
 		const raw = sourceJson["mcpServers"];
-		if (isRecord$11(raw)) for (const [name, srv] of Object.entries(raw)) srcServers[name] = srv;
+		if (isRecord$12(raw)) for (const [name, srv] of Object.entries(raw)) srcServers[name] = srv;
 	}
 	const mergedTargetServers = {};
 	let targetText;
@@ -290618,9 +290614,9 @@ async function migrateMcpStep(input) {
 	let targetUnparseable = false;
 	if (targetText !== void 0) try {
 		const parsed = JSON.parse(targetText);
-		if (isRecord$11(parsed)) {
+		if (isRecord$12(parsed)) {
 			const raw = parsed["mcpServers"];
-			if (isRecord$11(raw)) for (const [name, srv] of Object.entries(raw)) mergedTargetServers[name] = srv;
+			if (isRecord$12(raw)) for (const [name, srv] of Object.entries(raw)) mergedTargetServers[name] = srv;
 		}
 	} catch {
 		targetUnparseable = true;
@@ -314981,6 +314977,278 @@ var init_esm = __esmMin((() => {
 	import_commander = /* @__PURE__ */ __toESM(require_commander(), 1);
 	({program, createCommand, createArgument, createOption, CommanderError, InvalidArgumentError, InvalidOptionArgumentError, Command, Argument, Option, Help} = import_commander.default);
 }));
+// src/cli/sso/contract.ts
+init_session_import();
+init_esm();
+/**
+* Pure contract for the NexgenRouter SSO provisioning flow, ported from the
+* gateway client already in production (`nexgen-movil/src/lib/gateway/sso-contract.ts`).
+*
+* ```
+* 1. POST /sso/cli/start                (public) -> { login_id, poll_secret, user_code, verification_uri_complete }
+* 2. open verification_uri_complete                -> SSO login
+* 3. GET  /sso/cli/poll/{login_id}      [x-litellm-cli-poll-secret] -> pending… -> ready { key (JWT 24h), user_id, teams }
+* 3b. GET  .../poll/{login_id}?team_id=<id>        -> ready { key } when `requires_team_selection`
+* 4. POST /key/generate  (Bearer JWT)              -> durable key `sk-…`
+* ```
+*
+* Everything here is decided without network so the parsing rules stay testable:
+* the HTTP client that uses these pieces lives in `./client.ts`.
+*/
+/** Team alias in the gateway that carries the models a CLI key should be scoped to. */
+const NEXGEN_SSO_TEAM_ALIAS = "nexgen-desktop";
+var SsoError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SsoError";
+		this.code = code;
+	}
+};
+function isRecord$11(value) {
+	return typeof value === "object" && value !== null;
+}
+function str$1(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function strArray(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter((item) => typeof item === "string");
+}
+function parseTeamDetails(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter(isRecord$11).map((item) => ({
+		teamId: str$1(item["team_id"]),
+		teamAlias: str$1(item["team_alias"]),
+		teamModels: strArray(item["team_models"])
+	}));
+}
+function parseSsoStart(body) {
+	if (!isRecord$11(body)) throw new SsoError("start_malformed", "/sso/cli/start returned a non-JSON body.");
+	const loginId = str$1(body["login_id"]);
+	if (loginId === void 0) throw new SsoError("start_malformed", "/sso/cli/start did not return login_id.");
+	const pollSecret = str$1(body["poll_secret"]);
+	if (pollSecret === void 0) throw new SsoError("no_poll_secret", "/sso/cli/start did not return poll_secret, so the SSO state cannot be polled.");
+	const expiresIn = typeof body["expires_in"] === "number" ? body["expires_in"] : void 0;
+	return {
+		loginId,
+		pollSecret,
+		userCode: typeof body["user_code"] === "string" ? body["user_code"] : "",
+		verificationUriComplete: str$1(body["verification_uri_complete"]),
+		expiresInSeconds: expiresIn
+	};
+}
+function parseSsoPoll(body) {
+	if (!isRecord$11(body)) throw new SsoError("malformed", "/sso/cli/poll returned a non-JSON body.");
+	const status = str$1(body["status"]);
+	if (status === void 0) throw new SsoError("malformed", "/sso/cli/poll did not return status.");
+	return {
+		status,
+		key: str$1(body["key"]),
+		userId: str$1(body["user_id"]),
+		teams: strArray(body["teams"]) ?? [],
+		teamDetails: parseTeamDetails(body["team_details"]),
+		teamId: str$1(body["team_id"]),
+		requiresTeamSelection: body["requires_team_selection"] === true
+	};
+}
+function parseReady(body) {
+	if (body.key === void 0) throw new SsoError("no_session_token", "the gateway returned no session token (key).");
+	return {
+		jwt: body.key,
+		userId: body.userId,
+		teams: body.teams,
+		teamDetails: body.teamDetails,
+		teamId: body.teamId
+	};
+}
+const NO_TEAM_MESSAGE = `this account does not belong to the ${NEXGEN_SSO_TEAM_ALIAS} team — ask an administrator to add it`;
+const NO_MATCHING_TEAM_MESSAGE = `this account belongs to several teams and none is ${NEXGEN_SSO_TEAM_ALIAS} — ask an administrator to add it`;
+const NO_TEAM_MODELS_MESSAGE = `the ${NEXGEN_SSO_TEAM_ALIAS} team has no models assigned — ask an administrator to check the team`;
+function resolveLoginTeam(teams, details) {
+	const byAlias = details.find((detail) => detail.teamAlias === "nexgen-desktop" && detail.teamId !== void 0)?.teamId;
+	if (byAlias !== void 0) return { teamId: byAlias };
+	if (teams.length === 0 && details.length === 0) return { reason: "no_teams" };
+	if (teams.length === 1) return { teamId: teams[0] };
+	if (teams.length === 0 && details.length === 1 && details[0].teamId !== void 0) return { teamId: details[0].teamId };
+	return { reason: "no_matching_team" };
+}
+function teamHasModels(details, teamId, teams) {
+	const target = teamId ?? (teams.length === 1 ? teams[0] : void 0);
+	if (target === void 0) return void 0;
+	const detail = details.find((item) => item.teamId === target);
+	if (detail === void 0) return void 0;
+	if (detail.teamModels !== void 0 && detail.teamModels.length === 0) return false;
+	return true;
+}
+/**
+* `ready` without `key` is not the end of the flow: the gateway answers that
+* way while the account spans several teams and one must be picked, and also
+* transiently before minting the session token.
+*/
+function decideSsoPoll(body) {
+	if (body.status !== "ready") return { action: "wait" };
+	if (body.requiresTeamSelection) {
+		const resolved = resolveLoginTeam(body.teams, body.teamDetails);
+		if ("reason" in resolved) return {
+			action: "fail",
+			code: "no_team",
+			message: resolved.reason === "no_teams" ? NO_TEAM_MESSAGE : NO_MATCHING_TEAM_MESSAGE
+		};
+		return {
+			action: "select_team",
+			teamId: resolved.teamId
+		};
+	}
+	if (body.key === void 0) return { action: "wait" };
+	if (body.teams.length === 0 && body.teamId === void 0) return {
+		action: "fail",
+		code: "no_team",
+		message: NO_TEAM_MESSAGE
+	};
+	if (teamHasModels(body.teamDetails, body.teamId, body.teams) === false) return {
+		action: "fail",
+		code: "no_team",
+		message: NO_TEAM_MODELS_MESSAGE
+	};
+	return {
+		action: "ready",
+		ready: parseReady(body)
+	};
+}
+/** LiteLLM requires `key_alias` to be unique across the deployment, so each mint gets its own. */
+function keyAliasFor(userId, now = Date.now()) {
+	return `nexgenk-${userId}-${now}`;
+}
+function isDurableKey(value) {
+	return typeof value === "string" && value.startsWith("sk-");
+}
+function parseMintResponse(body, alias) {
+	if (!isRecord$11(body)) throw new SsoError("malformed", "/key/generate returned a non-JSON body.");
+	const key = body["key"];
+	if (!isDurableKey(key)) throw new SsoError("malformed", "the generated key is not a durable `sk-…` key.");
+	return {
+		key,
+		alias
+	};
+}
+/** Fallback team pick for the mint when the poll did not scope a team. */
+function selectTeam(teams, details) {
+	const byAlias = details.find((detail) => detail.teamAlias === NEXGEN_SSO_TEAM_ALIAS)?.teamId;
+	if (byAlias !== void 0) return byAlias;
+	const firstWithId = details.find((detail) => detail.teamId !== void 0)?.teamId;
+	if (firstWithId !== void 0) return firstWithId;
+	return teams.length === 1 ? teams[0] : void 0;
+}
+// src/cli/sso/client.ts
+/**
+* HTTP client for the NexgenRouter SSO provisioning flow described in
+* `./contract.ts`. It turns a browser login into the durable `sk-…` key the
+* CLI stores, mirroring the client already in production for the mobile and
+* desktop apps.
+*/
+const POLL_INTERVAL_MS$1 = 2e3;
+const DEFAULT_EXPIRES_IN_SECONDS = 600;
+const MAX_TEAM_SELECTIONS = 2;
+async function readJson(response) {
+	const text = await response.text();
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new SsoError("malformed", `the gateway answered ${response.status} with a non-JSON body.`);
+	}
+}
+async function startSso(input, signal) {
+	const response = await fetch(`${input.gatewayUrl}/sso/cli/start`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: "{}",
+		signal
+	});
+	if (!response.ok) throw new SsoError("start_malformed", `/sso/cli/start answered HTTP ${response.status}.`);
+	return parseSsoStart(await readJson(response));
+}
+async function pollOnce(input, start, teamId, signal) {
+	const url = new URL(`${input.gatewayUrl}/sso/cli/poll/${encodeURIComponent(start.loginId)}`);
+	if (teamId !== void 0) url.searchParams.set("team_id", teamId);
+	const response = await fetch(url, {
+		method: "GET",
+		headers: { "x-litellm-cli-poll-secret": start.pollSecret },
+		signal
+	});
+	if (!response.ok) throw new SsoError("malformed", `/sso/cli/poll answered HTTP ${response.status}.`);
+	return parseSsoPoll(await readJson(response));
+}
+async function mintDurableKey(input, ready, signal) {
+	const userId = ready.userId;
+	if (userId === void 0) throw new SsoError("no_user_id", "the gateway returned no user_id, so the key alias cannot be built.");
+	const teamId = ready.teamId ?? selectTeam(ready.teams, ready.teamDetails);
+	if (teamId === void 0) throw new SsoError("no_team", "this account has no resolvable team in the gateway — ask an administrator to add it to nexgen-desktop.");
+	const alias = keyAliasFor(userId, input.now?.());
+	const response = await fetch(`${input.gatewayUrl}/key/generate`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${ready.jwt}`
+		},
+		body: JSON.stringify({
+			key_alias: alias,
+			team_id: teamId
+		}),
+		signal
+	});
+	const body = await readJson(response);
+	if (!response.ok) throw new SsoError("malformed", `the gateway refused to create the key: ${typeof body === "object" && body !== null && "error" in body ? JSON.stringify(body.error).slice(0, 200) : `HTTP ${response.status}`}`);
+	const minted = parseMintResponse(body, alias);
+	return {
+		key: minted.key,
+		alias: minted.alias,
+		userId
+	};
+}
+/**
+* Runs the whole flow and returns the durable key. The caller persists nothing
+* until this resolves, so a cancelled login leaves no half-written state.
+*/
+async function provisionApiKeyViaSso(input) {
+	const now = input.now ?? Date.now;
+	const sleep = input.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const interval = input.pollIntervalMs ?? POLL_INTERVAL_MS$1;
+	const start = await startSso(input, input.signal);
+	const browserUrl = start.verificationUriComplete ?? `${input.gatewayUrl}/sso/key/generate?source=litellm-cli&key=${encodeURIComponent(start.loginId)}&user_code=${encodeURIComponent(start.userCode)}`;
+	input.onStatus?.(`Opening browser to sign in: ${browserUrl}`);
+	input.openBrowser?.(browserUrl);
+	const deadline = now() + (start.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS) * 1e3 - 5e3;
+	let pendingTeamId;
+	let chosenTeamId;
+	let selections = 0;
+	let sawReadyWithoutKey = false;
+	for (;;) {
+		if (input.signal?.aborted === true) throw new SsoError("sso_timeout", "login cancelled.");
+		const body = await pollOnce(input, start, pendingTeamId, input.signal);
+		if (pendingTeamId !== void 0) chosenTeamId = pendingTeamId;
+		pendingTeamId = void 0;
+		if (chosenTeamId !== void 0 && body.status === "ready" && body.key !== void 0) return mintDurableKey(input, {
+			jwt: body.key,
+			userId: body.userId,
+			teamId: body.teamId ?? chosenTeamId,
+			teams: body.teams,
+			teamDetails: body.teamDetails
+		}, input.signal);
+		const decision = decideSsoPoll(body);
+		if (decision.action === "ready") return mintDurableKey(input, decision.ready, input.signal);
+		if (decision.action === "fail") throw new SsoError(decision.code, decision.message);
+		if (decision.action === "select_team") {
+			selections += 1;
+			if (selections > MAX_TEAM_SELECTIONS) throw new SsoError("no_team", "the gateway keeps asking for a team selection that cannot be satisfied.");
+			pendingTeamId = decision.teamId;
+			continue;
+		}
+		if (body.status === "ready") sawReadyWithoutKey = true;
+		if (now() >= deadline) throw new SsoError(sawReadyWithoutKey ? "no_session_token" : "sso_timeout", sawReadyWithoutKey ? "the SSO finished without a session token (the gateway never returned one)." : "the SSO did not finish in time — the browser login was never completed.");
+		await sleep(interval);
+	}
+}
 // src/utils/process/resolve-command.ts
 function pathExtensions(platform, env) {
 	if (platform !== "win32") return [""];
@@ -315066,63 +315334,162 @@ var init_open_url = __esmMin((() => {
 	init_resolve_command();
 }));
 // src/cli/sub/login-flow.ts
-init_session_import();
-init_esm();
 init_src$8();
-init_src$13();
 init_version$2();
 init_open_url();
-init_region();
-/** Parse a `--region` CLI flag; exits with an actionable message on bad input. */
-function parseRegionFlag(value) {
-	if (value !== "mainland-cn" && value !== "global") {
-		process.stderr.write(`Invalid --region "${value}" (expected "mainland-cn" or "global").\n`);
+const DEFAULT_BASE_URL = "https://ia.nexgen.systems/v1";
+const PROVIDER_ID = "nexgenk";
+const PREFERRED_MODEL = "nexgen-auto";
+const FALLBACK_MAX_CONTEXT_SIZE = 262144;
+const MODELS_REQUEST_TIMEOUT_MS = 2e4;
+async function runLoginFlow(options = {}) {
+	try {
+		const baseUrl = normalizeBaseUrl(options.baseUrl ?? readEnv("NEXGEN_BASE_URL") ?? DEFAULT_BASE_URL);
+		const { apiKey, source } = await obtainApiKey(options, baseUrl);
+		const models = await fetchRouterModels({
+			apiKey,
+			baseUrl
+		});
+		const harness = createNexgenHarness({
+			identity: createNexgenCodeHostIdentity(),
+			uiMode: "cli"
+		});
+		await harness.ensureConfigFile();
+		const defaultModel = (await harness.setConfig(buildConfigPatch({
+			apiKey,
+			baseUrl,
+			models
+		}))).defaultModel ?? PREFERRED_MODEL;
+		process.stderr.write([
+			"",
+			`Logged in to ${baseUrl} (${models.length} models available) via ${source}.`,
+			`  provider:      ${PROVIDER_ID}`,
+			`  default model: ${defaultModel}`,
+			`  config:        ${harness.configPath}`,
+			"",
+			`Verify with: nexgenk -p "Responde solo: ok"`,
+			""
+		].join("\n"));
+		process.exit(0);
+	} catch (error) {
+		process.stderr.write(`Login failed: ${error instanceof Error ? error.message : String(error)}\n`);
 		process.exit(1);
 	}
-	return value;
 }
-async function runLoginFlow(options = {}) {
-	const region = options.region ?? regionForBareLogin(persistedNexgenOAuthRef());
-	const harness = createNexgenHarness({
-		identity: createNexgenCodeHostIdentity(),
-		uiMode: "cli"
-	});
+function readEnv(name) {
+	const value = process.env[name]?.trim();
+	return value === void 0 || value.length === 0 ? void 0 : value;
+}
+async function obtainApiKey(options, baseUrl) {
+	const explicit = options.apiKey?.trim();
+	if (explicit !== void 0 && explicit !== "") return {
+		apiKey: explicit,
+		source: "the provided API key"
+	};
+	const fromEnv = readEnv("NEXGEN_API_KEY");
+	if (fromEnv !== void 0) return {
+		apiKey: fromEnv,
+		source: "NEXGEN_API_KEY"
+	};
+	process.stderr.write([
+		"",
+		"No API key found — signing in with SSO.",
+		"A browser window will open; approve the login and this command finishes on its own.",
+		""
+	].join("\n"));
 	const controller = new AbortController();
-	process.once("SIGINT", () => {
-		controller.abort();
-	});
+	const onSigint = () => controller.abort();
+	process.once("SIGINT", onSigint);
 	try {
-		const result = await harness.auth.login(void 0, {
+		const provisioned = await provisionApiKeyViaSso({
+			gatewayUrl: gatewayOrigin(baseUrl),
 			signal: controller.signal,
-			region,
-			onDeviceCode: (data) => {
-				const url = data.verificationUriComplete || data.verificationUri;
-				process.stderr.write([
-					"",
-					`Opening browser for Nexgen device login: ${url}`,
-					`If the browser did not open, paste the URL above and enter code: ${data.userCode}`,
-					data.expiresIn !== null && data.expiresIn !== void 0 ? `Code expires in ${data.expiresIn}s.` : void 0,
-					"Waiting for authorization to complete…",
-					""
-				].filter((line) => line !== void 0).join("\n"));
-				try {
-					openUrl(url);
-				} catch {}
+			onStatus: (line) => process.stderr.write(`${line}\n`),
+			openBrowser: (url) => {
+				if (options.noBrowser === true) {
+					process.stderr.write(`Open this URL to sign in: ${url}\n`);
+					return;
+				}
+				process.stderr.write(`Waiting for the SSO login to complete…\n`);
+				openUrl(url, (error) => {
+					process.stderr.write(`Could not open a browser (${error.message}). Open this URL to sign in: ${url}\n`);
+				});
 			}
 		});
-		process.stderr.write(`Logged in to ${result.providerName}.\n`);
-		process.exit(0);
+		return {
+			apiKey: provisioned.key,
+			source: `SSO (key alias ${provisioned.alias})`
+		};
+	} finally {
+		process.off("SIGINT", onSigint);
+	}
+}
+function normalizeBaseUrl(raw) {
+	const trimmed = raw.trim().replace(/\/+$/, "");
+	if (trimmed === "") throw new Error("empty base URL.");
+	let parsed;
+	try {
+		parsed = new URL(trimmed);
+	} catch {
+		throw new Error(`invalid base URL "${raw}".`);
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`base URL must be http(s), got "${raw}".`);
+	return parsed.pathname === "" || parsed.pathname === "/" ? `${trimmed}/v1` : trimmed;
+}
+function gatewayOrigin(baseUrl) {
+	const parsed = new URL(baseUrl);
+	return /\/v1\/?$/.test(parsed.pathname) ? parsed.origin : baseUrl.replace(/\/+$/, "");
+}
+async function fetchRouterModels(input) {
+	const url = `${input.baseUrl}/models`;
+	let response;
+	try {
+		response = await fetch(url, {
+			headers: {
+				Authorization: `Bearer ${input.apiKey}`,
+				Accept: "application/json"
+			},
+			signal: AbortSignal.timeout(MODELS_REQUEST_TIMEOUT_MS)
+		});
 	} catch (error) {
-		if (controller.signal.aborted) process.stderr.write("Login cancelled.\n");
-		else if (error instanceof OAuthAccessDeniedError) {
-			const message = error instanceof Error ? error.message : String(error);
-			process.stderr.write(`Login cancelled: ${message}\n`);
-		} else {
-			const message = error instanceof Error ? error.message : String(error);
-			process.stderr.write(`Login failed: ${message}\n`);
-		}
-		process.exit(1);
+		if (error instanceof Error && error.name === "TimeoutError") throw new Error(`${url} did not answer within ${MODELS_REQUEST_TIMEOUT_MS / 1e3}s.`);
+		throw new Error(`could not reach ${url}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (response.status === 401 || response.status === 403) throw new Error(`${url} rejected the API key (HTTP ${response.status}). Check the key and try again.`);
+	if (!response.ok) {
+		const body = (await response.text().catch(() => "")).slice(0, 200);
+		throw new Error(`${url} answered HTTP ${response.status}${body === "" ? "" : `: ${body}`}`);
 	}
+	const models = ((await response.json().catch(() => void 0))?.data ?? []).flatMap((entry) => {
+		if (typeof entry.id !== "string" || entry.id.length === 0) return [];
+		return [{
+			id: entry.id,
+			maxInputTokens: entry.max_input_tokens,
+			maxOutputTokens: entry.max_output_tokens
+		}];
+	});
+	if (models.length === 0) throw new Error(`${url} returned no models for this key.`);
+	return models;
+}
+function buildConfigPatch(input) {
+	const aliases = {};
+	for (const model of input.models) aliases[model.id] = {
+		provider: PROVIDER_ID,
+		model: model.id,
+		maxContextSize: model.maxInputTokens ?? FALLBACK_MAX_CONTEXT_SIZE,
+		maxOutputSize: model.maxOutputTokens,
+		displayName: model.id
+	};
+	const ids = input.models.map((model) => model.id);
+	return {
+		providers: { [PROVIDER_ID]: {
+			type: "nexgenk",
+			baseUrl: input.baseUrl,
+			apiKey: input.apiKey
+		} },
+		models: aliases,
+		defaultModel: ids.includes(PREFERRED_MODEL) ? PREFERRED_MODEL : ids[0]
+	};
 }
 // ../../node_modules/.pnpm/@agentclientprotocol+sdk@1.3.0_zod@4.3.6/node_modules/@agentclientprotocol/sdk/dist/schema/index.js
 var AGENT_METHODS, CLIENT_METHODS, PROTOCOL_METHODS;
@@ -322087,9 +322454,12 @@ init_version$2();
 init_app$1();
 init_paths();
 function registerAcpCommand(parent) {
-	parent.command("acp").description("Run nexgenk as an Agent Client Protocol (ACP) server over stdio.").option("--login", "Run the device-code login flow then exit (entry point for ACP terminal-auth).", false).option("--region <region>", "Login region used together with --login: \"mainland-cn\" (nexgenk.com) or \"global\" (nexgenk.ai).").action(async (opts) => {
+	parent.command("acp").description("Run nexgenk as an Agent Client Protocol (ACP) server over stdio.").option("--login", "Run the API-key login flow then exit (entry point for ACP terminal-auth).", false).option("--api-key <key>", "API key used together with --login. Defaults to NEXGEN_API_KEY.").option("--base-url <url>", "Router base URL used together with --login.").action(async (opts) => {
 		if (opts.login === true) {
-			await runLoginFlow({ region: opts.region === void 0 ? void 0 : parseRegionFlag(opts.region) });
+			await runLoginFlow({
+				apiKey: opts.apiKey,
+				baseUrl: opts.baseUrl
+			});
 			return;
 		}
 		const sandboxHome = process.env[NEXGEN_HOME_ENV];
@@ -323136,8 +323506,12 @@ function registerInstallDesktopCommand(program) {
 }
 // src/cli/sub/login.ts
 function registerLoginCommand(parent) {
-	parent.command("login").description("Authenticate with NexgenK CLI via the device-code flow.").option("--region <region>", "Login region: \"mainland-cn\" (nexgenk.com) or \"global\" (nexgenk.ai).").action(async (opts) => {
-		await runLoginFlow({ region: opts.region === void 0 ? void 0 : parseRegionFlag(opts.region) });
+	parent.command("login").description("Sign in with SSO (or an API key) and configure the default model.").option("--api-key <key>", "Use this API key instead of the SSO flow. Defaults to NEXGEN_API_KEY.").option("--base-url <url>", "Router base URL. Defaults to NEXGEN_BASE_URL or https://ia.nexgen.systems/v1.").option("--no-browser", "Print the SSO URL instead of opening a browser (headless hosts).").action(async (opts) => {
+		await runLoginFlow({
+			apiKey: opts.apiKey,
+			baseUrl: opts.baseUrl,
+			noBrowser: opts.browser === false
+		});
 	});
 }
 // src/built-in-catalog.ts