nexgenk 1.0.1 → 1.1.0

package/dist/main.mjs

@@ -41447,10 +41447,10 @@ function finalizeChatCompletion(snapshot, params) {
 					tool_calls: tool_calls.map((tool_call, i) => {
 						const { function: fn, type, id, ...toolRest } = tool_call;
 						const { arguments: args, name, ...fnRest } = fn || {};
-						if (id == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].id\n${str$2(snapshot)}`);
-						if (type == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].type\n${str$2(snapshot)}`);
-						if (name == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.name\n${str$2(snapshot)}`);
-						if (args == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.arguments\n${str$2(snapshot)}`);
+						if (id == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].id\n${str$3(snapshot)}`);
+						if (type == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].type\n${str$3(snapshot)}`);
+						if (name == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.name\n${str$3(snapshot)}`);
+						if (args == null) throw new OpenAIError(`missing choices[${index}].tool_calls[${i}].function.arguments\n${str$3(snapshot)}`);
 						return {
 							...toolRest,
 							id,
@@ -41483,7 +41483,7 @@ function finalizeChatCompletion(snapshot, params) {
 		...system_fingerprint ? { system_fingerprint } : {}
 	}, params);
 }
-function str$2(x) {
+function str$3(x) {
 	return JSON.stringify(x);
 }
 var _ChatCompletionStream_instances, _ChatCompletionStream_params, _ChatCompletionStream_choiceEventStates, _ChatCompletionStream_currentChatCompletionSnapshot, _ChatCompletionStream_beginRequest, _ChatCompletionStream_getChoiceEventState, _ChatCompletionStream_addChunk, _ChatCompletionStream_emitToolCallDoneEvent, _ChatCompletionStream_emitContentDoneEvents, _ChatCompletionStream_endRequest, _ChatCompletionStream_getAutoParseableResponseFormat, _ChatCompletionStream_accumulateChatCompletion, ChatCompletionStream;
@@ -58702,7 +58702,7 @@ function tokenFromWire(wire) {
 }
 var init_types$28 = __esmMin((() => {}));
 // ../../packages/nexgen-auth/src/utils.ts
-function isRecord$25(value) {
+function isRecord$26(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var init_utils$4 = __esmMin((() => {}));
@@ -58757,7 +58757,7 @@ var init_storage = __esmMin((() => {
 			} catch {
 				return;
 			}
-			if (!isRecord$25(parsed)) return void 0;
+			if (!isRecord$26(parsed)) return void 0;
 			return tokenFromWire(parsed);
 		}
 		async save(name, token) {
@@ -58810,7 +58810,7 @@ function extractApiErrorMessage(value) {
 		}
 		return;
 	}
-	if (!isRecord$25(value)) return void 0;
+	if (!isRecord$26(value)) return void 0;
 	for (const key of DIRECT_ERROR_KEYS) {
 		const message = stringField$7(value, key);
 		if (message !== void 0) return message;
@@ -58818,7 +58818,7 @@ function extractApiErrorMessage(value) {
 	const error = value["error"];
 	const errorString = nonEmptyString$6(error);
 	if (errorString !== void 0) return errorString;
-	if (isRecord$25(error)) for (const key of NESTED_ERROR_KEYS) {
+	if (isRecord$26(error)) for (const key of NESTED_ERROR_KEYS) {
 		const message = stringField$7(error, key);
 		if (message !== void 0) return message;
 	}
@@ -58907,7 +58907,7 @@ async function postForm(url, params, deviceHeaders, options) {
 	let data = {};
 	try {
 		const parsed = await response.json();
-		if (isRecord$25(parsed)) data = parsed;
+		if (isRecord$26(parsed)) data = parsed;
 	} catch {}
 	return {
 		status,
@@ -60827,7 +60827,7 @@ function formatDuration$1(totalSeconds) {
 	return parts.length > 0 ? parts.join(" ") : "0s";
 }
 function parseManagedUsagePayload(payload) {
-	if (!isRecord$25(payload)) return {
+	if (!isRecord$26(payload)) return {
 		usages: {},
 		extraUsage: null
 	};
@@ -60837,7 +60837,7 @@ function parseManagedUsagePayload(payload) {
 	};
 }
 function parseQuotaUsages(raw) {
-	if (!isRecord$25(raw)) return {};
+	if (!isRecord$26(raw)) return {};
 	return {
 		limit5h: parseQuotaEntry(raw["limit_5h"]),
 		limit7d: parseQuotaEntry(raw["limit_7d"]),
@@ -60846,7 +60846,7 @@ function parseQuotaUsages(raw) {
 	};
 }
 function parseQuotaEntry(raw) {
-	if (!isRecord$25(raw)) return void 0;
+	if (!isRecord$26(raw)) return void 0;
 	const usedRatio = ratioValue(raw["used_ratio"]);
 	if (usedRatio === void 0) return void 0;
 	const resetAt = raw["reset_time"];
@@ -60861,7 +60861,7 @@ function fixedPointToCents(value) {
 	return Math.round(cents);
 }
 function parseMoney(raw) {
-	if (!isRecord$25(raw)) return null;
+	if (!isRecord$26(raw)) return null;
 	const cents = intValue(raw["priceInCents"]);
 	if (cents === null) return null;
 	return {
@@ -60870,9 +60870,9 @@ function parseMoney(raw) {
 	};
 }
 function parseBoosterWallet(raw) {
-	if (!isRecord$25(raw)) return null;
+	if (!isRecord$26(raw)) return null;
 	const balance = raw["balance"];
-	if (!isRecord$25(balance)) return null;
+	if (!isRecord$26(balance)) return null;
 	if (balance["type"] !== "BOOSTER") return null;
 	const amountRaw = intValue(balance["amount"]);
 	if (amountRaw === null || amountRaw <= 0) return null;
@@ -61000,8 +61000,8 @@ function userExtras(existing, remoteOwnedFields) {
 	return out;
 }
 function mergeRefreshedModelAlias(existing, remote, remoteOwnedFields) {
-	const current = isRecord$25(existing) ? existing : {};
-	const overrides = cloneOverrides(isRecord$25(current["overrides"]) ? current["overrides"] : void 0);
+	const current = isRecord$26(existing) ? existing : {};
+	const overrides = cloneOverrides(isRecord$26(current["overrides"]) ? current["overrides"] : void 0);
 	return {
 		...userExtras(current, remoteOwnedFields),
 		...remote,
@@ -61184,19 +61184,19 @@ function resolveNexgenCodeLoginAuth(options) {
 	};
 }
 function toModelInfo$1(item) {
-	if (!isRecord$25(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
+	if (!isRecord$26(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
 	const rawLimit = item["limit"];
-	const limit = isRecord$25(rawLimit) ? rawLimit : void 0;
+	const limit = isRecord$26(rawLimit) ? rawLimit : void 0;
 	const contextLength = Number(limit?.["context"]);
 	if (!Number.isInteger(contextLength) || contextLength <= 0) throw new Error(`NexgenK model "${item["id"]}" must include a positive limit.context.`);
 	const displayName = item["display_name"];
 	const normalizedDisplayName = typeof displayName === "string" && displayName.length > 0 ? displayName : void 0;
 	const supportsToolUse = Object.hasOwn(item, "supports_tool_use") ? Boolean(item["supports_tool_use"]) : true;
 	const rawModalities = item["modalities"];
-	const inputModalities = isRecord$25(rawModalities) ? parseStringArray(rawModalities["input"]) : void 0;
+	const inputModalities = isRecord$26(rawModalities) ? parseStringArray(rawModalities["input"]) : void 0;
 	const reasoning = parseModelReasoning(item["reasoning"]);
 	const rawTools = item["tools"];
-	const supportsDynamicTools = isRecord$25(rawTools) && rawTools["dynamic_load"] === true;
+	const supportsDynamicTools = isRecord$26(rawTools) && rawTools["dynamic_load"] === true;
 	return {
 		id: item["id"],
 		contextLength,
@@ -61222,7 +61222,7 @@ function toModelInfo$1(item) {
 * that is not listed in `valid` is dropped.
 */
 function parseModelReasoning(value) {
-	if (!isRecord$25(value)) return {
+	if (!isRecord$26(value)) return {
 		supportsReasoning: false,
 		supportsThinkingType: "no",
 		supportEfforts: void 0,
@@ -61231,7 +61231,7 @@ function parseModelReasoning(value) {
 	const rawType = value["type"];
 	const supportsThinkingType = rawType === "only" || rawType === "both" ? rawType : rawType === "none" ? "no" : void 0;
 	const rawEffort = value["effort"];
-	const effort = isRecord$25(rawEffort) ? rawEffort : void 0;
+	const effort = isRecord$26(rawEffort) ? rawEffort : void 0;
 	const supportEfforts = effort !== void 0 ? parseStringArray(effort["valid"]) : void 0;
 	const rawDefault = effort?.["default"];
 	const parsedDefault = typeof rawDefault === "string" && rawDefault.length > 0 ? rawDefault : void 0;
@@ -61294,7 +61294,7 @@ async function fetchManagedNexgenCodeModels(options) {
 		throw new Error(message);
 	}
 	const payload = await response.json();
-	if (!isRecord$25(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${baseUrl}.`);
+	if (!isRecord$26(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${baseUrl}.`);
 	return payload["data"].map((item) => toModelInfo$1(item)).filter((item) => item !== void 0);
 }
 /**
@@ -61331,10 +61331,10 @@ function applyManagedNexgenCodeConfig(config, options) {
 		apiKeyEnv: "NEXGEN_API_KEY"
 	};
 	const upstreamKeys = new Set(options.models.map((m) => managedModelKey(m.id)));
-	for (const [key, model] of Object.entries(existingModels)) if (isRecord$25(model) && model["provider"] === "managed:nexgenk" && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, model] of Object.entries(existingModels)) if (isRecord$26(model) && model["provider"] === "managed:nexgenk" && !upstreamKeys.has(key)) delete existingModels[key];
 	for (const model of options.models) {
 		const key = managedModelKey(model.id);
-		existingModels[key] = mergeRefreshedModelAlias(isRecord$25(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(NEXGEN_PROVIDER_NAME, model), MANAGED_NEXGEN_MODEL_FIELDS);
+		existingModels[key] = mergeRefreshedModelAlias(isRecord$26(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(NEXGEN_PROVIDER_NAME, model), MANAGED_NEXGEN_MODEL_FIELDS);
 	}
 	config.models = existingModels;
 	config.defaultModel = selectedDefault.modelKey;
@@ -61370,10 +61370,10 @@ function applyManagedApiKeyProviderModels(config, providerId, models, aliasPrefi
 	for (const model of models) assertPositiveContextLength(model);
 	const existingModels = config.models ?? {};
 	const upstreamKeys = new Set(models.map((m) => `${aliasPrefix}${m.id}`));
-	for (const [key, model] of Object.entries(existingModels)) if (isRecord$25(model) && model["provider"] === providerId && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, model] of Object.entries(existingModels)) if (isRecord$26(model) && model["provider"] === providerId && !upstreamKeys.has(key)) delete existingModels[key];
 	for (const model of models) {
 		const key = `${aliasPrefix}${model.id}`;
-		existingModels[key] = mergeRefreshedModelAlias(isRecord$25(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(providerId, model), MANAGED_NEXGEN_MODEL_FIELDS);
+		existingModels[key] = mergeRefreshedModelAlias(isRecord$26(existingModels[key]) ? existingModels[key] : {}, toManagedModelAlias(providerId, model), MANAGED_NEXGEN_MODEL_FIELDS);
 	}
 	config.models = existingModels;
 }
@@ -61382,7 +61382,7 @@ function applyManagedNexgenCodeLogoutConfig(config) {
 	let removedDefaultModel = false;
 	const existingModels = config.models ?? {};
 	for (const [key, model] of Object.entries(existingModels)) {
-		if (!isRecord$25(model) || model["provider"] !== "managed:nexgenk") continue;
+		if (!isRecord$26(model) || model["provider"] !== "managed:nexgenk") continue;
 		delete existingModels[key];
 		if (config.defaultModel === key) removedDefaultModel = true;
 	}
@@ -61421,7 +61421,7 @@ function selectDefaultModel(config, models, options) {
 function canPreserveDefaultModel(existingModels, defaultModel, managedModels) {
 	if (managedModels.has(defaultModel)) return true;
 	const existing = existingModels[defaultModel];
-	return isRecord$25(existing) && existing["provider"] !== "managed:nexgenk";
+	return isRecord$26(existing) && existing["provider"] !== "managed:nexgenk";
 }
 function clearManagedNexgenCodeConfig(config) {
 	const removedProvider = Object.hasOwn(config.providers, NEXGEN_PROVIDER_NAME);
@@ -61429,7 +61429,7 @@ function clearManagedNexgenCodeConfig(config) {
 	const removedModels = [];
 	const models = config.models;
 	if (models !== void 0) for (const [key, model] of Object.entries(models)) {
-		if (!isRecord$25(model) || model["provider"] !== "managed:nexgenk") continue;
+		if (!isRecord$26(model) || model["provider"] !== "managed:nexgenk") continue;
 		delete models[key];
 		removedModels.push(key);
 	}
@@ -62003,7 +62003,7 @@ function nexgenkCodeUserInfoUrl() {
 * string, is malformed; every other field degrades independently.
 */
 function parseManagedUserInfoPayload(payload) {
-	if (!isRecord$25(payload)) return null;
+	if (!isRecord$26(payload)) return null;
 	const userId = stringField$6(payload, "user_id");
 	if (userId === void 0) return null;
 	return {
@@ -62027,7 +62027,7 @@ function parseManagedUserInfoPayload(payload) {
 	};
 }
 function parsePhone(raw) {
-	if (!isRecord$25(raw)) return void 0;
+	if (!isRecord$26(raw)) return void 0;
 	const countryCode = stringField$6(raw, "country_code") ?? "";
 	const number = stringField$6(raw, "number") ?? "";
 	if (countryCode === "" && number === "") return void 0;
@@ -62192,7 +62192,7 @@ async function fetchChatTitle(url, accessToken, chatContent, opts = {}) {
 	}
 }
 function parseChatTitle(payload) {
-	if (!isRecord$25(payload)) return void 0;
+	if (!isRecord$26(payload)) return void 0;
 	const value = payload["title"];
 	if (typeof value !== "string") return void 0;
 	const title = value.trim();
@@ -62391,7 +62391,7 @@ function isOpenPlatformId(id) {
 	return OPEN_PLATFORMS.some((p) => p.id === id);
 }
 function toModelInfo(item) {
-	if (!isRecord$25(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
+	if (!isRecord$26(item) || typeof item["id"] !== "string" || item["id"].length === 0) return;
 	const contextLength = Number(item["context_length"]);
 	if (!Number.isInteger(contextLength) || contextLength <= 0) throw new Error(`Model "${item["id"]}" must include a positive context_length.`);
 	const displayName = item["display_name"];
@@ -62440,7 +62440,7 @@ async function fetchOpenPlatformModels(platform, apiKey, fetchImpl = fetch, sign
 	});
 	if (!res.ok) throw new OpenPlatformApiError(await readApiErrorMessage(res, `Failed to list models (HTTP ${res.status}).`), res.status);
 	const payload = await res.json();
-	if (!isRecord$25(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${platform.baseUrl}.`);
+	if (!isRecord$26(payload) || !Array.isArray(payload["data"])) throw new Error(`Unexpected models response for ${platform.baseUrl}.`);
 	return payload["data"].map((item) => toModelInfo(item)).filter((item) => item !== void 0);
 }
 function filterModelsByPrefix(models, platform) {
@@ -62460,10 +62460,10 @@ function applyOpenPlatformConfig(config, options) {
 	};
 	const existingModels = config.models ?? {};
 	const upstreamKeys = new Set(options.models.map((m) => `${providerKey}/${m.id}`));
-	for (const [key, model] of Object.entries(existingModels)) if (isRecord$25(model) && model["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, model] of Object.entries(existingModels)) if (isRecord$26(model) && model["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
 	for (const model of options.models) {
 		const aliasKey = `${providerKey}/${model.id}`;
-		existingModels[aliasKey] = mergeRefreshedModelAlias(isRecord$25(existingModels[aliasKey]) ? existingModels[aliasKey] : {}, {
+		existingModels[aliasKey] = mergeRefreshedModelAlias(isRecord$26(existingModels[aliasKey]) ? existingModels[aliasKey] : {}, {
 			provider: providerKey,
 			model: model.id,
 			maxContextSize: model.contextLength,
@@ -62594,17 +62594,17 @@ var init_provider_credential = __esmMin((() => {}));
 * is owned by a given registry URL.
 */
 function customRegistrySourceUrl(provider) {
-	if (!isRecord$25(provider)) return void 0;
+	if (!isRecord$26(provider)) return void 0;
 	const candidate = provider["source"];
-	if (!isRecord$25(candidate) || candidate["kind"] !== "apiJson") return void 0;
+	if (!isRecord$26(candidate) || candidate["kind"] !== "apiJson") return void 0;
 	const url = candidate["url"];
 	return typeof url === "string" && url.length > 0 ? url : void 0;
 }
 function readCustomRegistrySource$1(provider) {
-	if (!isRecord$25(provider)) return void 0;
+	if (!isRecord$26(provider)) return void 0;
 	const candidate = provider["source"];
 	const url = customRegistrySourceUrl(provider);
-	const apiKey = isRecord$25(candidate) ? candidate["apiKey"] : void 0;
+	const apiKey = isRecord$26(candidate) ? candidate["apiKey"] : void 0;
 	if (url === void 0 || typeof apiKey !== "string") return void 0;
 	return {
 		kind: "apiJson",
@@ -62650,14 +62650,14 @@ function isValidRetirementAt(value) {
 	return value === void 0 || value === null || typeof value === "string" && RFC3339_PATTERN.test(value) && Number.isFinite(Date.parse(value));
 }
 function toModelEntry(value) {
-	if (!isRecord$25(value)) return void 0;
+	if (!isRecord$26(value)) return void 0;
 	const id = value["id"];
 	if (typeof id !== "string" || id.length === 0) return void 0;
 	const entry = { id };
 	const name = value["name"];
 	if (typeof name === "string" && name.length > 0) entry.name = name;
 	const limit = value["limit"];
-	if (isRecord$25(limit)) {
+	if (isRecord$26(limit)) {
 		const context = limit["context"];
 		const output = limit["output"];
 		const parsedLimit = {};
@@ -62672,7 +62672,7 @@ function toModelEntry(value) {
 	const defaultEffort = value["default_effort"];
 	if (typeof defaultEffort === "string" && defaultEffort.length > 0) entry.default_effort = defaultEffort;
 	const modalities = value["modalities"];
-	if (isRecord$25(modalities)) {
+	if (isRecord$26(modalities)) {
 		const input = toStringArrayOrUndefined(modalities["input"]);
 		const output = toStringArrayOrUndefined(modalities["output"]);
 		if (input !== void 0 || output !== void 0) entry.modalities = {
@@ -62682,7 +62682,7 @@ function toModelEntry(value) {
 	}
 	const rawUpgrade = value["upgrade"];
 	if (rawUpgrade !== void 0 && rawUpgrade !== null) {
-		if (!isRecord$25(rawUpgrade)) throw new Error(`Invalid upgrade for model "${id}": expected an object.`);
+		if (!isRecord$26(rawUpgrade)) throw new Error(`Invalid upgrade for model "${id}": expected an object.`);
 		const targetModel = nonEmptyString$5(rawUpgrade["model"]);
 		if (targetModel === void 0) throw new Error(`Invalid upgrade for model "${id}": expected a non-empty target model.`);
 		const migrationMarkdown = rawUpgrade["migration_markdown"];
@@ -62698,7 +62698,7 @@ function toModelEntry(value) {
 	return entry;
 }
 function toProviderEntry(value) {
-	if (!isRecord$25(value)) return void 0;
+	if (!isRecord$26(value)) return void 0;
 	const id = value["id"];
 	const name = value["name"];
 	const api = value["api"];
@@ -62708,7 +62708,7 @@ function toProviderEntry(value) {
 	if (typeof name !== "string" || name.length === 0) return void 0;
 	if (typeof api !== "string" || api.length === 0) return void 0;
 	if (!isAllowedProviderType(type)) return void 0;
-	if (!isRecord$25(models)) return void 0;
+	if (!isRecord$26(models)) return void 0;
 	const parsedModels = {};
 	for (const [key, raw] of Object.entries(models)) {
 		const modelEntry = toModelEntry(raw);
@@ -62746,7 +62746,7 @@ async function fetchCustomRegistry(source, options = {}) {
 		throw new CustomRegistryApiError(message, response.status);
 	}
 	const payload = await response.json();
-	if (!isRecord$25(payload)) throw new Error(`Unexpected custom registry response at ${source.url}: expected a JSON object keyed by provider id.`);
+	if (!isRecord$26(payload)) throw new Error(`Unexpected custom registry response at ${source.url}: expected a JSON object keyed by provider id.`);
 	const out = {};
 	for (const [key, raw] of Object.entries(payload)) {
 		const entry = toProviderEntry(raw);
@@ -62807,8 +62807,8 @@ function resolveCapabilities(model) {
 */
 function retainedApiKeyEnv(existing, entry, source) {
 	assertCustomRegistryProviderId(entry.id);
-	if (isRecord$25(existing) && existing["oauth"] !== void 0) throw new Error(oauthManagedProviderMessage(entry.id));
-	if (!isRecord$25(existing) || readCustomRegistrySource$1(existing)?.url !== source.url) return;
+	if (isRecord$26(existing) && existing["oauth"] !== void 0) throw new Error(oauthManagedProviderMessage(entry.id));
+	if (!isRecord$26(existing) || readCustomRegistrySource$1(existing)?.url !== source.url) return;
 	const apiKeyEnv = nonEmptyString$5(existing["apiKeyEnv"]);
 	if (apiKeyEnv !== void 0 && normalizedEndpoint(existing["baseUrl"]) !== normalizedEndpoint(entry.api)) throw new Error(`Custom registry provider "${entry.id}" changed endpoint while api_key_env is configured. Remove api_key_env, re-import the registry, verify the new endpoint, then restore api_key_env.`);
 	return apiKeyEnv;
@@ -62829,14 +62829,14 @@ function applyCustomRegistryProvider(config, entry, source, priorProviders) {
 	};
 	const existingModels = config.models ?? {};
 	const upstreamKeys = new Set(Object.keys(entry.models).map((modelKey) => `${providerKey}/${modelKey}`));
-	for (const [key, alias] of Object.entries(existingModels)) if (isRecord$25(alias) && alias["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
+	for (const [key, alias] of Object.entries(existingModels)) if (isRecord$26(alias) && alias["provider"] === providerKey && !upstreamKeys.has(key)) delete existingModels[key];
 	const modelEntries = Object.entries(entry.models);
 	for (const [modelKey, model] of modelEntries) {
 		const aliasKey = `${providerKey}/${modelKey}`;
 		const maxContextSize = resolveMaxContextSize(model);
 		const capabilities = resolveCapabilities(model);
 		const displayName = typeof model.name === "string" && model.name.length > 0 ? model.name : model.id;
-		const existing = isRecord$25(existingModels[aliasKey]) ? existingModels[aliasKey] : {};
+		const existing = isRecord$26(existingModels[aliasKey]) ? existingModels[aliasKey] : {};
 		const upgrade = model.upgrade;
 		const target = upgrade === void 0 ? void 0 : modelEntries.find(([, candidate]) => candidate.id === upgrade.model);
 		const targetAlias = target === void 0 || target[1].id === model.id ? void 0 : `${providerKey}/${target[0]}`;
@@ -62867,7 +62867,7 @@ function removeCustomRegistryProvider(config, providerId) {
 	let removedDefault = false;
 	const existingModels = config.models ?? {};
 	for (const [key, alias] of Object.entries(existingModels)) {
-		if (!isRecord$25(alias) || alias["provider"] !== providerId) continue;
+		if (!isRecord$26(alias) || alias["provider"] !== providerId) continue;
 		delete existingModels[key];
 		if (config.defaultModel === key) removedDefault = true;
 	}
@@ -62882,7 +62882,7 @@ function removeCustomRegistryProvider(config, providerId) {
 */
 function declaredUpgradeTarget(config, alias) {
 	const model = alias === void 0 ? void 0 : config.models?.[alias];
-	return isRecord$25(model) && isRecord$25(model["upgrade"]) ? nonEmptyString$5(model["upgrade"]["model"]) : void 0;
+	return isRecord$26(model) && isRecord$26(model["upgrade"]) ? nonEmptyString$5(model["upgrade"]["model"]) : void 0;
 }
 /**
 * Surfaces the credential env var each entry declares via its `env` field, as
@@ -62922,10 +62922,10 @@ function removeCustomRegistryEntries(config, entries, source) {
 		previousDefaultProvider: config["defaultProvider"]
 	};
 	for (const [providerId, provider] of Object.entries(config.providers)) {
-		if (!isRecord$25(provider)) continue;
+		if (!isRecord$26(provider)) continue;
 		if (provider["oauth"] !== void 0 || isReservedProviderId(providerId)) continue;
 		const existingSource = provider["source"];
-		const sameRegistry = isRecord$25(existingSource) && existingSource["kind"] === "apiJson" && existingSource["url"] === source.url;
+		const sameRegistry = isRecord$26(existingSource) && existingSource["kind"] === "apiJson" && existingSource["url"] === source.url;
 		if (surviving.has(providerId) || sameRegistry) removeCustomRegistryProvider(config, providerId);
 	}
 	return removal;
@@ -62933,12 +62933,12 @@ function removeCustomRegistryEntries(config, entries, source) {
 function customRegistryReplacementKeys(config, entries, source) {
 	const providerIds = new Set(Object.values(entries).map((entry) => entry.id));
 	for (const [providerId, provider] of Object.entries(config.providers)) {
-		if (!isRecord$25(provider)) continue;
+		if (!isRecord$26(provider)) continue;
 		if (provider["oauth"] !== void 0 || isReservedProviderId(providerId)) continue;
 		if (customRegistrySourceUrl(provider) === source.url) providerIds.add(providerId);
 	}
 	const modelIds = /* @__PURE__ */ new Set();
-	for (const [modelId, model] of Object.entries(config.models ?? {})) if (isRecord$25(model) && providerIds.has(String(model["provider"]))) modelIds.add(modelId);
+	for (const [modelId, model] of Object.entries(config.models ?? {})) if (isRecord$26(model) && providerIds.has(String(model["provider"]))) modelIds.add(modelId);
 	for (const entry of Object.values(entries)) for (const modelId of Object.keys(entry.models)) modelIds.add(`${entry.id}/${modelId}`);
 	return {
 		providers: [...providerIds],
@@ -63266,7 +63266,7 @@ function resolveProviderApiKey(provider, providerName) {
 		if (value === void 0) throw new Error(apiKeyEnvMissingMessage(providerName, declared.apiKeyEnv));
 		return value;
 	}
-	if (isRecord$25(provider.env)) {
+	if (isRecord$26(provider.env)) {
 		const fromEnv = nonEmptyString$5(provider.env["NEXGEN_API_KEY"]);
 		if (fromEnv !== void 0) {
 			if (provider.oauth !== void 0) throw new Error(credentialConflictMessage("Provider", providerName, "apiKey", "oauth"));
@@ -111182,7 +111182,7 @@ function dump$1(input, options) {
 	if (writeNode(state, 0, value, true, true)) return state.dump + "\n";
 	return "";
 }
-var common, exception, snippet, TYPE_CONSTRUCTOR_OPTIONS, YAML_NODE_KINDS, type$2, schema, str$1, seq, map, failsafe, _null, bool, int, YAML_FLOAT_PATTERN, SCIENTIFIC_WITHOUT_DOT, float, json, core, YAML_DATE_REGEXP, YAML_TIMESTAMP_REGEXP, timestamp$1, merge, BASE64_MAP, binary, _hasOwnProperty$3, _toString$2, omap, _toString$1, pairs, _hasOwnProperty$2, set$1, _default, _hasOwnProperty$1, CONTEXT_FLOW_IN, CONTEXT_FLOW_OUT, CONTEXT_BLOCK_IN, CONTEXT_BLOCK_OUT, CHOMPING_CLIP, CHOMPING_STRIP, CHOMPING_KEEP, PATTERN_NON_PRINTABLE, PATTERN_NON_ASCII_LINE_BREAKS, PATTERN_FLOW_INDICATORS, PATTERN_TAG_HANDLE, PATTERN_TAG_URI, simpleEscapeCheck, simpleEscapeMap, i$1, directiveHandlers, loader, _toString, _hasOwnProperty, CHAR_BOM, CHAR_TAB, CHAR_LINE_FEED, CHAR_CARRIAGE_RETURN, CHAR_SPACE, CHAR_EXCLAMATION, CHAR_DOUBLE_QUOTE, CHAR_SHARP, CHAR_PERCENT, CHAR_AMPERSAND, CHAR_SINGLE_QUOTE, CHAR_ASTERISK, CHAR_COMMA, CHAR_MINUS, CHAR_COLON, CHAR_EQUALS, CHAR_GREATER_THAN, CHAR_QUESTION, CHAR_COMMERCIAL_AT, CHAR_LEFT_SQUARE_BRACKET, CHAR_RIGHT_SQUARE_BRACKET, CHAR_GRAVE_ACCENT, CHAR_LEFT_CURLY_BRACKET, CHAR_VERTICAL_LINE, CHAR_RIGHT_CURLY_BRACKET, ESCAPE_SEQUENCES, DEPRECATED_BOOLEANS_SYNTAX, DEPRECATED_BASE60_SYNTAX, QUOTING_TYPE_SINGLE, QUOTING_TYPE_DOUBLE, STYLE_PLAIN, STYLE_SINGLE, STYLE_LITERAL, STYLE_FOLDED, STYLE_DOUBLE, dumper, load;
+var common, exception, snippet, TYPE_CONSTRUCTOR_OPTIONS, YAML_NODE_KINDS, type$2, schema, str$2, seq, map, failsafe, _null, bool, int, YAML_FLOAT_PATTERN, SCIENTIFIC_WITHOUT_DOT, float, json, core, YAML_DATE_REGEXP, YAML_TIMESTAMP_REGEXP, timestamp$1, merge, BASE64_MAP, binary, _hasOwnProperty$3, _toString$2, omap, _toString$1, pairs, _hasOwnProperty$2, set$1, _default, _hasOwnProperty$1, CONTEXT_FLOW_IN, CONTEXT_FLOW_OUT, CONTEXT_BLOCK_IN, CONTEXT_BLOCK_OUT, CHOMPING_CLIP, CHOMPING_STRIP, CHOMPING_KEEP, PATTERN_NON_PRINTABLE, PATTERN_NON_ASCII_LINE_BREAKS, PATTERN_FLOW_INDICATORS, PATTERN_TAG_HANDLE, PATTERN_TAG_URI, simpleEscapeCheck, simpleEscapeMap, i$1, directiveHandlers, loader, _toString, _hasOwnProperty, CHAR_BOM, CHAR_TAB, CHAR_LINE_FEED, CHAR_CARRIAGE_RETURN, CHAR_SPACE, CHAR_EXCLAMATION, CHAR_DOUBLE_QUOTE, CHAR_SHARP, CHAR_PERCENT, CHAR_AMPERSAND, CHAR_SINGLE_QUOTE, CHAR_ASTERISK, CHAR_COMMA, CHAR_MINUS, CHAR_COLON, CHAR_EQUALS, CHAR_GREATER_THAN, CHAR_QUESTION, CHAR_COMMERCIAL_AT, CHAR_LEFT_SQUARE_BRACKET, CHAR_RIGHT_SQUARE_BRACKET, CHAR_GRAVE_ACCENT, CHAR_LEFT_CURLY_BRACKET, CHAR_VERTICAL_LINE, CHAR_RIGHT_CURLY_BRACKET, ESCAPE_SEQUENCES, DEPRECATED_BOOLEANS_SYNTAX, DEPRECATED_BASE60_SYNTAX, QUOTING_TYPE_SINGLE, QUOTING_TYPE_DOUBLE, STYLE_PLAIN, STYLE_SINGLE, STYLE_LITERAL, STYLE_FOLDED, STYLE_DOUBLE, dumper, load;
 var init_js_yaml = __esmMin((() => {
 	common = {
 		isNothing,
@@ -111243,7 +111243,7 @@ var init_js_yaml = __esmMin((() => {
 		return result;
 	};
 	schema = Schema$1;
-	str$1 = new type$2("tag:yaml.org,2002:str", {
+	str$2 = new type$2("tag:yaml.org,2002:str", {
 		kind: "scalar",
 		construct: function(data) {
 			return data !== null ? data : "";
@@ -111262,7 +111262,7 @@ var init_js_yaml = __esmMin((() => {
 		}
 	});
 	failsafe = new schema({ explicit: [
-		str$1,
+		str$2,
 		seq,
 		map
 	] });
@@ -111606,7 +111606,7 @@ function parseSkillText(options) {
 		throw error;
 	}
 	const frontmatter = parsed.data ?? {};
-	if (!isRecord$24(frontmatter)) throw new SkillParseError(`Frontmatter in ${options.skillMdPath} must be a mapping at the top level`);
+	if (!isRecord$25(frontmatter)) throw new SkillParseError(`Frontmatter in ${options.skillMdPath} must be a mapping at the top level`);
 	const metadata = normalizeMetadata(frontmatter);
 	if (!isSupportedSkillType(metadata.type)) throw new UnsupportedSkillTypeError(metadata.type ?? String(frontmatter["type"]));
 	const name = nonEmptyString$4(metadata.name);
@@ -111654,7 +111654,7 @@ function descriptionFromBody$1(body) {
 function nonEmptyString$4(value) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
-function isRecord$24(value) {
+function isRecord$25(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var SkillParseError, UnsupportedSkillTypeError, FENCE, METADATA_ALIASES;
@@ -112197,10 +112197,10 @@ async function readMcpJson(fs, filePath, options = {}) {
 	}
 }
 function parseMcpJsonServers(data) {
-	if (!isRecord$23(data)) throw new Error("expected a JSON object");
+	if (!isRecord$24(data)) throw new Error("expected a JSON object");
 	if (!("mcpServers" in data)) return {};
 	const raw = data["mcpServers"];
-	if (!isRecord$23(raw)) throw new Error("\"mcpServers\" must be an object");
+	if (!isRecord$24(raw)) throw new Error("\"mcpServers\" must be an object");
 	return Object.fromEntries(Object.entries(raw).map(([name, value]) => [name, McpServerConfigSchema.parse(value)]));
 }
 function normalizeMcpServers(servers, options) {
@@ -112221,7 +112221,7 @@ function mapValuesToPath(servers, path) {
 	for (const name of Object.keys(servers)) origins[name] = path;
 	return origins;
 }
-function isRecord$23(value) {
+function isRecord$24(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isFileNotFound(error) {
@@ -122943,7 +122943,7 @@ function configError(message, cause) {
 function describeError$1(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-function isRecord$22(value) {
+function isRecord$23(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var IMcpConfigStore, CONFIG_SCOPE$1, MCP_CONFIG_KEY, textEncoder$6, textDecoder$6, McpConfigStore, NO_ABORT$5;
@@ -123054,9 +123054,9 @@ var init_configStore = __esmMin((() => {
 			} catch (error) {
 				throw configError(`Invalid JSON in ${this.path}: ${describeError$1(error)}`, error);
 			}
-			if (!isRecord$22(parsed)) throw configError(`Invalid MCP config in ${this.path}: expected a JSON object`);
+			if (!isRecord$23(parsed)) throw configError(`Invalid MCP config in ${this.path}: expected a JSON object`);
 			const rawServersValue = parsed["mcpServers"];
-			if (rawServersValue !== void 0 && !isRecord$22(rawServersValue)) throw configError(`Invalid MCP config in ${this.path}: "mcpServers" must be an object`);
+			if (rawServersValue !== void 0 && !isRecord$23(rawServersValue)) throw configError(`Invalid MCP config in ${this.path}: "mcpServers" must be an object`);
 			const rawServers = rawServersValue ?? {};
 			const servers = Object.entries(rawServers).map(([name, value]) => parseServer(name, value));
 			return {
@@ -123967,7 +123967,7 @@ function parseAgentFileText(options) {
 	}
 	const frontmatter = parsed.data;
 	if (frontmatter === null) throw new AgentFileParseError(`Missing frontmatter in ${options.path}`);
-	if (!isRecord$21(frontmatter)) throw new AgentFileParseError(`Frontmatter in ${options.path} must be a mapping at the top level`);
+	if (!isRecord$22(frontmatter)) throw new AgentFileParseError(`Frontmatter in ${options.path} must be a mapping at the top level`);
 	const nameField = frontmatter["name"];
 	if (nameField !== void 0 && nameField !== null && typeof nameField !== "string") throw new AgentFileParseError(`Frontmatter field "name" in ${options.path} must be a non-empty string`);
 	const name = nonEmptyString$3(nameField) ?? deriveNameFromPath(options.path);
@@ -124023,7 +124023,7 @@ function deriveNameFromPath(filePath) {
 function nonEmptyString$3(value) {
 	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
-function isRecord$21(value) {
+function isRecord$22(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var AgentFileParseError, AGENT_NAME_PATTERN;
@@ -179733,12 +179733,12 @@ function legacyStatusToCurrent$1(task) {
 	return task.status;
 }
 function isReadablePersistedTask$1(obj) {
-	return isRecord$20(obj) && (typeof obj["taskId"] === "string" || typeof obj["task_id"] === "string");
+	return isRecord$21(obj) && (typeof obj["taskId"] === "string" || typeof obj["task_id"] === "string");
 }
 function isLegacyPersistedTask$1(task) {
 	return "task_id" in task;
 }
-function isRecord$20(value) {
+function isRecord$21(value) {
 	return typeof value === "object" && value !== null;
 }
 function optionalNonEmptyString$1(value) {
@@ -192132,7 +192132,7 @@ function normalizeNexgenToolSchema(schema) {
 }
 function ensureNexgenPropertyTypes(schema) {
 	const normalized = cloneJsonValue(schema);
-	if (!isRecord$19(normalized)) throw new SyntaxRequestFormatError("JSON Schema root must normalize to an object.");
+	if (!isRecord$20(normalized)) throw new SyntaxRequestFormatError("JSON Schema root must normalize to an object.");
 	recurseSchema(normalized);
 	return normalized;
 }
@@ -192193,7 +192193,7 @@ function resolveLocalJsonPointer(root, ref) {
 	let current = root;
 	for (const rawPart of ref.slice(2).split("/")) {
 		const part = unescapeJsonPointerPart(rawPart);
-		if (isRecord$19(current)) {
+		if (isRecord$20(current)) {
 			if (!hasOwn$1(current, part)) return { found: false };
 			current = current[part];
 		} else if (Array.isArray(current)) {
@@ -192215,20 +192215,20 @@ function parseJsonPointerArrayIndex(part) {
 	return Number(part);
 }
 function recurseSchema(node) {
-	if (!isRecord$19(node)) return;
+	if (!isRecord$20(node)) return;
 	visitChildSchemas(node, normalizeProperty);
 }
 function visitChildSchemas(node, visit) {
 	for (const { key, kind } of CHILD_SCHEMA_SLOTS) {
 		const value = node[key];
 		if (kind === "single") {
-			if (isRecord$19(value)) visit(value);
+			if (isRecord$20(value)) visit(value);
 		} else if (kind === "array") {
 			if (Array.isArray(value)) for (const item of value) visit(item);
 		} else if (kind === "map") {
-			if (isRecord$19(value)) for (const item of Object.values(value)) visit(item);
+			if (isRecord$20(value)) for (const item of Object.values(value)) visit(item);
 		} else if (kind === "schema-or-array") {
-			if (isRecord$19(value)) visit(value);
+			if (isRecord$20(value)) visit(value);
 			else if (Array.isArray(value)) for (const item of value) visit(item);
 		}
 	}
@@ -192240,7 +192240,7 @@ function childSchemaKeysForParentType(parentType) {
 	});
 }
 function normalizeProperty(node) {
-	if (!isRecord$19(node)) return;
+	if (!isRecord$20(node)) return;
 	if (!hasOwn$1(node, "type") && !hasAnyKey(node, TYPE_COMPLETION_SKIP_KEYS)) {
 		const enumValues = node["enum"];
 		if (Array.isArray(enumValues) && enumValues.length > 0) node["type"] = inferTypeFromValues(enumValues);
@@ -192324,14 +192324,14 @@ function hasAnyKey(obj, keys) {
 }
 function cloneJsonValue(value) {
 	if (Array.isArray(value)) return value.map((item) => cloneJsonValue(item));
-	if (isRecord$19(value)) {
+	if (isRecord$20(value)) {
 		const cloned = {};
 		for (const [key, child] of Object.entries(value)) cloned[key] = cloneJsonValue(child);
 		return cloned;
 	}
 	return value;
 }
-function isRecord$19(value) {
+function isRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasOwn$1(obj, key) {
@@ -201623,15 +201623,15 @@ async function seedDefaultModelWhenUnset$1(config, alias) {
 }
 function registryKeyFromExisting(providers, url) {
 	for (const provider of Object.values(providers)) {
-		if (!isRecord$18(provider)) continue;
+		if (!isRecord$19(provider)) continue;
 		const source = provider["source"];
-		if (isRecord$18(source) && source["kind"] === "apiJson" && source["url"] === url) {
+		if (isRecord$19(source) && source["kind"] === "apiJson" && source["url"] === url) {
 			const key = source["apiKey"];
 			if (typeof key === "string" && key.length > 0) return key;
 		}
 	}
 }
-function isRecord$18(value) {
+function isRecord$19(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function truncateUpstreamMessage(err, limit = 300) {
@@ -201988,7 +201988,7 @@ var init_types$20 = __esmMin((() => {
 function parseCommandText(input) {
 	const { text, commandPath, pluginId } = input;
 	const parsed = parseFrontmatter(text);
-	const frontmatter = isRecord$17(parsed.data) ? parsed.data : {};
+	const frontmatter = isRecord$18(parsed.data) ? parsed.data : {};
 	const baseName = input.fallbackName ?? nodePath.basename(commandPath).replace(/\.md$/i, "");
 	const name = nonEmptyString$2(frontmatter["name"]) ?? baseName;
 	const body = parsed.body.trim();
@@ -202025,7 +202025,7 @@ function descriptionFromBody(body) {
 	if (firstLine === void 0) return "No description provided.";
 	return firstLine.length > 240 ? `${firstLine.slice(0, 239)}…` : firstLine;
 }
-function isRecord$17(value) {
+function isRecord$18(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var init_commands$1 = __esmMin((() => {
@@ -204879,7 +204879,7 @@ function parsePluginMarketplace(raw, location) {
 	} catch (error) {
 		throw new Error(`Plugin marketplace is not valid JSON: ${formatParseError(error)}`, { cause: error });
 	}
-	if (!isRecord$16(parsed)) throw new TypeError("Plugin marketplace must be an object.");
+	if (!isRecord$17(parsed)) throw new TypeError("Plugin marketplace must be an object.");
 	const rawPlugins = parsed["plugins"];
 	if (!Array.isArray(rawPlugins)) throw new TypeError("Plugin marketplace must contain a \"plugins\" array.");
 	return {
@@ -204925,7 +204925,7 @@ async function readMarketplaceText(location, fetchImpl) {
 	return response.text();
 }
 function parseMarketplaceEntry(value, index, location) {
-	if (!isRecord$16(value)) throw new TypeError(`Plugin marketplace entry ${index + 1} must be an object.`);
+	if (!isRecord$17(value)) throw new TypeError(`Plugin marketplace entry ${index + 1} must be an object.`);
 	const id = requiredString(value, "id", index);
 	validateMarketplaceEntryType(value, id);
 	const source = stringField$4(value, "source") ?? stringField$4(value, "url") ?? stringField$4(value, "downloadUrl");
@@ -205053,7 +205053,7 @@ function stringArrayField(value, field) {
 	const out = raw.filter((item) => typeof item === "string").map((item) => item.trim()).filter((item) => item.length > 0);
 	return out.length > 0 ? out : void 0;
 }
-function isRecord$16(value) {
+function isRecord$17(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function formatParseError(error) {
@@ -210968,7 +210968,7 @@ function killProcess(proc) {
 		proc.kill("SIGKILL");
 	}, KILL_GRACE_MS$1).unref();
 }
-function isRecord$15(value) {
+function isRecord$16(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function errorMessage$17(error) {
@@ -210985,7 +210985,7 @@ var init_runHook = __esmMin((() => {
 		if (typeof value === "string") return value;
 		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value);
 	}, string().optional());
-	HookSpecificOutputSchema = preprocess((value) => isRecord$15(value) ? value : void 0, looseObject({
+	HookSpecificOutputSchema = preprocess((value) => isRecord$16(value) ? value : void 0, looseObject({
 		message: OptionalStringSchema,
 		permissionDecision: unknown().optional(),
 		permissionDecisionReason: unknown().optional()
@@ -289438,7 +289438,7 @@ var init_paths$1 = __esmMin((() => {
 	siblingMcpJson = (tgt) => join(tgt, "mcp.migrated-from-nexgenk-cli.json");
 }));
 // ../../packages/migration-legacy/src/source-config.ts
-function isRecord$14(value) {
+function isRecord$15(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isEnoent$1(error) {
@@ -289459,7 +289459,7 @@ async function readSourceConfig(sourceHome) {
 		const parsed = parse$9(tomlText);
 		return {
 			kind: "toml",
-			parsed: isRecord$14(parsed) ? parsed : {}
+			parsed: isRecord$15(parsed) ? parsed : {}
 		};
 	} catch {
 		return {
@@ -289482,7 +289482,7 @@ async function readSourceConfig(sourceHome) {
 		const parsed = JSON.parse(jsonText);
 		return {
 			kind: "json",
-			parsed: isRecord$14(parsed) ? parsed : {}
+			parsed: isRecord$15(parsed) ? parsed : {}
 		};
 	} catch {
 		return {
@@ -289898,10 +289898,10 @@ async function detectMigration(opts) {
 	const oauthCredentials = new Set(credentialFiles.map((n) => n.slice(0, -5)).filter((n) => n.length > 0));
 	if (sourceConfig.kind === "toml" || sourceConfig.kind === "json") {
 		const providers = sourceConfig.parsed["providers"];
-		if (isRecord$13(providers)) for (const prov of Object.values(providers)) {
-			if (!isRecord$13(prov)) continue;
+		if (isRecord$14(providers)) for (const prov of Object.values(providers)) {
+			if (!isRecord$14(prov)) continue;
 			const oauth = prov["oauth"];
-			if (!isRecord$13(oauth)) continue;
+			if (!isRecord$14(oauth)) continue;
 			const key = oauth["key"];
 			if (typeof key !== "string" || key === "") continue;
 			const name = key.split("/").pop();
@@ -290005,7 +290005,7 @@ async function detectMigration(opts) {
 function unknownWorkdirReason$1() {
 	return "No local workdir mapping was found for this legacy session bucket; nexgenk.json may be missing, unreadable, or not list the workdir.";
 }
-function isRecord$13(value) {
+function isRecord$14(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function dirHasEntries(dir) {
@@ -290024,11 +290024,11 @@ async function detectMcpOauthServers(src) {
 	}
 	try {
 		const parsed = JSON.parse(text);
-		if (!isRecord$13(parsed)) return [];
+		if (!isRecord$14(parsed)) return [];
 		const servers = parsed["mcpServers"];
-		if (!isRecord$13(servers)) return [];
+		if (!isRecord$14(servers)) return [];
 		const out = [];
-		for (const [name, server] of Object.entries(servers)) if (isRecord$13(server) && server["auth"] === "oauth") out.push(name);
+		for (const [name, server] of Object.entries(servers)) if (isRecord$14(server) && server["auth"] === "oauth") out.push(name);
 		return out;
 	} catch {
 		return [];
@@ -290206,7 +290206,7 @@ var init_stub_detect = __esmMin((() => {
 	init_dist$8();
 }));
 // ../../packages/migration-legacy/src/steps/config.ts
-function isRecord$12(value) {
+function isRecord$13(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function emptyResult$1() {
@@ -290242,20 +290242,20 @@ function filterRegisteredExperimentalFlags(value) {
 * and its (already type-mapped) `type` is one the kosong runtime can construct. */
 function providerIsSupported(prov) {
 	const transformed = providersFromToml({ x: prov });
-	const entry = isRecord$12(transformed) ? transformed["x"] : void 0;
+	const entry = isRecord$13(transformed) ? transformed["x"] : void 0;
 	if (entry === void 0) return false;
 	try {
 		ProviderConfigSchema.parse(entry);
 	} catch {
 		return false;
 	}
-	const type = isRecord$12(entry) ? entry["type"] : void 0;
+	const type = isRecord$13(entry) ? entry["type"] : void 0;
 	return typeof type === "string" && SUPPORTED_PROVIDER_TYPES.has(type);
 }
 /** True when the nexgenk-cli model entry validates against nexgenk's v2 schema. */
 function modelIsSupported(mod) {
 	const transformed = modelsFromToml({ x: mod });
-	const entry = isRecord$12(transformed) ? transformed["x"] : void 0;
+	const entry = isRecord$13(transformed) ? transformed["x"] : void 0;
 	if (entry === void 0) return false;
 	try {
 		ModelRecordSchema.parse(entry);
@@ -290267,7 +290267,7 @@ function modelIsSupported(mod) {
 /** Order-insensitive deep-equality key, so re-ordered tables are not conflicts. */
 function stableKey(value) {
 	if (Array.isArray(value)) return `[${value.map(stableKey).join(",")}]`;
-	if (isRecord$12(value)) return `{${Object.keys(value).toSorted().map((k) => `${JSON.stringify(k)}:${stableKey(value[k])}`).join(",")}}`;
+	if (isRecord$13(value)) return `{${Object.keys(value).toSorted().map((k) => `${JSON.stringify(k)}:${stableKey(value[k])}`).join(",")}}`;
 	return JSON.stringify(value) ?? "null";
 }
 function deepEqual(a, b) {
@@ -290275,11 +290275,11 @@ function deepEqual(a, b) {
 }
 function mapLegacyProviderTypes(parsed) {
 	const providers = parsed["providers"];
-	if (!isRecord$12(providers)) return parsed;
+	if (!isRecord$13(providers)) return parsed;
 	let changed = false;
 	const mapped = {};
 	for (const [name, prov] of Object.entries(providers)) {
-		if (!isRecord$12(prov)) {
+		if (!isRecord$13(prov)) {
 			mapped[name] = prov;
 			continue;
 		}
@@ -290308,8 +290308,8 @@ function mergeConfig(target, migrated) {
 	const merged = { ...target };
 	const conflicts = [];
 	for (const [key, value] of Object.entries(migrated)) {
-		if ((key === "providers" || key === "models") && isRecord$12(value)) {
-			const section = isRecord$12(merged[key]) ? { ...merged[key] } : {};
+		if ((key === "providers" || key === "models") && isRecord$13(value)) {
+			const section = isRecord$13(merged[key]) ? { ...merged[key] } : {};
 			for (const [name, entry] of Object.entries(value)) if (section[name] === void 0) section[name] = entry;
 			else if (!deepEqual(section[name], entry)) conflicts.push(`${key}.${name}`);
 			merged[key] = section;
@@ -290344,18 +290344,18 @@ async function migrateConfigStep(input) {
 	if (targetText === void 0 || targetText === "# ~/.nexgenk/config.toml\n# Runtime settings for NexgenK.\n# This file starts empty so built-in defaults can apply.\n# Login will populate managed Nexgen provider and model entries.\n") targetMode = "overwrite";
 	else try {
 		const tp = parse$9(targetText);
-		targetParsed = isRecord$12(tp) ? tp : {};
+		targetParsed = isRecord$13(tp) ? tp : {};
 		targetMode = "merge";
 	} catch {
 		targetMode = "sibling";
 	}
-	const availableProviderNames = new Set(isRecord$12(targetParsed["providers"]) ? Object.keys(targetParsed["providers"]) : []);
-	const availableModelNames = new Set(isRecord$12(targetParsed["models"]) ? Object.keys(targetParsed["models"]) : []);
+	const availableProviderNames = new Set(isRecord$13(targetParsed["providers"]) ? Object.keys(targetParsed["providers"]) : []);
+	const availableModelNames = new Set(isRecord$13(targetParsed["models"]) ? Object.keys(targetParsed["models"]) : []);
 	const droppedProviders = [];
 	const keptProviders = {};
-	if (isRecord$12(parsed["providers"])) for (const [name, prov] of Object.entries(parsed["providers"])) if (isRecord$12(prov) && providerIsSupported(prov)) keptProviders[name] = prov;
+	if (isRecord$13(parsed["providers"])) for (const [name, prov] of Object.entries(parsed["providers"])) if (isRecord$13(prov) && providerIsSupported(prov)) keptProviders[name] = prov;
 	else droppedProviders.push(name);
-	const targetProviders = isRecord$12(targetParsed["providers"]) ? targetParsed["providers"] : {};
+	const targetProviders = isRecord$13(targetParsed["providers"]) ? targetParsed["providers"] : {};
 	const conflictedProviderNames = /* @__PURE__ */ new Set();
 	for (const [name, prov] of Object.entries(keptProviders)) {
 		const targetProv = targetProviders[name];
@@ -290363,8 +290363,8 @@ async function migrateConfigStep(input) {
 	}
 	const droppedModels = [];
 	const keptModels = {};
-	if (isRecord$12(parsed["models"])) for (const [name, mod] of Object.entries(parsed["models"])) {
-		if (!isRecord$12(mod) || !modelIsSupported(mod)) {
+	if (isRecord$13(parsed["models"])) for (const [name, mod] of Object.entries(parsed["models"])) {
+		if (!isRecord$13(mod) || !modelIsSupported(mod)) {
 			droppedModels.push(name);
 			continue;
 		}
@@ -290412,17 +290412,17 @@ async function migrateConfigStep(input) {
 			continue;
 		}
 		if (k === "default_model" && typeof v === "string" && keptModels[v] === void 0 && !availableModelNames.has(v)) continue;
-		if (k === "loop_control" && isRecord$12(v)) {
+		if (k === "loop_control" && isRecord$13(v)) {
 			const filteredLoopControl = filterFields(v, LOOP_CONTROL_FIELDS_TO_KEEP);
 			if (filteredLoopControl !== void 0) migratedTop[k] = filteredLoopControl;
 			continue;
 		}
-		if (k === "background" && isRecord$12(v)) {
+		if (k === "background" && isRecord$13(v)) {
 			const filteredBackground = filterFields(v, BACKGROUND_FIELDS_TO_KEEP);
 			if (filteredBackground !== void 0) migratedTop[k] = filteredBackground;
 			continue;
 		}
-		if (k === "experimental" && isRecord$12(v)) {
+		if (k === "experimental" && isRecord$13(v)) {
 			const filteredExperimental = filterRegisteredExperimentalFlags(v);
 			if (filteredExperimental !== void 0) migratedTop[k] = filteredExperimental;
 			continue;
@@ -290583,7 +290583,7 @@ function emptyResult(sourceUnreadable) {
 function isEnoent(error) {
 	return typeof error === "object" && error !== null && error.code === "ENOENT";
 }
-function isRecord$11(value) {
+function isRecord$12(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function migrateMcpStep(input) {
@@ -290600,9 +290600,9 @@ async function migrateMcpStep(input) {
 		return emptyResult(true);
 	}
 	const srcServers = {};
-	if (isRecord$11(sourceJson)) {
+	if (isRecord$12(sourceJson)) {
 		const raw = sourceJson["mcpServers"];
-		if (isRecord$11(raw)) for (const [name, srv] of Object.entries(raw)) srcServers[name] = srv;
+		if (isRecord$12(raw)) for (const [name, srv] of Object.entries(raw)) srcServers[name] = srv;
 	}
 	const mergedTargetServers = {};
 	let targetText;
@@ -290614,9 +290614,9 @@ async function migrateMcpStep(input) {
 	let targetUnparseable = false;
 	if (targetText !== void 0) try {
 		const parsed = JSON.parse(targetText);
-		if (isRecord$11(parsed)) {
+		if (isRecord$12(parsed)) {
 			const raw = parsed["mcpServers"];
-			if (isRecord$11(raw)) for (const [name, srv] of Object.entries(raw)) mergedTargetServers[name] = srv;
+			if (isRecord$12(raw)) for (const [name, srv] of Object.entries(raw)) mergedTargetServers[name] = srv;
 		}
 	} catch {
 		targetUnparseable = true;
@@ -314977,11 +314977,366 @@ var init_esm = __esmMin((() => {
 	import_commander = /* @__PURE__ */ __toESM(require_commander(), 1);
 	({program, createCommand, createArgument, createOption, CommanderError, InvalidArgumentError, InvalidOptionArgumentError, Command, Argument, Option, Help} = import_commander.default);
 }));
-// src/cli/sub/login-flow.ts
+// src/cli/sso/contract.ts
 init_session_import();
 init_esm();
+/**
+* Pure contract for the NexgenRouter SSO provisioning flow, ported from the
+* gateway client already in production (`nexgen-movil/src/lib/gateway/sso-contract.ts`).
+*
+* ```
+* 1. POST /sso/cli/start                (public) -> { login_id, poll_secret, user_code, verification_uri_complete }
+* 2. open verification_uri_complete                -> SSO login
+* 3. GET  /sso/cli/poll/{login_id}      [x-litellm-cli-poll-secret] -> pending… -> ready { key (JWT 24h), user_id, teams }
+* 3b. GET  .../poll/{login_id}?team_id=<id>        -> ready { key } when `requires_team_selection`
+* 4. POST /key/generate  (Bearer JWT)              -> durable key `sk-…`
+* ```
+*
+* Everything here is decided without network so the parsing rules stay testable:
+* the HTTP client that uses these pieces lives in `./client.ts`.
+*/
+/** Team alias in the gateway that carries the models a CLI key should be scoped to. */
+const NEXGEN_SSO_TEAM_ALIAS = "nexgen-desktop";
+var SsoError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "SsoError";
+		this.code = code;
+	}
+};
+function isRecord$11(value) {
+	return typeof value === "object" && value !== null;
+}
+function str$1(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function strArray(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter((item) => typeof item === "string");
+}
+function parseTeamDetails(value) {
+	if (!Array.isArray(value)) return [];
+	return value.filter(isRecord$11).map((item) => ({
+		teamId: str$1(item["team_id"]),
+		teamAlias: str$1(item["team_alias"]),
+		teamModels: strArray(item["team_models"])
+	}));
+}
+function parseSsoStart(body) {
+	if (!isRecord$11(body)) throw new SsoError("start_malformed", "/sso/cli/start returned a non-JSON body.");
+	const loginId = str$1(body["login_id"]);
+	if (loginId === void 0) throw new SsoError("start_malformed", "/sso/cli/start did not return login_id.");
+	const pollSecret = str$1(body["poll_secret"]);
+	if (pollSecret === void 0) throw new SsoError("no_poll_secret", "/sso/cli/start did not return poll_secret, so the SSO state cannot be polled.");
+	const expiresIn = typeof body["expires_in"] === "number" ? body["expires_in"] : void 0;
+	return {
+		loginId,
+		pollSecret,
+		userCode: typeof body["user_code"] === "string" ? body["user_code"] : "",
+		verificationUriComplete: str$1(body["verification_uri_complete"]),
+		expiresInSeconds: expiresIn
+	};
+}
+function parseSsoPoll(body) {
+	if (!isRecord$11(body)) throw new SsoError("malformed", "/sso/cli/poll returned a non-JSON body.");
+	const status = str$1(body["status"]);
+	if (status === void 0) throw new SsoError("malformed", "/sso/cli/poll did not return status.");
+	return {
+		status,
+		key: str$1(body["key"]),
+		userId: str$1(body["user_id"]),
+		teams: strArray(body["teams"]) ?? [],
+		teamDetails: parseTeamDetails(body["team_details"]),
+		teamId: str$1(body["team_id"]),
+		requiresTeamSelection: body["requires_team_selection"] === true
+	};
+}
+function parseReady(body) {
+	if (body.key === void 0) throw new SsoError("no_session_token", "the gateway returned no session token (key).");
+	return {
+		jwt: body.key,
+		userId: body.userId,
+		teams: body.teams,
+		teamDetails: body.teamDetails,
+		teamId: body.teamId
+	};
+}
+const NO_TEAM_MESSAGE = `this account does not belong to the ${NEXGEN_SSO_TEAM_ALIAS} team — ask an administrator to add it`;
+const NO_MATCHING_TEAM_MESSAGE = `this account belongs to several teams and none is ${NEXGEN_SSO_TEAM_ALIAS} — ask an administrator to add it`;
+const NO_TEAM_MODELS_MESSAGE = `the ${NEXGEN_SSO_TEAM_ALIAS} team has no models assigned — ask an administrator to check the team`;
+function resolveLoginTeam(teams, details) {
+	const byAlias = details.find((detail) => detail.teamAlias === "nexgen-desktop" && detail.teamId !== void 0)?.teamId;
+	if (byAlias !== void 0) return { teamId: byAlias };
+	if (teams.length === 0 && details.length === 0) return { reason: "no_teams" };
+	if (teams.length === 1) return { teamId: teams[0] };
+	if (teams.length === 0 && details.length === 1 && details[0].teamId !== void 0) return { teamId: details[0].teamId };
+	return { reason: "no_matching_team" };
+}
+function teamHasModels(details, teamId, teams) {
+	const target = teamId ?? (teams.length === 1 ? teams[0] : void 0);
+	if (target === void 0) return void 0;
+	const detail = details.find((item) => item.teamId === target);
+	if (detail === void 0) return void 0;
+	if (detail.teamModels !== void 0 && detail.teamModels.length === 0) return false;
+	return true;
+}
+/**
+* `ready` without `key` is not the end of the flow: the gateway answers that
+* way while the account spans several teams and one must be picked, and also
+* transiently before minting the session token.
+*/
+function decideSsoPoll(body) {
+	if (body.status !== "ready") return { action: "wait" };
+	if (body.requiresTeamSelection) {
+		const resolved = resolveLoginTeam(body.teams, body.teamDetails);
+		if ("reason" in resolved) return {
+			action: "fail",
+			code: "no_team",
+			message: resolved.reason === "no_teams" ? NO_TEAM_MESSAGE : NO_MATCHING_TEAM_MESSAGE
+		};
+		return {
+			action: "select_team",
+			teamId: resolved.teamId
+		};
+	}
+	if (body.key === void 0) return { action: "wait" };
+	if (body.teams.length === 0 && body.teamId === void 0) return {
+		action: "fail",
+		code: "no_team",
+		message: NO_TEAM_MESSAGE
+	};
+	if (teamHasModels(body.teamDetails, body.teamId, body.teams) === false) return {
+		action: "fail",
+		code: "no_team",
+		message: NO_TEAM_MODELS_MESSAGE
+	};
+	return {
+		action: "ready",
+		ready: parseReady(body)
+	};
+}
+/** LiteLLM requires `key_alias` to be unique across the deployment, so each mint gets its own. */
+function keyAliasFor(userId, now = Date.now()) {
+	return `nexgenk-${userId}-${now}`;
+}
+function isDurableKey(value) {
+	return typeof value === "string" && value.startsWith("sk-");
+}
+function parseMintResponse(body, alias) {
+	if (!isRecord$11(body)) throw new SsoError("malformed", "/key/generate returned a non-JSON body.");
+	const key = body["key"];
+	if (!isDurableKey(key)) throw new SsoError("malformed", "the generated key is not a durable `sk-…` key.");
+	return {
+		key,
+		alias
+	};
+}
+/** Fallback team pick for the mint when the poll did not scope a team. */
+function selectTeam(teams, details) {
+	const byAlias = details.find((detail) => detail.teamAlias === NEXGEN_SSO_TEAM_ALIAS)?.teamId;
+	if (byAlias !== void 0) return byAlias;
+	const firstWithId = details.find((detail) => detail.teamId !== void 0)?.teamId;
+	if (firstWithId !== void 0) return firstWithId;
+	return teams.length === 1 ? teams[0] : void 0;
+}
+// src/cli/sso/client.ts
+/**
+* HTTP client for the NexgenRouter SSO provisioning flow described in
+* `./contract.ts`. It turns a browser login into the durable `sk-…` key the
+* CLI stores, mirroring the client already in production for the mobile and
+* desktop apps.
+*/
+const POLL_INTERVAL_MS$1 = 2e3;
+const DEFAULT_EXPIRES_IN_SECONDS = 600;
+const MAX_TEAM_SELECTIONS = 2;
+async function readJson(response) {
+	const text = await response.text();
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new SsoError("malformed", `the gateway answered ${response.status} with a non-JSON body.`);
+	}
+}
+async function startSso(input, signal) {
+	const response = await fetch(`${input.gatewayUrl}/sso/cli/start`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: "{}",
+		signal
+	});
+	if (!response.ok) throw new SsoError("start_malformed", `/sso/cli/start answered HTTP ${response.status}.`);
+	return parseSsoStart(await readJson(response));
+}
+async function pollOnce(input, start, teamId, signal) {
+	const url = new URL(`${input.gatewayUrl}/sso/cli/poll/${encodeURIComponent(start.loginId)}`);
+	if (teamId !== void 0) url.searchParams.set("team_id", teamId);
+	const response = await fetch(url, {
+		method: "GET",
+		headers: { "x-litellm-cli-poll-secret": start.pollSecret },
+		signal
+	});
+	if (!response.ok) throw new SsoError("malformed", `/sso/cli/poll answered HTTP ${response.status}.`);
+	return parseSsoPoll(await readJson(response));
+}
+async function mintDurableKey(input, ready, signal) {
+	const userId = ready.userId;
+	if (userId === void 0) throw new SsoError("no_user_id", "the gateway returned no user_id, so the key alias cannot be built.");
+	const teamId = ready.teamId ?? selectTeam(ready.teams, ready.teamDetails);
+	if (teamId === void 0) throw new SsoError("no_team", "this account has no resolvable team in the gateway — ask an administrator to add it to nexgen-desktop.");
+	const alias = keyAliasFor(userId, input.now?.());
+	const response = await fetch(`${input.gatewayUrl}/key/generate`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			Authorization: `Bearer ${ready.jwt}`
+		},
+		body: JSON.stringify({
+			key_alias: alias,
+			team_id: teamId
+		}),
+		signal
+	});
+	const body = await readJson(response);
+	if (!response.ok) throw new SsoError("malformed", `the gateway refused to create the key: ${typeof body === "object" && body !== null && "error" in body ? JSON.stringify(body.error).slice(0, 200) : `HTTP ${response.status}`}`);
+	const minted = parseMintResponse(body, alias);
+	return {
+		key: minted.key,
+		alias: minted.alias,
+		userId
+	};
+}
+/**
+* Runs the whole flow and returns the durable key. The caller persists nothing
+* until this resolves, so a cancelled login leaves no half-written state.
+*/
+async function provisionApiKeyViaSso(input) {
+	const now = input.now ?? Date.now;
+	const sleep = input.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const interval = input.pollIntervalMs ?? POLL_INTERVAL_MS$1;
+	const start = await startSso(input, input.signal);
+	const browserUrl = start.verificationUriComplete ?? `${input.gatewayUrl}/sso/key/generate?source=litellm-cli&key=${encodeURIComponent(start.loginId)}&user_code=${encodeURIComponent(start.userCode)}`;
+	input.onStatus?.(`Opening browser to sign in: ${browserUrl}`);
+	input.openBrowser?.(browserUrl);
+	const deadline = now() + (start.expiresInSeconds ?? DEFAULT_EXPIRES_IN_SECONDS) * 1e3 - 5e3;
+	let pendingTeamId;
+	let chosenTeamId;
+	let selections = 0;
+	let sawReadyWithoutKey = false;
+	for (;;) {
+		if (input.signal?.aborted === true) throw new SsoError("sso_timeout", "login cancelled.");
+		const body = await pollOnce(input, start, pendingTeamId, input.signal);
+		if (pendingTeamId !== void 0) chosenTeamId = pendingTeamId;
+		pendingTeamId = void 0;
+		if (chosenTeamId !== void 0 && body.status === "ready" && body.key !== void 0) return mintDurableKey(input, {
+			jwt: body.key,
+			userId: body.userId,
+			teamId: body.teamId ?? chosenTeamId,
+			teams: body.teams,
+			teamDetails: body.teamDetails
+		}, input.signal);
+		const decision = decideSsoPoll(body);
+		if (decision.action === "ready") return mintDurableKey(input, decision.ready, input.signal);
+		if (decision.action === "fail") throw new SsoError(decision.code, decision.message);
+		if (decision.action === "select_team") {
+			selections += 1;
+			if (selections > MAX_TEAM_SELECTIONS) throw new SsoError("no_team", "the gateway keeps asking for a team selection that cannot be satisfied.");
+			pendingTeamId = decision.teamId;
+			continue;
+		}
+		if (body.status === "ready") sawReadyWithoutKey = true;
+		if (now() >= deadline) throw new SsoError(sawReadyWithoutKey ? "no_session_token" : "sso_timeout", sawReadyWithoutKey ? "the SSO finished without a session token (the gateway never returned one)." : "the SSO did not finish in time — the browser login was never completed.");
+		await sleep(interval);
+	}
+}
+// src/utils/process/resolve-command.ts
+function pathExtensions(platform, env) {
+	if (platform !== "win32") return [""];
+	const raw = env["PATHEXT"];
+	if (raw === void 0 || raw.trim().length === 0) return DEFAULT_WIN32_PATHEXT;
+	return raw.split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
+}
+function candidateNames(command, extensions) {
+	if (extensions.length === 1 && extensions[0] === "") return [command];
+	const lower = command.toLowerCase();
+	if (extensions.some((ext) => lower.endsWith(ext.toLowerCase()))) return [command, ...extensions.map((ext) => command + ext)];
+	return extensions.map((ext) => command + ext);
+}
+function isExecutableFile(candidate, platform) {
+	try {
+		if (!statSync(candidate).isFile()) return false;
+		if (platform !== "win32") accessSync(candidate, constants$1.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function isInsideCwd(candidate, cwd, platform) {
+	let resolvedCandidate = resolve(candidate);
+	let resolvedCwd = resolve(cwd);
+	if (resolvedCwd === parse(resolvedCwd).root) return false;
+	if (platform === "win32") {
+		resolvedCandidate = resolvedCandidate.toLowerCase();
+		resolvedCwd = resolvedCwd.toLowerCase();
+	}
+	const rel = relative(resolvedCwd, resolvedCandidate);
+	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+/**
+* Resolve a bare command name to an absolute executable path by searching
+* PATH (PATHEXT-aware on Windows). Returns undefined when the command is not
+* found — or when the only hit lives inside `cwd`, since executing that would
+* run whatever a malicious workspace planted there.
+*/
+function resolveCommandPath(command, cwd = process.cwd()) {
+	const platform = process.platform;
+	const env = process.env;
+	const names = candidateNames(command, pathExtensions(platform, env));
+	const pathValue = env["PATH"] ?? "";
+	const separator = platform === "win32" ? ";" : ":";
+	for (const dir of pathValue.split(separator)) {
+		if (dir === "") continue;
+		for (const name of names) {
+			const candidate = join(dir, name);
+			if (!isExecutableFile(candidate, platform)) continue;
+			if (isInsideCwd(candidate, cwd, platform)) continue;
+			return resolve(candidate);
+		}
+	}
+}
+var DEFAULT_WIN32_PATHEXT;
+var init_resolve_command = __esmMin((() => {
+	DEFAULT_WIN32_PATHEXT = [
+		".COM",
+		".EXE",
+		".BAT",
+		".CMD"
+	];
+}));
+// src/utils/open-url.ts
+function openUrl(url, onError) {
+	const command = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-EncodedCommand",
+		Buffer.from(`try { Start-Process -FilePath '${url.replaceAll("'", "''")}' -ErrorAction Stop } catch { exit 1 }`, "utf16le").toString("base64")
+	]] : ["xdg-open", [url]];
+	const executable = resolveCommandPath(command[0]);
+	if (executable === void 0) {
+		onError?.(/* @__PURE__ */ new Error(`Cannot find ${command[0]}`));
+		return;
+	}
+	execFile(executable, command[1], { windowsHide: true }, (error) => {
+		if (error) onError?.(error);
+	});
+}
+var init_open_url = __esmMin((() => {
+	init_resolve_command();
+}));
+// src/cli/sub/login-flow.ts
 init_src$8();
 init_version$2();
+init_open_url();
 const DEFAULT_BASE_URL = "https://ia.nexgen.systems/v1";
 const PROVIDER_ID = "nexgenk";
 const PREFERRED_MODEL = "nexgen-auto";
@@ -314989,8 +315344,8 @@ const FALLBACK_MAX_CONTEXT_SIZE = 262144;
 const MODELS_REQUEST_TIMEOUT_MS = 2e4;
 async function runLoginFlow(options = {}) {
 	try {
-		const apiKey = resolveApiKey$1(options.apiKey);
 		const baseUrl = normalizeBaseUrl(options.baseUrl ?? readEnv("NEXGEN_BASE_URL") ?? DEFAULT_BASE_URL);
+		const { apiKey, source } = await obtainApiKey(options, baseUrl);
 		const models = await fetchRouterModels({
 			apiKey,
 			baseUrl
@@ -315007,7 +315362,7 @@ async function runLoginFlow(options = {}) {
 		}))).defaultModel ?? PREFERRED_MODEL;
 		process.stderr.write([
 			"",
-			`Logged in to ${baseUrl} (${models.length} models available).`,
+			`Logged in to ${baseUrl} (${models.length} models available) via ${source}.`,
 			`  provider:      ${PROVIDER_ID}`,
 			`  default model: ${defaultModel}`,
 			`  config:        ${harness.configPath}`,
@@ -315025,10 +315380,49 @@ function readEnv(name) {
 	const value = process.env[name]?.trim();
 	return value === void 0 || value.length === 0 ? void 0 : value;
 }
-function resolveApiKey$1(explicit) {
-	const candidate = explicit?.trim() ?? readEnv("NEXGEN_API_KEY");
-	if (candidate === void 0 || candidate === "") throw new Error("no API key. Pass --api-key <key>, or export NEXGEN_API_KEY with the key issued at https://ia.nexgen.systems.");
-	return candidate;
+async function obtainApiKey(options, baseUrl) {
+	const explicit = options.apiKey?.trim();
+	if (explicit !== void 0 && explicit !== "") return {
+		apiKey: explicit,
+		source: "the provided API key"
+	};
+	const fromEnv = readEnv("NEXGEN_API_KEY");
+	if (fromEnv !== void 0) return {
+		apiKey: fromEnv,
+		source: "NEXGEN_API_KEY"
+	};
+	process.stderr.write([
+		"",
+		"No API key found — signing in with SSO.",
+		"A browser window will open; approve the login and this command finishes on its own.",
+		""
+	].join("\n"));
+	const controller = new AbortController();
+	const onSigint = () => controller.abort();
+	process.once("SIGINT", onSigint);
+	try {
+		const provisioned = await provisionApiKeyViaSso({
+			gatewayUrl: gatewayOrigin(baseUrl),
+			signal: controller.signal,
+			onStatus: (line) => process.stderr.write(`${line}\n`),
+			openBrowser: (url) => {
+				if (options.noBrowser === true) {
+					process.stderr.write(`Open this URL to sign in: ${url}\n`);
+					return;
+				}
+				process.stderr.write(`Waiting for the SSO login to complete…\n`);
+				openUrl(url, (error) => {
+					process.stderr.write(`Could not open a browser (${error.message}). Open this URL to sign in: ${url}\n`);
+				});
+			}
+		});
+		return {
+			apiKey: provisioned.key,
+			source: `SSO (key alias ${provisioned.alias})`
+		};
+	} finally {
+		process.off("SIGINT", onSigint);
+	}
 }
 function normalizeBaseUrl(raw) {
 	const trimmed = raw.trim().replace(/\/+$/, "");
@@ -315042,6 +315436,10 @@ function normalizeBaseUrl(raw) {
 	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") throw new Error(`base URL must be http(s), got "${raw}".`);
 	return parsed.pathname === "" || parsed.pathname === "/" ? `${trimmed}/v1` : trimmed;
 }
+function gatewayOrigin(baseUrl) {
+	const parsed = new URL(baseUrl);
+	return /\/v1\/?$/.test(parsed.pathname) ? parsed.origin : baseUrl.replace(/\/+$/, "");
+}
 async function fetchRouterModels(input) {
 	const url = `${input.baseUrl}/models`;
 	let response;
@@ -322645,70 +323043,6 @@ function formatIssuePath(path) {
 function camelToSnake$1(value) {
 	return value.replaceAll(/[A-Z]/g, (ch) => `_${ch.toLowerCase()}`);
 }
-// src/utils/process/resolve-command.ts
-function pathExtensions(platform, env) {
-	if (platform !== "win32") return [""];
-	const raw = env["PATHEXT"];
-	if (raw === void 0 || raw.trim().length === 0) return DEFAULT_WIN32_PATHEXT;
-	return raw.split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
-}
-function candidateNames(command, extensions) {
-	if (extensions.length === 1 && extensions[0] === "") return [command];
-	const lower = command.toLowerCase();
-	if (extensions.some((ext) => lower.endsWith(ext.toLowerCase()))) return [command, ...extensions.map((ext) => command + ext)];
-	return extensions.map((ext) => command + ext);
-}
-function isExecutableFile(candidate, platform) {
-	try {
-		if (!statSync(candidate).isFile()) return false;
-		if (platform !== "win32") accessSync(candidate, constants$1.X_OK);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function isInsideCwd(candidate, cwd, platform) {
-	let resolvedCandidate = resolve(candidate);
-	let resolvedCwd = resolve(cwd);
-	if (resolvedCwd === parse(resolvedCwd).root) return false;
-	if (platform === "win32") {
-		resolvedCandidate = resolvedCandidate.toLowerCase();
-		resolvedCwd = resolvedCwd.toLowerCase();
-	}
-	const rel = relative(resolvedCwd, resolvedCandidate);
-	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
-}
-/**
-* Resolve a bare command name to an absolute executable path by searching
-* PATH (PATHEXT-aware on Windows). Returns undefined when the command is not
-* found — or when the only hit lives inside `cwd`, since executing that would
-* run whatever a malicious workspace planted there.
-*/
-function resolveCommandPath(command, cwd = process.cwd()) {
-	const platform = process.platform;
-	const env = process.env;
-	const names = candidateNames(command, pathExtensions(platform, env));
-	const pathValue = env["PATH"] ?? "";
-	const separator = platform === "win32" ? ";" : ":";
-	for (const dir of pathValue.split(separator)) {
-		if (dir === "") continue;
-		for (const name of names) {
-			const candidate = join(dir, name);
-			if (!isExecutableFile(candidate, platform)) continue;
-			if (isInsideCwd(candidate, cwd, platform)) continue;
-			return resolve(candidate);
-		}
-	}
-}
-var DEFAULT_WIN32_PATHEXT;
-var init_resolve_command = __esmMin((() => {
-	DEFAULT_WIN32_PATHEXT = [
-		".COM",
-		".EXE",
-		".BAT",
-		".CMD"
-	];
-}));
 // src/cli/update/types.ts
 function emptyUpdateCache() {
 	return {
@@ -323147,26 +323481,6 @@ async function confirmPreviousSession(summary) {
 function errorMessage$7(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-// src/utils/open-url.ts
-function openUrl(url, onError) {
-	const command = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["powershell.exe", [
-		"-NoProfile",
-		"-NonInteractive",
-		"-EncodedCommand",
-		Buffer.from(`try { Start-Process -FilePath '${url.replaceAll("'", "''")}' -ErrorAction Stop } catch { exit 1 }`, "utf16le").toString("base64")
-	]] : ["xdg-open", [url]];
-	const executable = resolveCommandPath(command[0]);
-	if (executable === void 0) {
-		onError?.(/* @__PURE__ */ new Error(`Cannot find ${command[0]}`));
-		return;
-	}
-	execFile(executable, command[1], { windowsHide: true }, (error) => {
-		if (error) onError?.(error);
-	});
-}
-var init_open_url = __esmMin((() => {
-	init_resolve_command();
-}));
 // src/cli/sub/app.ts
 init_open_url();
 function registerAppCommand(program) {
@@ -323192,10 +323506,11 @@ function registerInstallDesktopCommand(program) {
 }
 // src/cli/sub/login.ts
 function registerLoginCommand(parent) {
-	parent.command("login").description("Validate your NexgenK API key and configure the default model.").option("--api-key <key>", "API key issued at https://ia.nexgen.systems. Defaults to NEXGEN_API_KEY.").option("--base-url <url>", "Router base URL. Defaults to NEXGEN_BASE_URL or https://ia.nexgen.systems/v1.").action(async (opts) => {
+	parent.command("login").description("Sign in with SSO (or an API key) and configure the default model.").option("--api-key <key>", "Use this API key instead of the SSO flow. Defaults to NEXGEN_API_KEY.").option("--base-url <url>", "Router base URL. Defaults to NEXGEN_BASE_URL or https://ia.nexgen.systems/v1.").option("--no-browser", "Print the SSO URL instead of opening a browser (headless hosts).").action(async (opts) => {
 		await runLoginFlow({
 			apiKey: opts.apiKey,
-			baseUrl: opts.baseUrl
+			baseUrl: opts.baseUrl,
+			noBrowser: opts.browser === false
 		});
 	});
 }