open-multi-agent-kit 1.2.3 → 1.2.4

package/dist/commands/provider-adopt-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adopt-cli.d.ts","sourceRoot":"","sources":["../../src/commands/provider-adopt-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA+BH,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AA+ID,wBAAsB,mBAAmB,CACxC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,GAAE,4BAAiC,GAC1C,OAAO,CAAC,uBAAuB,CAAC,CAmClC","sourcesContent":["/**\n * `omk provider adopt [<provider-id>] [--from <source>] [--dry-run] [--json] [--status]`\n *\n * Copies credentials this machine already holds (an OpenAI Codex CLI login, a Claude Code CLI\n * login) into OMK's own credential store, so a subscription does not have to be signed in twice.\n * `--status` only reports what the store holds; it never refreshes, writes or contacts a provider.\n *\n * Exit codes: 0 = adopted, already current, or status reported; 1 = no usable source or the store\n * is unreadable; 2 = usage error. No output contains token material.\n */\n\nimport { join } from \"node:path\";\nimport { APP_NAME, getAgentDir } from \"../config.ts\";\nimport { AuthStorage } from \"../core/auth-storage.ts\";\nimport {\n\tcredentialSourcePath,\n\tcredentialSourcesFor,\n\tEXTERNAL_CREDENTIAL_SOURCE_LABELS,\n\ttype ExternalCredentialIo,\n\ttype ExternalCredentialSourceId,\n\treadExternalCredential,\n} from \"../core/external-credential-sources.ts\";\nimport { readAuthStoreFile, storedProviderIds, writeStatusReport } from \"./provider-adopt-status.ts\";\n\nconst USAGE = `Usage: ${APP_NAME} provider adopt [<provider-id>] [--from <source>] [--dry-run] [--json] [--status]`;\nconst HELP = [\n\t\"Provider adopt: copy credentials that already exist on this machine into OMK's store.\",\n\t\"\",\n\tUSAGE,\n\t\"\",\n\t\"  --from <source>  credential store to read: codex-cli | claude-code\",\n\t\"  --dry-run        report what would change without writing auth.json\",\n\t\"  --json           print one JSON document instead of the text report\",\n\t\"  --status         report the stored accounts (valid/expired) and exit; writes nothing\",\n\t\"\",\n\t\"Sources: codex-cli = ~/.codex/auth.json (Codex CLI), claude-code = ~/.claude/.credentials.json.\",\n\t\"Providers: openai-codex <- codex-cli, anthropic <- claude-code.\",\n\t\"Exit codes: 0 = adopted or nothing to change, 1 = source unusable or store unreadable, 2 = usage error.\",\n].join(\"\\n\");\n\nexport interface ProviderAdoptCliDependencies {\n\treadonly agentDir?: string;\n\treadonly env?: Readonly<Record<string, string | undefined>>;\n\treadonly readFile?: (path: string) => string;\n\treadonly now?: () => number;\n\treadonly home?: string;\n\treadonly writeLine?: (line: string) => void;\n}\n\nexport interface ProviderAdoptCliOutcome {\n\treadonly handled: boolean;\n\treadonly exitCode: number;\n}\n\ntype ParsedAdoptArgs = {\n\treadonly providerId?: string;\n\treadonly from?: ExternalCredentialSourceId;\n\treadonly dryRun: boolean;\n\treadonly json: boolean;\n\treadonly status: boolean;\n};\n\ntype ParseOutcome =\n\t| { readonly kind: \"absent\" }\n\t| { readonly kind: \"help\" }\n\t| { readonly kind: \"error\"; readonly message: string }\n\t| { readonly kind: \"ok\"; readonly parsed: ParsedAdoptArgs };\n\nconst SOURCE_IDS: readonly ExternalCredentialSourceId[] = [\"codex-cli\", \"claude-code\"];\n\nfunction parseArgs(args: readonly string[]): ParseOutcome {\n\tif (args[0] !== \"provider\" || args[1] !== \"adopt\") return { kind: \"absent\" };\n\tif (args.includes(\"--help\") || args.includes(\"-h\")) return { kind: \"help\" };\n\tlet providerId: string | undefined;\n\tlet from: ExternalCredentialSourceId | undefined;\n\tlet dryRun = false;\n\tlet json = false;\n\tlet status = false;\n\tfor (let index = 2; index < args.length; index += 1) {\n\t\tconst arg = args[index] ?? \"\";\n\t\tif (arg === \"--dry-run\") dryRun = true;\n\t\telse if (arg === \"--json\") json = true;\n\t\telse if (arg === \"--status\") status = true;\n\t\telse if (arg === \"--from\") {\n\t\t\tconst value = args[index + 1];\n\t\t\tif (value === undefined || value.startsWith(\"-\"))\n\t\t\t\treturn { kind: \"error\", message: \"Missing value for --from.\" };\n\t\t\tif (!SOURCE_IDS.includes(value as ExternalCredentialSourceId)) {\n\t\t\t\treturn { kind: \"error\", message: `Unknown --from value. Use one of: ${SOURCE_IDS.join(\", \")}.` };\n\t\t\t}\n\t\t\tfrom = value as ExternalCredentialSourceId;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-\")) return { kind: \"error\", message: \"Unknown option for provider adopt.\" };\n\t\telse if (providerId === undefined) providerId = arg;\n\t\telse return { kind: \"error\", message: \"Unexpected extra argument.\" };\n\t}\n\tif (!status && providerId === undefined) return { kind: \"error\", message: \"Missing provider id.\" };\n\treturn { kind: \"ok\", parsed: { providerId, from, dryRun, json, status } };\n}\n\n/**\n * Sources to try for one provider. `--from` narrows the provider's own mapping; it must never\n * broaden it, or a foreign provider's OAuth grant would be stored under this provider id.\n */\nfunction sourcesForAdoption(\n\tproviderId: string,\n\tfrom: ExternalCredentialSourceId | undefined,\n): readonly ExternalCredentialSourceId[] {\n\tconst mapped = credentialSourcesFor(providerId);\n\treturn from === undefined ? mapped : mapped.filter((source) => source === from);\n}\n\n/** Adopt one provider's credential from the first source that yields a usable token. */\nfunction adoptProvider(\n\targs: ParsedAdoptArgs,\n\tdependencies: ProviderAdoptCliDependencies,\n\tstorage: AuthStorage,\n\tauthPath: string,\n\twriteLine: (line: string) => void,\n): number {\n\tconst providerId = args.providerId ?? \"\";\n\tconst io: ExternalCredentialIo = {\n\t\treadFile: dependencies.readFile,\n\t\tnow: dependencies.now,\n\t\tenv: dependencies.env,\n\t\thome: dependencies.home,\n\t};\n\tconst sources = sourcesForAdoption(providerId, args.from);\n\tif (sources.length === 0) {\n\t\twriteLine(`No external credential source is mapped to \"${providerId}\".`);\n\t\twriteLine(`Known mappings: openai-codex <- codex-cli, anthropic <- claude-code.`);\n\t\treturn 2;\n\t}\n\n\tlet failure: { source: ExternalCredentialSourceId; path: string; reason: string } | undefined;\n\tfor (const source of sources) {\n\t\tconst lookup = readExternalCredential(source, io);\n\t\tif (lookup.status !== \"found\") {\n\t\t\tfailure = { source, path: lookup.path, reason: lookup.reason };\n\t\t\tcontinue;\n\t\t}\n\t\tconst preview = args.dryRun\n\t\t\t? storage.previewOAuthAccountImport(providerId, lookup.candidate.credentials)\n\t\t\t: storage.addOAuthAccount(providerId, lookup.candidate.credentials);\n\t\tif (args.json) {\n\t\t\twriteLine(\n\t\t\t\tJSON.stringify(\n\t\t\t\t\t{\n\t\t\t\t\t\tprovider: providerId,\n\t\t\t\t\t\tsource,\n\t\t\t\t\t\tpath: lookup.candidate.path,\n\t\t\t\t\t\tdetail: lookup.candidate.detail,\n\t\t\t\t\t\taction: preview.action,\n\t\t\t\t\t\taccountIndex: preview.accountIndex,\n\t\t\t\t\t\treason: preview.reason,\n\t\t\t\t\t\tdryRun: args.dryRun,\n\t\t\t\t\t},\n\t\t\t\t\tnull,\n\t\t\t\t\t2,\n\t\t\t\t),\n\t\t\t);\n\t\t} else {\n\t\t\twriteLine(`${providerId} <- ${EXTERNAL_CREDENTIAL_SOURCE_LABELS[source]}`);\n\t\t\twriteLine(`  found: ${lookup.candidate.detail}`);\n\t\t\tconst where = preview.accountIndex === undefined ? \"\" : ` account[${preview.accountIndex}]`;\n\t\t\tconst suffix = preview.reason ? ` (${preview.reason})` : \"\";\n\t\t\twriteLine(`  ${args.dryRun ? \"would be\" : \"result\"}: ${preview.action}${where}${suffix}`);\n\t\t\twriteLine(args.dryRun ? `  dry run: ${authPath} not written` : `  wrote ${authPath}`);\n\t\t}\n\t\tif (preview.action === \"blocked\") return 1;\n\t\t// A write swallowed into the error queue still prints \"wrote auth.json\" above; check the\n\t\t// queue so adopt cannot report success while nothing persisted.\n\t\tconst writeErrors = storage.drainErrors();\n\t\tif (writeErrors.length > 0) {\n\t\t\twriteLine(`  warning: the credential store reported an error: ${writeErrors[0]?.message}`);\n\t\t\treturn 1;\n\t\t}\n\t\treturn 0;\n\t}\n\n\tconst reason = failure ? `${failure.reason}` : \"no source produced a credential\";\n\tconst failedSource = failure?.source ?? sources[0] ?? \"codex-cli\";\n\tconst path = failure?.path ?? credentialSourcePath(failedSource, io);\n\tif (args.json) {\n\t\twriteLine(\n\t\t\tJSON.stringify({ provider: providerId, source: failedSource, path, action: \"unavailable\", reason }, null, 2),\n\t\t);\n\t} else {\n\t\twriteLine(`${providerId}: no usable credential to adopt from ${EXTERNAL_CREDENTIAL_SOURCE_LABELS[failedSource]}`);\n\t\twriteLine(`  ${path}`);\n\t\twriteLine(`  ${reason}`);\n\t}\n\treturn 1;\n}\n\nexport async function runProviderAdoptCli(\n\targs: readonly string[],\n\toverrides: ProviderAdoptCliDependencies = {},\n): Promise<ProviderAdoptCliOutcome> {\n\tconst outcome = parseArgs(args);\n\tif (outcome.kind === \"absent\") return { handled: false, exitCode: 0 };\n\tconst writeLine = overrides.writeLine ?? ((line: string) => process.stdout.write(`${line}\\n`));\n\tif (outcome.kind === \"help\") {\n\t\twriteLine(HELP);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\tif (outcome.kind === \"error\") {\n\t\twriteLine(outcome.message);\n\t\twriteLine(USAGE);\n\t\treturn { handled: true, exitCode: 2 };\n\t}\n\n\tconst authPath = join(overrides.agentDir ?? getAgentDir(), \"auth.json\");\n\tconst storage = AuthStorage.create(authPath);\n\tconst now = (overrides.now ?? Date.now)();\n\tconst readFile = overrides.readFile ?? readAuthStoreFile;\n\n\tif (outcome.parsed.status) {\n\t\t// An unreadable store is not an empty store: report the load failure instead of\n\t\t// \"no stored credential\", the same distinction the request path enforces.\n\t\tif (storage.hasLoadError()) {\n\t\t\twriteLine(`The credential store could not be read: ${authPath}`);\n\t\t\twriteLine(`  Another session may hold the lock. Retry shortly.`);\n\t\t\treturn { handled: true, exitCode: 1 };\n\t\t}\n\t\tconst providerIds = outcome.parsed.providerId\n\t\t\t? [outcome.parsed.providerId]\n\t\t\t: storedProviderIds(authPath, readFile);\n\t\twriteStatusReport({ storage, providerIds, json: outcome.parsed.json, authPath, writeLine, now });\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\n\treturn { handled: true, exitCode: adoptProvider(outcome.parsed, overrides, storage, authPath, writeLine) };\n}\n"]}

package/dist/commands/provider-adopt-cli.js

@@ -0,0 +1,182 @@
+/**
+ * `omk provider adopt [<provider-id>] [--from <source>] [--dry-run] [--json] [--status]`
+ *
+ * Copies credentials this machine already holds (an OpenAI Codex CLI login, a Claude Code CLI
+ * login) into OMK's own credential store, so a subscription does not have to be signed in twice.
+ * `--status` only reports what the store holds; it never refreshes, writes or contacts a provider.
+ *
+ * Exit codes: 0 = adopted, already current, or status reported; 1 = no usable source or the store
+ * is unreadable; 2 = usage error. No output contains token material.
+ */
+import { join } from "node:path";
+import { APP_NAME, getAgentDir } from "../config.js";
+import { AuthStorage } from "../core/auth-storage.js";
+import { credentialSourcePath, credentialSourcesFor, EXTERNAL_CREDENTIAL_SOURCE_LABELS, readExternalCredential, } from "../core/external-credential-sources.js";
+import { readAuthStoreFile, storedProviderIds, writeStatusReport } from "./provider-adopt-status.js";
+const USAGE = `Usage: ${APP_NAME} provider adopt [<provider-id>] [--from <source>] [--dry-run] [--json] [--status]`;
+const HELP = [
+    "Provider adopt: copy credentials that already exist on this machine into OMK's store.",
+    "",
+    USAGE,
+    "",
+    "  --from <source>  credential store to read: codex-cli | claude-code",
+    "  --dry-run        report what would change without writing auth.json",
+    "  --json           print one JSON document instead of the text report",
+    "  --status         report the stored accounts (valid/expired) and exit; writes nothing",
+    "",
+    "Sources: codex-cli = ~/.codex/auth.json (Codex CLI), claude-code = ~/.claude/.credentials.json.",
+    "Providers: openai-codex <- codex-cli, anthropic <- claude-code.",
+    "Exit codes: 0 = adopted or nothing to change, 1 = source unusable or store unreadable, 2 = usage error.",
+].join("\n");
+const SOURCE_IDS = ["codex-cli", "claude-code"];
+function parseArgs(args) {
+    if (args[0] !== "provider" || args[1] !== "adopt")
+        return { kind: "absent" };
+    if (args.includes("--help") || args.includes("-h"))
+        return { kind: "help" };
+    let providerId;
+    let from;
+    let dryRun = false;
+    let json = false;
+    let status = false;
+    for (let index = 2; index < args.length; index += 1) {
+        const arg = args[index] ?? "";
+        if (arg === "--dry-run")
+            dryRun = true;
+        else if (arg === "--json")
+            json = true;
+        else if (arg === "--status")
+            status = true;
+        else if (arg === "--from") {
+            const value = args[index + 1];
+            if (value === undefined || value.startsWith("-"))
+                return { kind: "error", message: "Missing value for --from." };
+            if (!SOURCE_IDS.includes(value)) {
+                return { kind: "error", message: `Unknown --from value. Use one of: ${SOURCE_IDS.join(", ")}.` };
+            }
+            from = value;
+            index += 1;
+        }
+        else if (arg.startsWith("-"))
+            return { kind: "error", message: "Unknown option for provider adopt." };
+        else if (providerId === undefined)
+            providerId = arg;
+        else
+            return { kind: "error", message: "Unexpected extra argument." };
+    }
+    if (!status && providerId === undefined)
+        return { kind: "error", message: "Missing provider id." };
+    return { kind: "ok", parsed: { providerId, from, dryRun, json, status } };
+}
+/**
+ * Sources to try for one provider. `--from` narrows the provider's own mapping; it must never
+ * broaden it, or a foreign provider's OAuth grant would be stored under this provider id.
+ */
+function sourcesForAdoption(providerId, from) {
+    const mapped = credentialSourcesFor(providerId);
+    return from === undefined ? mapped : mapped.filter((source) => source === from);
+}
+/** Adopt one provider's credential from the first source that yields a usable token. */
+function adoptProvider(args, dependencies, storage, authPath, writeLine) {
+    const providerId = args.providerId ?? "";
+    const io = {
+        readFile: dependencies.readFile,
+        now: dependencies.now,
+        env: dependencies.env,
+        home: dependencies.home,
+    };
+    const sources = sourcesForAdoption(providerId, args.from);
+    if (sources.length === 0) {
+        writeLine(`No external credential source is mapped to "${providerId}".`);
+        writeLine(`Known mappings: openai-codex <- codex-cli, anthropic <- claude-code.`);
+        return 2;
+    }
+    let failure;
+    for (const source of sources) {
+        const lookup = readExternalCredential(source, io);
+        if (lookup.status !== "found") {
+            failure = { source, path: lookup.path, reason: lookup.reason };
+            continue;
+        }
+        const preview = args.dryRun
+            ? storage.previewOAuthAccountImport(providerId, lookup.candidate.credentials)
+            : storage.addOAuthAccount(providerId, lookup.candidate.credentials);
+        if (args.json) {
+            writeLine(JSON.stringify({
+                provider: providerId,
+                source,
+                path: lookup.candidate.path,
+                detail: lookup.candidate.detail,
+                action: preview.action,
+                accountIndex: preview.accountIndex,
+                reason: preview.reason,
+                dryRun: args.dryRun,
+            }, null, 2));
+        }
+        else {
+            writeLine(`${providerId} <- ${EXTERNAL_CREDENTIAL_SOURCE_LABELS[source]}`);
+            writeLine(`  found: ${lookup.candidate.detail}`);
+            const where = preview.accountIndex === undefined ? "" : ` account[${preview.accountIndex}]`;
+            const suffix = preview.reason ? ` (${preview.reason})` : "";
+            writeLine(`  ${args.dryRun ? "would be" : "result"}: ${preview.action}${where}${suffix}`);
+            writeLine(args.dryRun ? `  dry run: ${authPath} not written` : `  wrote ${authPath}`);
+        }
+        if (preview.action === "blocked")
+            return 1;
+        // A write swallowed into the error queue still prints "wrote auth.json" above; check the
+        // queue so adopt cannot report success while nothing persisted.
+        const writeErrors = storage.drainErrors();
+        if (writeErrors.length > 0) {
+            writeLine(`  warning: the credential store reported an error: ${writeErrors[0]?.message}`);
+            return 1;
+        }
+        return 0;
+    }
+    const reason = failure ? `${failure.reason}` : "no source produced a credential";
+    const failedSource = failure?.source ?? sources[0] ?? "codex-cli";
+    const path = failure?.path ?? credentialSourcePath(failedSource, io);
+    if (args.json) {
+        writeLine(JSON.stringify({ provider: providerId, source: failedSource, path, action: "unavailable", reason }, null, 2));
+    }
+    else {
+        writeLine(`${providerId}: no usable credential to adopt from ${EXTERNAL_CREDENTIAL_SOURCE_LABELS[failedSource]}`);
+        writeLine(`  ${path}`);
+        writeLine(`  ${reason}`);
+    }
+    return 1;
+}
+export async function runProviderAdoptCli(args, overrides = {}) {
+    const outcome = parseArgs(args);
+    if (outcome.kind === "absent")
+        return { handled: false, exitCode: 0 };
+    const writeLine = overrides.writeLine ?? ((line) => process.stdout.write(`${line}\n`));
+    if (outcome.kind === "help") {
+        writeLine(HELP);
+        return { handled: true, exitCode: 0 };
+    }
+    if (outcome.kind === "error") {
+        writeLine(outcome.message);
+        writeLine(USAGE);
+        return { handled: true, exitCode: 2 };
+    }
+    const authPath = join(overrides.agentDir ?? getAgentDir(), "auth.json");
+    const storage = AuthStorage.create(authPath);
+    const now = (overrides.now ?? Date.now)();
+    const readFile = overrides.readFile ?? readAuthStoreFile;
+    if (outcome.parsed.status) {
+        // An unreadable store is not an empty store: report the load failure instead of
+        // "no stored credential", the same distinction the request path enforces.
+        if (storage.hasLoadError()) {
+            writeLine(`The credential store could not be read: ${authPath}`);
+            writeLine(`  Another session may hold the lock. Retry shortly.`);
+            return { handled: true, exitCode: 1 };
+        }
+        const providerIds = outcome.parsed.providerId
+            ? [outcome.parsed.providerId]
+            : storedProviderIds(authPath, readFile);
+        writeStatusReport({ storage, providerIds, json: outcome.parsed.json, authPath, writeLine, now });
+        return { handled: true, exitCode: 0 };
+    }
+    return { handled: true, exitCode: adoptProvider(outcome.parsed, overrides, storage, authPath, writeLine) };
+}
+//# sourceMappingURL=provider-adopt-cli.js.map

package/dist/commands/provider-adopt-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adopt-cli.js","sourceRoot":"","sources":["../../src/commands/provider-adopt-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,iCAAiC,EAGjC,sBAAsB,GACtB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAErG,MAAM,KAAK,GAAG,UAAU,QAAQ,mFAAmF,CAAC;AACpH,MAAM,IAAI,GAAG;IACZ,uFAAuF;IACvF,EAAE;IACF,KAAK;IACL,EAAE;IACF,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IACvE,wFAAwF;IACxF,EAAE;IACF,iGAAiG;IACjG,iEAAiE;IACjE,yGAAyG;CACzG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AA8Bb,MAAM,UAAU,GAA0C,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAEvF,SAAS,SAAS,CAAC,IAAuB,EAAgB;IACzD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5E,IAAI,UAA8B,CAAC;IACnC,IAAI,IAA4C,CAAC;IACjD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,WAAW;YAAE,MAAM,GAAG,IAAI,CAAC;aAClC,IAAI,GAAG,KAAK,QAAQ;YAAE,IAAI,GAAG,IAAI,CAAC;aAClC,IAAI,GAAG,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC;aACtC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC/C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;YAChE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAmC,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAClG,CAAC;YACD,IAAI,GAAG,KAAmC,CAAC;YAC3C,KAAK,IAAI,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;aACnG,IAAI,UAAU,KAAK,SAAS;YAAE,UAAU,GAAG,GAAG,CAAC;;YAC/C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IACnG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;AAAA,CAC1E;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAC1B,UAAkB,EAClB,IAA4C,EACJ;IACxC,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAAA,CAChF;AAED,wFAAwF;AACxF,SAAS,aAAa,CACrB,IAAqB,EACrB,YAA0C,EAC1C,OAAoB,EACpB,QAAgB,EAChB,SAAiC,EACxB;IACT,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,EAAE,GAAyB;QAChC,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,GAAG,EAAE,YAAY,CAAC,GAAG;QACrB,IAAI,EAAE,YAAY,CAAC,IAAI;KACvB,CAAC;IACF,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,SAAS,CAAC,+CAA+C,UAAU,IAAI,CAAC,CAAC;QACzE,SAAS,CAAC,sEAAsE,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC;IACV,CAAC;IAED,IAAI,OAAyF,CAAC;IAC9F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/D,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM;YAC1B,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC;YAC7E,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,SAAS,CACR,IAAI,CAAC,SAAS,CACb;gBACC,QAAQ,EAAE,UAAU;gBACpB,MAAM;gBACN,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI;gBAC3B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;gBAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;aACnB,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;QACH,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,GAAG,UAAU,OAAO,iCAAiC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,SAAS,CAAC,YAAY,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,YAAY,GAAG,CAAC;YAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,SAAS,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC,CAAC;YAC1F,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,QAAQ,cAAc,CAAC,CAAC,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC3C,yFAAyF;QACzF,gEAAgE;QAChE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,sDAAsD,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC;QACV,CAAC;QACD,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC;IACjF,MAAM,YAAY,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,oBAAoB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,SAAS,CACR,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC5G,CAAC;IACH,CAAC;SAAM,CAAC;QACP,SAAS,CAAC,GAAG,UAAU,wCAAwC,iCAAiC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAClH,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACvB,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,CAAC;AAAA,CACT;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,IAAuB,EACvB,SAAS,GAAiC,EAAE,EACT;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACtE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,WAAW,EAAE,EAAE,WAAW,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEzD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3B,gFAAgF;QAChF,0EAA0E;QAC1E,IAAI,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC5B,SAAS,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;YACjE,SAAS,CAAC,qDAAqD,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU;YAC5C,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YAC7B,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,iBAAiB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;AAAA,CAC3G","sourcesContent":["/**\n * `omk provider adopt [<provider-id>] [--from <source>] [--dry-run] [--json] [--status]`\n *\n * Copies credentials this machine already holds (an OpenAI Codex CLI login, a Claude Code CLI\n * login) into OMK's own credential store, so a subscription does not have to be signed in twice.\n * `--status` only reports what the store holds; it never refreshes, writes or contacts a provider.\n *\n * Exit codes: 0 = adopted, already current, or status reported; 1 = no usable source or the store\n * is unreadable; 2 = usage error. No output contains token material.\n */\n\nimport { join } from \"node:path\";\nimport { APP_NAME, getAgentDir } from \"../config.ts\";\nimport { AuthStorage } from \"../core/auth-storage.ts\";\nimport {\n\tcredentialSourcePath,\n\tcredentialSourcesFor,\n\tEXTERNAL_CREDENTIAL_SOURCE_LABELS,\n\ttype ExternalCredentialIo,\n\ttype ExternalCredentialSourceId,\n\treadExternalCredential,\n} from \"../core/external-credential-sources.ts\";\nimport { readAuthStoreFile, storedProviderIds, writeStatusReport } from \"./provider-adopt-status.ts\";\n\nconst USAGE = `Usage: ${APP_NAME} provider adopt [<provider-id>] [--from <source>] [--dry-run] [--json] [--status]`;\nconst HELP = [\n\t\"Provider adopt: copy credentials that already exist on this machine into OMK's store.\",\n\t\"\",\n\tUSAGE,\n\t\"\",\n\t\"  --from <source>  credential store to read: codex-cli | claude-code\",\n\t\"  --dry-run        report what would change without writing auth.json\",\n\t\"  --json           print one JSON document instead of the text report\",\n\t\"  --status         report the stored accounts (valid/expired) and exit; writes nothing\",\n\t\"\",\n\t\"Sources: codex-cli = ~/.codex/auth.json (Codex CLI), claude-code = ~/.claude/.credentials.json.\",\n\t\"Providers: openai-codex <- codex-cli, anthropic <- claude-code.\",\n\t\"Exit codes: 0 = adopted or nothing to change, 1 = source unusable or store unreadable, 2 = usage error.\",\n].join(\"\\n\");\n\nexport interface ProviderAdoptCliDependencies {\n\treadonly agentDir?: string;\n\treadonly env?: Readonly<Record<string, string | undefined>>;\n\treadonly readFile?: (path: string) => string;\n\treadonly now?: () => number;\n\treadonly home?: string;\n\treadonly writeLine?: (line: string) => void;\n}\n\nexport interface ProviderAdoptCliOutcome {\n\treadonly handled: boolean;\n\treadonly exitCode: number;\n}\n\ntype ParsedAdoptArgs = {\n\treadonly providerId?: string;\n\treadonly from?: ExternalCredentialSourceId;\n\treadonly dryRun: boolean;\n\treadonly json: boolean;\n\treadonly status: boolean;\n};\n\ntype ParseOutcome =\n\t| { readonly kind: \"absent\" }\n\t| { readonly kind: \"help\" }\n\t| { readonly kind: \"error\"; readonly message: string }\n\t| { readonly kind: \"ok\"; readonly parsed: ParsedAdoptArgs };\n\nconst SOURCE_IDS: readonly ExternalCredentialSourceId[] = [\"codex-cli\", \"claude-code\"];\n\nfunction parseArgs(args: readonly string[]): ParseOutcome {\n\tif (args[0] !== \"provider\" || args[1] !== \"adopt\") return { kind: \"absent\" };\n\tif (args.includes(\"--help\") || args.includes(\"-h\")) return { kind: \"help\" };\n\tlet providerId: string | undefined;\n\tlet from: ExternalCredentialSourceId | undefined;\n\tlet dryRun = false;\n\tlet json = false;\n\tlet status = false;\n\tfor (let index = 2; index < args.length; index += 1) {\n\t\tconst arg = args[index] ?? \"\";\n\t\tif (arg === \"--dry-run\") dryRun = true;\n\t\telse if (arg === \"--json\") json = true;\n\t\telse if (arg === \"--status\") status = true;\n\t\telse if (arg === \"--from\") {\n\t\t\tconst value = args[index + 1];\n\t\t\tif (value === undefined || value.startsWith(\"-\"))\n\t\t\t\treturn { kind: \"error\", message: \"Missing value for --from.\" };\n\t\t\tif (!SOURCE_IDS.includes(value as ExternalCredentialSourceId)) {\n\t\t\t\treturn { kind: \"error\", message: `Unknown --from value. Use one of: ${SOURCE_IDS.join(\", \")}.` };\n\t\t\t}\n\t\t\tfrom = value as ExternalCredentialSourceId;\n\t\t\tindex += 1;\n\t\t} else if (arg.startsWith(\"-\")) return { kind: \"error\", message: \"Unknown option for provider adopt.\" };\n\t\telse if (providerId === undefined) providerId = arg;\n\t\telse return { kind: \"error\", message: \"Unexpected extra argument.\" };\n\t}\n\tif (!status && providerId === undefined) return { kind: \"error\", message: \"Missing provider id.\" };\n\treturn { kind: \"ok\", parsed: { providerId, from, dryRun, json, status } };\n}\n\n/**\n * Sources to try for one provider. `--from` narrows the provider's own mapping; it must never\n * broaden it, or a foreign provider's OAuth grant would be stored under this provider id.\n */\nfunction sourcesForAdoption(\n\tproviderId: string,\n\tfrom: ExternalCredentialSourceId | undefined,\n): readonly ExternalCredentialSourceId[] {\n\tconst mapped = credentialSourcesFor(providerId);\n\treturn from === undefined ? mapped : mapped.filter((source) => source === from);\n}\n\n/** Adopt one provider's credential from the first source that yields a usable token. */\nfunction adoptProvider(\n\targs: ParsedAdoptArgs,\n\tdependencies: ProviderAdoptCliDependencies,\n\tstorage: AuthStorage,\n\tauthPath: string,\n\twriteLine: (line: string) => void,\n): number {\n\tconst providerId = args.providerId ?? \"\";\n\tconst io: ExternalCredentialIo = {\n\t\treadFile: dependencies.readFile,\n\t\tnow: dependencies.now,\n\t\tenv: dependencies.env,\n\t\thome: dependencies.home,\n\t};\n\tconst sources = sourcesForAdoption(providerId, args.from);\n\tif (sources.length === 0) {\n\t\twriteLine(`No external credential source is mapped to \"${providerId}\".`);\n\t\twriteLine(`Known mappings: openai-codex <- codex-cli, anthropic <- claude-code.`);\n\t\treturn 2;\n\t}\n\n\tlet failure: { source: ExternalCredentialSourceId; path: string; reason: string } | undefined;\n\tfor (const source of sources) {\n\t\tconst lookup = readExternalCredential(source, io);\n\t\tif (lookup.status !== \"found\") {\n\t\t\tfailure = { source, path: lookup.path, reason: lookup.reason };\n\t\t\tcontinue;\n\t\t}\n\t\tconst preview = args.dryRun\n\t\t\t? storage.previewOAuthAccountImport(providerId, lookup.candidate.credentials)\n\t\t\t: storage.addOAuthAccount(providerId, lookup.candidate.credentials);\n\t\tif (args.json) {\n\t\t\twriteLine(\n\t\t\t\tJSON.stringify(\n\t\t\t\t\t{\n\t\t\t\t\t\tprovider: providerId,\n\t\t\t\t\t\tsource,\n\t\t\t\t\t\tpath: lookup.candidate.path,\n\t\t\t\t\t\tdetail: lookup.candidate.detail,\n\t\t\t\t\t\taction: preview.action,\n\t\t\t\t\t\taccountIndex: preview.accountIndex,\n\t\t\t\t\t\treason: preview.reason,\n\t\t\t\t\t\tdryRun: args.dryRun,\n\t\t\t\t\t},\n\t\t\t\t\tnull,\n\t\t\t\t\t2,\n\t\t\t\t),\n\t\t\t);\n\t\t} else {\n\t\t\twriteLine(`${providerId} <- ${EXTERNAL_CREDENTIAL_SOURCE_LABELS[source]}`);\n\t\t\twriteLine(`  found: ${lookup.candidate.detail}`);\n\t\t\tconst where = preview.accountIndex === undefined ? \"\" : ` account[${preview.accountIndex}]`;\n\t\t\tconst suffix = preview.reason ? ` (${preview.reason})` : \"\";\n\t\t\twriteLine(`  ${args.dryRun ? \"would be\" : \"result\"}: ${preview.action}${where}${suffix}`);\n\t\t\twriteLine(args.dryRun ? `  dry run: ${authPath} not written` : `  wrote ${authPath}`);\n\t\t}\n\t\tif (preview.action === \"blocked\") return 1;\n\t\t// A write swallowed into the error queue still prints \"wrote auth.json\" above; check the\n\t\t// queue so adopt cannot report success while nothing persisted.\n\t\tconst writeErrors = storage.drainErrors();\n\t\tif (writeErrors.length > 0) {\n\t\t\twriteLine(`  warning: the credential store reported an error: ${writeErrors[0]?.message}`);\n\t\t\treturn 1;\n\t\t}\n\t\treturn 0;\n\t}\n\n\tconst reason = failure ? `${failure.reason}` : \"no source produced a credential\";\n\tconst failedSource = failure?.source ?? sources[0] ?? \"codex-cli\";\n\tconst path = failure?.path ?? credentialSourcePath(failedSource, io);\n\tif (args.json) {\n\t\twriteLine(\n\t\t\tJSON.stringify({ provider: providerId, source: failedSource, path, action: \"unavailable\", reason }, null, 2),\n\t\t);\n\t} else {\n\t\twriteLine(`${providerId}: no usable credential to adopt from ${EXTERNAL_CREDENTIAL_SOURCE_LABELS[failedSource]}`);\n\t\twriteLine(`  ${path}`);\n\t\twriteLine(`  ${reason}`);\n\t}\n\treturn 1;\n}\n\nexport async function runProviderAdoptCli(\n\targs: readonly string[],\n\toverrides: ProviderAdoptCliDependencies = {},\n): Promise<ProviderAdoptCliOutcome> {\n\tconst outcome = parseArgs(args);\n\tif (outcome.kind === \"absent\") return { handled: false, exitCode: 0 };\n\tconst writeLine = overrides.writeLine ?? ((line: string) => process.stdout.write(`${line}\\n`));\n\tif (outcome.kind === \"help\") {\n\t\twriteLine(HELP);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\tif (outcome.kind === \"error\") {\n\t\twriteLine(outcome.message);\n\t\twriteLine(USAGE);\n\t\treturn { handled: true, exitCode: 2 };\n\t}\n\n\tconst authPath = join(overrides.agentDir ?? getAgentDir(), \"auth.json\");\n\tconst storage = AuthStorage.create(authPath);\n\tconst now = (overrides.now ?? Date.now)();\n\tconst readFile = overrides.readFile ?? readAuthStoreFile;\n\n\tif (outcome.parsed.status) {\n\t\t// An unreadable store is not an empty store: report the load failure instead of\n\t\t// \"no stored credential\", the same distinction the request path enforces.\n\t\tif (storage.hasLoadError()) {\n\t\t\twriteLine(`The credential store could not be read: ${authPath}`);\n\t\t\twriteLine(`  Another session may hold the lock. Retry shortly.`);\n\t\t\treturn { handled: true, exitCode: 1 };\n\t\t}\n\t\tconst providerIds = outcome.parsed.providerId\n\t\t\t? [outcome.parsed.providerId]\n\t\t\t: storedProviderIds(authPath, readFile);\n\t\twriteStatusReport({ storage, providerIds, json: outcome.parsed.json, authPath, writeLine, now });\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\n\treturn { handled: true, exitCode: adoptProvider(outcome.parsed, overrides, storage, authPath, writeLine) };\n}\n"]}

package/dist/commands/provider-adopt-status.d.ts

@@ -0,0 +1,21 @@
+import type { AuthStorage } from "../core/auth-storage.ts";
+export type AccountHealth = {
+    readonly index: number;
+    readonly label: string;
+    readonly selected: boolean;
+    readonly state: "valid" | "refreshable" | "expired";
+    readonly expiresAt?: number;
+    readonly hasRefresh: boolean;
+};
+export declare function describeAccounts(storage: AuthStorage, providerId: string, now: number): AccountHealth[];
+export declare function storedProviderIds(authPath: string, readFile: (path: string) => string): readonly string[];
+export declare function writeStatusReport(input: {
+    readonly storage: AuthStorage;
+    readonly providerIds: readonly string[];
+    readonly json: boolean;
+    readonly authPath: string;
+    readonly writeLine: (line: string) => void;
+    readonly now: number;
+}): void;
+export declare function readAuthStoreFile(authPath: string): string;
+//# sourceMappingURL=provider-adopt-status.d.ts.map

package/dist/commands/provider-adopt-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adopt-status.d.ts","sourceRoot":"","sources":["../../src/commands/provider-adopt-status.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAqBvG;AAgBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,MAAM,EAAE,CAQzG;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACxC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CA0BP;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D","sourcesContent":["/**\n * `--status` reporting helpers for `omk provider adopt`.\n *\n * Extracted from provider-adopt-cli.ts so the command stays under the module-size\n * ceiling: account health rendering and store enumeration are independent of the\n * adoption write path.\n */\nimport { readFileSync } from \"node:fs\";\nimport type { OAuthCredentials } from \"omk-ai\";\nimport type { AuthStorage } from \"../core/auth-storage.ts\";\n\nexport type AccountHealth = {\n\treadonly index: number;\n\treadonly label: string;\n\treadonly selected: boolean;\n\treadonly state: \"valid\" | \"refreshable\" | \"expired\";\n\treadonly expiresAt?: number;\n\treadonly hasRefresh: boolean;\n};\n\nexport function describeAccounts(storage: AuthStorage, providerId: string, now: number): AccountHealth[] {\n\tconst credential = storage.get(providerId);\n\tif (credential?.type !== \"oauth\") return [];\n\tconst labels = storage.listOAuthAccounts(providerId);\n\tconst accounts: OAuthCredentials[] =\n\t\tArray.isArray(credential.accounts) && credential.accounts.length > 0 ? credential.accounts : [credential];\n\tconst selectedIndex = typeof credential.activeAccount === \"number\" ? credential.activeAccount : 0;\n\treturn accounts.map((account, index) => {\n\t\tconst expires = typeof account.expires === \"number\" ? account.expires : undefined;\n\t\tconst hasRefresh = Boolean(account.refresh);\n\t\tconst state: AccountHealth[\"state\"] =\n\t\t\texpires !== undefined && expires > now ? \"valid\" : hasRefresh ? \"refreshable\" : \"expired\";\n\t\treturn {\n\t\t\tindex,\n\t\t\tlabel: labels.find((entry) => entry.index === index)?.label ?? `Account ${index + 1}`,\n\t\t\tselected: index === selectedIndex,\n\t\t\tstate,\n\t\t\texpiresAt: expires,\n\t\t\thasRefresh,\n\t\t};\n\t});\n}\n\nfunction formatInstant(ms: number | undefined): string {\n\tif (ms === undefined || !Number.isFinite(ms)) return \"an unknown time\";\n\treturn `${new Date(ms).toISOString().slice(0, 16).replace(\"T\", \" \")} UTC`;\n}\n\nfunction accountLine(account: AccountHealth): string {\n\tconst selected = account.selected ? \"selected\" : \"not selected\";\n\tif (account.state === \"valid\")\n\t\treturn `valid until ${formatInstant(account.expiresAt)}, refresh ${account.hasRefresh ? \"yes\" : \"no\"} (${selected})`;\n\tif (account.state === \"refreshable\")\n\t\treturn `expired ${formatInstant(account.expiresAt)}, refreshes on use (${selected})`;\n\treturn `expired ${formatInstant(account.expiresAt)}, no refresh token: sign in again (${selected})`;\n}\n\nexport function storedProviderIds(authPath: string, readFile: (path: string) => string): readonly string[] {\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(readFile(authPath));\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return [];\n\t\treturn Object.keys(parsed as Record<string, unknown>).sort();\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nexport function writeStatusReport(input: {\n\treadonly storage: AuthStorage;\n\treadonly providerIds: readonly string[];\n\treadonly json: boolean;\n\treadonly authPath: string;\n\treadonly writeLine: (line: string) => void;\n\treadonly now: number;\n}): void {\n\tconst providers = input.providerIds.map((providerId) => {\n\t\tconst credential = input.storage.get(providerId);\n\t\tconst kind = credential?.type === \"oauth\" ? \"oauth\" : credential?.type === \"api_key\" ? \"api_key\" : \"none\";\n\t\tconst accounts = kind === \"oauth\" ? describeAccounts(input.storage, providerId, input.now) : [];\n\t\treturn { provider: providerId, kind, accounts };\n\t});\n\tif (input.json) {\n\t\tinput.writeLine(JSON.stringify({ status: \"reported\", authPath: input.authPath, providers }, null, 2));\n\t\treturn;\n\t}\n\tinput.writeLine(`${input.authPath}`);\n\tfor (const entry of providers) {\n\t\tif (entry.kind === \"none\") {\n\t\t\tinput.writeLine(`  ${entry.provider}: no stored credential`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (entry.kind === \"api_key\") {\n\t\t\tinput.writeLine(`  ${entry.provider}: API key stored`);\n\t\t\tcontinue;\n\t\t}\n\t\tinput.writeLine(`  ${entry.provider}: ${entry.accounts.length} OAuth account(s)`);\n\t\tfor (const account of entry.accounts) {\n\t\t\tinput.writeLine(`    [${account.index}] ${account.label} ${accountLine(account)}`);\n\t\t}\n\t}\n}\n\nexport function readAuthStoreFile(authPath: string): string {\n\treturn readFileSync(authPath, \"utf-8\");\n}\n"]}

package/dist/commands/provider-adopt-status.js

@@ -0,0 +1,84 @@
+/**
+ * `--status` reporting helpers for `omk provider adopt`.
+ *
+ * Extracted from provider-adopt-cli.ts so the command stays under the module-size
+ * ceiling: account health rendering and store enumeration are independent of the
+ * adoption write path.
+ */
+import { readFileSync } from "node:fs";
+export function describeAccounts(storage, providerId, now) {
+    const credential = storage.get(providerId);
+    if (credential?.type !== "oauth")
+        return [];
+    const labels = storage.listOAuthAccounts(providerId);
+    const accounts = Array.isArray(credential.accounts) && credential.accounts.length > 0 ? credential.accounts : [credential];
+    const selectedIndex = typeof credential.activeAccount === "number" ? credential.activeAccount : 0;
+    return accounts.map((account, index) => {
+        const expires = typeof account.expires === "number" ? account.expires : undefined;
+        const hasRefresh = Boolean(account.refresh);
+        const state = expires !== undefined && expires > now ? "valid" : hasRefresh ? "refreshable" : "expired";
+        return {
+            index,
+            label: labels.find((entry) => entry.index === index)?.label ?? `Account ${index + 1}`,
+            selected: index === selectedIndex,
+            state,
+            expiresAt: expires,
+            hasRefresh,
+        };
+    });
+}
+function formatInstant(ms) {
+    if (ms === undefined || !Number.isFinite(ms))
+        return "an unknown time";
+    return `${new Date(ms).toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function accountLine(account) {
+    const selected = account.selected ? "selected" : "not selected";
+    if (account.state === "valid")
+        return `valid until ${formatInstant(account.expiresAt)}, refresh ${account.hasRefresh ? "yes" : "no"} (${selected})`;
+    if (account.state === "refreshable")
+        return `expired ${formatInstant(account.expiresAt)}, refreshes on use (${selected})`;
+    return `expired ${formatInstant(account.expiresAt)}, no refresh token: sign in again (${selected})`;
+}
+export function storedProviderIds(authPath, readFile) {
+    try {
+        const parsed = JSON.parse(readFile(authPath));
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return [];
+        return Object.keys(parsed).sort();
+    }
+    catch {
+        return [];
+    }
+}
+export function writeStatusReport(input) {
+    const providers = input.providerIds.map((providerId) => {
+        const credential = input.storage.get(providerId);
+        const kind = credential?.type === "oauth" ? "oauth" : credential?.type === "api_key" ? "api_key" : "none";
+        const accounts = kind === "oauth" ? describeAccounts(input.storage, providerId, input.now) : [];
+        return { provider: providerId, kind, accounts };
+    });
+    if (input.json) {
+        input.writeLine(JSON.stringify({ status: "reported", authPath: input.authPath, providers }, null, 2));
+        return;
+    }
+    input.writeLine(`${input.authPath}`);
+    for (const entry of providers) {
+        if (entry.kind === "none") {
+            input.writeLine(`  ${entry.provider}: no stored credential`);
+            continue;
+        }
+        if (entry.kind === "api_key") {
+            input.writeLine(`  ${entry.provider}: API key stored`);
+            continue;
+        }
+        input.writeLine(`  ${entry.provider}: ${entry.accounts.length} OAuth account(s)`);
+        for (const account of entry.accounts) {
+            input.writeLine(`    [${account.index}] ${account.label} ${accountLine(account)}`);
+        }
+    }
+}
+export function readAuthStoreFile(authPath) {
+    return readFileSync(authPath, "utf-8");
+}
+//# sourceMappingURL=provider-adopt-status.js.map

package/dist/commands/provider-adopt-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adopt-status.js","sourceRoot":"","sources":["../../src/commands/provider-adopt-status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAavC,MAAM,UAAU,gBAAgB,CAAC,OAAoB,EAAE,UAAkB,EAAE,GAAW,EAAmB;IACxG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,QAAQ,GACb,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3G,MAAM,aAAa,GAAG,OAAO,UAAU,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,KAAK,GACV,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,OAAO;YACN,KAAK;YACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,KAAK,IAAI,WAAW,KAAK,GAAG,CAAC,EAAE;YACrF,QAAQ,EAAE,KAAK,KAAK,aAAa;YACjC,KAAK;YACL,SAAS,EAAE,OAAO;YAClB,UAAU;SACV,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AAED,SAAS,aAAa,CAAC,EAAsB,EAAU;IACtD,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACvE,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC;AAAA,CAC1E;AAED,SAAS,WAAW,CAAC,OAAsB,EAAU;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;IAChE,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO;QAC5B,OAAO,eAAe,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,GAAG,CAAC;IACtH,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa;QAClC,OAAO,WAAW,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,QAAQ,GAAG,CAAC;IACtF,OAAO,WAAW,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,sCAAsC,QAAQ,GAAG,CAAC;AAAA,CACpG;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAAkC,EAAqB;IAC1G,IAAI,CAAC;QACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AAAA,CACD;AAED,MAAM,UAAU,iBAAiB,CAAC,KAOjC,EAAQ;IACR,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1G,MAAM,QAAQ,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAA,CAChD,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtG,OAAO;IACR,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,QAAQ,wBAAwB,CAAC,CAAC;YAC7D,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,QAAQ,kBAAkB,CAAC,CAAC;YACvD,SAAS;QACV,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAClF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,SAAS,CAAC,QAAQ,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;IACF,CAAC;AAAA,CACD;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAU;IAC3D,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAAA,CACvC","sourcesContent":["/**\n * `--status` reporting helpers for `omk provider adopt`.\n *\n * Extracted from provider-adopt-cli.ts so the command stays under the module-size\n * ceiling: account health rendering and store enumeration are independent of the\n * adoption write path.\n */\nimport { readFileSync } from \"node:fs\";\nimport type { OAuthCredentials } from \"omk-ai\";\nimport type { AuthStorage } from \"../core/auth-storage.ts\";\n\nexport type AccountHealth = {\n\treadonly index: number;\n\treadonly label: string;\n\treadonly selected: boolean;\n\treadonly state: \"valid\" | \"refreshable\" | \"expired\";\n\treadonly expiresAt?: number;\n\treadonly hasRefresh: boolean;\n};\n\nexport function describeAccounts(storage: AuthStorage, providerId: string, now: number): AccountHealth[] {\n\tconst credential = storage.get(providerId);\n\tif (credential?.type !== \"oauth\") return [];\n\tconst labels = storage.listOAuthAccounts(providerId);\n\tconst accounts: OAuthCredentials[] =\n\t\tArray.isArray(credential.accounts) && credential.accounts.length > 0 ? credential.accounts : [credential];\n\tconst selectedIndex = typeof credential.activeAccount === \"number\" ? credential.activeAccount : 0;\n\treturn accounts.map((account, index) => {\n\t\tconst expires = typeof account.expires === \"number\" ? account.expires : undefined;\n\t\tconst hasRefresh = Boolean(account.refresh);\n\t\tconst state: AccountHealth[\"state\"] =\n\t\t\texpires !== undefined && expires > now ? \"valid\" : hasRefresh ? \"refreshable\" : \"expired\";\n\t\treturn {\n\t\t\tindex,\n\t\t\tlabel: labels.find((entry) => entry.index === index)?.label ?? `Account ${index + 1}`,\n\t\t\tselected: index === selectedIndex,\n\t\t\tstate,\n\t\t\texpiresAt: expires,\n\t\t\thasRefresh,\n\t\t};\n\t});\n}\n\nfunction formatInstant(ms: number | undefined): string {\n\tif (ms === undefined || !Number.isFinite(ms)) return \"an unknown time\";\n\treturn `${new Date(ms).toISOString().slice(0, 16).replace(\"T\", \" \")} UTC`;\n}\n\nfunction accountLine(account: AccountHealth): string {\n\tconst selected = account.selected ? \"selected\" : \"not selected\";\n\tif (account.state === \"valid\")\n\t\treturn `valid until ${formatInstant(account.expiresAt)}, refresh ${account.hasRefresh ? \"yes\" : \"no\"} (${selected})`;\n\tif (account.state === \"refreshable\")\n\t\treturn `expired ${formatInstant(account.expiresAt)}, refreshes on use (${selected})`;\n\treturn `expired ${formatInstant(account.expiresAt)}, no refresh token: sign in again (${selected})`;\n}\n\nexport function storedProviderIds(authPath: string, readFile: (path: string) => string): readonly string[] {\n\ttry {\n\t\tconst parsed: unknown = JSON.parse(readFile(authPath));\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) return [];\n\t\treturn Object.keys(parsed as Record<string, unknown>).sort();\n\t} catch {\n\t\treturn [];\n\t}\n}\n\nexport function writeStatusReport(input: {\n\treadonly storage: AuthStorage;\n\treadonly providerIds: readonly string[];\n\treadonly json: boolean;\n\treadonly authPath: string;\n\treadonly writeLine: (line: string) => void;\n\treadonly now: number;\n}): void {\n\tconst providers = input.providerIds.map((providerId) => {\n\t\tconst credential = input.storage.get(providerId);\n\t\tconst kind = credential?.type === \"oauth\" ? \"oauth\" : credential?.type === \"api_key\" ? \"api_key\" : \"none\";\n\t\tconst accounts = kind === \"oauth\" ? describeAccounts(input.storage, providerId, input.now) : [];\n\t\treturn { provider: providerId, kind, accounts };\n\t});\n\tif (input.json) {\n\t\tinput.writeLine(JSON.stringify({ status: \"reported\", authPath: input.authPath, providers }, null, 2));\n\t\treturn;\n\t}\n\tinput.writeLine(`${input.authPath}`);\n\tfor (const entry of providers) {\n\t\tif (entry.kind === \"none\") {\n\t\t\tinput.writeLine(`  ${entry.provider}: no stored credential`);\n\t\t\tcontinue;\n\t\t}\n\t\tif (entry.kind === \"api_key\") {\n\t\t\tinput.writeLine(`  ${entry.provider}: API key stored`);\n\t\t\tcontinue;\n\t\t}\n\t\tinput.writeLine(`  ${entry.provider}: ${entry.accounts.length} OAuth account(s)`);\n\t\tfor (const account of entry.accounts) {\n\t\t\tinput.writeLine(`    [${account.index}] ${account.label} ${accountLine(account)}`);\n\t\t}\n\t}\n}\n\nexport function readAuthStoreFile(authPath: string): string {\n\treturn readFileSync(authPath, \"utf-8\");\n}\n"]}

package/dist/commands/provider-known-apis.d.ts

@@ -0,0 +1,2 @@
+export declare function isKnownApi(api: string): boolean;
+//# sourceMappingURL=provider-known-apis.d.ts.map

package/dist/commands/provider-known-apis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-known-apis.d.ts","sourceRoot":"","sources":["../../src/commands/provider-known-apis.ts"],"names":[],"mappings":"AAwBA,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG/C","sourcesContent":["/**\n * Whether an `api` string names a supported provider API.\n *\n * The engine's own registry is authoritative: `registerBuiltins` registers `devin-agent` and\n * `cursor-agent`, which a hand-written list had missed, so `omk provider doctor devin` failed\n * every run with \"Provider API type is unsupported\" for a supported provider. The literal stays\n * as the bootstrap fallback for processes where the registry is not populated yet.\n */\nimport { getApiProviders } from \"omk-ai\";\n\nconst STATIC_KNOWN_APIS: readonly string[] = [\n\t\"openai-completions\",\n\t\"mistral-conversations\",\n\t\"openai-responses\",\n\t\"azure-openai-responses\",\n\t\"openai-codex-responses\",\n\t\"anthropic-messages\",\n\t\"bedrock-converse-stream\",\n\t\"google-generative-ai\",\n\t\"google-vertex\",\n\t\"devin-agent\",\n\t\"cursor-agent\",\n];\n\nexport function isKnownApi(api: string): boolean {\n\tif (STATIC_KNOWN_APIS.includes(api)) return true;\n\treturn getApiProviders().some((provider) => provider.api === api);\n}\n"]}

package/dist/commands/provider-known-apis.js

@@ -0,0 +1,28 @@
+/**
+ * Whether an `api` string names a supported provider API.
+ *
+ * The engine's own registry is authoritative: `registerBuiltins` registers `devin-agent` and
+ * `cursor-agent`, which a hand-written list had missed, so `omk provider doctor devin` failed
+ * every run with "Provider API type is unsupported" for a supported provider. The literal stays
+ * as the bootstrap fallback for processes where the registry is not populated yet.
+ */
+import { getApiProviders } from "omk-ai";
+const STATIC_KNOWN_APIS = [
+    "openai-completions",
+    "mistral-conversations",
+    "openai-responses",
+    "azure-openai-responses",
+    "openai-codex-responses",
+    "anthropic-messages",
+    "bedrock-converse-stream",
+    "google-generative-ai",
+    "google-vertex",
+    "devin-agent",
+    "cursor-agent",
+];
+export function isKnownApi(api) {
+    if (STATIC_KNOWN_APIS.includes(api))
+        return true;
+    return getApiProviders().some((provider) => provider.api === api);
+}
+//# sourceMappingURL=provider-known-apis.js.map

package/dist/commands/provider-known-apis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-known-apis.js","sourceRoot":"","sources":["../../src/commands/provider-known-apis.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAEzC,MAAM,iBAAiB,GAAsB;IAC5C,oBAAoB;IACpB,uBAAuB;IACvB,kBAAkB;IAClB,wBAAwB;IACxB,wBAAwB;IACxB,oBAAoB;IACpB,yBAAyB;IACzB,sBAAsB;IACtB,eAAe;IACf,aAAa;IACb,cAAc;CACd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,GAAW,EAAW;IAChD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAAA,CAClE","sourcesContent":["/**\n * Whether an `api` string names a supported provider API.\n *\n * The engine's own registry is authoritative: `registerBuiltins` registers `devin-agent` and\n * `cursor-agent`, which a hand-written list had missed, so `omk provider doctor devin` failed\n * every run with \"Provider API type is unsupported\" for a supported provider. The literal stays\n * as the bootstrap fallback for processes where the registry is not populated yet.\n */\nimport { getApiProviders } from \"omk-ai\";\n\nconst STATIC_KNOWN_APIS: readonly string[] = [\n\t\"openai-completions\",\n\t\"mistral-conversations\",\n\t\"openai-responses\",\n\t\"azure-openai-responses\",\n\t\"openai-codex-responses\",\n\t\"anthropic-messages\",\n\t\"bedrock-converse-stream\",\n\t\"google-generative-ai\",\n\t\"google-vertex\",\n\t\"devin-agent\",\n\t\"cursor-agent\",\n];\n\nexport function isKnownApi(api: string): boolean {\n\tif (STATIC_KNOWN_APIS.includes(api)) return true;\n\treturn getApiProviders().some((provider) => provider.api === api);\n}\n"]}

package/dist/commands/run-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-command.d.ts","sourceRoot":"","sources":["../../src/commands/run-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAW/E,KAAK,UAAU,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAY3E,+EAA+E;AAC/E,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAUlG","sourcesContent":["import type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { runAdaptOrchDoctorCli } from \"./adaptorch-doctor-cli.ts\";\nimport { runDoctorProviderCli } from \"./doctor-provider-cli.ts\";\nimport { runProviderSyncCli } from \"./provider-sync-cli.ts\";\nimport { runResourceDoctorCli } from \"./resource-doctor-cli.ts\";\nimport { runRouterFeedbackCli } from \"./router-feedback-cli.ts\";\nimport { runSdkSessionCli } from \"./sdk-session-cli.ts\";\nimport { runSessionDoctorCli } from \"./session-doctor-cli.ts\";\nimport { runStatsCli } from \"./stats-cli.ts\";\nimport { runVerifiedRunCli } from \"./verified-run-cli.ts\";\n\ntype CliOutcome = { readonly handled: boolean; readonly exitCode: number };\n\nconst COMMANDS: ReadonlyArray<(args: string[]) => CliOutcome | Promise<CliOutcome>> = [\n\trunSessionDoctorCli,\n\trunDoctorProviderCli,\n\trunResourceDoctorCli,\n\trunAdaptOrchDoctorCli,\n\trunStatsCli,\n\trunSdkSessionCli,\n\trunRouterFeedbackCli,\n];\n\n/** Each handler owns a distinct prefix; preserve the first handled outcome. */\nexport async function runCommand(args: string[], runtime?: VerifiedRunRuntime): Promise<CliOutcome> {\n\tconst providerSync = await runProviderSyncCli(args);\n\tif (providerSync.handled) return providerSync;\n\tconst verifiedRun = await runVerifiedRunCli(args, runtime);\n\tif (verifiedRun.handled) return verifiedRun;\n\tfor (const command of COMMANDS) {\n\t\tconst outcome = await command(args);\n\t\tif (outcome.handled) return outcome;\n\t}\n\treturn { handled: false, exitCode: 0 };\n}\n"]}
+{"version":3,"file":"run-command.d.ts","sourceRoot":"","sources":["../../src/commands/run-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAY/E,KAAK,UAAU,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAY3E,+EAA+E;AAC/E,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAYlG","sourcesContent":["import type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { runAdaptOrchDoctorCli } from \"./adaptorch-doctor-cli.ts\";\nimport { runDoctorProviderCli } from \"./doctor-provider-cli.ts\";\nimport { runProviderAdoptCli } from \"./provider-adopt-cli.ts\";\nimport { runProviderSyncCli } from \"./provider-sync-cli.ts\";\nimport { runResourceDoctorCli } from \"./resource-doctor-cli.ts\";\nimport { runRouterFeedbackCli } from \"./router-feedback-cli.ts\";\nimport { runSdkSessionCli } from \"./sdk-session-cli.ts\";\nimport { runSessionDoctorCli } from \"./session-doctor-cli.ts\";\nimport { runStatsCli } from \"./stats-cli.ts\";\nimport { runVerifiedRunCli } from \"./verified-run-cli.ts\";\n\ntype CliOutcome = { readonly handled: boolean; readonly exitCode: number };\n\nconst COMMANDS: ReadonlyArray<(args: string[]) => CliOutcome | Promise<CliOutcome>> = [\n\trunSessionDoctorCli,\n\trunDoctorProviderCli,\n\trunResourceDoctorCli,\n\trunAdaptOrchDoctorCli,\n\trunStatsCli,\n\trunSdkSessionCli,\n\trunRouterFeedbackCli,\n];\n\n/** Each handler owns a distinct prefix; preserve the first handled outcome. */\nexport async function runCommand(args: string[], runtime?: VerifiedRunRuntime): Promise<CliOutcome> {\n\tconst providerAdopt = await runProviderAdoptCli(args);\n\tif (providerAdopt.handled) return providerAdopt;\n\tconst providerSync = await runProviderSyncCli(args);\n\tif (providerSync.handled) return providerSync;\n\tconst verifiedRun = await runVerifiedRunCli(args, runtime);\n\tif (verifiedRun.handled) return verifiedRun;\n\tfor (const command of COMMANDS) {\n\t\tconst outcome = await command(args);\n\t\tif (outcome.handled) return outcome;\n\t}\n\treturn { handled: false, exitCode: 0 };\n}\n"]}

package/dist/commands/run-command.js

@@ -1,5 +1,6 @@
 import { runAdaptOrchDoctorCli } from "./adaptorch-doctor-cli.js";
 import { runDoctorProviderCli } from "./doctor-provider-cli.js";
+import { runProviderAdoptCli } from "./provider-adopt-cli.js";
 import { runProviderSyncCli } from "./provider-sync-cli.js";
 import { runResourceDoctorCli } from "./resource-doctor-cli.js";
 import { runRouterFeedbackCli } from "./router-feedback-cli.js";
@@ -18,6 +19,9 @@ const COMMANDS = [
 ];
 /** Each handler owns a distinct prefix; preserve the first handled outcome. */
 export async function runCommand(args, runtime) {
+    const providerAdopt = await runProviderAdoptCli(args);
+    if (providerAdopt.handled)
+        return providerAdopt;
     const providerSync = await runProviderSyncCli(args);
     if (providerSync.handled)
         return providerSync;

package/dist/commands/run-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-command.js","sourceRoot":"","sources":["../../src/commands/run-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI1D,MAAM,QAAQ,GAAwE;IACrF,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,oBAAoB;CACpB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,OAA4B,EAAuB;IACnG,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,YAAY,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAAA,CACvC","sourcesContent":["import type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { runAdaptOrchDoctorCli } from \"./adaptorch-doctor-cli.ts\";\nimport { runDoctorProviderCli } from \"./doctor-provider-cli.ts\";\nimport { runProviderSyncCli } from \"./provider-sync-cli.ts\";\nimport { runResourceDoctorCli } from \"./resource-doctor-cli.ts\";\nimport { runRouterFeedbackCli } from \"./router-feedback-cli.ts\";\nimport { runSdkSessionCli } from \"./sdk-session-cli.ts\";\nimport { runSessionDoctorCli } from \"./session-doctor-cli.ts\";\nimport { runStatsCli } from \"./stats-cli.ts\";\nimport { runVerifiedRunCli } from \"./verified-run-cli.ts\";\n\ntype CliOutcome = { readonly handled: boolean; readonly exitCode: number };\n\nconst COMMANDS: ReadonlyArray<(args: string[]) => CliOutcome | Promise<CliOutcome>> = [\n\trunSessionDoctorCli,\n\trunDoctorProviderCli,\n\trunResourceDoctorCli,\n\trunAdaptOrchDoctorCli,\n\trunStatsCli,\n\trunSdkSessionCli,\n\trunRouterFeedbackCli,\n];\n\n/** Each handler owns a distinct prefix; preserve the first handled outcome. */\nexport async function runCommand(args: string[], runtime?: VerifiedRunRuntime): Promise<CliOutcome> {\n\tconst providerSync = await runProviderSyncCli(args);\n\tif (providerSync.handled) return providerSync;\n\tconst verifiedRun = await runVerifiedRunCli(args, runtime);\n\tif (verifiedRun.handled) return verifiedRun;\n\tfor (const command of COMMANDS) {\n\t\tconst outcome = await command(args);\n\t\tif (outcome.handled) return outcome;\n\t}\n\treturn { handled: false, exitCode: 0 };\n}\n"]}
+{"version":3,"file":"run-command.js","sourceRoot":"","sources":["../../src/commands/run-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI1D,MAAM,QAAQ,GAAwE;IACrF,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,WAAW;IACX,gBAAgB;IAChB,oBAAoB;CACpB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,OAA4B,EAAuB;IACnG,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,aAAa,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC;IAChD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,YAAY,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,OAAO;QAAE,OAAO,WAAW,CAAC;IAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAAA,CACvC","sourcesContent":["import type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { runAdaptOrchDoctorCli } from \"./adaptorch-doctor-cli.ts\";\nimport { runDoctorProviderCli } from \"./doctor-provider-cli.ts\";\nimport { runProviderAdoptCli } from \"./provider-adopt-cli.ts\";\nimport { runProviderSyncCli } from \"./provider-sync-cli.ts\";\nimport { runResourceDoctorCli } from \"./resource-doctor-cli.ts\";\nimport { runRouterFeedbackCli } from \"./router-feedback-cli.ts\";\nimport { runSdkSessionCli } from \"./sdk-session-cli.ts\";\nimport { runSessionDoctorCli } from \"./session-doctor-cli.ts\";\nimport { runStatsCli } from \"./stats-cli.ts\";\nimport { runVerifiedRunCli } from \"./verified-run-cli.ts\";\n\ntype CliOutcome = { readonly handled: boolean; readonly exitCode: number };\n\nconst COMMANDS: ReadonlyArray<(args: string[]) => CliOutcome | Promise<CliOutcome>> = [\n\trunSessionDoctorCli,\n\trunDoctorProviderCli,\n\trunResourceDoctorCli,\n\trunAdaptOrchDoctorCli,\n\trunStatsCli,\n\trunSdkSessionCli,\n\trunRouterFeedbackCli,\n];\n\n/** Each handler owns a distinct prefix; preserve the first handled outcome. */\nexport async function runCommand(args: string[], runtime?: VerifiedRunRuntime): Promise<CliOutcome> {\n\tconst providerAdopt = await runProviderAdoptCli(args);\n\tif (providerAdopt.handled) return providerAdopt;\n\tconst providerSync = await runProviderSyncCli(args);\n\tif (providerSync.handled) return providerSync;\n\tconst verifiedRun = await runVerifiedRunCli(args, runtime);\n\tif (verifiedRun.handled) return verifiedRun;\n\tfor (const command of COMMANDS) {\n\t\tconst outcome = await command(args);\n\t\tif (outcome.handled) return outcome;\n\t}\n\treturn { handled: false, exitCode: 0 };\n}\n"]}