panoma 0.1.9 → 0.9.0

package/dist/chunk-JY7ALFNX.js

@@ -0,0 +1,1362 @@
+import {
+  panomaPath,
+  resolveExecutable,
+  restrictToOwner
+} from "./chunk-5EG7NRL4.js";
+
+// ../../packages/ai/dist/index.js
+import { homedir } from "os";
+import { join } from "path";
+import { copyFile, mkdir, open, readdir, readFile, rename, rm } from "fs/promises";
+import { basename, dirname, join as join2 } from "path";
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+import { spawn } from "child_process";
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { tmpdir } from "os";
+function failureMessage(failure) {
+  switch (failure.code) {
+    case "noCommand":
+      return `${failure.provider} declares no command to run.`;
+    case "launchFailed":
+      return `Could not launch ${failure.command}: ${failure.reason}`;
+    case "exited":
+      return `${failure.provider} exited with code ${failure.status}. ${failure.output}`.trim();
+    case "emptyBody":
+      return `${failure.provider} answered with no body.`;
+    case "providerRefused":
+      return `${failure.provider} answered ${failure.status}: ${failure.detail}`;
+    case "tokenRefused":
+      return `${failure.provider} refused the token request (${failure.status}): ${failure.detail}`;
+    case "neverAnswered":
+      return `${failure.provider} never answered: ${failure.last}. Attempts: ${failure.attempts}. The model did not say no \u2014 the request never left this machine.`;
+    case "configShape":
+      return "the contents are not shaped like a panoma configuration";
+    case "configLocked":
+      return `Another panoma process is writing the configuration${failure.holder ? ` (${failure.holder})` : ""}.
+If none is running, the lock was left behind by an earlier run:
+  rm ${failure.lock}`;
+    case "noProvider":
+      return "No AI provider is configured. Run 'panoma ai' to see the options.";
+    case "unknownProvider":
+      return `Unknown provider: ${failure.id}`;
+    case "oauthTimeout":
+      return "Timed out waiting for you to come back from the browser.";
+    case "noOauth":
+      return `${failure.provider} does not use sign-in.`;
+    case "badUrl":
+      return `${failure.provider}'s address is not a valid URL: \xAB${failure.value}\xBB. Check ${failure.where}.`;
+    case "notHttp":
+      return `${failure.provider}'s address has to be http or https.`;
+    case "urlHasCredentials":
+      return `${failure.provider}'s address carries a user or a password inside. Take them out and use the key.`;
+    case "insecureHost":
+      return `panoma will not send ${failure.provider}'s credential unencrypted to ${failure.host}. Use https, or a server on your own machine.`;
+  }
+}
+var AiError = class extends Error {
+  failure;
+  constructor(failure) {
+    super(failureMessage(failure));
+    this.name = "AiError";
+    this.failure = failure;
+  }
+};
+var PROVIDERS = [
+  {
+    id: "anthropic",
+    name: "Anthropic",
+    auth: "api-key",
+    description: "Claude por API. Facturaci\xF3n por uso.",
+    descriptionEn: "Claude over the API. Pay as you go.",
+    api: "anthropic",
+    baseUrl: "https://api.anthropic.com",
+    apiKeyEnvVars: ["ANTHROPIC_API_KEY"],
+    baseUrlEnvVar: "ANTHROPIC_BASE_URL",
+    defaultModel: "claude-opus-5",
+    models: ["claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5-20251001"],
+    signupUrl: "https://console.anthropic.com/settings/keys"
+  },
+  {
+    id: "openai",
+    name: "OpenAI",
+    auth: "api-key",
+    description: "GPT por API. Facturaci\xF3n por uso.",
+    descriptionEn: "GPT over the API. Pay as you go.",
+    api: "openai",
+    baseUrl: "https://api.openai.com/v1",
+    apiKeyEnvVars: ["OPENAI_API_KEY"],
+    baseUrlEnvVar: "OPENAI_BASE_URL",
+    defaultModel: "gpt-5",
+    models: ["gpt-5", "gpt-5-mini"],
+    signupUrl: "https://platform.openai.com/api-keys"
+  },
+  {
+    id: "openrouter",
+    name: "OpenRouter",
+    auth: "api-key",
+    description: "Una clave para modelos de muchos fabricantes.",
+    descriptionEn: "One key for models from many makers.",
+    api: "openai",
+    baseUrl: "https://openrouter.ai/api/v1",
+    apiKeyEnvVars: ["OPENROUTER_API_KEY"],
+    baseUrlEnvVar: "OPENROUTER_BASE_URL",
+    defaultModel: "anthropic/claude-opus-4.6",
+    models: ["anthropic/claude-opus-4.6", "openai/gpt-5", "google/gemini-2.5-pro", "deepseek/deepseek-chat"],
+    signupUrl: "https://openrouter.ai/keys"
+  },
+  {
+    id: "google",
+    name: "Google AI Studio",
+    auth: "api-key",
+    description: "Gemini por su endpoint compatible con OpenAI.",
+    descriptionEn: "Gemini through its OpenAI-compatible endpoint.",
+    api: "openai",
+    baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
+    apiKeyEnvVars: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
+    baseUrlEnvVar: "GEMINI_BASE_URL",
+    defaultModel: "gemini-2.5-pro",
+    models: ["gemini-2.5-pro", "gemini-2.5-flash"],
+    signupUrl: "https://aistudio.google.com/apikey"
+  },
+  {
+    id: "local",
+    name: "Modelo local",
+    auth: "api-key",
+    description: "Ollama, LM Studio o cualquier servidor compatible con OpenAI.",
+    descriptionEn: "Ollama, LM Studio, or any OpenAI-compatible server.",
+    api: "openai",
+    baseUrl: "http://127.0.0.1:11434/v1",
+    apiKeyEnvVars: ["LOCAL_LLM_API_KEY"],
+    baseUrlEnvVar: "LOCAL_LLM_BASE_URL",
+    defaultModel: "qwen3:8b",
+    signupUrl: "https://ollama.com"
+  },
+  /*
+    ── The others, and why they are ─────────────────────────────────────────────────────
+    Everyone talks in the OpenAI format, so none includes code: they are rows. It is the promise
+    of the declarative record fulfilled, and the reason for having chosen this form — its catalog
+    goes beyond thirty providers without a `if` per manufacturer anywhere.
+    The list comes from those offered by veteran open agents, removing those that are not a row:
+    the big cloud ones (Bedrock, Vertex, Azure) need entire credential chains — AWS’s, a Google
+    service account — and putting them here would be promising a key field that is useless. Those
+    go in the day someone needs them, with their code.
+    Each one allows `baseUrlEnvVar` because these endpoints move —they change region, route
+    version— and an environment variable fixes in a moment what otherwise would require waiting
+    for a new version of Panoma.
+   */
+  {
+    id: "deepseek",
+    name: "DeepSeek",
+    auth: "api-key",
+    description: "Modelos de razonamiento a precio bajo.",
+    descriptionEn: "Reasoning models at a low price.",
+    api: "openai",
+    baseUrl: "https://api.deepseek.com/v1",
+    apiKeyEnvVars: ["DEEPSEEK_API_KEY"],
+    baseUrlEnvVar: "DEEPSEEK_BASE_URL",
+    defaultModel: "deepseek-chat",
+    models: ["deepseek-chat", "deepseek-reasoner"],
+    signupUrl: "https://platform.deepseek.com/api_keys"
+  },
+  {
+    id: "groq",
+    name: "Groq",
+    auth: "api-key",
+    description: "Modelos abiertos, con la respuesta m\xE1s r\xE1pida del mercado.",
+    descriptionEn: "Open models, with the fastest responses on the market.",
+    api: "openai",
+    baseUrl: "https://api.groq.com/openai/v1",
+    apiKeyEnvVars: ["GROQ_API_KEY"],
+    baseUrlEnvVar: "GROQ_BASE_URL",
+    defaultModel: "llama-3.3-70b-versatile",
+    signupUrl: "https://console.groq.com/keys"
+  },
+  {
+    id: "xai",
+    name: "xAI",
+    auth: "api-key",
+    description: "Grok por API.",
+    descriptionEn: "Grok over the API.",
+    api: "openai",
+    baseUrl: "https://api.x.ai/v1",
+    apiKeyEnvVars: ["XAI_API_KEY"],
+    baseUrlEnvVar: "XAI_BASE_URL",
+    defaultModel: "grok-4-fast-reasoning",
+    signupUrl: "https://console.x.ai"
+  },
+  {
+    id: "together",
+    name: "Together AI",
+    auth: "api-key",
+    description: "Cat\xE1logo grande de modelos abiertos alojados.",
+    descriptionEn: "A large catalog of hosted open models.",
+    api: "openai",
+    baseUrl: "https://api.together.xyz/v1",
+    apiKeyEnvVars: ["TOGETHER_API_KEY"],
+    baseUrlEnvVar: "TOGETHER_BASE_URL",
+    defaultModel: "deepseek-ai/DeepSeek-V3",
+    signupUrl: "https://api.together.ai/settings/api-keys"
+  },
+  {
+    id: "fireworks",
+    name: "Fireworks AI",
+    auth: "api-key",
+    description: "Modelos abiertos servidos r\xE1pido.",
+    descriptionEn: "Open models, served fast.",
+    api: "openai",
+    baseUrl: "https://api.fireworks.ai/inference/v1",
+    apiKeyEnvVars: ["FIREWORKS_API_KEY"],
+    baseUrlEnvVar: "FIREWORKS_BASE_URL",
+    defaultModel: "accounts/fireworks/models/kimi-k2-instruct",
+    signupUrl: "https://fireworks.ai/account/api-keys"
+  },
+  {
+    id: "cerebras",
+    name: "Cerebras",
+    auth: "api-key",
+    description: "Inferencia sobre oblea entera. Muy r\xE1pida, cat\xE1logo corto.",
+    descriptionEn: "Wafer-scale inference. Very fast, short catalog.",
+    api: "openai",
+    baseUrl: "https://api.cerebras.ai/v1",
+    apiKeyEnvVars: ["CEREBRAS_API_KEY"],
+    baseUrlEnvVar: "CEREBRAS_BASE_URL",
+    defaultModel: "llama-3.3-70b",
+    signupUrl: "https://cloud.cerebras.ai"
+  },
+  {
+    id: "moonshot",
+    name: "Moonshot \xB7 Kimi",
+    auth: "api-key",
+    description: "Kimi, con ventana de contexto larga.",
+    descriptionEn: "Kimi, with a long context window.",
+    api: "openai",
+    baseUrl: "https://api.moonshot.ai/v1",
+    apiKeyEnvVars: ["MOONSHOT_API_KEY", "KIMI_API_KEY"],
+    baseUrlEnvVar: "MOONSHOT_BASE_URL",
+    defaultModel: "kimi-k2-turbo-preview",
+    signupUrl: "https://platform.moonshot.ai/console/api-keys"
+  },
+  {
+    id: "alibaba",
+    name: "Qwen \xB7 DashScope",
+    auth: "api-key",
+    description: "Qwen por el endpoint compatible de Alibaba.",
+    descriptionEn: "Qwen through Alibaba\u2019s compatible endpoint.",
+    api: "openai",
+    baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",
+    apiKeyEnvVars: ["DASHSCOPE_API_KEY"],
+    baseUrlEnvVar: "DASHSCOPE_BASE_URL",
+    defaultModel: "qwen-max",
+    signupUrl: "https://bailian.console.alibabacloud.com"
+  },
+  {
+    id: "nvidia",
+    name: "NVIDIA NIM",
+    auth: "api-key",
+    description: "Modelos abiertos servidos por NVIDIA.",
+    descriptionEn: "Open models served by NVIDIA.",
+    api: "openai",
+    baseUrl: "https://integrate.api.nvidia.com/v1",
+    apiKeyEnvVars: ["NVIDIA_API_KEY"],
+    baseUrlEnvVar: "NVIDIA_BASE_URL",
+    defaultModel: "meta/llama-3.3-70b-instruct",
+    signupUrl: "https://build.nvidia.com"
+  },
+  {
+    id: "huggingface",
+    name: "Hugging Face",
+    auth: "api-key",
+    description: "El enrutador de inferencia del Hub.",
+    descriptionEn: "The Hub\u2019s inference router.",
+    api: "openai",
+    baseUrl: "https://router.huggingface.co/v1",
+    apiKeyEnvVars: ["HF_TOKEN", "HUGGINGFACE_API_KEY"],
+    baseUrlEnvVar: "HF_BASE_URL",
+    defaultModel: "Qwen/Qwen2.5-72B-Instruct",
+    signupUrl: "https://huggingface.co/settings/tokens"
+  },
+  {
+    id: "ollama-cloud",
+    name: "Ollama Cloud",
+    auth: "api-key",
+    description: "Los modelos de Ollama, servidos por ellos en vez de por tu port\xE1til.",
+    descriptionEn: "Ollama\u2019s models, served by them instead of your laptop.",
+    api: "openai",
+    baseUrl: "https://ollama.com/v1",
+    apiKeyEnvVars: ["OLLAMA_API_KEY"],
+    baseUrlEnvVar: "OLLAMA_BASE_URL",
+    defaultModel: "gpt-oss:120b",
+    signupUrl: "https://ollama.com/settings/keys"
+  },
+  {
+    id: "lmstudio",
+    name: "LM Studio",
+    auth: "api-key",
+    description: "El servidor local de LM Studio. Sin clave, salvo que le pongas una.",
+    descriptionEn: "LM Studio\u2019s local server. No key, unless you set one.",
+    api: "openai",
+    baseUrl: "http://127.0.0.1:1234/v1",
+    apiKeyEnvVars: ["LM_API_KEY", "LMSTUDIO_API_KEY"],
+    baseUrlEnvVar: "LMSTUDIO_BASE_URL",
+    defaultModel: "local-model",
+    signupUrl: "https://lmstudio.ai"
+  },
+  // ── Sign in with a subscription ───────────────────────────────────────
+  {
+    id: "openai-codex",
+    name: "ChatGPT (Codex)",
+    auth: "oauth",
+    description: "Tu suscripci\xF3n de ChatGPT Plus o Pro, sin clave y sin binario local. Uso personal: se apoya en el inicio de sesi\xF3n del CLI de Codex y en un endpoint privado de OpenAI, as\xED que puede dejar de funcionar el d\xEDa que ellos lo cambien.",
+    descriptionEn: "Your ChatGPT Plus or Pro subscription, no key and no local binary. Personal use: it leans on the Codex CLI sign-in and a private OpenAI endpoint, so it can stop working the day they change it.",
+    api: "codex",
+    // The backup of ChatGPT, not `api.openai.com`: the subscription token is the only thing from
+    // OpenAI that is charged from the plan, and it is only valid against this gate.
+    baseUrl: "https://chatgpt.com/backend-api/codex",
+    baseUrlEnvVar: "CODEX_BASE_URL",
+    /*
+      Those who accept a ChatGPT account are not the same as those who accept a API key.
+      With a key, any model of the API is valid; with a subscription, the backup only supports
+      those assigned to your plan and returns 400 for the rest — 'The 'X' model is not supported
+      when using Codex with a ChatGPT account.' `terra` is the balanced one and that is why it is
+      the default; `sol` is for difficult tasks, `luna` for fast tasks, and `spark` only if you
+      pay for Pro. If this list becomes outdated, the model field is written manually.
+     */
+    defaultModel: "gpt-5.6-terra",
+    models: ["gpt-5.6-terra", "gpt-5.6-sol", "gpt-5.6-luna", "gpt-5.5"],
+    signupUrl: "https://chatgpt.com",
+    oauth: {
+      /*
+        The public client_id distributed by CLI of Codex itself.
+        It is not a secret —it travels in every login of anyone who uses `codex` — but it is not
+        ours either: it belongs to the registered OpenAI application, and the port and return path
+        are set in that registry. That is why 1455 cannot be changed.
+       */
+      clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
+      authorizeUrl: "https://auth.openai.com/oauth/authorize",
+      tokenUrl: "https://auth.openai.com/oauth/token",
+      // `offline_access` is what causes them to return a refresh token; without it, you would have
+      // to log in again every few hours.
+      scopes: ["openid", "profile", "email", "offline_access"],
+      redirectPort: 1455,
+      redirectPath: "/auth/callback"
+    }
+  },
+  // ── Delegation to already installed agents ────────────────────────────────────── This is the
+  // 'subscription' route: the session is held by the user's official tool, on their machine. Panoma
+  // does not store any token nor sees their credentials.
+  {
+    id: "claude-cli",
+    name: "Claude Code",
+    auth: "cli",
+    description: "Usa tu sesi\xF3n de Claude Code ya iniciada. Sin claves.",
+    descriptionEn: "Uses your signed-in Claude Code session. No keys.",
+    command: "claude",
+    /*
+      `-p` alone booted the person's whole Claude Code: every MCP server in their config, the
+      instruction files of the server's cwd, and a session persisted under `~/.claude/projects`.
+      Measured elsewhere, a `-p` without `--strict-mcp-config` cost about 70 times more than one
+      with it, for a one-line answer. `--strict-mcp-config` with no `--mcp-config` means no MCP
+      servers at all; `--no-session-persistence` leaves nothing on disk. Not `--bare`: it disables
+      OAuth and would break the very subscription route this row exists for.
+     */
+    args: ["-p", "--strict-mcp-config", "--no-session-persistence"],
+    bundles: [
+      join(homedir(), ".claude", "local", "claude"),
+      "/Applications/Claude.app/Contents/Resources/claude"
+    ]
+  },
+  {
+    /*
+          «Codex CLI» and not «Codex», which is what it said.
+    
+          Two entries away sits `openai-codex`, called «ChatGPT (Codex)», and a list showing both
+          offered the reader the same word twice with no way to tell them apart. They are not variants:
+          this one runs the `codex` binary on this machine as a subprocess, and that one talks to
+          OpenAI over your ChatGPT sign-in without any local binary at all. Whoever picked wrong was
+          not being careless — the screen gave them nothing to pick with.
+    
+          The descriptions say the mechanism now, for the same reason: «uses your signed-in session,
+          no keys» was true of both.
+         */
+    id: "codex-cli",
+    name: "Codex CLI",
+    auth: "cli",
+    description: "Ejecuta el binario `codex` de esta m\xE1quina. Usa su sesi\xF3n ya iniciada, sin claves.",
+    descriptionEn: "Runs the `codex` binary on this machine, using its signed-in session. No keys.",
+    command: "codex",
+    // `--ephemeral` leaves no session on disk; `--skip-git-repo-check` because the agent is
+    // launched from a neutral temporary directory, which is not a repository. See `complete.ts`.
+    args: ["exec", "--ephemeral", "--skip-git-repo-check"],
+    bundles: ["/Applications/ChatGPT.app/Contents/Resources/codex"]
+  },
+  {
+    id: "gemini-cli",
+    name: "Gemini CLI",
+    auth: "cli",
+    description: "Usa tu sesi\xF3n de Gemini CLI ya iniciada. Sin claves.",
+    descriptionEn: "Uses your signed-in Gemini CLI session. No keys.",
+    command: "gemini",
+    args: ["-p"]
+  },
+  /*
+    The three at the top were the only ones, and the list ran short immediately.
+    When teaching the agents in the catalog panel, the gap was seen: on this same machine there
+    was a `cursor-agent` running that Panoma did not know about. Those that have a stable binary
+    and a non-interactive mode are added; what is not installed is not displayed, so expanding the
+    list does not make noise — it just stops having invisible agents.
+   */
+  {
+    id: "cursor-agent",
+    name: "Cursor Agent",
+    auth: "cli",
+    description: "Usa tu sesi\xF3n de Cursor ya iniciada. Sin claves.",
+    descriptionEn: "Uses your signed-in Cursor session. No keys.",
+    command: "cursor-agent",
+    args: ["-p"],
+    // Its installer puts it in `~/.local/bin`, which is in the PATH of a session shell but not in
+    // that of the server that starts `panoma up`. Same case as the `.app`.
+    bundles: [join(homedir(), ".local", "bin", "cursor-agent")]
+  },
+  {
+    id: "copilot-cli",
+    name: "GitHub Copilot",
+    auth: "cli",
+    description: "Usa tu suscripci\xF3n de Copilot ya iniciada. Sin claves.",
+    descriptionEn: "Uses your signed-in Copilot subscription. No keys.",
+    command: "copilot",
+    args: ["-p"]
+  },
+  {
+    id: "opencode",
+    name: "OpenCode",
+    auth: "cli",
+    description: "Usa tu instalaci\xF3n de OpenCode. Sin claves.",
+    descriptionEn: "Uses your OpenCode install. No keys.",
+    command: "opencode",
+    args: ["run"]
+  },
+  {
+    id: "aider",
+    name: "Aider",
+    auth: "cli",
+    description: "Usa tu instalaci\xF3n de Aider. Sin claves.",
+    descriptionEn: "Uses your Aider install. No keys.",
+    command: "aider",
+    args: ["--message"]
+  },
+  {
+    id: "amp-cli",
+    name: "Amp",
+    auth: "cli",
+    description: "Usa tu sesi\xF3n de Amp ya iniciada. Sin claves.",
+    descriptionEn: "Uses your signed-in Amp session. No keys.",
+    command: "amp",
+    args: ["-x"]
+  },
+  {
+    id: "goose",
+    name: "Goose",
+    auth: "cli",
+    description: "Usa tu instalaci\xF3n de Goose. Sin claves.",
+    descriptionEn: "Uses your Goose install. No keys.",
+    command: "goose",
+    args: ["run", "-t"]
+  }
+];
+function findProvider(id) {
+  return PROVIDERS.find((provider) => provider.id === id);
+}
+function providersByAuth(auth) {
+  return PROVIDERS.filter((provider) => provider.auth === auth);
+}
+function createChallenge() {
+  const verifier = base64url(randomBytes(48));
+  return {
+    verifier,
+    challenge: base64url(createHash("sha256").update(verifier).digest()),
+    state: base64url(randomBytes(24))
+  };
+}
+function base64url(buffer) {
+  return buffer.toString("base64url");
+}
+function redirectUri(provider) {
+  const config = requireOauth(provider);
+  return `http://localhost:${config.redirectPort}${config.redirectPath}`;
+}
+function authorizeUrl(provider, challenge) {
+  const config = requireOauth(provider);
+  const url = new URL(config.authorizeUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", config.clientId);
+  url.searchParams.set("redirect_uri", redirectUri(provider));
+  url.searchParams.set("scope", config.scopes.join(" "));
+  url.searchParams.set("code_challenge", challenge.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", challenge.state);
+  return url.toString();
+}
+var DEADLINE_MS = 3e5;
+function awaitCallback(provider, challenge) {
+  const config = requireOauth(provider);
+  return new Promise((resolve, reject) => {
+    let server;
+    const close = () => server?.close();
+    const deadline = setTimeout(() => {
+      close();
+      reject(new AiError({ code: "oauthTimeout" }));
+    }, DEADLINE_MS);
+    const finish = (error, code) => {
+      clearTimeout(deadline);
+      close();
+      if (error) reject(error);
+      else resolve(code);
+    };
+    server = createServer((request, response) => {
+      const url = new URL(request.url ?? "/", `http://localhost:${config.redirectPort}`);
+      if (url.pathname !== config.redirectPath) {
+        response.writeHead(404).end();
+        return;
+      }
+      const error = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state") ?? "";
+      if (!same(state, challenge.state)) {
+        respond(response, 400, "Ese retorno no era de esta sesi\xF3n.");
+        finish(new Error("El \xABstate\xBB del retorno no coincide: se descarta."));
+        return;
+      }
+      if (error) {
+        respond(response, 400, "No se pudo iniciar sesi\xF3n.");
+        finish(new Error(`El proveedor devolvi\xF3 \xAB${error}\xBB.`));
+        return;
+      }
+      if (!code) {
+        respond(response, 400, "El retorno vino sin c\xF3digo.");
+        finish(new Error("El retorno no tra\xEDa c\xF3digo de autorizaci\xF3n."));
+        return;
+      }
+      respond(response, 200, "Listo. Ya puedes cerrar esta pesta\xF1a y volver a Panoma.");
+      finish(null, code);
+    });
+    server.on("error", (error) => {
+      clearTimeout(deadline);
+      reject(
+        new Error(
+          error.code === "EADDRINUSE" ? `El puerto ${config.redirectPort} est\xE1 ocupado, y es el \xFAnico que vale para este inicio de sesi\xF3n. Suele ser un 'codex login' a medias: ci\xE9rralo y vuelve a probar.` : `No se pudo escuchar en el puerto ${config.redirectPort}: ${error.message}`
+        )
+      );
+    });
+    server.listen(config.redirectPort, "127.0.0.1");
+  });
+}
+function respond(response, status, text) {
+  response.writeHead(status, { "content-type": "text/html; charset=utf-8" });
+  response.end(
+    `<!doctype html><meta charset="utf-8"><title>Panoma</title><body style="font:15px system-ui;padding:3rem;color:#171717">${text}</body>`
+  );
+}
+function same(a, b) {
+  const one = Buffer.from(a);
+  const other = Buffer.from(b);
+  if (one.length !== other.length) return false;
+  return timingSafeEqual(one, other);
+}
+async function exchangeCode(provider, code, verifier) {
+  return requestToken(provider, {
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri(provider),
+    code_verifier: verifier
+  });
+}
+async function refresh(provider, refresh2) {
+  const token = await requestToken(provider, { grant_type: "refresh_token", refresh_token: refresh2 });
+  return { ...token, refresh: token.refresh ?? refresh2 };
+}
+async function requestToken(provider, fields) {
+  const config = requireOauth(provider);
+  const response = await fetch(config.tokenUrl, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ ...fields, client_id: config.clientId })
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || !body.access_token) {
+    throw new AiError({
+      code: "tokenRefused",
+      provider: provider.name,
+      status: response.status,
+      /* The provider's own words, whole: translating somebody else's refusal invents one. */
+      detail: body.error_description ?? body.error ?? response.statusText
+    });
+  }
+  return {
+    access: body.access_token,
+    ...body.refresh_token ? { refresh: body.refresh_token } : {},
+    ...body.expires_in ? { expiresAt: Date.now() + body.expires_in * 1e3 } : {},
+    ...accountFrom(body.id_token) ? { accountId: accountFrom(body.id_token) } : {}
+  };
+}
+function accountFrom(idToken) {
+  if (!idToken) return void 0;
+  const chunk = idToken.split(".")[1];
+  if (!chunk) return void 0;
+  try {
+    const claims = JSON.parse(Buffer.from(chunk, "base64url").toString("utf8"));
+    const auth = claims["https://api.openai.com/auth"];
+    const account = auth?.["chatgpt_account_id"];
+    return typeof account === "string" ? account : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MARGIN_MS = 12e4;
+function expired(token) {
+  return token.expiresAt !== void 0 && Date.now() > token.expiresAt - MARGIN_MS;
+}
+function requireOauth(provider) {
+  if (!provider.oauth) throw new AiError({ code: "noOauth", provider: provider.name });
+  return provider.oauth;
+}
+function checkBaseUrl(provider, value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new AiError({
+      code: "badUrl",
+      provider: provider.name,
+      value,
+      where: provider.baseUrlEnvVar ?? "the configuration"
+    });
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new AiError({ code: "notHttp", provider: provider.name });
+  }
+  if (url.username || url.password) {
+    throw new AiError({ code: "urlHasCredentials", provider: provider.name });
+  }
+  if (url.protocol === "http:" && !isLocal(url.hostname)) {
+    throw new AiError({
+      code: "insecureHost",
+      provider: provider.name,
+      host: url.hostname
+    });
+  }
+  return value;
+}
+function isLocal(hostname) {
+  const clean = hostname.replace(/^\[|\]$/g, "");
+  return clean === "localhost" || clean === "127.0.0.1" || clean === "::1";
+}
+function pointsElsewhere(provider, url) {
+  if (!url || !provider.baseUrl) return false;
+  try {
+    return new URL(url).origin !== new URL(provider.baseUrl).origin;
+  } catch {
+    return false;
+  }
+}
+var SHAPES = [
+  /\bsk-[A-Za-z0-9_-]{8,}/g,
+  /\bgsk_[A-Za-z0-9]{8,}/g,
+  /\bxai-[A-Za-z0-9]{8,}/g,
+  /\bAIza[A-Za-z0-9_-]{8,}/g,
+  /\b(?:ghp|gho|ghs|ghu)_[A-Za-z0-9]{8,}/g,
+  /\bgithub_pat_[A-Za-z0-9_]{8,}/g,
+  /\bhf_[A-Za-z0-9]{8,}/g,
+  /\beyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi
+];
+var REDACTED = "\xABcredencial oculta\xBB";
+function redact(text, known = []) {
+  let output = text;
+  for (const secret of known) {
+    if (!secret || secret.length < 4) continue;
+    output = output.split(secret).join(REDACTED);
+  }
+  for (const shape of SHAPES) output = output.replace(shape, REDACTED);
+  return output.replace(/\b[A-Za-z0-9_-]{40,}\b/g, REDACTED);
+}
+function configPath() {
+  return panomaPath("ai.json");
+}
+function backupPath() {
+  return `${configPath()}.anterior`;
+}
+var ConfigCorruptError = class extends Error {
+  constructor(path, problem, recovery) {
+    const lines = [`Could not read the AI configuration at ${path}: ${problem.message}`];
+    if (recovery) {
+      lines.push(
+        /*
+          Both forms written whole rather than an `s` glued to the figure. The house rule: never
+          attach an inflected word to a digit, and this line only ever reads wrong at one.
+         */
+        recovery.keys === 1 ? `There is an earlier copy at ${recovery.path} holding one key. Recover it with:` : `There is an earlier copy at ${recovery.path} holding ${recovery.keys} keys. Recover it with:`,
+        `  mv ${recovery.path} ${path}`,
+        "Do not run 'panoma ai key' first: it would overwrite the file and whatever is left in it."
+      );
+    } else {
+      lines.push(
+        "There is no earlier copy. Open it and fix it by hand, or delete it to start over \u2014",
+        "you will lose whatever keys were saved inside."
+      );
+    }
+    super(lines.join("\n"), { cause: problem });
+    this.path = path;
+    this.recovery = recovery;
+    this.name = "ConfigCorruptError";
+  }
+  path;
+  recovery;
+};
+function isConfig(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const record = value;
+  if (record["provider"] !== void 0 && typeof record["provider"] !== "string") return false;
+  if (record["model"] !== void 0 && typeof record["model"] !== "string") return false;
+  const keys = record["keys"];
+  if (keys !== void 0) {
+    if (typeof keys !== "object" || keys === null || Array.isArray(keys)) return false;
+    if (Object.values(keys).some((key) => typeof key !== "string")) return false;
+  }
+  const tokens = record["tokens"];
+  if (tokens !== void 0) {
+    if (typeof tokens !== "object" || tokens === null || Array.isArray(tokens)) return false;
+    if (Object.values(tokens).some(
+      (token) => typeof token !== "object" || token === null || typeof token.access !== "string"
+    )) {
+      return false;
+    }
+  }
+  return true;
+}
+async function readFileConfig(path) {
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+  const parsed = JSON.parse(raw);
+  if (!isConfig(parsed)) {
+    throw new AiError({ code: "configShape" });
+  }
+  return parsed;
+}
+async function readConfig() {
+  const path = configPath();
+  try {
+    return await readFileConfig(path) ?? {};
+  } catch (error) {
+    const recovered = await readFileConfig(backupPath()).catch(() => void 0);
+    throw new ConfigCorruptError(
+      path,
+      error,
+      recovered ? { path: backupPath(), keys: Object.keys(recovered.keys ?? {}).length } : void 0
+    );
+  }
+}
+async function writeConfig(config) {
+  const path = configPath();
+  await mkdir(dirname(path), { recursive: true });
+  const current = await readFileConfig(path).catch(() => void 0);
+  if (current) {
+    await copyFile(path, backupPath()).then(() => restrictToOwner(backupPath())).catch(() => {
+    });
+  }
+  const temporary = `${path}.${process.pid}.tmp`;
+  const body = `${JSON.stringify(config, null, 2)}
+`;
+  try {
+    const handle = await open(temporary, "w", 384);
+    try {
+      await handle.writeFile(body, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename(temporary, path);
+  } catch (error) {
+    await rm(temporary, { force: true }).catch(() => {
+    });
+    throw error;
+  }
+  await restrictToOwner(path);
+  await open(dirname(path), "r").then(async (dir) => {
+    await dir.sync().catch(() => {
+    });
+    await dir.close();
+  }).catch(() => {
+  });
+  await sweepTemporaries();
+}
+async function sweepTemporaries() {
+  const directory = dirname(configPath());
+  const prefix = `${basename(configPath())}.`;
+  const files = await readdir(directory).catch(() => []);
+  for (const file of files) {
+    if (!file.startsWith(prefix) || !file.endsWith(".tmp")) continue;
+    const pid = Number.parseInt(file.slice(prefix.length, -".tmp".length), 10);
+    if (!Number.isInteger(pid)) continue;
+    if (pid !== process.pid && isRunning(pid)) continue;
+    await rm(join2(directory, file), { force: true }).catch(() => {
+    });
+  }
+}
+function isRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+async function withLock(action) {
+  const lock = `${configPath()}.lock`;
+  await mkdir(dirname(lock), { recursive: true });
+  const deadline = Date.now() + 3e3;
+  for (; ; ) {
+    try {
+      const handle = await open(lock, "wx", 384);
+      await handle.writeFile(`${process.pid}
+`, "utf8").catch(() => {
+      });
+      await handle.close();
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() > deadline) {
+        const owner = await readFile(lock, "utf8").catch(() => "");
+        throw new AiError({
+          code: "configLocked",
+          lock,
+          holder: owner.trim() ? `pid ${owner.trim()}` : void 0
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    await rm(lock, { force: true }).catch(() => {
+    });
+  }
+}
+var NoCredentialError = class extends Error {
+  constructor(provider) {
+    const how = provider.auth === "cli" ? `Install ${provider.name} and sign in; panoma will call '${provider.command}'.` : provider.auth === "oauth" ? `Sign in to ${provider.name} from the model page in panoma.` : `Run 'panoma ai key ${provider.id}' or export ${provider.apiKeyEnvVars?.[0]}. The key comes from ${provider.signupUrl}.`;
+    super(`No credential for ${provider.name}. ${how}`);
+    this.provider = provider;
+    this.name = "NoCredentialError";
+  }
+  provider;
+};
+async function resolveCredential(providerId, config) {
+  const settings = config ?? await readConfig();
+  const id = providerId ?? settings.provider;
+  if (!id) {
+    throw new AiError({ code: "noProvider" });
+  }
+  const provider = findProvider(id);
+  if (!provider) throw new AiError({ code: "unknownProvider", id });
+  if (provider.auth === "cli") {
+    return { provider, model: settings.model ?? "", source: "agent-session" };
+  }
+  if (provider.auth === "oauth") {
+    const savedValue = settings.tokens?.[provider.id];
+    if (!savedValue) throw new NoCredentialError(provider);
+    let token = savedValue;
+    if (expired(token)) {
+      if (!token.refresh) throw new NoCredentialError(provider);
+      token = await refresh(provider, token.refresh);
+      await saveToken(provider.id, token);
+    }
+    return {
+      provider,
+      model: settings.model ?? provider.defaultModel ?? "",
+      apiKey: token.access,
+      baseUrl: resolveBaseUrl(provider),
+      ...token.accountId ? { accountId: token.accountId } : {},
+      source: "login"
+    };
+  }
+  for (const variable of provider.apiKeyEnvVars ?? []) {
+    const value = process.env[variable];
+    if (value) {
+      return {
+        provider,
+        model: settings.model ?? provider.defaultModel ?? "",
+        apiKey: value,
+        baseUrl: resolveBaseUrl(provider),
+        source: "env"
+      };
+    }
+  }
+  const stored = settings.keys?.[provider.id];
+  if (stored) {
+    return {
+      provider,
+      model: settings.model ?? provider.defaultModel ?? "",
+      apiKey: stored,
+      baseUrl: resolveBaseUrl(provider),
+      source: "file"
+    };
+  }
+  throw new NoCredentialError(provider);
+}
+function resolveBaseUrl(provider) {
+  const override = provider.baseUrlEnvVar ? process.env[provider.baseUrlEnvVar] : void 0;
+  const chosenOne = override || provider.baseUrl;
+  return chosenOne ? checkBaseUrl(provider, chosenOne) : void 0;
+}
+async function saveKey(providerId, apiKey) {
+  await withLock(async () => {
+    const config = await readConfig();
+    config.keys = { ...config.keys, [providerId]: apiKey };
+    config.provider ??= providerId;
+    await writeConfig(config);
+  });
+}
+async function saveToken(providerId, token) {
+  await withLock(async () => {
+    const config = await readConfig();
+    config.tokens = { ...config.tokens, [providerId]: token };
+    config.provider ??= providerId;
+    await writeConfig(config);
+  });
+}
+async function forgetCredential(providerId) {
+  await updateConfig((config) => {
+    const keys = { ...config.keys };
+    const tokens = { ...config.tokens };
+    delete keys[providerId];
+    delete tokens[providerId];
+    return { ...config, keys, tokens };
+  });
+}
+async function updateConfig(change) {
+  return withLock(async () => {
+    const next = await change(await readConfig());
+    await writeConfig(next);
+    return next;
+  });
+}
+function maskKey(apiKey) {
+  return apiKey.length <= 8 ? "\u2022\u2022\u2022\u2022" : `${apiKey.slice(0, 3)}\u2026${apiKey.slice(-4)}`;
+}
+var run = promisify(execFile);
+async function probe(command) {
+  try {
+    const launch = resolveExecutable(command, ["--version"]);
+    const { stdout } = await run(launch.file, launch.args, { timeout: 15e3 });
+    return { ok: true, version: stdout.trim().split("\n")[0] ?? "" };
+  } catch (error) {
+    const failure = error;
+    if (failure.code === "ENOENT") return { ok: false, missing: true };
+    const said = (failure.stderr || failure.message || "").trim().split("\n")[0] ?? "";
+    return { ok: false, missing: false, said: said.slice(0, 160) || "no responde" };
+  }
+}
+async function detectCliAgents(providers) {
+  return Promise.all(
+    providers.map(async (provider) => {
+      if (!provider.command) return { provider, installed: false };
+      const first = await probe(provider.command);
+      if (first.ok) {
+        return { provider, installed: true, command: provider.command, version: first.version };
+      }
+      for (const bundled of provider.bundles ?? []) {
+        const next = await probe(bundled);
+        if (next.ok) {
+          return { provider, installed: true, command: bundled, version: next.version };
+        }
+      }
+      if (first.missing) return { provider, installed: false };
+      return { provider, installed: false, broken: first.said };
+    })
+  );
+}
+var MAX_OUTPUT = 2e5;
+async function completeWithCliAgent(provider, prompt, options = {}) {
+  const command = options.command ?? provider.command;
+  if (!command) throw new AiError({ code: "noCommand", provider: provider.name });
+  return new Promise((resolve, reject) => {
+    const launch = resolveExecutable(command, provider.args ?? []);
+    const child = spawn(launch.file, launch.args, {
+      cwd: options.cwd,
+      // Without shell: the prompt is user text and can contain anything.
+      shell: false,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      if (stdout.length < MAX_OUTPUT) stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      if (stderr.length < 8e3) stderr += chunk.toString();
+    });
+    const timer = setTimeout(() => child.kill("SIGKILL"), options.timeoutMs ?? 18e4);
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(new AiError({ code: "launchFailed", command, reason: error.message }));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) return resolve(stdout.trim());
+      reject(
+        new Error(
+          redact(
+            failureMessage({
+              code: "exited",
+              provider: provider.name,
+              status: code ?? -1,
+              output: stderr.trim().slice(0, 600)
+            })
+          )
+        )
+      );
+    });
+    child.stdin.end(prompt);
+  });
+}
+var MAX = 60;
+var CLIENT_VERSION = "1.0.0";
+async function listModels(providerId, signal) {
+  const credential = await resolveCredential(providerId);
+  const { provider } = credential;
+  if (provider.auth === "cli" || !credential.baseUrl) return [];
+  const anthropic = provider.api === "anthropic";
+  const version = provider.api === "codex" ? `?client_version=${CLIENT_VERSION}` : "";
+  const url = `${credential.baseUrl}${anthropic ? "/v1/models" : "/models"}${version}`;
+  const response = await fetch(url, {
+    headers: anthropic ? {
+      "x-api-key": credential.apiKey ?? "",
+      "anthropic-version": "2023-06-01"
+    } : {
+      authorization: `Bearer ${credential.apiKey}`,
+      ...credential.accountId ? { "chatgpt-account-id": credential.accountId } : {}
+    },
+    ...signal ? { signal } : {}
+  });
+  if (!response.ok) {
+    const body2 = await response.json().catch(() => ({}));
+    throw new Error(
+      redact(
+        `${provider.name} no quiso listar sus modelos (${response.status}): ${body2.error?.message ?? response.statusText}`,
+        [credential.apiKey]
+      )
+    );
+  }
+  const body = await response.json().catch(() => ({}));
+  const rawIds = [
+    ...(body.data ?? []).map((m) => m.id),
+    ...(body.models ?? []).map((m) => m.id ?? m.slug ?? m.name)
+  ];
+  return [...new Set(rawIds.filter((id) => Boolean(id)))].sort().slice(0, MAX);
+}
+var ATTEMPTS = 3;
+var WAITS = [500, 2e3];
+function transportFailure(error) {
+  if (!(error instanceof Error)) return void 0;
+  if (error.name === "AbortError" || error.name === "TimeoutError") return void 0;
+  if (!(error instanceof TypeError) && codeOf(error) === void 0) return void 0;
+  const parts = [];
+  let step = error;
+  while (step instanceof Error && parts.length < 4) {
+    const code = codeOf(step);
+    parts.push(code === void 0 ? step.message : `${code} (${step.message})`);
+    step = step.cause;
+  }
+  const seen = parts.filter((part, index) => parts.indexOf(part) === index);
+  const useful = seen.filter((part) => part !== "fetch failed");
+  return (useful.length > 0 ? useful : seen).join(" \u2190 ");
+}
+function codeOf(error) {
+  const code = error.code;
+  return typeof code === "string" && code.length > 0 ? code : void 0;
+}
+async function callProvider(name, url, init, options = {}) {
+  const attempts = options.attempts ?? ATTEMPTS;
+  const call = options.fetchImpl ?? fetch;
+  const wait = options.wait ?? sleep;
+  let last = "";
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await call(url, init);
+    } catch (error) {
+      const why = transportFailure(error);
+      if (why === void 0) throw error;
+      last = why;
+      if (attempt < attempts) await wait(WAITS[Math.min(attempt - 1, WAITS.length - 1)] ?? 0);
+    }
+  }
+  throw new AiError({ code: "neverAnswered", provider: name, last: String(last), attempts });
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var VisionUnsupportedError = class extends Error {
+  constructor(provider) {
+    super(
+      `${provider} cannot take images. Configure a provider with a key \u2014'panoma ai key'\u2014 or pass one with --provider.`
+    );
+    this.provider = provider;
+    this.name = "VisionUnsupportedError";
+  }
+  provider;
+};
+async function complete(request) {
+  const credential = await resolveCredential(request.provider);
+  if (credential.provider.auth === "cli") {
+    if (request.images?.length) throw new VisionUnsupportedError(credential.provider.name);
+    const prompt = request.system ? `${request.system}
+
+---
+
+${request.prompt}` : request.prompt;
+    const text = await completeWithCliAgent(credential.provider, prompt, { cwd: tmpdir() });
+    return { text, provider: credential.provider.id, model: credential.model || "session" };
+  }
+  if (credential.provider.api === "anthropic") return completeAnthropic(credential, request);
+  if (credential.provider.api === "codex") return completeCodex(credential, request);
+  return completeOpenAi(credential, request);
+}
+async function readCodexStream(body) {
+  const lector = body.pipeThrough(new TextDecoderStream()).getReader();
+  let pending = "";
+  let text = "";
+  let final;
+  for (; ; ) {
+    const { done, value } = await lector.read();
+    if (done) break;
+    pending += value;
+    const lines = pending.split("\n");
+    pending = lines.pop() ?? "";
+    for (const line of lines) {
+      if (!line.startsWith("data:")) continue;
+      const datum = line.slice(5).trim();
+      if (!datum || datum === "[DONE]") continue;
+      let event;
+      try {
+        event = JSON.parse(datum);
+      } catch {
+        continue;
+      }
+      if (typeof event.delta === "string" && event.type?.endsWith(".delta")) {
+        text += event.delta;
+      }
+      if (event.response) final = event.response;
+    }
+  }
+  return { text, ...final ? { final } : {} };
+}
+async function completeCodex(credential, request) {
+  const response = await callProvider(credential.provider.name, `${credential.baseUrl}/responses`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${credential.apiKey}`,
+      // Which account is charged. It comes from the `id_token` at login; without it, the request
+      // goes to the user's default account.
+      ...credential.accountId ? { "chatgpt-account-id": credential.accountId } : {},
+      // Who is calling. The support looks at it to decide whether to accept the subscription token.
+      originator: "codex_cli_rs",
+      "openai-beta": "responses=experimental",
+      accept: "text/event-stream"
+    },
+    body: JSON.stringify({
+      model: credential.model,
+      ...request.system ? { instructions: request.system } : {},
+      input: [
+        {
+          role: "user",
+          content: [
+            ...(request.images ?? []).map((image) => ({
+              type: "input_image",
+              // Here yes, the entire URL of data: this backup does not have a field for the type.
+              image_url: dataUrl(image)
+            })),
+            { type: "input_text", text: request.prompt }
+          ]
+        }
+      ],
+      /*
+        Without `max_output_tokens`, and not out of forgetfulness: this backup rejects it
+        —"Unsupported parameter"— because the cap is not set by the request, it is set by the
+        plan. This is the fundamental difference between paying per token and paying a
+        subscription, and that is why `request.maxTokens` does not go here: in this provider it
+        means nothing.
+       */
+      // Mandatory: without this, it answers 400 «Stream must be set to true». This is not our
+      // preference — this backend does not know how to respond in any other way.
+      stream: true,
+      store: false
+    }),
+    signal: request.signal
+  });
+  if (!response.ok) {
+    const failure = await response.json().catch(() => ({}));
+    throw new AiError({
+      code: "providerRefused",
+      provider: credential.provider.name,
+      status: response.status,
+      detail: redact(
+        String(failure.error?.message ?? failure.detail ?? response.statusText),
+        [credential.apiKey]
+      )
+    });
+  }
+  if (!response.body) throw new AiError({ code: "emptyBody", provider: credential.provider.name });
+  const { text, final } = await readCodexStream(response.body);
+  const outputText = (final?.output ?? []).flatMap((block) => block.content ?? []).flatMap((chunk) => chunk.text ? [chunk.text] : []).join("\n");
+  const shortcut = Array.isArray(final?.output_text) ? final.output_text.join("\n") : final?.output_text;
+  return {
+    text: (text || outputText || shortcut || "").trim(),
+    provider: credential.provider.id,
+    model: final?.model ?? credential.model,
+    ...final?.status === "incomplete" ? { stopReason: final.incomplete_details?.reason === "max_output_tokens" ? "length" : "stop" } : final ? { stopReason: "stop" } : {},
+    ...metered(final?.usage?.input_tokens, final?.usage?.output_tokens)
+  };
+}
+function metered(input, output) {
+  return typeof input === "number" && Number.isFinite(input) && typeof output === "number" && Number.isFinite(output) ? { usage: { input, output } } : {};
+}
+async function completeAnthropic(credential, request) {
+  const { default: Anthropic } = await import("@anthropic-ai/sdk");
+  const client = new Anthropic({ apiKey: credential.apiKey, baseURL: credential.baseUrl });
+  const message = await client.messages.stream(
+    {
+      model: credential.model,
+      max_tokens: request.maxTokens ?? 2048,
+      system: request.system,
+      messages: [
+        {
+          role: "user",
+          content: [
+            ...(request.images ?? []).map((image) => ({
+              type: "image",
+              // The only one of the three families that separates type and bytes, and the one
+              // that states it in its typing: that's why `CompleteImage` stores both separately.
+              source: {
+                type: "base64",
+                media_type: image.mediaType,
+                data: image.data
+              }
+            })),
+            { type: "text", text: request.prompt }
+          ]
+        }
+      ]
+    },
+    { signal: request.signal }
+  ).finalMessage();
+  const text = message.content.flatMap((block) => block.type === "text" ? [block.text] : []).join("\n").trim();
+  return {
+    text,
+    provider: credential.provider.id,
+    model: message.model,
+    usage: { input: message.usage.input_tokens, output: message.usage.output_tokens },
+    stopReason: message.stop_reason === "max_tokens" ? "length" : "stop"
+  };
+}
+async function completeOpenAi(credential, request) {
+  const messages = [];
+  if (request.system) messages.push({ role: "system", content: request.system });
+  const images = request.images ?? [];
+  if (images.length === 0) {
+    messages.push({ role: "user", content: request.prompt });
+  } else {
+    messages.push({
+      role: "user",
+      content: [
+        ...images.map(
+          (image) => ({ type: "image_url", image_url: { url: dataUrl(image) } })
+        ),
+        { type: "text", text: request.prompt }
+      ]
+    });
+  }
+  const response = await callProvider(
+    credential.provider.name,
+    `${credential.baseUrl}/chat/completions`,
+    {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${credential.apiKey}`
+      },
+      body: JSON.stringify({
+        model: credential.model,
+        max_tokens: request.maxTokens ?? 2048,
+        messages
+      }),
+      signal: request.signal
+    }
+  );
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new AiError({
+      code: "providerRefused",
+      provider: credential.provider.name,
+      status: response.status,
+      detail: redact(String(body.error?.message ?? response.statusText), [credential.apiKey])
+    });
+  }
+  return {
+    text: (body.choices?.[0]?.message?.content ?? "").trim(),
+    provider: credential.provider.id,
+    model: body.model ?? credential.model,
+    ...body.choices?.[0]?.finish_reason ? { stopReason: body.choices[0].finish_reason === "length" ? "length" : "stop" } : {},
+    ...metered(body.usage?.prompt_tokens, body.usage?.completion_tokens)
+  };
+}
+function dataUrl(image) {
+  return `data:${image.mediaType};base64,${image.data}`;
+}
+
+export {
+  failureMessage,
+  AiError,
+  PROVIDERS,
+  findProvider,
+  providersByAuth,
+  createChallenge,
+  redirectUri,
+  authorizeUrl,
+  awaitCallback,
+  exchangeCode,
+  refresh,
+  accountFrom,
+  expired,
+  checkBaseUrl,
+  pointsElsewhere,
+  REDACTED,
+  redact,
+  configPath,
+  ConfigCorruptError,
+  readConfig,
+  writeConfig,
+  NoCredentialError,
+  resolveCredential,
+  saveKey,
+  saveToken,
+  forgetCredential,
+  updateConfig,
+  maskKey,
+  detectCliAgents,
+  completeWithCliAgent,
+  listModels,
+  ATTEMPTS,
+  transportFailure,
+  callProvider,
+  VisionUnsupportedError,
+  complete
+};