panoma 0.1.9 → 0.9.1

package/dist/chunk-ROPR3LUO.js

@@ -1,1350 +0,0 @@
-import {
-  panomaPath,
-  resolveExecutable,
-  restrictToOwner
-} from "./chunk-K27F6QDR.js";
-
-// ../../packages/ai/dist/index.js
-import { homedir } from "os";
-import { join } from "path";
-import { copyFile, mkdir, open, readdir, readFile, rename, rm } from "fs/promises";
-import { basename, dirname, join as join2 } from "path";
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
-import { createServer } from "http";
-import { spawn } from "child_process";
-import { execFile } from "child_process";
-import { promisify } from "util";
-function failureMessage(failure) {
-  switch (failure.code) {
-    case "noCommand":
-      return `${failure.provider} declares no command to run.`;
-    case "launchFailed":
-      return `Could not launch ${failure.command}: ${failure.reason}`;
-    case "exited":
-      return `${failure.provider} exited with code ${failure.status}. ${failure.output}`.trim();
-    case "emptyBody":
-      return `${failure.provider} answered with no body.`;
-    case "providerRefused":
-      return `${failure.provider} answered ${failure.status}: ${failure.detail}`;
-    case "tokenRefused":
-      return `${failure.provider} refused the token request (${failure.status}): ${failure.detail}`;
-    case "neverAnswered":
-      return `${failure.provider} never answered: ${failure.last}. Attempts: ${failure.attempts}. The model did not say no \u2014 the request never left this machine.`;
-    case "configShape":
-      return "the contents are not shaped like a panoma configuration";
-    case "configLocked":
-      return `Another panoma process is writing the configuration${failure.holder ? ` (${failure.holder})` : ""}.
-If none is running, the lock was left behind by an earlier run:
-  rm ${failure.lock}`;
-    case "noProvider":
-      return "No AI provider is configured. Run 'panoma ai' to see the options.";
-    case "unknownProvider":
-      return `Unknown provider: ${failure.id}`;
-    case "oauthTimeout":
-      return "Timed out waiting for you to come back from the browser.";
-    case "noOauth":
-      return `${failure.provider} does not use sign-in.`;
-    case "badUrl":
-      return `${failure.provider}'s address is not a valid URL: \xAB${failure.value}\xBB. Check ${failure.where}.`;
-    case "notHttp":
-      return `${failure.provider}'s address has to be http or https.`;
-    case "urlHasCredentials":
-      return `${failure.provider}'s address carries a user or a password inside. Take them out and use the key.`;
-    case "insecureHost":
-      return `panoma will not send ${failure.provider}'s credential unencrypted to ${failure.host}. Use https, or a server on your own machine.`;
-  }
-}
-var AiError = class extends Error {
-  failure;
-  constructor(failure) {
-    super(failureMessage(failure));
-    this.name = "AiError";
-    this.failure = failure;
-  }
-};
-var PROVIDERS = [
-  {
-    id: "anthropic",
-    name: "Anthropic",
-    auth: "api-key",
-    description: "Claude por API. Facturaci\xF3n por uso.",
-    descriptionEn: "Claude over the API. Pay as you go.",
-    api: "anthropic",
-    baseUrl: "https://api.anthropic.com",
-    apiKeyEnvVars: ["ANTHROPIC_API_KEY"],
-    baseUrlEnvVar: "ANTHROPIC_BASE_URL",
-    defaultModel: "claude-opus-5",
-    models: ["claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5-20251001"],
-    signupUrl: "https://console.anthropic.com/settings/keys"
-  },
-  {
-    id: "openai",
-    name: "OpenAI",
-    auth: "api-key",
-    description: "GPT por API. Facturaci\xF3n por uso.",
-    descriptionEn: "GPT over the API. Pay as you go.",
-    api: "openai",
-    baseUrl: "https://api.openai.com/v1",
-    apiKeyEnvVars: ["OPENAI_API_KEY"],
-    baseUrlEnvVar: "OPENAI_BASE_URL",
-    defaultModel: "gpt-5",
-    models: ["gpt-5", "gpt-5-mini"],
-    signupUrl: "https://platform.openai.com/api-keys"
-  },
-  {
-    id: "openrouter",
-    name: "OpenRouter",
-    auth: "api-key",
-    description: "Una clave para modelos de muchos fabricantes.",
-    descriptionEn: "One key for models from many makers.",
-    api: "openai",
-    baseUrl: "https://openrouter.ai/api/v1",
-    apiKeyEnvVars: ["OPENROUTER_API_KEY"],
-    baseUrlEnvVar: "OPENROUTER_BASE_URL",
-    defaultModel: "anthropic/claude-opus-4.6",
-    models: ["anthropic/claude-opus-4.6", "openai/gpt-5", "google/gemini-2.5-pro", "deepseek/deepseek-chat"],
-    signupUrl: "https://openrouter.ai/keys"
-  },
-  {
-    id: "google",
-    name: "Google AI Studio",
-    auth: "api-key",
-    description: "Gemini por su endpoint compatible con OpenAI.",
-    descriptionEn: "Gemini through its OpenAI-compatible endpoint.",
-    api: "openai",
-    baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
-    apiKeyEnvVars: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
-    baseUrlEnvVar: "GEMINI_BASE_URL",
-    defaultModel: "gemini-2.5-pro",
-    models: ["gemini-2.5-pro", "gemini-2.5-flash"],
-    signupUrl: "https://aistudio.google.com/apikey"
-  },
-  {
-    id: "local",
-    name: "Modelo local",
-    auth: "api-key",
-    description: "Ollama, LM Studio o cualquier servidor compatible con OpenAI.",
-    descriptionEn: "Ollama, LM Studio, or any OpenAI-compatible server.",
-    api: "openai",
-    baseUrl: "http://127.0.0.1:11434/v1",
-    apiKeyEnvVars: ["LOCAL_LLM_API_KEY"],
-    baseUrlEnvVar: "LOCAL_LLM_BASE_URL",
-    defaultModel: "qwen3:8b",
-    signupUrl: "https://ollama.com"
-  },
-  /*
-    ── The others, and why they are ─────────────────────────────────────────────────────
-    Everyone talks in the OpenAI format, so none includes code: they are rows. It is the promise
-    of the declarative record fulfilled, and the reason for having chosen this form — its catalog
-    goes beyond thirty providers without a `if` per manufacturer anywhere.
-    The list comes from those offered by veteran open agents, removing those that are not a row:
-    the big cloud ones (Bedrock, Vertex, Azure) need entire credential chains — AWS’s, a Google
-    service account — and putting them here would be promising a key field that is useless. Those
-    go in the day someone needs them, with their code.
-    Each one allows `baseUrlEnvVar` because these endpoints move —they change region, route
-    version— and an environment variable fixes in a moment what otherwise would require waiting
-    for a new version of Panoma.
-   */
-  {
-    id: "deepseek",
-    name: "DeepSeek",
-    auth: "api-key",
-    description: "Modelos de razonamiento a precio bajo.",
-    descriptionEn: "Reasoning models at a low price.",
-    api: "openai",
-    baseUrl: "https://api.deepseek.com/v1",
-    apiKeyEnvVars: ["DEEPSEEK_API_KEY"],
-    baseUrlEnvVar: "DEEPSEEK_BASE_URL",
-    defaultModel: "deepseek-chat",
-    models: ["deepseek-chat", "deepseek-reasoner"],
-    signupUrl: "https://platform.deepseek.com/api_keys"
-  },
-  {
-    id: "groq",
-    name: "Groq",
-    auth: "api-key",
-    description: "Modelos abiertos, con la respuesta m\xE1s r\xE1pida del mercado.",
-    descriptionEn: "Open models, with the fastest responses on the market.",
-    api: "openai",
-    baseUrl: "https://api.groq.com/openai/v1",
-    apiKeyEnvVars: ["GROQ_API_KEY"],
-    baseUrlEnvVar: "GROQ_BASE_URL",
-    defaultModel: "llama-3.3-70b-versatile",
-    signupUrl: "https://console.groq.com/keys"
-  },
-  {
-    id: "xai",
-    name: "xAI",
-    auth: "api-key",
-    description: "Grok por API.",
-    descriptionEn: "Grok over the API.",
-    api: "openai",
-    baseUrl: "https://api.x.ai/v1",
-    apiKeyEnvVars: ["XAI_API_KEY"],
-    baseUrlEnvVar: "XAI_BASE_URL",
-    defaultModel: "grok-4-fast-reasoning",
-    signupUrl: "https://console.x.ai"
-  },
-  {
-    id: "together",
-    name: "Together AI",
-    auth: "api-key",
-    description: "Cat\xE1logo grande de modelos abiertos alojados.",
-    descriptionEn: "A large catalog of hosted open models.",
-    api: "openai",
-    baseUrl: "https://api.together.xyz/v1",
-    apiKeyEnvVars: ["TOGETHER_API_KEY"],
-    baseUrlEnvVar: "TOGETHER_BASE_URL",
-    defaultModel: "deepseek-ai/DeepSeek-V3",
-    signupUrl: "https://api.together.ai/settings/api-keys"
-  },
-  {
-    id: "fireworks",
-    name: "Fireworks AI",
-    auth: "api-key",
-    description: "Modelos abiertos servidos r\xE1pido.",
-    descriptionEn: "Open models, served fast.",
-    api: "openai",
-    baseUrl: "https://api.fireworks.ai/inference/v1",
-    apiKeyEnvVars: ["FIREWORKS_API_KEY"],
-    baseUrlEnvVar: "FIREWORKS_BASE_URL",
-    defaultModel: "accounts/fireworks/models/kimi-k2-instruct",
-    signupUrl: "https://fireworks.ai/account/api-keys"
-  },
-  {
-    id: "cerebras",
-    name: "Cerebras",
-    auth: "api-key",
-    description: "Inferencia sobre oblea entera. Muy r\xE1pida, cat\xE1logo corto.",
-    descriptionEn: "Wafer-scale inference. Very fast, short catalog.",
-    api: "openai",
-    baseUrl: "https://api.cerebras.ai/v1",
-    apiKeyEnvVars: ["CEREBRAS_API_KEY"],
-    baseUrlEnvVar: "CEREBRAS_BASE_URL",
-    defaultModel: "llama-3.3-70b",
-    signupUrl: "https://cloud.cerebras.ai"
-  },
-  {
-    id: "moonshot",
-    name: "Moonshot \xB7 Kimi",
-    auth: "api-key",
-    description: "Kimi, con ventana de contexto larga.",
-    descriptionEn: "Kimi, with a long context window.",
-    api: "openai",
-    baseUrl: "https://api.moonshot.ai/v1",
-    apiKeyEnvVars: ["MOONSHOT_API_KEY", "KIMI_API_KEY"],
-    baseUrlEnvVar: "MOONSHOT_BASE_URL",
-    defaultModel: "kimi-k2-turbo-preview",
-    signupUrl: "https://platform.moonshot.ai/console/api-keys"
-  },
-  {
-    id: "alibaba",
-    name: "Qwen \xB7 DashScope",
-    auth: "api-key",
-    description: "Qwen por el endpoint compatible de Alibaba.",
-    descriptionEn: "Qwen through Alibaba\u2019s compatible endpoint.",
-    api: "openai",
-    baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",
-    apiKeyEnvVars: ["DASHSCOPE_API_KEY"],
-    baseUrlEnvVar: "DASHSCOPE_BASE_URL",
-    defaultModel: "qwen-max",
-    signupUrl: "https://bailian.console.alibabacloud.com"
-  },
-  {
-    id: "nvidia",
-    name: "NVIDIA NIM",
-    auth: "api-key",
-    description: "Modelos abiertos servidos por NVIDIA.",
-    descriptionEn: "Open models served by NVIDIA.",
-    api: "openai",
-    baseUrl: "https://integrate.api.nvidia.com/v1",
-    apiKeyEnvVars: ["NVIDIA_API_KEY"],
-    baseUrlEnvVar: "NVIDIA_BASE_URL",
-    defaultModel: "meta/llama-3.3-70b-instruct",
-    signupUrl: "https://build.nvidia.com"
-  },
-  {
-    id: "huggingface",
-    name: "Hugging Face",
-    auth: "api-key",
-    description: "El enrutador de inferencia del Hub.",
-    descriptionEn: "The Hub\u2019s inference router.",
-    api: "openai",
-    baseUrl: "https://router.huggingface.co/v1",
-    apiKeyEnvVars: ["HF_TOKEN", "HUGGINGFACE_API_KEY"],
-    baseUrlEnvVar: "HF_BASE_URL",
-    defaultModel: "Qwen/Qwen2.5-72B-Instruct",
-    signupUrl: "https://huggingface.co/settings/tokens"
-  },
-  {
-    id: "ollama-cloud",
-    name: "Ollama Cloud",
-    auth: "api-key",
-    description: "Los modelos de Ollama, servidos por ellos en vez de por tu port\xE1til.",
-    descriptionEn: "Ollama\u2019s models, served by them instead of your laptop.",
-    api: "openai",
-    baseUrl: "https://ollama.com/v1",
-    apiKeyEnvVars: ["OLLAMA_API_KEY"],
-    baseUrlEnvVar: "OLLAMA_BASE_URL",
-    defaultModel: "gpt-oss:120b",
-    signupUrl: "https://ollama.com/settings/keys"
-  },
-  {
-    id: "lmstudio",
-    name: "LM Studio",
-    auth: "api-key",
-    description: "El servidor local de LM Studio. Sin clave, salvo que le pongas una.",
-    descriptionEn: "LM Studio\u2019s local server. No key, unless you set one.",
-    api: "openai",
-    baseUrl: "http://127.0.0.1:1234/v1",
-    apiKeyEnvVars: ["LM_API_KEY", "LMSTUDIO_API_KEY"],
-    baseUrlEnvVar: "LMSTUDIO_BASE_URL",
-    defaultModel: "local-model",
-    signupUrl: "https://lmstudio.ai"
-  },
-  // ── Sign in with a subscription ───────────────────────────────────────
-  {
-    id: "openai-codex",
-    name: "ChatGPT (Codex)",
-    auth: "oauth",
-    description: "Tu suscripci\xF3n de ChatGPT Plus o Pro, sin clave y sin binario local. Uso personal: se apoya en el inicio de sesi\xF3n del CLI de Codex y en un endpoint privado de OpenAI, as\xED que puede dejar de funcionar el d\xEDa que ellos lo cambien.",
-    descriptionEn: "Your ChatGPT Plus or Pro subscription, no key and no local binary. Personal use: it leans on the Codex CLI sign-in and a private OpenAI endpoint, so it can stop working the day they change it.",
-    api: "codex",
-    // The backup of ChatGPT, not `api.openai.com`: the subscription token is the only thing from
-    // OpenAI that is charged from the plan, and it is only valid against this gate.
-    baseUrl: "https://chatgpt.com/backend-api/codex",
-    baseUrlEnvVar: "CODEX_BASE_URL",
-    /*
-      Those who accept a ChatGPT account are not the same as those who accept a API key.
-      With a key, any model of the API is valid; with a subscription, the backup only supports
-      those assigned to your plan and returns 400 for the rest — 'The 'X' model is not supported
-      when using Codex with a ChatGPT account.' `terra` is the balanced one and that is why it is
-      the default; `sol` is for difficult tasks, `luna` for fast tasks, and `spark` only if you
-      pay for Pro. If this list becomes outdated, the model field is written manually.
-     */
-    defaultModel: "gpt-5.6-terra",
-    models: ["gpt-5.6-terra", "gpt-5.6-sol", "gpt-5.6-luna", "gpt-5.5"],
-    signupUrl: "https://chatgpt.com",
-    oauth: {
-      /*
-        The public client_id distributed by CLI of Codex itself.
-        It is not a secret —it travels in every login of anyone who uses `codex` — but it is not
-        ours either: it belongs to the registered OpenAI application, and the port and return path
-        are set in that registry. That is why 1455 cannot be changed.
-       */
-      clientId: "app_EMoamEEZ73f0CkXaXp7hrann",
-      authorizeUrl: "https://auth.openai.com/oauth/authorize",
-      tokenUrl: "https://auth.openai.com/oauth/token",
-      // `offline_access` is what causes them to return a refresh token; without it, you would have
-      // to log in again every few hours.
-      scopes: ["openid", "profile", "email", "offline_access"],
-      redirectPort: 1455,
-      redirectPath: "/auth/callback"
-    }
-  },
-  // ── Delegation to already installed agents ────────────────────────────────────── This is the
-  // 'subscription' route: the session is held by the user's official tool, on their machine. Panoma
-  // does not store any token nor sees their credentials.
-  {
-    id: "claude-cli",
-    name: "Claude Code",
-    auth: "cli",
-    description: "Usa tu sesi\xF3n de Claude Code ya iniciada. Sin claves.",
-    descriptionEn: "Uses your signed-in Claude Code session. No keys.",
-    command: "claude",
-    args: ["-p"],
-    bundles: [
-      join(homedir(), ".claude", "local", "claude"),
-      "/Applications/Claude.app/Contents/Resources/claude"
-    ]
-  },
-  {
-    /*
-          «Codex CLI» and not «Codex», which is what it said.
-    
-          Two entries away sits `openai-codex`, called «ChatGPT (Codex)», and a list showing both
-          offered the reader the same word twice with no way to tell them apart. They are not variants:
-          this one runs the `codex` binary on this machine as a subprocess, and that one talks to
-          OpenAI over your ChatGPT sign-in without any local binary at all. Whoever picked wrong was
-          not being careless — the screen gave them nothing to pick with.
-    
-          The descriptions say the mechanism now, for the same reason: «uses your signed-in session,
-          no keys» was true of both.
-         */
-    id: "codex-cli",
-    name: "Codex CLI",
-    auth: "cli",
-    description: "Ejecuta el binario `codex` de esta m\xE1quina. Usa su sesi\xF3n ya iniciada, sin claves.",
-    descriptionEn: "Runs the `codex` binary on this machine, using its signed-in session. No keys.",
-    command: "codex",
-    args: ["exec"],
-    bundles: ["/Applications/ChatGPT.app/Contents/Resources/codex"]
-  },
-  {
-    id: "gemini-cli",
-    name: "Gemini CLI",
-    auth: "cli",
-    description: "Usa tu sesi\xF3n de Gemini CLI ya iniciada. Sin claves.",
-    descriptionEn: "Uses your signed-in Gemini CLI session. No keys.",
-    command: "gemini",
-    args: ["-p"]
-  },
-  /*
-    The three at the top were the only ones, and the list ran short immediately.
-    When teaching the agents in the catalog panel, the gap was seen: on this same machine there
-    was a `cursor-agent` running that Panoma did not know about. Those that have a stable binary
-    and a non-interactive mode are added; what is not installed is not displayed, so expanding the
-    list does not make noise — it just stops having invisible agents.
-   */
-  {
-    id: "cursor-agent",
-    name: "Cursor Agent",
-    auth: "cli",
-    description: "Usa tu sesi\xF3n de Cursor ya iniciada. Sin claves.",
-    descriptionEn: "Uses your signed-in Cursor session. No keys.",
-    command: "cursor-agent",
-    args: ["-p"],
-    // Its installer puts it in `~/.local/bin`, which is in the PATH of a session shell but not in
-    // that of the server that starts `panoma up`. Same case as the `.app`.
-    bundles: [join(homedir(), ".local", "bin", "cursor-agent")]
-  },
-  {
-    id: "copilot-cli",
-    name: "GitHub Copilot",
-    auth: "cli",
-    description: "Usa tu suscripci\xF3n de Copilot ya iniciada. Sin claves.",
-    descriptionEn: "Uses your signed-in Copilot subscription. No keys.",
-    command: "copilot",
-    args: ["-p"]
-  },
-  {
-    id: "opencode",
-    name: "OpenCode",
-    auth: "cli",
-    description: "Usa tu instalaci\xF3n de OpenCode. Sin claves.",
-    descriptionEn: "Uses your OpenCode install. No keys.",
-    command: "opencode",
-    args: ["run"]
-  },
-  {
-    id: "aider",
-    name: "Aider",
-    auth: "cli",
-    description: "Usa tu instalaci\xF3n de Aider. Sin claves.",
-    descriptionEn: "Uses your Aider install. No keys.",
-    command: "aider",
-    args: ["--message"]
-  },
-  {
-    id: "amp-cli",
-    name: "Amp",
-    auth: "cli",
-    description: "Usa tu sesi\xF3n de Amp ya iniciada. Sin claves.",
-    descriptionEn: "Uses your signed-in Amp session. No keys.",
-    command: "amp",
-    args: ["-x"]
-  },
-  {
-    id: "goose",
-    name: "Goose",
-    auth: "cli",
-    description: "Usa tu instalaci\xF3n de Goose. Sin claves.",
-    descriptionEn: "Uses your Goose install. No keys.",
-    command: "goose",
-    args: ["run", "-t"]
-  }
-];
-function findProvider(id) {
-  return PROVIDERS.find((provider) => provider.id === id);
-}
-function providersByAuth(auth) {
-  return PROVIDERS.filter((provider) => provider.auth === auth);
-}
-function createChallenge() {
-  const verifier = base64url(randomBytes(48));
-  return {
-    verifier,
-    challenge: base64url(createHash("sha256").update(verifier).digest()),
-    state: base64url(randomBytes(24))
-  };
-}
-function base64url(buffer) {
-  return buffer.toString("base64url");
-}
-function redirectUri(provider) {
-  const config = requireOauth(provider);
-  return `http://localhost:${config.redirectPort}${config.redirectPath}`;
-}
-function authorizeUrl(provider, challenge) {
-  const config = requireOauth(provider);
-  const url = new URL(config.authorizeUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", config.clientId);
-  url.searchParams.set("redirect_uri", redirectUri(provider));
-  url.searchParams.set("scope", config.scopes.join(" "));
-  url.searchParams.set("code_challenge", challenge.challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("state", challenge.state);
-  return url.toString();
-}
-var DEADLINE_MS = 3e5;
-function awaitCallback(provider, challenge) {
-  const config = requireOauth(provider);
-  return new Promise((resolve, reject) => {
-    let server;
-    const close = () => server?.close();
-    const deadline = setTimeout(() => {
-      close();
-      reject(new AiError({ code: "oauthTimeout" }));
-    }, DEADLINE_MS);
-    const finish = (error, code) => {
-      clearTimeout(deadline);
-      close();
-      if (error) reject(error);
-      else resolve(code);
-    };
-    server = createServer((request, response) => {
-      const url = new URL(request.url ?? "/", `http://localhost:${config.redirectPort}`);
-      if (url.pathname !== config.redirectPath) {
-        response.writeHead(404).end();
-        return;
-      }
-      const error = url.searchParams.get("error");
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state") ?? "";
-      if (!same(state, challenge.state)) {
-        respond(response, 400, "Ese retorno no era de esta sesi\xF3n.");
-        finish(new Error("El \xABstate\xBB del retorno no coincide: se descarta."));
-        return;
-      }
-      if (error) {
-        respond(response, 400, "No se pudo iniciar sesi\xF3n.");
-        finish(new Error(`El proveedor devolvi\xF3 \xAB${error}\xBB.`));
-        return;
-      }
-      if (!code) {
-        respond(response, 400, "El retorno vino sin c\xF3digo.");
-        finish(new Error("El retorno no tra\xEDa c\xF3digo de autorizaci\xF3n."));
-        return;
-      }
-      respond(response, 200, "Listo. Ya puedes cerrar esta pesta\xF1a y volver a Panoma.");
-      finish(null, code);
-    });
-    server.on("error", (error) => {
-      clearTimeout(deadline);
-      reject(
-        new Error(
-          error.code === "EADDRINUSE" ? `El puerto ${config.redirectPort} est\xE1 ocupado, y es el \xFAnico que vale para este inicio de sesi\xF3n. Suele ser un 'codex login' a medias: ci\xE9rralo y vuelve a probar.` : `No se pudo escuchar en el puerto ${config.redirectPort}: ${error.message}`
-        )
-      );
-    });
-    server.listen(config.redirectPort, "127.0.0.1");
-  });
-}
-function respond(response, status, text) {
-  response.writeHead(status, { "content-type": "text/html; charset=utf-8" });
-  response.end(
-    `<!doctype html><meta charset="utf-8"><title>Panoma</title><body style="font:15px system-ui;padding:3rem;color:#141722">${text}</body>`
-  );
-}
-function same(a, b) {
-  const one = Buffer.from(a);
-  const other = Buffer.from(b);
-  if (one.length !== other.length) return false;
-  return timingSafeEqual(one, other);
-}
-async function exchangeCode(provider, code, verifier) {
-  return requestToken(provider, {
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: redirectUri(provider),
-    code_verifier: verifier
-  });
-}
-async function refresh(provider, refresh2) {
-  const token = await requestToken(provider, { grant_type: "refresh_token", refresh_token: refresh2 });
-  return { ...token, refresh: token.refresh ?? refresh2 };
-}
-async function requestToken(provider, fields) {
-  const config = requireOauth(provider);
-  const response = await fetch(config.tokenUrl, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ ...fields, client_id: config.clientId })
-  });
-  const body = await response.json().catch(() => ({}));
-  if (!response.ok || !body.access_token) {
-    throw new AiError({
-      code: "tokenRefused",
-      provider: provider.name,
-      status: response.status,
-      /* The provider's own words, whole: translating somebody else's refusal invents one. */
-      detail: body.error_description ?? body.error ?? response.statusText
-    });
-  }
-  return {
-    access: body.access_token,
-    ...body.refresh_token ? { refresh: body.refresh_token } : {},
-    ...body.expires_in ? { expiresAt: Date.now() + body.expires_in * 1e3 } : {},
-    ...accountFrom(body.id_token) ? { accountId: accountFrom(body.id_token) } : {}
-  };
-}
-function accountFrom(idToken) {
-  if (!idToken) return void 0;
-  const chunk = idToken.split(".")[1];
-  if (!chunk) return void 0;
-  try {
-    const claims = JSON.parse(Buffer.from(chunk, "base64url").toString("utf8"));
-    const auth = claims["https://api.openai.com/auth"];
-    const account = auth?.["chatgpt_account_id"];
-    return typeof account === "string" ? account : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var MARGIN_MS = 12e4;
-function expired(token) {
-  return token.expiresAt !== void 0 && Date.now() > token.expiresAt - MARGIN_MS;
-}
-function requireOauth(provider) {
-  if (!provider.oauth) throw new AiError({ code: "noOauth", provider: provider.name });
-  return provider.oauth;
-}
-function checkBaseUrl(provider, value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new AiError({
-      code: "badUrl",
-      provider: provider.name,
-      value,
-      where: provider.baseUrlEnvVar ?? "the configuration"
-    });
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new AiError({ code: "notHttp", provider: provider.name });
-  }
-  if (url.username || url.password) {
-    throw new AiError({ code: "urlHasCredentials", provider: provider.name });
-  }
-  if (url.protocol === "http:" && !isLocal(url.hostname)) {
-    throw new AiError({
-      code: "insecureHost",
-      provider: provider.name,
-      host: url.hostname
-    });
-  }
-  return value;
-}
-function isLocal(hostname) {
-  const clean = hostname.replace(/^\[|\]$/g, "");
-  return clean === "localhost" || clean === "127.0.0.1" || clean === "::1";
-}
-function pointsElsewhere(provider, url) {
-  if (!url || !provider.baseUrl) return false;
-  try {
-    return new URL(url).origin !== new URL(provider.baseUrl).origin;
-  } catch {
-    return false;
-  }
-}
-var SHAPES = [
-  /\bsk-[A-Za-z0-9_-]{8,}/g,
-  /\bgsk_[A-Za-z0-9]{8,}/g,
-  /\bxai-[A-Za-z0-9]{8,}/g,
-  /\bAIza[A-Za-z0-9_-]{8,}/g,
-  /\b(?:ghp|gho|ghs|ghu)_[A-Za-z0-9]{8,}/g,
-  /\bgithub_pat_[A-Za-z0-9_]{8,}/g,
-  /\bhf_[A-Za-z0-9]{8,}/g,
-  /\beyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
-  /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi
-];
-var REDACTED = "\xABcredencial oculta\xBB";
-function redact(text, known = []) {
-  let output = text;
-  for (const secret of known) {
-    if (!secret || secret.length < 4) continue;
-    output = output.split(secret).join(REDACTED);
-  }
-  for (const shape of SHAPES) output = output.replace(shape, REDACTED);
-  return output.replace(/\b[A-Za-z0-9_-]{40,}\b/g, REDACTED);
-}
-function configPath() {
-  return panomaPath("ai.json");
-}
-function backupPath() {
-  return `${configPath()}.anterior`;
-}
-var ConfigCorruptError = class extends Error {
-  constructor(path, problem, recovery) {
-    const lines = [`Could not read the AI configuration at ${path}: ${problem.message}`];
-    if (recovery) {
-      lines.push(
-        /*
-          Both forms written whole rather than an `s` glued to the figure. The house rule: never
-          attach an inflected word to a digit, and this line only ever reads wrong at one.
-         */
-        recovery.keys === 1 ? `There is an earlier copy at ${recovery.path} holding one key. Recover it with:` : `There is an earlier copy at ${recovery.path} holding ${recovery.keys} keys. Recover it with:`,
-        `  mv ${recovery.path} ${path}`,
-        "Do not run 'panoma ai key' first: it would overwrite the file and whatever is left in it."
-      );
-    } else {
-      lines.push(
-        "There is no earlier copy. Open it and fix it by hand, or delete it to start over \u2014",
-        "you will lose whatever keys were saved inside."
-      );
-    }
-    super(lines.join("\n"), { cause: problem });
-    this.path = path;
-    this.recovery = recovery;
-    this.name = "ConfigCorruptError";
-  }
-  path;
-  recovery;
-};
-function isConfig(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const record = value;
-  if (record["provider"] !== void 0 && typeof record["provider"] !== "string") return false;
-  if (record["model"] !== void 0 && typeof record["model"] !== "string") return false;
-  const keys = record["keys"];
-  if (keys !== void 0) {
-    if (typeof keys !== "object" || keys === null || Array.isArray(keys)) return false;
-    if (Object.values(keys).some((key) => typeof key !== "string")) return false;
-  }
-  const tokens = record["tokens"];
-  if (tokens !== void 0) {
-    if (typeof tokens !== "object" || tokens === null || Array.isArray(tokens)) return false;
-    if (Object.values(tokens).some(
-      (token) => typeof token !== "object" || token === null || typeof token.access !== "string"
-    )) {
-      return false;
-    }
-  }
-  return true;
-}
-async function readFileConfig(path) {
-  let raw;
-  try {
-    raw = await readFile(path, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
-  }
-  const parsed = JSON.parse(raw);
-  if (!isConfig(parsed)) {
-    throw new AiError({ code: "configShape" });
-  }
-  return parsed;
-}
-async function readConfig() {
-  const path = configPath();
-  try {
-    return await readFileConfig(path) ?? {};
-  } catch (error) {
-    const recovered = await readFileConfig(backupPath()).catch(() => void 0);
-    throw new ConfigCorruptError(
-      path,
-      error,
-      recovered ? { path: backupPath(), keys: Object.keys(recovered.keys ?? {}).length } : void 0
-    );
-  }
-}
-async function writeConfig(config) {
-  const path = configPath();
-  await mkdir(dirname(path), { recursive: true });
-  const current = await readFileConfig(path).catch(() => void 0);
-  if (current) {
-    await copyFile(path, backupPath()).then(() => restrictToOwner(backupPath())).catch(() => {
-    });
-  }
-  const temporary = `${path}.${process.pid}.tmp`;
-  const body = `${JSON.stringify(config, null, 2)}
-`;
-  try {
-    const handle = await open(temporary, "w", 384);
-    try {
-      await handle.writeFile(body, "utf8");
-      await handle.sync();
-    } finally {
-      await handle.close();
-    }
-    await rename(temporary, path);
-  } catch (error) {
-    await rm(temporary, { force: true }).catch(() => {
-    });
-    throw error;
-  }
-  await restrictToOwner(path);
-  await open(dirname(path), "r").then(async (dir) => {
-    await dir.sync().catch(() => {
-    });
-    await dir.close();
-  }).catch(() => {
-  });
-  await sweepTemporaries();
-}
-async function sweepTemporaries() {
-  const directory = dirname(configPath());
-  const prefix = `${basename(configPath())}.`;
-  const files = await readdir(directory).catch(() => []);
-  for (const file of files) {
-    if (!file.startsWith(prefix) || !file.endsWith(".tmp")) continue;
-    const pid = Number.parseInt(file.slice(prefix.length, -".tmp".length), 10);
-    if (!Number.isInteger(pid)) continue;
-    if (pid !== process.pid && isRunning(pid)) continue;
-    await rm(join2(directory, file), { force: true }).catch(() => {
-    });
-  }
-}
-function isRunning(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}
-async function withLock(action) {
-  const lock = `${configPath()}.lock`;
-  await mkdir(dirname(lock), { recursive: true });
-  const deadline = Date.now() + 3e3;
-  for (; ; ) {
-    try {
-      const handle = await open(lock, "wx", 384);
-      await handle.writeFile(`${process.pid}
-`, "utf8").catch(() => {
-      });
-      await handle.close();
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      if (Date.now() > deadline) {
-        const owner = await readFile(lock, "utf8").catch(() => "");
-        throw new AiError({
-          code: "configLocked",
-          lock,
-          holder: owner.trim() ? `pid ${owner.trim()}` : void 0
-        });
-      }
-      await new Promise((resolve) => setTimeout(resolve, 50));
-    }
-  }
-  try {
-    return await action();
-  } finally {
-    await rm(lock, { force: true }).catch(() => {
-    });
-  }
-}
-var NoCredentialError = class extends Error {
-  constructor(provider) {
-    const how = provider.auth === "cli" ? `Install ${provider.name} and sign in; panoma will call '${provider.command}'.` : provider.auth === "oauth" ? `Sign in to ${provider.name} from the model page in panoma.` : `Run 'panoma ai key ${provider.id}' or export ${provider.apiKeyEnvVars?.[0]}. The key comes from ${provider.signupUrl}.`;
-    super(`No credential for ${provider.name}. ${how}`);
-    this.provider = provider;
-    this.name = "NoCredentialError";
-  }
-  provider;
-};
-async function resolveCredential(providerId, config) {
-  const settings = config ?? await readConfig();
-  const id = providerId ?? settings.provider;
-  if (!id) {
-    throw new AiError({ code: "noProvider" });
-  }
-  const provider = findProvider(id);
-  if (!provider) throw new AiError({ code: "unknownProvider", id });
-  if (provider.auth === "cli") {
-    return { provider, model: settings.model ?? "", source: "agent-session" };
-  }
-  if (provider.auth === "oauth") {
-    const savedValue = settings.tokens?.[provider.id];
-    if (!savedValue) throw new NoCredentialError(provider);
-    let token = savedValue;
-    if (expired(token)) {
-      if (!token.refresh) throw new NoCredentialError(provider);
-      token = await refresh(provider, token.refresh);
-      await saveToken(provider.id, token);
-    }
-    return {
-      provider,
-      model: settings.model ?? provider.defaultModel ?? "",
-      apiKey: token.access,
-      baseUrl: resolveBaseUrl(provider),
-      ...token.accountId ? { accountId: token.accountId } : {},
-      source: "login"
-    };
-  }
-  for (const variable of provider.apiKeyEnvVars ?? []) {
-    const value = process.env[variable];
-    if (value) {
-      return {
-        provider,
-        model: settings.model ?? provider.defaultModel ?? "",
-        apiKey: value,
-        baseUrl: resolveBaseUrl(provider),
-        source: "env"
-      };
-    }
-  }
-  const stored = settings.keys?.[provider.id];
-  if (stored) {
-    return {
-      provider,
-      model: settings.model ?? provider.defaultModel ?? "",
-      apiKey: stored,
-      baseUrl: resolveBaseUrl(provider),
-      source: "file"
-    };
-  }
-  throw new NoCredentialError(provider);
-}
-function resolveBaseUrl(provider) {
-  const override = provider.baseUrlEnvVar ? process.env[provider.baseUrlEnvVar] : void 0;
-  const chosenOne = override || provider.baseUrl;
-  return chosenOne ? checkBaseUrl(provider, chosenOne) : void 0;
-}
-async function saveKey(providerId, apiKey) {
-  await withLock(async () => {
-    const config = await readConfig();
-    config.keys = { ...config.keys, [providerId]: apiKey };
-    config.provider ??= providerId;
-    await writeConfig(config);
-  });
-}
-async function saveToken(providerId, token) {
-  await withLock(async () => {
-    const config = await readConfig();
-    config.tokens = { ...config.tokens, [providerId]: token };
-    config.provider ??= providerId;
-    await writeConfig(config);
-  });
-}
-async function forgetCredential(providerId) {
-  await updateConfig((config) => {
-    const keys = { ...config.keys };
-    const tokens = { ...config.tokens };
-    delete keys[providerId];
-    delete tokens[providerId];
-    return { ...config, keys, tokens };
-  });
-}
-async function updateConfig(change) {
-  return withLock(async () => {
-    const next = await change(await readConfig());
-    await writeConfig(next);
-    return next;
-  });
-}
-function maskKey(apiKey) {
-  return apiKey.length <= 8 ? "\u2022\u2022\u2022\u2022" : `${apiKey.slice(0, 3)}\u2026${apiKey.slice(-4)}`;
-}
-var run = promisify(execFile);
-async function probe(command) {
-  try {
-    const launch = resolveExecutable(command, ["--version"]);
-    const { stdout } = await run(launch.file, launch.args, { timeout: 15e3 });
-    return { ok: true, version: stdout.trim().split("\n")[0] ?? "" };
-  } catch (error) {
-    const failure = error;
-    if (failure.code === "ENOENT") return { ok: false, missing: true };
-    const said = (failure.stderr || failure.message || "").trim().split("\n")[0] ?? "";
-    return { ok: false, missing: false, said: said.slice(0, 160) || "no responde" };
-  }
-}
-async function detectCliAgents(providers) {
-  return Promise.all(
-    providers.map(async (provider) => {
-      if (!provider.command) return { provider, installed: false };
-      const first = await probe(provider.command);
-      if (first.ok) {
-        return { provider, installed: true, command: provider.command, version: first.version };
-      }
-      for (const bundled of provider.bundles ?? []) {
-        const next = await probe(bundled);
-        if (next.ok) {
-          return { provider, installed: true, command: bundled, version: next.version };
-        }
-      }
-      if (first.missing) return { provider, installed: false };
-      return { provider, installed: false, broken: first.said };
-    })
-  );
-}
-var MAX_OUTPUT = 2e5;
-async function completeWithCliAgent(provider, prompt, options = {}) {
-  const command = options.command ?? provider.command;
-  if (!command) throw new AiError({ code: "noCommand", provider: provider.name });
-  return new Promise((resolve, reject) => {
-    const launch = resolveExecutable(command, provider.args ?? []);
-    const child = spawn(launch.file, launch.args, {
-      cwd: options.cwd,
-      // Without shell: the prompt is user text and can contain anything.
-      shell: false,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (chunk) => {
-      if (stdout.length < MAX_OUTPUT) stdout += chunk.toString();
-    });
-    child.stderr.on("data", (chunk) => {
-      if (stderr.length < 8e3) stderr += chunk.toString();
-    });
-    const timer = setTimeout(() => child.kill("SIGKILL"), options.timeoutMs ?? 18e4);
-    child.on("error", (error) => {
-      clearTimeout(timer);
-      reject(new AiError({ code: "launchFailed", command, reason: error.message }));
-    });
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      if (code === 0) return resolve(stdout.trim());
-      reject(
-        new Error(
-          redact(
-            failureMessage({
-              code: "exited",
-              provider: provider.name,
-              status: code ?? -1,
-              output: stderr.trim().slice(0, 600)
-            })
-          )
-        )
-      );
-    });
-    child.stdin.end(prompt);
-  });
-}
-var MAX = 60;
-var CLIENT_VERSION = "1.0.0";
-async function listModels(providerId, signal) {
-  const credential = await resolveCredential(providerId);
-  const { provider } = credential;
-  if (provider.auth === "cli" || !credential.baseUrl) return [];
-  const anthropic = provider.api === "anthropic";
-  const version = provider.api === "codex" ? `?client_version=${CLIENT_VERSION}` : "";
-  const url = `${credential.baseUrl}${anthropic ? "/v1/models" : "/models"}${version}`;
-  const response = await fetch(url, {
-    headers: anthropic ? {
-      "x-api-key": credential.apiKey ?? "",
-      "anthropic-version": "2023-06-01"
-    } : {
-      authorization: `Bearer ${credential.apiKey}`,
-      ...credential.accountId ? { "chatgpt-account-id": credential.accountId } : {}
-    },
-    ...signal ? { signal } : {}
-  });
-  if (!response.ok) {
-    const body2 = await response.json().catch(() => ({}));
-    throw new Error(
-      redact(
-        `${provider.name} no quiso listar sus modelos (${response.status}): ${body2.error?.message ?? response.statusText}`,
-        [credential.apiKey]
-      )
-    );
-  }
-  const body = await response.json().catch(() => ({}));
-  const rawIds = [
-    ...(body.data ?? []).map((m) => m.id),
-    ...(body.models ?? []).map((m) => m.id ?? m.slug ?? m.name)
-  ];
-  return [...new Set(rawIds.filter((id) => Boolean(id)))].sort().slice(0, MAX);
-}
-var ATTEMPTS = 3;
-var WAITS = [500, 2e3];
-function transportFailure(error) {
-  if (!(error instanceof Error)) return void 0;
-  if (error.name === "AbortError" || error.name === "TimeoutError") return void 0;
-  if (!(error instanceof TypeError) && codeOf(error) === void 0) return void 0;
-  const parts = [];
-  let step = error;
-  while (step instanceof Error && parts.length < 4) {
-    const code = codeOf(step);
-    parts.push(code === void 0 ? step.message : `${code} (${step.message})`);
-    step = step.cause;
-  }
-  const seen = parts.filter((part, index) => parts.indexOf(part) === index);
-  const useful = seen.filter((part) => part !== "fetch failed");
-  return (useful.length > 0 ? useful : seen).join(" \u2190 ");
-}
-function codeOf(error) {
-  const code = error.code;
-  return typeof code === "string" && code.length > 0 ? code : void 0;
-}
-async function callProvider(name, url, init, options = {}) {
-  const attempts = options.attempts ?? ATTEMPTS;
-  const call = options.fetchImpl ?? fetch;
-  const wait = options.wait ?? sleep;
-  let last = "";
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    try {
-      return await call(url, init);
-    } catch (error) {
-      const why = transportFailure(error);
-      if (why === void 0) throw error;
-      last = why;
-      if (attempt < attempts) await wait(WAITS[Math.min(attempt - 1, WAITS.length - 1)] ?? 0);
-    }
-  }
-  throw new AiError({ code: "neverAnswered", provider: name, last: String(last), attempts });
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-var VisionUnsupportedError = class extends Error {
-  constructor(provider) {
-    super(
-      `${provider} cannot take images. Configure a provider with a key \u2014'panoma ai key'\u2014 or pass one with --provider.`
-    );
-    this.provider = provider;
-    this.name = "VisionUnsupportedError";
-  }
-  provider;
-};
-async function complete(request) {
-  const credential = await resolveCredential(request.provider);
-  if (credential.provider.auth === "cli") {
-    if (request.images?.length) throw new VisionUnsupportedError(credential.provider.name);
-    const prompt = request.system ? `${request.system}
-
----
-
-${request.prompt}` : request.prompt;
-    const text = await completeWithCliAgent(credential.provider, prompt);
-    return { text, provider: credential.provider.id, model: credential.model || "session" };
-  }
-  if (credential.provider.api === "anthropic") return completeAnthropic(credential, request);
-  if (credential.provider.api === "codex") return completeCodex(credential, request);
-  return completeOpenAi(credential, request);
-}
-async function readCodexStream(body) {
-  const lector = body.pipeThrough(new TextDecoderStream()).getReader();
-  let pending = "";
-  let text = "";
-  let final;
-  for (; ; ) {
-    const { done, value } = await lector.read();
-    if (done) break;
-    pending += value;
-    const lines = pending.split("\n");
-    pending = lines.pop() ?? "";
-    for (const line of lines) {
-      if (!line.startsWith("data:")) continue;
-      const datum = line.slice(5).trim();
-      if (!datum || datum === "[DONE]") continue;
-      let event;
-      try {
-        event = JSON.parse(datum);
-      } catch {
-        continue;
-      }
-      if (typeof event.delta === "string" && event.type?.endsWith(".delta")) {
-        text += event.delta;
-      }
-      if (event.response) final = event.response;
-    }
-  }
-  return { text, ...final ? { final } : {} };
-}
-async function completeCodex(credential, request) {
-  const response = await callProvider(credential.provider.name, `${credential.baseUrl}/responses`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${credential.apiKey}`,
-      // Which account is charged. It comes from the `id_token` at login; without it, the request
-      // goes to the user's default account.
-      ...credential.accountId ? { "chatgpt-account-id": credential.accountId } : {},
-      // Who is calling. The support looks at it to decide whether to accept the subscription token.
-      originator: "codex_cli_rs",
-      "openai-beta": "responses=experimental",
-      accept: "text/event-stream"
-    },
-    body: JSON.stringify({
-      model: credential.model,
-      ...request.system ? { instructions: request.system } : {},
-      input: [
-        {
-          role: "user",
-          content: [
-            ...(request.images ?? []).map((image) => ({
-              type: "input_image",
-              // Here yes, the entire URL of data: this backup does not have a field for the type.
-              image_url: dataUrl(image)
-            })),
-            { type: "input_text", text: request.prompt }
-          ]
-        }
-      ],
-      /*
-        Without `max_output_tokens`, and not out of forgetfulness: this backup rejects it
-        —"Unsupported parameter"— because the cap is not set by the request, it is set by the
-        plan. This is the fundamental difference between paying per token and paying a
-        subscription, and that is why `request.maxTokens` does not go here: in this provider it
-        means nothing.
-       */
-      // Mandatory: without this, it answers 400 «Stream must be set to true». This is not our
-      // preference — this backend does not know how to respond in any other way.
-      stream: true,
-      store: false
-    }),
-    signal: request.signal
-  });
-  if (!response.ok) {
-    const failure = await response.json().catch(() => ({}));
-    throw new AiError({
-      code: "providerRefused",
-      provider: credential.provider.name,
-      status: response.status,
-      detail: redact(
-        String(failure.error?.message ?? failure.detail ?? response.statusText),
-        [credential.apiKey]
-      )
-    });
-  }
-  if (!response.body) throw new AiError({ code: "emptyBody", provider: credential.provider.name });
-  const { text, final } = await readCodexStream(response.body);
-  const outputText = (final?.output ?? []).flatMap((block) => block.content ?? []).flatMap((chunk) => chunk.text ? [chunk.text] : []).join("\n");
-  const shortcut = Array.isArray(final?.output_text) ? final.output_text.join("\n") : final?.output_text;
-  return {
-    text: (text || outputText || shortcut || "").trim(),
-    provider: credential.provider.id,
-    model: final?.model ?? credential.model,
-    ...final?.usage ? {
-      usage: {
-        input: final.usage.input_tokens ?? 0,
-        output: final.usage.output_tokens ?? 0
-      }
-    } : {}
-  };
-}
-async function completeAnthropic(credential, request) {
-  const { default: Anthropic } = await import("@anthropic-ai/sdk");
-  const client = new Anthropic({ apiKey: credential.apiKey, baseURL: credential.baseUrl });
-  const message = await client.messages.stream(
-    {
-      model: credential.model,
-      max_tokens: request.maxTokens ?? 2048,
-      system: request.system,
-      messages: [
-        {
-          role: "user",
-          content: [
-            ...(request.images ?? []).map((image) => ({
-              type: "image",
-              // The only one of the three families that separates type and bytes, and the one
-              // that states it in its typing: that's why `CompleteImage` stores both separately.
-              source: {
-                type: "base64",
-                media_type: image.mediaType,
-                data: image.data
-              }
-            })),
-            { type: "text", text: request.prompt }
-          ]
-        }
-      ]
-    },
-    { signal: request.signal }
-  ).finalMessage();
-  const text = message.content.flatMap((block) => block.type === "text" ? [block.text] : []).join("\n").trim();
-  return {
-    text,
-    provider: credential.provider.id,
-    model: message.model,
-    usage: { input: message.usage.input_tokens, output: message.usage.output_tokens }
-  };
-}
-async function completeOpenAi(credential, request) {
-  const messages = [];
-  if (request.system) messages.push({ role: "system", content: request.system });
-  const images = request.images ?? [];
-  if (images.length === 0) {
-    messages.push({ role: "user", content: request.prompt });
-  } else {
-    messages.push({
-      role: "user",
-      content: [
-        ...images.map(
-          (image) => ({ type: "image_url", image_url: { url: dataUrl(image) } })
-        ),
-        { type: "text", text: request.prompt }
-      ]
-    });
-  }
-  const response = await callProvider(
-    credential.provider.name,
-    `${credential.baseUrl}/chat/completions`,
-    {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${credential.apiKey}`
-      },
-      body: JSON.stringify({
-        model: credential.model,
-        max_tokens: request.maxTokens ?? 2048,
-        messages
-      }),
-      signal: request.signal
-    }
-  );
-  const body = await response.json().catch(() => ({}));
-  if (!response.ok) {
-    throw new AiError({
-      code: "providerRefused",
-      provider: credential.provider.name,
-      status: response.status,
-      detail: redact(String(body.error?.message ?? response.statusText), [credential.apiKey])
-    });
-  }
-  return {
-    text: (body.choices?.[0]?.message?.content ?? "").trim(),
-    provider: credential.provider.id,
-    model: body.model ?? credential.model,
-    usage: body.usage ? { input: body.usage.prompt_tokens ?? 0, output: body.usage.completion_tokens ?? 0 } : void 0
-  };
-}
-function dataUrl(image) {
-  return `data:${image.mediaType};base64,${image.data}`;
-}
-
-export {
-  failureMessage,
-  AiError,
-  PROVIDERS,
-  findProvider,
-  providersByAuth,
-  createChallenge,
-  redirectUri,
-  authorizeUrl,
-  awaitCallback,
-  exchangeCode,
-  refresh,
-  accountFrom,
-  expired,
-  checkBaseUrl,
-  pointsElsewhere,
-  REDACTED,
-  redact,
-  configPath,
-  ConfigCorruptError,
-  readConfig,
-  writeConfig,
-  NoCredentialError,
-  resolveCredential,
-  saveKey,
-  saveToken,
-  forgetCredential,
-  updateConfig,
-  maskKey,
-  detectCliAgents,
-  completeWithCliAgent,
-  listModels,
-  ATTEMPTS,
-  transportFailure,
-  callProvider,
-  VisionUnsupportedError,
-  complete
-};