pi2dsh 0.3.0 → 0.3.1

package/dist/credentials-oauth.d.mts

@@ -0,0 +1,27 @@
+
+import { CredentialInfo, CredentialProvider, CredentialRef, ResolvedCredential } from "@deepseek-ai/dsh-credentials";
+import { Context } from "@deepseek-ai/cordis";
+//#region src/credentials-oauth.d.ts
+type UnknownRecord = Record<string, unknown>;
+declare function oauthCredentialRef(providerId: string): string;
+interface PiOAuthCredentialProviderOptions {
+  /** Path to the Pi-format auth.json; defaults to `$agentDir/auth.json`. */
+  authPath?: string;
+  /** Additional provider configs (id → config with an oauth block), e.g. from packages that registered providers. */
+  providers?: ReadonlyMap<string, UnknownRecord>;
+}
+declare class PiOAuthCredentialProvider extends CredentialProvider {
+  private readonly oauthStore;
+  private readonly extraProviders;
+  constructor(ctx: Context, options?: PiOAuthCredentialProviderOptions);
+  private oauthConfigFor;
+  resolve(ref: CredentialRef): Promise<ResolvedCredential | undefined>;
+  describe(ref: CredentialRef): Promise<CredentialInfo>;
+  set(ref: CredentialRef, _value: string): Promise<void>;
+  unset(ref: CredentialRef): Promise<void>;
+}
+declare const name = "pi2dsh-credentials-oauth";
+declare function apply(ctx: Context, config?: PiOAuthCredentialProviderOptions): void;
+//#endregion
+export { PiOAuthCredentialProvider, PiOAuthCredentialProviderOptions, apply, name, oauthCredentialRef };
+//# sourceMappingURL=credentials-oauth.d.mts.map

package/dist/credentials-oauth.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-oauth.d.mts","names":[],"sources":["../src/credentials-oauth.ts"],"mappings":";;;;KAOK,gBAAgB;iBAgBL,mBAAmB;UASlB;;EAEf;;EAEA,YAAY,oBAAoB;;cAGrB,kCAAkC;mBAC5B;mBACA;EAEL,YAAA,KAAK,SAAS,UAAS;UAM3B;EAQF,QAAQ,KAAK,gBAAgB,QAAQ;EAiBrC,SAAS,KAAK,gBAAgB,QAAQ;EAUtC,IAAI,KAAK,eAAe,iBAAiB;EAIzC,MAAM,KAAK,gBAAgB;;cAUtB;iBAEG,MAAM,KAAK,SAAS,SAAQ"}

package/dist/credentials-oauth.mjs

@@ -0,0 +1,91 @@
+
+import { t as getAgentDir } from "./pi-config-shim-CZ1wFzqM.mjs";
+import "./pi-coding-agent-Z1hTs61i.mjs";
+import { a as storedOAuthCredential, i as resolveOAuthApiKey, r as providerSupportsOAuth, t as FileCredentialStore } from "./oauth-bridge-BpPrppjR.mjs";
+import { r as builtinProviders } from "./pi-ai-CWFlgigJ.mjs";
+import { join } from "node:path";
+import { CredentialProvider } from "@deepseek-ai/dsh-credentials";
+//#region src/credentials-oauth.ts
+const OAUTH_REF_PREFIX = "PI2DSH_OAUTH_";
+function oauthCredentialRef(providerId) {
+	return `${OAUTH_REF_PREFIX}${providerId.toUpperCase().replaceAll("-", "_")}`;
+}
+function providerIdOfRef(ref) {
+	if (!ref.startsWith(OAUTH_REF_PREFIX)) return void 0;
+	return ref.slice(13).toLowerCase().replaceAll("_", "-");
+}
+var PiOAuthCredentialProvider = class extends CredentialProvider {
+	oauthStore;
+	extraProviders;
+	constructor(ctx, options = {}) {
+		super(ctx);
+		this.oauthStore = new FileCredentialStore(options.authPath ?? join(getAgentDir(), "auth.json"));
+		this.extraProviders = options.providers ?? /* @__PURE__ */ new Map();
+	}
+	oauthConfigFor(providerId) {
+		const registered = this.extraProviders.get(providerId);
+		if (providerSupportsOAuth(registered)) return registered;
+		const builtin = builtinProviders().find((provider) => provider.id === providerId);
+		if (builtin === void 0) return void 0;
+		return {
+			name: builtin.name,
+			baseUrl: builtin.baseUrl,
+			oauth: builtin.auth.oauth
+		};
+	}
+	async resolve(ref) {
+		const providerId = providerIdOfRef(String(ref));
+		if (providerId === void 0) {
+			const value = process.env[String(ref)];
+			return value !== void 0 && value.length > 0 ? {
+				value,
+				source: "env"
+			} : void 0;
+		}
+		const config = this.oauthConfigFor(providerId);
+		if (config === void 0) return void 0;
+		const value = await resolveOAuthApiKey({
+			providerId,
+			providerName: typeof config.name === "string" ? config.name : providerId,
+			providerConfig: config,
+			store: this.oauthStore
+		});
+		return value !== void 0 && value.length > 0 ? {
+			value,
+			source: "pi-oauth"
+		} : void 0;
+	}
+	async describe(ref) {
+		const providerId = providerIdOfRef(String(ref));
+		if (providerId === void 0) {
+			const value = process.env[String(ref)];
+			return {
+				configured: value !== void 0 && value.length > 0,
+				...value ? { source: "env" } : {},
+				writable: false
+			};
+		}
+		const stored = await storedOAuthCredential(this.oauthStore, providerId);
+		return {
+			configured: stored !== void 0,
+			...stored !== void 0 ? { source: "pi-oauth" } : {},
+			writable: false
+		};
+	}
+	async set(ref, _value) {
+		throw new Error(`credential ${String(ref)} is read-only here: OAuth tokens are managed by /login, environment values by the shell`);
+	}
+	async unset(ref) {
+		const providerId = providerIdOfRef(String(ref));
+		if (providerId === void 0) throw new Error(`credential ${String(ref)} is read-only here: environment values are managed by the shell`);
+		await this.oauthStore.delete(providerId, void 0);
+	}
+};
+const name = "pi2dsh-credentials-oauth";
+function apply(ctx, config = {}) {
+	new PiOAuthCredentialProvider(ctx, config);
+}
+//#endregion
+export { PiOAuthCredentialProvider, apply, name, oauthCredentialRef };
+
+//# sourceMappingURL=credentials-oauth.mjs.map

package/dist/credentials-oauth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-oauth.mjs","names":[],"sources":["../src/credentials-oauth.ts"],"sourcesContent":["import { join } from 'node:path'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { CredentialProvider, type CredentialInfo, type CredentialRef, type ResolvedCredential } from '@deepseek-ai/dsh-credentials'\nimport { FileCredentialStore, providerSupportsOAuth, resolveOAuthApiKey, storedOAuthCredential } from './oauth-bridge.js'\nimport { builtinProviders } from './compat/pi-ai.js'\nimport { getAgentDir } from './compat/pi-coding-agent.js'\n\ntype UnknownRecord = Record<string, unknown>\n\n// L4 of the OAuth host seam: a standard dsh-credentials provider that serves\n// Pi OAuth tokens to DSH's native LLM request path. A route configured as\n// `apiKeyEnv: PI2DSH_OAUTH_OPENAI_CODEX` resolves per request through this\n// provider — Pi's double-checked-lock refresh runs on every resolution, so a\n// rotated token reaches the next model call with no restart, exactly the\n// per-operation semantics the credentials seam demands. Every other reference\n// falls through to the process environment, so one provider instance serves a\n// whole composition.\n//\n// Reference convention: PI2DSH_OAUTH_<PROVIDER_ID> where the provider id is\n// upper-cased with `-` as `_` (openai-codex → PI2DSH_OAUTH_OPENAI_CODEX).\n\nconst OAUTH_REF_PREFIX = 'PI2DSH_OAUTH_'\n\nexport function oauthCredentialRef(providerId: string): string {\n  return `${OAUTH_REF_PREFIX}${providerId.toUpperCase().replaceAll('-', '_')}`\n}\n\nfunction providerIdOfRef(ref: string): string | undefined {\n  if (!ref.startsWith(OAUTH_REF_PREFIX)) return undefined\n  return ref.slice(OAUTH_REF_PREFIX.length).toLowerCase().replaceAll('_', '-')\n}\n\nexport interface PiOAuthCredentialProviderOptions {\n  /** Path to the Pi-format auth.json; defaults to `$agentDir/auth.json`. */\n  authPath?: string\n  /** Additional provider configs (id → config with an oauth block), e.g. from packages that registered providers. */\n  providers?: ReadonlyMap<string, UnknownRecord>\n}\n\nexport class PiOAuthCredentialProvider extends CredentialProvider {\n  private readonly oauthStore: FileCredentialStore\n  private readonly extraProviders: ReadonlyMap<string, UnknownRecord>\n\n  constructor(ctx: Context, options: PiOAuthCredentialProviderOptions = {}) {\n    super(ctx)\n    this.oauthStore = new FileCredentialStore(options.authPath ?? join(getAgentDir(), 'auth.json'))\n    this.extraProviders = options.providers ?? new Map()\n  }\n\n  private oauthConfigFor(providerId: string): UnknownRecord | undefined {\n    const registered = this.extraProviders.get(providerId)\n    if (providerSupportsOAuth(registered)) return registered\n    const builtin = builtinProviders().find(provider => provider.id === providerId)\n    if (builtin === undefined) return undefined\n    return { name: builtin.name, baseUrl: builtin.baseUrl, oauth: builtin.auth.oauth }\n  }\n\n  async resolve(ref: CredentialRef): Promise<ResolvedCredential | undefined> {\n    const providerId = providerIdOfRef(String(ref))\n    if (providerId === undefined) {\n      const value = process.env[String(ref)]\n      return value !== undefined && value.length > 0 ? { value, source: 'env' } : undefined\n    }\n    const config = this.oauthConfigFor(providerId)\n    if (config === undefined) return undefined\n    const value = await resolveOAuthApiKey({\n      providerId,\n      providerName: typeof config.name === 'string' ? config.name : providerId,\n      providerConfig: config,\n      store: this.oauthStore,\n    })\n    return value !== undefined && value.length > 0 ? { value, source: 'pi-oauth' } : undefined\n  }\n\n  async describe(ref: CredentialRef): Promise<CredentialInfo> {\n    const providerId = providerIdOfRef(String(ref))\n    if (providerId === undefined) {\n      const value = process.env[String(ref)]\n      return { configured: value !== undefined && value.length > 0, ...(value ? { source: 'env' } : {}), writable: false }\n    }\n    const stored = await storedOAuthCredential(this.oauthStore, providerId)\n    return { configured: stored !== undefined, ...(stored !== undefined ? { source: 'pi-oauth' } : {}), writable: false }\n  }\n\n  async set(ref: CredentialRef, _value: string): Promise<void> {\n    throw new Error(`credential ${String(ref)} is read-only here: OAuth tokens are managed by /login, environment values by the shell`)\n  }\n\n  async unset(ref: CredentialRef): Promise<void> {\n    const providerId = providerIdOfRef(String(ref))\n    if (providerId === undefined) {\n      throw new Error(`credential ${String(ref)} is read-only here: environment values are managed by the shell`)\n    }\n    // Logging out is a legitimate unset: drop the stored token.\n    await this.oauthStore.delete(providerId, undefined)\n  }\n}\n\nexport const name = 'pi2dsh-credentials-oauth'\n\nexport function apply(ctx: Context, config: PiOAuthCredentialProviderOptions = {}): void {\n  // The Service constructor registers itself as ctx.credentials.\n  void new PiOAuthCredentialProvider(ctx, config)\n}\n"],"mappings":";;;;;;;;AAqBA,MAAM,mBAAmB;AAEzB,SAAgB,mBAAmB,YAA4B;CAC7D,OAAO,GAAG,mBAAmB,WAAW,YAAY,CAAC,CAAC,WAAW,KAAK,GAAG;AAC3E;AAEA,SAAS,gBAAgB,KAAiC;CACxD,IAAI,CAAC,IAAI,WAAW,gBAAgB,GAAG,OAAO,KAAA;CAC9C,OAAO,IAAI,MAAM,EAAuB,CAAC,CAAC,YAAY,CAAC,CAAC,WAAW,KAAK,GAAG;AAC7E;AASA,IAAa,4BAAb,cAA+C,mBAAmB;CAChE;CACA;CAEA,YAAY,KAAc,UAA4C,CAAC,GAAG;EACxE,MAAM,GAAG;EACT,KAAK,aAAa,IAAI,oBAAoB,QAAQ,YAAY,KAAK,YAAY,GAAG,WAAW,CAAC;EAC9F,KAAK,iBAAiB,QAAQ,6BAAa,IAAI,IAAI;CACrD;CAEA,eAAuB,YAA+C;EACpE,MAAM,aAAa,KAAK,eAAe,IAAI,UAAU;EACrD,IAAI,sBAAsB,UAAU,GAAG,OAAO;EAC9C,MAAM,UAAU,iBAAiB,CAAC,CAAC,MAAK,aAAY,SAAS,OAAO,UAAU;EAC9E,IAAI,YAAY,KAAA,GAAW,OAAO,KAAA;EAClC,OAAO;GAAE,MAAM,QAAQ;GAAM,SAAS,QAAQ;GAAS,OAAO,QAAQ,KAAK;EAAM;CACnF;CAEA,MAAM,QAAQ,KAA6D;EACzE,MAAM,aAAa,gBAAgB,OAAO,GAAG,CAAC;EAC9C,IAAI,eAAe,KAAA,GAAW;GAC5B,MAAM,QAAQ,QAAQ,IAAI,OAAO,GAAG;GACpC,OAAO,UAAU,KAAA,KAAa,MAAM,SAAS,IAAI;IAAE;IAAO,QAAQ;GAAM,IAAI,KAAA;EAC9E;EACA,MAAM,SAAS,KAAK,eAAe,UAAU;EAC7C,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,MAAM,QAAQ,MAAM,mBAAmB;GACrC;GACA,cAAc,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;GAC9D,gBAAgB;GAChB,OAAO,KAAK;EACd,CAAC;EACD,OAAO,UAAU,KAAA,KAAa,MAAM,SAAS,IAAI;GAAE;GAAO,QAAQ;EAAW,IAAI,KAAA;CACnF;CAEA,MAAM,SAAS,KAA6C;EAC1D,MAAM,aAAa,gBAAgB,OAAO,GAAG,CAAC;EAC9C,IAAI,eAAe,KAAA,GAAW;GAC5B,MAAM,QAAQ,QAAQ,IAAI,OAAO,GAAG;GACpC,OAAO;IAAE,YAAY,UAAU,KAAA,KAAa,MAAM,SAAS;IAAG,GAAI,QAAQ,EAAE,QAAQ,MAAM,IAAI,CAAC;IAAI,UAAU;GAAM;EACrH;EACA,MAAM,SAAS,MAAM,sBAAsB,KAAK,YAAY,UAAU;EACtE,OAAO;GAAE,YAAY,WAAW,KAAA;GAAW,GAAI,WAAW,KAAA,IAAY,EAAE,QAAQ,WAAW,IAAI,CAAC;GAAI,UAAU;EAAM;CACtH;CAEA,MAAM,IAAI,KAAoB,QAA+B;EAC3D,MAAM,IAAI,MAAM,cAAc,OAAO,GAAG,EAAE,wFAAwF;CACpI;CAEA,MAAM,MAAM,KAAmC;EAC7C,MAAM,aAAa,gBAAgB,OAAO,GAAG,CAAC;EAC9C,IAAI,eAAe,KAAA,GACjB,MAAM,IAAI,MAAM,cAAc,OAAO,GAAG,EAAE,gEAAgE;EAG5G,MAAM,KAAK,WAAW,OAAO,YAAY,KAAA,CAAS;CACpD;AACF;AAEA,MAAa,OAAO;AAEpB,SAAgB,MAAM,KAAc,SAA2C,CAAC,GAAS;CAEvF,IAAS,0BAA0B,KAAK,MAAM;AAChD"}

package/dist/host.mjs

@@ -1,5 +1,5 @@
 
-import { t as applyPiPackage } from "./runtime-oLd2EInK.mjs";
+import { t as applyPiPackage } from "./runtime-6DefpI6h.mjs";
 import { t as resolvePiPackage } from "./source-0sA5z08z.mjs";
 import { createRequire } from "node:module";
 import { cp, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
@@ -157,6 +157,8 @@ async function generateHostBundle(options) {
 			marked: "^16.4.1",
 			typebox: "^1.0.4",
 			tinyglobby: "^0.2.15",
+			"cross-spawn": "^7.0.6",
+			diff: "^9.0.0",
 			"@deepseek-ai/dsh-skill-filesystem": "^0.1.0-rc.6"
 		},
 		peerDependencies: {

package/dist/host.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"host.mjs","names":[],"sources":["../src/host.ts"],"sourcesContent":["// PiHostOnDSH: one DSH plugin that hosts unmodified Pi packages.\n//\n// Instead of converting each package into a vendored bundle, the host bundle\n// declares Pi packages as ordinary npm dependencies; DSH's plugin manager\n// (pnpm) installs them, and at load time this module resolves each installed\n// package, discovers its Pi entry points, and mounts it through the same\n// package-agnostic runtime as converted bundles. One host, any package —\n// there is deliberately no per-package branching here.\n\nimport { readdir, readFile, stat, writeFile, mkdir, cp } from 'node:fs/promises'\nimport { createRequire } from 'node:module'\nimport { basename, dirname, join, relative } from 'node:path'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { applyPiPackage } from './runtime.js'\nimport { resolvePiPackage } from './source.js'\nimport type { GeneratedRuntimeManifest, ResolvedPiPackage } from './types.js'\n\ntype UnknownRecord = Record<string, unknown>\n\nexport interface PiHostPackageSpec {\n  /** npm package name as installed in the host bundle's node_modules. */\n  name: string\n  /** Optional per-package config forwarded to the runtime. */\n  config?: UnknownRecord\n}\n\nexport interface PiHostConfig {\n  packages: Array<string | PiHostPackageSpec>\n}\n\nfunction parseFrontmatter(text: string): { attributes: Record<string, string>; body: string } {\n  const normalized = text.replace(/\\r\\n?/gu, '\\n')\n  if (!normalized.startsWith('---')) return { attributes: {}, body: normalized }\n  const endIndex = normalized.indexOf('\\n---', 3)\n  if (endIndex === -1) return { attributes: {}, body: normalized }\n  const attributes: Record<string, string> = {}\n  for (const line of normalized.slice(4, endIndex).split('\\n')) {\n    const separator = line.indexOf(':')\n    if (separator === -1) continue\n    const key = line.slice(0, separator).trim()\n    let value = line.slice(separator + 1).trim()\n    if ((value.startsWith('\"') && value.endsWith('\"')) || (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1)\n    }\n    if (key.length > 0) attributes[key] = value\n  }\n  return { attributes, body: normalized.slice(endIndex + 4).trim() }\n}\n\n/** Build a runtime manifest in place over an installed Pi package directory. */\nexport async function manifestForInstalled(pkg: ResolvedPiPackage): Promise<GeneratedRuntimeManifest> {\n  const relativeTo = (file: string): string => relative(pkg.rootDir, file).replaceAll('\\\\', '/')\n\n  const skillDirs = new Set<string>()\n  for (const file of pkg.resources.skills) {\n    // <dir>/<name>/SKILL.md contributes <dir>; a flat <dir>/<name>.md contributes <dir>.\n    skillDirs.add(relativeTo(basename(file) === 'SKILL.md' ? dirname(dirname(file)) : dirname(file)))\n  }\n\n  const prompts: GeneratedRuntimeManifest['prompts'] = []\n  const promptNames = new Set<string>()\n  for (const source of pkg.resources.prompts) {\n    const name = basename(source, '.md').toLowerCase().replace(/[^a-z0-9_-]+/gu, '-')\n    if (promptNames.has(name)) throw new Error(`prompt command name collision in ${pkg.identity.name}: ${name}`)\n    promptNames.add(name)\n    const { attributes, body } = parseFrontmatter(await readFile(source, 'utf8'))\n    const firstLine = body.split(/\\r?\\n/u).map(line => line.trim()).find(Boolean)\n    prompts.push({\n      name,\n      description: attributes.description ?? firstLine ?? `Run migrated Pi prompt ${name}`,\n      ...(attributes['argument-hint'] !== undefined ? { argumentHint: attributes['argument-hint'] } : {}),\n      path: relativeTo(source),\n    })\n  }\n\n  return {\n    schemaVersion: 1,\n    package: pkg.identity,\n    extensions: pkg.resources.extensions.map(relativeTo),\n    skillDirs: [...skillDirs].sort(),\n    prompts,\n  }\n}\n\nfunction normalizeSpecs(config: PiHostConfig): PiHostPackageSpec[] {\n  const packages = Array.isArray(config?.packages) ? config.packages : []\n  return packages.map(spec => (typeof spec === 'string' ? { name: spec } : spec))\n    .filter(spec => typeof spec?.name === 'string' && spec.name.length > 0)\n}\n\nfunction resolveInstalledDir(anchor: string, packageName: string): string {\n  const require = createRequire(anchor)\n  return dirname(require.resolve(`${packageName}/package.json`))\n}\n\n/**\n * Mount every configured Pi package from the host bundle's own node_modules.\n * Packages that fail to mount report their error and do not take down the\n * host or their siblings — matching Pi's own per-extension error isolation.\n */\nexport async function applyPiHost(ctx: Context, config: PiHostConfig, anchor?: string): Promise<void> {\n  const anchorPath = anchor ?? fileURLToPath(import.meta.url)\n  const errors: Array<{ name: string; error: string }> = []\n  for (const spec of normalizeSpecs(config)) {\n    try {\n      const dir = resolveInstalledDir(anchorPath, spec.name)\n      const pkg = await resolvePiPackage(dir)\n      try {\n        const manifest = await manifestForInstalled(pkg)\n        await applyPiPackage(ctx, {\n          rootUrl: pathToFileURL(`${pkg.rootDir}/`),\n          manifest,\n          ...(spec.config === undefined ? {} : { config: spec.config }),\n        })\n      } finally {\n        await pkg.dispose()\n      }\n    } catch (error) {\n      errors.push({ name: spec.name, error: error instanceof Error ? error.message : String(error) })\n    }\n  }\n  for (const failure of errors) {\n    const log = (ctx as unknown as { logger?: { warn?(message: string): void } }).logger\n    const warn = log?.warn?.bind(log) ?? console.warn\n    warn(`[pi2dsh host] failed to mount ${failure.name}: ${failure.error}`)\n  }\n  if (errors.length > 0 && errors.length === normalizeSpecs(config).length) {\n    throw new Error(`pi2dsh host mounted no packages; first failure: ${errors[0]!.name}: ${errors[0]!.error}`)\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Host bundle generation\n// ---------------------------------------------------------------------------\n\nexport interface HostBundleOptions {\n  outDir: string\n  /** npm specs, e.g. \"@narumitw/pi-lsp@0.49.4\" or \"pi-ask-user\". */\n  packages: string[]\n  bundleName?: string\n}\n\nfunction splitSpec(spec: string): { name: string; range: string } {\n  const at = spec.lastIndexOf('@')\n  if (at > 0) return { name: spec.slice(0, at), range: spec.slice(at + 1) }\n  return { name: spec, range: '*' }\n}\n\nasync function firstExisting(paths: string[]): Promise<string> {\n  for (const path of paths) {\n    try {\n      await stat(path)\n      return path\n    } catch {\n      // Try the next layout.\n    }\n  }\n  throw new Error(`cannot locate pi2dsh runtime artifact; tried: ${paths.join(', ')}`)\n}\n\nasync function copyEmbeddedHostRuntime(outDir: string): Promise<void> {\n  const moduleDir = dirname(fileURLToPath(import.meta.url))\n  const hostSource = await firstExisting([\n    join(moduleDir, 'host.mjs'),\n    join(moduleDir, '../dist/host.mjs'),\n  ])\n  const distRoot = dirname(hostSource)\n  const targetRoot = join(outDir, 'runtime')\n  await mkdir(join(targetRoot, 'compat', 'vendor'), { recursive: true })\n  for (const entry of await readdir(distRoot)) {\n    if (entry.endsWith('.mjs') || entry.endsWith('.d.mts')) {\n      await cp(join(distRoot, entry), join(targetRoot, entry))\n    }\n  }\n  for (const sub of ['compat', join('compat', 'vendor')]) {\n    const dir = join(distRoot, sub)\n    try {\n      for (const entry of await readdir(dir)) {\n        if (entry.endsWith('.mjs')) await cp(join(dir, entry), join(targetRoot, sub, entry))\n      }\n    } catch {\n      // dist layout without that subdirectory\n    }\n  }\n}\n\nexport async function generateHostBundle(options: HostBundleOptions): Promise<{ outDir: string; packageName: string }> {\n  const specs = options.packages.map(splitSpec)\n  if (specs.length === 0) throw new Error('host bundle requires at least one Pi package spec')\n  const packageName = options.bundleName ?? 'dsh-pi-host'\n  await mkdir(options.outDir, { recursive: true })\n  await copyEmbeddedHostRuntime(options.outDir)\n\n  const packageJson = {\n    name: packageName,\n    version: '0.1.0',\n    description: `pi2dsh host bundle mounting ${specs.map(spec => spec.name).join(', ')} as native DSH plugins`,\n    type: 'module',\n    main: './index.js',\n    files: ['index.js', 'cordis.patch.yml', 'runtime', 'PI2DSH-LICENSE', 'README.md'],\n    dependencies: {\n      ...Object.fromEntries(specs.map(spec => [spec.name, spec.range])),\n      jiti: '^2.7.0',\n      'get-east-asian-width': '^1.6.0',\n      marked: '^16.4.1',\n      typebox: '^1.0.4',\n      tinyglobby: '^0.2.15',\n      '@deepseek-ai/dsh-skill-filesystem': '^0.1.0-rc.6',\n    },\n    peerDependencies: {\n      '@deepseek-ai/dsh-llm': '^0.1.0-rc.6',\n      '@deepseek-ai/dsh-system-prompt': '^0.1.0-rc.6',\n    },\n    keywords: ['dsh-plugin', 'deepseek-harness', 'pi-package', 'pi2dsh', 'pi-host'],\n    license: 'MIT',\n    dsh: { bundle: { patch: './cordis.patch.yml' } },\n  }\n  await writeFile(join(options.outDir, 'package.json'), `${JSON.stringify(packageJson, null, 2)}\\n`)\n\n  const hostConfig: PiHostConfig = { packages: specs.map(spec => spec.name) }\n  const indexSource = `import { applyPiHost } from './runtime/host.mjs'\\n\\n`\n    + `export const name = ${JSON.stringify(packageName)}\\n`\n    + `export const inject = ${JSON.stringify(['tools', 'systemPrompt', 'commands', 'skills'])}\\n\\n`\n    + `const hostConfig = ${JSON.stringify(hostConfig, null, 2)}\\n\\n`\n    + `export async function apply(ctx, config = {}) {\\n`\n    + `  await applyPiHost(ctx, { ...hostConfig, ...config }, new URL(import.meta.url).pathname)\\n`\n    + `}\\n`\n  await writeFile(join(options.outDir, 'index.js'), indexSource)\n\n  await writeFile(join(options.outDir, 'cordis.patch.yml'),\n    `- insert:\\n    - id: ${packageName}\\n      name: ${JSON.stringify(packageName)}\\n`)\n\n  const licenseSource = await firstExisting([\n    join(dirname(fileURLToPath(import.meta.url)), 'compat/vendor/PI-LICENSE'),\n    join(dirname(fileURLToPath(import.meta.url)), '../src/compat/vendor/PI-LICENSE'),\n  ])\n  await cp(licenseSource, join(options.outDir, 'PI2DSH-LICENSE'))\n\n  await writeFile(join(options.outDir, 'README.md'),\n    `# ${packageName}\\n\\n`\n    + `A [pi2dsh](https://github.com/weijiafu14/pi2dsh) host bundle. The Pi packages below are installed as ordinary npm dependencies and mounted at load time — no per-package conversion, no vendored source snapshots.\\n\\n`\n    + specs.map(spec => `- \\`${spec.name}@${spec.range}\\`\\n`).join('')\n    + `\\nInstall:\\n\\n\\`\\`\\`sh\\ndsh plugin --profile headless add file:$PWD\\ndsh --profile headless --dump-config\\n\\`\\`\\`\\n`\n    + `\\nThe packages execute their original Pi extension source inside the pi2dsh Host ABI; install only sources you trust. Run \\`pi2dsh inspect <package>\\` for each package's compatibility report.\\n`)\n\n  return { outDir: options.outDir, packageName }\n}\n"],"mappings":";;;;;;;;AA+BA,SAAS,iBAAiB,MAAoE;CAC5F,MAAM,aAAa,KAAK,QAAQ,WAAW,IAAI;CAC/C,IAAI,CAAC,WAAW,WAAW,KAAK,GAAG,OAAO;EAAE,YAAY,CAAC;EAAG,MAAM;CAAW;CAC7E,MAAM,WAAW,WAAW,QAAQ,SAAS,CAAC;CAC9C,IAAI,aAAa,IAAI,OAAO;EAAE,YAAY,CAAC;EAAG,MAAM;CAAW;CAC/D,MAAM,aAAqC,CAAC;CAC5C,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG,QAAQ,CAAC,CAAC,MAAM,IAAI,GAAG;EAC5D,MAAM,YAAY,KAAK,QAAQ,GAAG;EAClC,IAAI,cAAc,IAAI;EACtB,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC,KAAK;EAC1C,IAAI,QAAQ,KAAK,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;EAC3C,IAAK,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,KAAO,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAChG,QAAQ,MAAM,MAAM,GAAG,EAAE;EAE3B,IAAI,IAAI,SAAS,GAAG,WAAW,OAAO;CACxC;CACA,OAAO;EAAE;EAAY,MAAM,WAAW,MAAM,WAAW,CAAC,CAAC,CAAC,KAAK;CAAE;AACnE;;AAGA,eAAsB,qBAAqB,KAA2D;CACpG,MAAM,cAAc,SAAyB,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG;CAE7F,MAAM,4BAAY,IAAI,IAAY;CAClC,KAAK,MAAM,QAAQ,IAAI,UAAU,QAE/B,UAAU,IAAI,WAAW,SAAS,IAAI,MAAM,aAAa,QAAQ,QAAQ,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;CAGlG,MAAM,UAA+C,CAAC;CACtD,MAAM,8BAAc,IAAI,IAAY;CACpC,KAAK,MAAM,UAAU,IAAI,UAAU,SAAS;EAC1C,MAAM,OAAO,SAAS,QAAQ,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,kBAAkB,GAAG;EAChF,IAAI,YAAY,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,oCAAoC,IAAI,SAAS,KAAK,IAAI,MAAM;EAC3G,YAAY,IAAI,IAAI;EACpB,MAAM,EAAE,YAAY,SAAS,iBAAiB,MAAM,SAAS,QAAQ,MAAM,CAAC;EAC5E,MAAM,YAAY,KAAK,MAAM,QAAQ,CAAC,CAAC,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;EAC5E,QAAQ,KAAK;GACX;GACA,aAAa,WAAW,eAAe,aAAa,0BAA0B;GAC9E,GAAI,WAAW,qBAAqB,KAAA,IAAY,EAAE,cAAc,WAAW,iBAAiB,IAAI,CAAC;GACjG,MAAM,WAAW,MAAM;EACzB,CAAC;CACH;CAEA,OAAO;EACL,eAAe;EACf,SAAS,IAAI;EACb,YAAY,IAAI,UAAU,WAAW,IAAI,UAAU;EACnD,WAAW,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK;EAC/B;CACF;AACF;AAEA,SAAS,eAAe,QAA2C;CAEjE,QADiB,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW,CAAC,EAAA,CACtD,KAAI,SAAS,OAAO,SAAS,WAAW,EAAE,MAAM,KAAK,IAAI,IAAK,CAAC,CAC5E,QAAO,SAAQ,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,SAAS,CAAC;AAC1E;AAEA,SAAS,oBAAoB,QAAgB,aAA6B;CACxE,MAAM,UAAU,cAAc,MAAM;CACpC,OAAO,QAAQ,QAAQ,QAAQ,GAAG,YAAY,cAAc,CAAC;AAC/D;;;;;;AAOA,eAAsB,YAAY,KAAc,QAAsB,QAAgC;CACpG,MAAM,aAAa,UAAU,cAAc,YAAY,GAAG;CAC1D,MAAM,SAAiD,CAAC;CACxD,KAAK,MAAM,QAAQ,eAAe,MAAM,GACtC,IAAI;EACF,MAAM,MAAM,oBAAoB,YAAY,KAAK,IAAI;EACrD,MAAM,MAAM,MAAM,iBAAiB,GAAG;EACtC,IAAI;GACF,MAAM,WAAW,MAAM,qBAAqB,GAAG;GAC/C,MAAM,eAAe,KAAK;IACxB,SAAS,cAAc,GAAG,IAAI,QAAQ,EAAE;IACxC;IACA,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;GAC7D,CAAC;EACH,UAAU;GACR,MAAM,IAAI,QAAQ;EACpB;CACF,SAAS,OAAO;EACd,OAAO,KAAK;GAAE,MAAM,KAAK;GAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAAE,CAAC;CAChG;CAEF,KAAK,MAAM,WAAW,QAAQ;EAC5B,MAAM,MAAO,IAAiE;EAE9E,CADa,KAAK,MAAM,KAAK,GAAG,KAAK,QAAQ,KAAA,CACxC,iCAAiC,QAAQ,KAAK,IAAI,QAAQ,OAAO;CACxE;CACA,IAAI,OAAO,SAAS,KAAK,OAAO,WAAW,eAAe,MAAM,CAAC,CAAC,QAChE,MAAM,IAAI,MAAM,mDAAmD,OAAO,EAAE,CAAE,KAAK,IAAI,OAAO,EAAE,CAAE,OAAO;AAE7G;AAaA,SAAS,UAAU,MAA+C;CAChE,MAAM,KAAK,KAAK,YAAY,GAAG;CAC/B,IAAI,KAAK,GAAG,OAAO;EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;EAAG,OAAO,KAAK,MAAM,KAAK,CAAC;CAAE;CACxE,OAAO;EAAE,MAAM;EAAM,OAAO;CAAI;AAClC;AAEA,eAAe,cAAc,OAAkC;CAC7D,KAAK,MAAM,QAAQ,OACjB,IAAI;EACF,MAAM,KAAK,IAAI;EACf,OAAO;CACT,QAAQ,CAER;CAEF,MAAM,IAAI,MAAM,iDAAiD,MAAM,KAAK,IAAI,GAAG;AACrF;AAEA,eAAe,wBAAwB,QAA+B;CACpE,MAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;CACxD,MAAM,aAAa,MAAM,cAAc,CACrC,KAAK,WAAW,UAAU,GAC1B,KAAK,WAAW,kBAAkB,CACpC,CAAC;CACD,MAAM,WAAW,QAAQ,UAAU;CACnC,MAAM,aAAa,KAAK,QAAQ,SAAS;CACzC,MAAM,MAAM,KAAK,YAAY,UAAU,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;CACrE,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,GACxC,IAAI,MAAM,SAAS,MAAM,KAAK,MAAM,SAAS,QAAQ,GACnD,MAAM,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC;CAG3D,KAAK,MAAM,OAAO,CAAC,UAAU,KAAK,UAAU,QAAQ,CAAC,GAAG;EACtD,MAAM,MAAM,KAAK,UAAU,GAAG;EAC9B,IAAI;GACF,KAAK,MAAM,SAAS,MAAM,QAAQ,GAAG,GACnC,IAAI,MAAM,SAAS,MAAM,GAAG,MAAM,GAAG,KAAK,KAAK,KAAK,GAAG,KAAK,YAAY,KAAK,KAAK,CAAC;EAEvF,QAAQ,CAER;CACF;AACF;AAEA,eAAsB,mBAAmB,SAA8E;CACrH,MAAM,QAAQ,QAAQ,SAAS,IAAI,SAAS;CAC5C,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,mDAAmD;CAC3F,MAAM,cAAc,QAAQ,cAAc;CAC1C,MAAM,MAAM,QAAQ,QAAQ,EAAE,WAAW,KAAK,CAAC;CAC/C,MAAM,wBAAwB,QAAQ,MAAM;CAE5C,MAAM,cAAc;EAClB,MAAM;EACN,SAAS;EACT,aAAa,+BAA+B,MAAM,KAAI,SAAQ,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;EACpF,MAAM;EACN,MAAM;EACN,OAAO;GAAC;GAAY;GAAoB;GAAW;GAAkB;EAAW;EAChF,cAAc;GACZ,GAAG,OAAO,YAAY,MAAM,KAAI,SAAQ,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,CAAC;GAChE,MAAM;GACN,wBAAwB;GACxB,QAAQ;GACR,SAAS;GACT,YAAY;GACZ,qCAAqC;EACvC;EACA,kBAAkB;GAChB,wBAAwB;GACxB,kCAAkC;EACpC;EACA,UAAU;GAAC;GAAc;GAAoB;GAAc;GAAU;EAAS;EAC9E,SAAS;EACT,KAAK,EAAE,QAAQ,EAAE,OAAO,qBAAqB,EAAE;CACjD;CACA,MAAM,UAAU,KAAK,QAAQ,QAAQ,cAAc,GAAG,GAAG,KAAK,UAAU,aAAa,MAAM,CAAC,EAAE,GAAG;CAEjG,MAAM,aAA2B,EAAE,UAAU,MAAM,KAAI,SAAQ,KAAK,IAAI,EAAE;CAC1E,MAAM,cAAc,2EACO,KAAK,UAAU,WAAW,EAAE,0BAC1B,KAAK,UAAU;EAAC;EAAS;EAAgB;EAAY;CAAQ,CAAC,EAAE,yBACnE,KAAK,UAAU,YAAY,MAAM,CAAC,EAAE;CAI9D,MAAM,UAAU,KAAK,QAAQ,QAAQ,UAAU,GAAG,WAAW;CAE7D,MAAM,UAAU,KAAK,QAAQ,QAAQ,kBAAkB,GACrD,wBAAwB,YAAY,gBAAgB,KAAK,UAAU,WAAW,EAAE,GAAG;CAErF,MAAM,gBAAgB,MAAM,cAAc,CACxC,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,0BAA0B,GACxE,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,iCAAiC,CACjF,CAAC;CACD,MAAM,GAAG,eAAe,KAAK,QAAQ,QAAQ,gBAAgB,CAAC;CAE9D,MAAM,UAAU,KAAK,QAAQ,QAAQ,WAAW,GAC9C,KAAK,YAAY,8NAEf,MAAM,KAAI,SAAQ,OAAO,KAAK,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,IAC/D,8SACmM;CAEvM,OAAO;EAAE,QAAQ,QAAQ;EAAQ;CAAY;AAC/C"}
+{"version":3,"file":"host.mjs","names":[],"sources":["../src/host.ts"],"sourcesContent":["// PiHostOnDSH: one DSH plugin that hosts unmodified Pi packages.\n//\n// Instead of converting each package into a vendored bundle, the host bundle\n// declares Pi packages as ordinary npm dependencies; DSH's plugin manager\n// (pnpm) installs them, and at load time this module resolves each installed\n// package, discovers its Pi entry points, and mounts it through the same\n// package-agnostic runtime as converted bundles. One host, any package —\n// there is deliberately no per-package branching here.\n\nimport { readdir, readFile, stat, writeFile, mkdir, cp } from 'node:fs/promises'\nimport { createRequire } from 'node:module'\nimport { basename, dirname, join, relative } from 'node:path'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { applyPiPackage } from './runtime.js'\nimport { resolvePiPackage } from './source.js'\nimport type { GeneratedRuntimeManifest, ResolvedPiPackage } from './types.js'\n\ntype UnknownRecord = Record<string, unknown>\n\nexport interface PiHostPackageSpec {\n  /** npm package name as installed in the host bundle's node_modules. */\n  name: string\n  /** Optional per-package config forwarded to the runtime. */\n  config?: UnknownRecord\n}\n\nexport interface PiHostConfig {\n  packages: Array<string | PiHostPackageSpec>\n}\n\nfunction parseFrontmatter(text: string): { attributes: Record<string, string>; body: string } {\n  const normalized = text.replace(/\\r\\n?/gu, '\\n')\n  if (!normalized.startsWith('---')) return { attributes: {}, body: normalized }\n  const endIndex = normalized.indexOf('\\n---', 3)\n  if (endIndex === -1) return { attributes: {}, body: normalized }\n  const attributes: Record<string, string> = {}\n  for (const line of normalized.slice(4, endIndex).split('\\n')) {\n    const separator = line.indexOf(':')\n    if (separator === -1) continue\n    const key = line.slice(0, separator).trim()\n    let value = line.slice(separator + 1).trim()\n    if ((value.startsWith('\"') && value.endsWith('\"')) || (value.startsWith(\"'\") && value.endsWith(\"'\"))) {\n      value = value.slice(1, -1)\n    }\n    if (key.length > 0) attributes[key] = value\n  }\n  return { attributes, body: normalized.slice(endIndex + 4).trim() }\n}\n\n/** Build a runtime manifest in place over an installed Pi package directory. */\nexport async function manifestForInstalled(pkg: ResolvedPiPackage): Promise<GeneratedRuntimeManifest> {\n  const relativeTo = (file: string): string => relative(pkg.rootDir, file).replaceAll('\\\\', '/')\n\n  const skillDirs = new Set<string>()\n  for (const file of pkg.resources.skills) {\n    // <dir>/<name>/SKILL.md contributes <dir>; a flat <dir>/<name>.md contributes <dir>.\n    skillDirs.add(relativeTo(basename(file) === 'SKILL.md' ? dirname(dirname(file)) : dirname(file)))\n  }\n\n  const prompts: GeneratedRuntimeManifest['prompts'] = []\n  const promptNames = new Set<string>()\n  for (const source of pkg.resources.prompts) {\n    const name = basename(source, '.md').toLowerCase().replace(/[^a-z0-9_-]+/gu, '-')\n    if (promptNames.has(name)) throw new Error(`prompt command name collision in ${pkg.identity.name}: ${name}`)\n    promptNames.add(name)\n    const { attributes, body } = parseFrontmatter(await readFile(source, 'utf8'))\n    const firstLine = body.split(/\\r?\\n/u).map(line => line.trim()).find(Boolean)\n    prompts.push({\n      name,\n      description: attributes.description ?? firstLine ?? `Run migrated Pi prompt ${name}`,\n      ...(attributes['argument-hint'] !== undefined ? { argumentHint: attributes['argument-hint'] } : {}),\n      path: relativeTo(source),\n    })\n  }\n\n  return {\n    schemaVersion: 1,\n    package: pkg.identity,\n    extensions: pkg.resources.extensions.map(relativeTo),\n    skillDirs: [...skillDirs].sort(),\n    prompts,\n  }\n}\n\nfunction normalizeSpecs(config: PiHostConfig): PiHostPackageSpec[] {\n  const packages = Array.isArray(config?.packages) ? config.packages : []\n  return packages.map(spec => (typeof spec === 'string' ? { name: spec } : spec))\n    .filter(spec => typeof spec?.name === 'string' && spec.name.length > 0)\n}\n\nfunction resolveInstalledDir(anchor: string, packageName: string): string {\n  const require = createRequire(anchor)\n  return dirname(require.resolve(`${packageName}/package.json`))\n}\n\n/**\n * Mount every configured Pi package from the host bundle's own node_modules.\n * Packages that fail to mount report their error and do not take down the\n * host or their siblings — matching Pi's own per-extension error isolation.\n */\nexport async function applyPiHost(ctx: Context, config: PiHostConfig, anchor?: string): Promise<void> {\n  const anchorPath = anchor ?? fileURLToPath(import.meta.url)\n  const errors: Array<{ name: string; error: string }> = []\n  for (const spec of normalizeSpecs(config)) {\n    try {\n      const dir = resolveInstalledDir(anchorPath, spec.name)\n      const pkg = await resolvePiPackage(dir)\n      try {\n        const manifest = await manifestForInstalled(pkg)\n        await applyPiPackage(ctx, {\n          rootUrl: pathToFileURL(`${pkg.rootDir}/`),\n          manifest,\n          ...(spec.config === undefined ? {} : { config: spec.config }),\n        })\n      } finally {\n        await pkg.dispose()\n      }\n    } catch (error) {\n      errors.push({ name: spec.name, error: error instanceof Error ? error.message : String(error) })\n    }\n  }\n  for (const failure of errors) {\n    const log = (ctx as unknown as { logger?: { warn?(message: string): void } }).logger\n    const warn = log?.warn?.bind(log) ?? console.warn\n    warn(`[pi2dsh host] failed to mount ${failure.name}: ${failure.error}`)\n  }\n  if (errors.length > 0 && errors.length === normalizeSpecs(config).length) {\n    throw new Error(`pi2dsh host mounted no packages; first failure: ${errors[0]!.name}: ${errors[0]!.error}`)\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Host bundle generation\n// ---------------------------------------------------------------------------\n\nexport interface HostBundleOptions {\n  outDir: string\n  /** npm specs, e.g. \"@narumitw/pi-lsp@0.49.4\" or \"pi-ask-user\". */\n  packages: string[]\n  bundleName?: string\n}\n\nfunction splitSpec(spec: string): { name: string; range: string } {\n  const at = spec.lastIndexOf('@')\n  if (at > 0) return { name: spec.slice(0, at), range: spec.slice(at + 1) }\n  return { name: spec, range: '*' }\n}\n\nasync function firstExisting(paths: string[]): Promise<string> {\n  for (const path of paths) {\n    try {\n      await stat(path)\n      return path\n    } catch {\n      // Try the next layout.\n    }\n  }\n  throw new Error(`cannot locate pi2dsh runtime artifact; tried: ${paths.join(', ')}`)\n}\n\nasync function copyEmbeddedHostRuntime(outDir: string): Promise<void> {\n  const moduleDir = dirname(fileURLToPath(import.meta.url))\n  const hostSource = await firstExisting([\n    join(moduleDir, 'host.mjs'),\n    join(moduleDir, '../dist/host.mjs'),\n  ])\n  const distRoot = dirname(hostSource)\n  const targetRoot = join(outDir, 'runtime')\n  await mkdir(join(targetRoot, 'compat', 'vendor'), { recursive: true })\n  for (const entry of await readdir(distRoot)) {\n    if (entry.endsWith('.mjs') || entry.endsWith('.d.mts')) {\n      await cp(join(distRoot, entry), join(targetRoot, entry))\n    }\n  }\n  for (const sub of ['compat', join('compat', 'vendor')]) {\n    const dir = join(distRoot, sub)\n    try {\n      for (const entry of await readdir(dir)) {\n        if (entry.endsWith('.mjs')) await cp(join(dir, entry), join(targetRoot, sub, entry))\n      }\n    } catch {\n      // dist layout without that subdirectory\n    }\n  }\n}\n\nexport async function generateHostBundle(options: HostBundleOptions): Promise<{ outDir: string; packageName: string }> {\n  const specs = options.packages.map(splitSpec)\n  if (specs.length === 0) throw new Error('host bundle requires at least one Pi package spec')\n  const packageName = options.bundleName ?? 'dsh-pi-host'\n  await mkdir(options.outDir, { recursive: true })\n  await copyEmbeddedHostRuntime(options.outDir)\n\n  const packageJson = {\n    name: packageName,\n    version: '0.1.0',\n    description: `pi2dsh host bundle mounting ${specs.map(spec => spec.name).join(', ')} as native DSH plugins`,\n    type: 'module',\n    main: './index.js',\n    files: ['index.js', 'cordis.patch.yml', 'runtime', 'PI2DSH-LICENSE', 'README.md'],\n    dependencies: {\n      ...Object.fromEntries(specs.map(spec => [spec.name, spec.range])),\n      jiti: '^2.7.0',\n      'get-east-asian-width': '^1.6.0',\n      marked: '^16.4.1',\n      typebox: '^1.0.4',\n      tinyglobby: '^0.2.15',\n      // The vendored Pi built-in tool constructors spawn through cross-spawn\n      // and diff exactly as Pi does — same runtime set the convert bundle\n      // carries (generator.ts keeps the sibling list).\n      'cross-spawn': '^7.0.6',\n      diff: '^9.0.0',\n      '@deepseek-ai/dsh-skill-filesystem': '^0.1.0-rc.6',\n    },\n    peerDependencies: {\n      '@deepseek-ai/dsh-llm': '^0.1.0-rc.6',\n      '@deepseek-ai/dsh-system-prompt': '^0.1.0-rc.6',\n    },\n    keywords: ['dsh-plugin', 'deepseek-harness', 'pi-package', 'pi2dsh', 'pi-host'],\n    license: 'MIT',\n    dsh: { bundle: { patch: './cordis.patch.yml' } },\n  }\n  await writeFile(join(options.outDir, 'package.json'), `${JSON.stringify(packageJson, null, 2)}\\n`)\n\n  const hostConfig: PiHostConfig = { packages: specs.map(spec => spec.name) }\n  const indexSource = `import { applyPiHost } from './runtime/host.mjs'\\n\\n`\n    + `export const name = ${JSON.stringify(packageName)}\\n`\n    + `export const inject = ${JSON.stringify(['tools', 'systemPrompt', 'commands', 'skills'])}\\n\\n`\n    + `const hostConfig = ${JSON.stringify(hostConfig, null, 2)}\\n\\n`\n    + `export async function apply(ctx, config = {}) {\\n`\n    + `  await applyPiHost(ctx, { ...hostConfig, ...config }, new URL(import.meta.url).pathname)\\n`\n    + `}\\n`\n  await writeFile(join(options.outDir, 'index.js'), indexSource)\n\n  await writeFile(join(options.outDir, 'cordis.patch.yml'),\n    `- insert:\\n    - id: ${packageName}\\n      name: ${JSON.stringify(packageName)}\\n`)\n\n  const licenseSource = await firstExisting([\n    join(dirname(fileURLToPath(import.meta.url)), 'compat/vendor/PI-LICENSE'),\n    join(dirname(fileURLToPath(import.meta.url)), '../src/compat/vendor/PI-LICENSE'),\n  ])\n  await cp(licenseSource, join(options.outDir, 'PI2DSH-LICENSE'))\n\n  await writeFile(join(options.outDir, 'README.md'),\n    `# ${packageName}\\n\\n`\n    + `A [pi2dsh](https://github.com/weijiafu14/pi2dsh) host bundle. The Pi packages below are installed as ordinary npm dependencies and mounted at load time — no per-package conversion, no vendored source snapshots.\\n\\n`\n    + specs.map(spec => `- \\`${spec.name}@${spec.range}\\`\\n`).join('')\n    + `\\nInstall:\\n\\n\\`\\`\\`sh\\ndsh plugin --profile headless add file:$PWD\\ndsh --profile headless --dump-config\\n\\`\\`\\`\\n`\n    + `\\nThe packages execute their original Pi extension source inside the pi2dsh Host ABI; install only sources you trust. Run \\`pi2dsh inspect <package>\\` for each package's compatibility report.\\n`)\n\n  return { outDir: options.outDir, packageName }\n}\n"],"mappings":";;;;;;;;AA+BA,SAAS,iBAAiB,MAAoE;CAC5F,MAAM,aAAa,KAAK,QAAQ,WAAW,IAAI;CAC/C,IAAI,CAAC,WAAW,WAAW,KAAK,GAAG,OAAO;EAAE,YAAY,CAAC;EAAG,MAAM;CAAW;CAC7E,MAAM,WAAW,WAAW,QAAQ,SAAS,CAAC;CAC9C,IAAI,aAAa,IAAI,OAAO;EAAE,YAAY,CAAC;EAAG,MAAM;CAAW;CAC/D,MAAM,aAAqC,CAAC;CAC5C,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG,QAAQ,CAAC,CAAC,MAAM,IAAI,GAAG;EAC5D,MAAM,YAAY,KAAK,QAAQ,GAAG;EAClC,IAAI,cAAc,IAAI;EACtB,MAAM,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC,KAAK;EAC1C,IAAI,QAAQ,KAAK,MAAM,YAAY,CAAC,CAAC,CAAC,KAAK;EAC3C,IAAK,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,KAAO,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAChG,QAAQ,MAAM,MAAM,GAAG,EAAE;EAE3B,IAAI,IAAI,SAAS,GAAG,WAAW,OAAO;CACxC;CACA,OAAO;EAAE;EAAY,MAAM,WAAW,MAAM,WAAW,CAAC,CAAC,CAAC,KAAK;CAAE;AACnE;;AAGA,eAAsB,qBAAqB,KAA2D;CACpG,MAAM,cAAc,SAAyB,SAAS,IAAI,SAAS,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG;CAE7F,MAAM,4BAAY,IAAI,IAAY;CAClC,KAAK,MAAM,QAAQ,IAAI,UAAU,QAE/B,UAAU,IAAI,WAAW,SAAS,IAAI,MAAM,aAAa,QAAQ,QAAQ,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;CAGlG,MAAM,UAA+C,CAAC;CACtD,MAAM,8BAAc,IAAI,IAAY;CACpC,KAAK,MAAM,UAAU,IAAI,UAAU,SAAS;EAC1C,MAAM,OAAO,SAAS,QAAQ,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,kBAAkB,GAAG;EAChF,IAAI,YAAY,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,oCAAoC,IAAI,SAAS,KAAK,IAAI,MAAM;EAC3G,YAAY,IAAI,IAAI;EACpB,MAAM,EAAE,YAAY,SAAS,iBAAiB,MAAM,SAAS,QAAQ,MAAM,CAAC;EAC5E,MAAM,YAAY,KAAK,MAAM,QAAQ,CAAC,CAAC,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;EAC5E,QAAQ,KAAK;GACX;GACA,aAAa,WAAW,eAAe,aAAa,0BAA0B;GAC9E,GAAI,WAAW,qBAAqB,KAAA,IAAY,EAAE,cAAc,WAAW,iBAAiB,IAAI,CAAC;GACjG,MAAM,WAAW,MAAM;EACzB,CAAC;CACH;CAEA,OAAO;EACL,eAAe;EACf,SAAS,IAAI;EACb,YAAY,IAAI,UAAU,WAAW,IAAI,UAAU;EACnD,WAAW,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK;EAC/B;CACF;AACF;AAEA,SAAS,eAAe,QAA2C;CAEjE,QADiB,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW,CAAC,EAAA,CACtD,KAAI,SAAS,OAAO,SAAS,WAAW,EAAE,MAAM,KAAK,IAAI,IAAK,CAAC,CAC5E,QAAO,SAAQ,OAAO,MAAM,SAAS,YAAY,KAAK,KAAK,SAAS,CAAC;AAC1E;AAEA,SAAS,oBAAoB,QAAgB,aAA6B;CACxE,MAAM,UAAU,cAAc,MAAM;CACpC,OAAO,QAAQ,QAAQ,QAAQ,GAAG,YAAY,cAAc,CAAC;AAC/D;;;;;;AAOA,eAAsB,YAAY,KAAc,QAAsB,QAAgC;CACpG,MAAM,aAAa,UAAU,cAAc,YAAY,GAAG;CAC1D,MAAM,SAAiD,CAAC;CACxD,KAAK,MAAM,QAAQ,eAAe,MAAM,GACtC,IAAI;EACF,MAAM,MAAM,oBAAoB,YAAY,KAAK,IAAI;EACrD,MAAM,MAAM,MAAM,iBAAiB,GAAG;EACtC,IAAI;GACF,MAAM,WAAW,MAAM,qBAAqB,GAAG;GAC/C,MAAM,eAAe,KAAK;IACxB,SAAS,cAAc,GAAG,IAAI,QAAQ,EAAE;IACxC;IACA,GAAI,KAAK,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO;GAC7D,CAAC;EACH,UAAU;GACR,MAAM,IAAI,QAAQ;EACpB;CACF,SAAS,OAAO;EACd,OAAO,KAAK;GAAE,MAAM,KAAK;GAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAAE,CAAC;CAChG;CAEF,KAAK,MAAM,WAAW,QAAQ;EAC5B,MAAM,MAAO,IAAiE;EAE9E,CADa,KAAK,MAAM,KAAK,GAAG,KAAK,QAAQ,KAAA,CACxC,iCAAiC,QAAQ,KAAK,IAAI,QAAQ,OAAO;CACxE;CACA,IAAI,OAAO,SAAS,KAAK,OAAO,WAAW,eAAe,MAAM,CAAC,CAAC,QAChE,MAAM,IAAI,MAAM,mDAAmD,OAAO,EAAE,CAAE,KAAK,IAAI,OAAO,EAAE,CAAE,OAAO;AAE7G;AAaA,SAAS,UAAU,MAA+C;CAChE,MAAM,KAAK,KAAK,YAAY,GAAG;CAC/B,IAAI,KAAK,GAAG,OAAO;EAAE,MAAM,KAAK,MAAM,GAAG,EAAE;EAAG,OAAO,KAAK,MAAM,KAAK,CAAC;CAAE;CACxE,OAAO;EAAE,MAAM;EAAM,OAAO;CAAI;AAClC;AAEA,eAAe,cAAc,OAAkC;CAC7D,KAAK,MAAM,QAAQ,OACjB,IAAI;EACF,MAAM,KAAK,IAAI;EACf,OAAO;CACT,QAAQ,CAER;CAEF,MAAM,IAAI,MAAM,iDAAiD,MAAM,KAAK,IAAI,GAAG;AACrF;AAEA,eAAe,wBAAwB,QAA+B;CACpE,MAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;CACxD,MAAM,aAAa,MAAM,cAAc,CACrC,KAAK,WAAW,UAAU,GAC1B,KAAK,WAAW,kBAAkB,CACpC,CAAC;CACD,MAAM,WAAW,QAAQ,UAAU;CACnC,MAAM,aAAa,KAAK,QAAQ,SAAS;CACzC,MAAM,MAAM,KAAK,YAAY,UAAU,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;CACrE,KAAK,MAAM,SAAS,MAAM,QAAQ,QAAQ,GACxC,IAAI,MAAM,SAAS,MAAM,KAAK,MAAM,SAAS,QAAQ,GACnD,MAAM,GAAG,KAAK,UAAU,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC;CAG3D,KAAK,MAAM,OAAO,CAAC,UAAU,KAAK,UAAU,QAAQ,CAAC,GAAG;EACtD,MAAM,MAAM,KAAK,UAAU,GAAG;EAC9B,IAAI;GACF,KAAK,MAAM,SAAS,MAAM,QAAQ,GAAG,GACnC,IAAI,MAAM,SAAS,MAAM,GAAG,MAAM,GAAG,KAAK,KAAK,KAAK,GAAG,KAAK,YAAY,KAAK,KAAK,CAAC;EAEvF,QAAQ,CAER;CACF;AACF;AAEA,eAAsB,mBAAmB,SAA8E;CACrH,MAAM,QAAQ,QAAQ,SAAS,IAAI,SAAS;CAC5C,IAAI,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,mDAAmD;CAC3F,MAAM,cAAc,QAAQ,cAAc;CAC1C,MAAM,MAAM,QAAQ,QAAQ,EAAE,WAAW,KAAK,CAAC;CAC/C,MAAM,wBAAwB,QAAQ,MAAM;CAE5C,MAAM,cAAc;EAClB,MAAM;EACN,SAAS;EACT,aAAa,+BAA+B,MAAM,KAAI,SAAQ,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;EACpF,MAAM;EACN,MAAM;EACN,OAAO;GAAC;GAAY;GAAoB;GAAW;GAAkB;EAAW;EAChF,cAAc;GACZ,GAAG,OAAO,YAAY,MAAM,KAAI,SAAQ,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,CAAC;GAChE,MAAM;GACN,wBAAwB;GACxB,QAAQ;GACR,SAAS;GACT,YAAY;GAIZ,eAAe;GACf,MAAM;GACN,qCAAqC;EACvC;EACA,kBAAkB;GAChB,wBAAwB;GACxB,kCAAkC;EACpC;EACA,UAAU;GAAC;GAAc;GAAoB;GAAc;GAAU;EAAS;EAC9E,SAAS;EACT,KAAK,EAAE,QAAQ,EAAE,OAAO,qBAAqB,EAAE;CACjD;CACA,MAAM,UAAU,KAAK,QAAQ,QAAQ,cAAc,GAAG,GAAG,KAAK,UAAU,aAAa,MAAM,CAAC,EAAE,GAAG;CAEjG,MAAM,aAA2B,EAAE,UAAU,MAAM,KAAI,SAAQ,KAAK,IAAI,EAAE;CAC1E,MAAM,cAAc,2EACO,KAAK,UAAU,WAAW,EAAE,0BAC1B,KAAK,UAAU;EAAC;EAAS;EAAgB;EAAY;CAAQ,CAAC,EAAE,yBACnE,KAAK,UAAU,YAAY,MAAM,CAAC,EAAE;CAI9D,MAAM,UAAU,KAAK,QAAQ,QAAQ,UAAU,GAAG,WAAW;CAE7D,MAAM,UAAU,KAAK,QAAQ,QAAQ,kBAAkB,GACrD,wBAAwB,YAAY,gBAAgB,KAAK,UAAU,WAAW,EAAE,GAAG;CAErF,MAAM,gBAAgB,MAAM,cAAc,CACxC,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,0BAA0B,GACxE,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,iCAAiC,CACjF,CAAC;CACD,MAAM,GAAG,eAAe,KAAK,QAAQ,QAAQ,gBAAgB,CAAC;CAE9D,MAAM,UAAU,KAAK,QAAQ,QAAQ,WAAW,GAC9C,KAAK,YAAY,8NAEf,MAAM,KAAI,SAAQ,OAAO,KAAK,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,IAC/D,8SACmM;CAEvM,OAAO;EAAE,QAAQ,QAAQ;EAAQ;CAAY;AAC/C"}

package/dist/oauth-bridge-BpPrppjR.mjs

@@ -0,0 +1,359 @@
+
+import { mkdir, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { readFileSync } from "node:fs";
+//#region src/compat/vendor/pi-ai-abort.ts
+function abortReason(signal) {
+	if (signal.reason !== void 0) return signal.reason;
+	const error = /* @__PURE__ */ new Error("The operation was aborted");
+	error.name = "AbortError";
+	return error;
+}
+/** Create an operation-local signal for public APIs whose signal is optional. */
+function operationSignal(signal) {
+	return signal ?? new AbortController().signal;
+}
+/**
+* Stop waiting for an operation when its signal aborts while continuing to
+* observe the abandoned promise so a later rejection is always handled.
+*/
+function raceWithAbortSignal(operation, signal) {
+	if (signal.aborted) {
+		operation.catch(() => {});
+		return Promise.reject(abortReason(signal));
+	}
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const cleanup = () => signal.removeEventListener("abort", onAbort);
+		const onAbort = () => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(abortReason(signal));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		operation.then((value) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		}, (error) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(error);
+		});
+		if (signal.aborted) onAbort();
+	});
+}
+//#endregion
+//#region src/compat/vendor/pi-ai-credential-store.ts
+/**
+* Default in-memory credential store. Apps inject persistent stores.
+* Keyed by `Provider.id`, one credential per provider; see `CredentialStore`.
+* Writes are serialized per provider through a promise chain.
+*/
+var InMemoryCredentialStore = class {
+	credentials = /* @__PURE__ */ new Map();
+	chains = /* @__PURE__ */ new Map();
+	/** Serialize tasks per provider id without releasing the chain before active work settles. */
+	enqueue(providerId, task, options) {
+		const signal = operationSignal(options?.signal);
+		const previous = this.chains.get(providerId) ?? Promise.resolve();
+		const queued = (async () => {
+			await previous.catch(() => {});
+			signal.throwIfAborted();
+			return task();
+		})();
+		const tail = queued.catch(() => {});
+		this.chains.set(providerId, tail);
+		tail.then(() => {
+			if (this.chains.get(providerId) === tail) this.chains.delete(providerId);
+		});
+		return raceWithAbortSignal(queued, signal);
+	}
+	async read(providerId, options) {
+		options?.signal?.throwIfAborted();
+		return this.credentials.get(providerId);
+	}
+	async list(options) {
+		options?.signal?.throwIfAborted();
+		return [...this.credentials].map(([providerId, credential]) => ({
+			providerId,
+			type: credential.type
+		}));
+	}
+	modify(providerId, fn, options) {
+		return this.enqueue(providerId, async () => {
+			const current = this.credentials.get(providerId);
+			const next = await fn(current);
+			options?.signal?.throwIfAborted();
+			if (next !== void 0) this.credentials.set(providerId, next);
+			return next ?? current;
+		}, options);
+	}
+	delete(providerId, options) {
+		return this.enqueue(providerId, async () => {
+			this.credentials.delete(providerId);
+		}, options);
+	}
+};
+//#endregion
+//#region src/compat/vendor/pi-ai-diagnostics.ts
+function formatThrownValue(value) {
+	if (value instanceof Error) return value.message || value.name;
+	if (typeof value === "string") return value;
+	return String(value);
+}
+//#endregion
+//#region src/compat/vendor/pi-ai-auth-resolve.ts
+var ModelsError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(withCauseDetail(message, options?.cause), options);
+		this.name = "ModelsError";
+		this.code = code;
+	}
+};
+/** Callers surface `error.message` only, so keep the underlying reason in it. */
+function withCauseDetail(message, cause) {
+	if (cause === void 0 || cause === null) return message;
+	const detail = formatThrownValue(cause).trim();
+	if (!detail || message.includes(detail)) return message;
+	return `${message}: ${detail}`;
+}
+/**
+* Auth resolution shared by the `Models` and `ImagesModels` collections.
+* A stored credential owns the provider: ambient/env is consulted only when
+* nothing is stored. No silent env fallback after a failed refresh or for a
+* credential type without a matching handler.
+*/
+function resolveProviderAuth(provider, credentials, authContext, overrides) {
+	const signal = operationSignal(overrides?.signal);
+	return raceWithAbortSignal(resolveProviderAuthWithSignal(provider, credentials, authContext, overrides, signal), signal);
+}
+async function resolveProviderAuthWithSignal(provider, credentials, authContext, overrides, signal) {
+	signal.throwIfAborted();
+	const requestAuthContext = overrides?.env ? overlayEnvAuthContext(authContext, overrides.env) : authContext;
+	if (overrides?.apiKey !== void 0 && provider.auth.apiKey) return resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, {
+		type: "api_key",
+		key: overrides.apiKey,
+		env: overrides.env
+	}, signal);
+	const stored = await readCredential(credentials, provider.id, signal);
+	if (stored) {
+		if (stored.type === "oauth" && provider.auth.oauth) return resolveStoredOAuth(credentials, provider.id, provider.auth.oauth, stored, signal, overrides?.minOAuthValidityMs);
+		if (stored.type === "api_key" && provider.auth.apiKey) {
+			const credential = overrides?.env ? {
+				...stored,
+				env: {
+					...stored.env,
+					...overrides.env
+				}
+			} : stored;
+			return resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, credential, signal);
+		}
+		return;
+	}
+	return provider.auth.apiKey ? resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, void 0, signal) : void 0;
+}
+function overlayEnvAuthContext(base, env) {
+	return {
+		env: async (name) => env[name] || await base.env(name),
+		fileExists: (path) => base.fileExists(path)
+	};
+}
+const DEFAULT_OAUTH_MINIMUM_VALIDITY_MS = 3e5;
+const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 15e3;
+/**
+* OAuth resolution with double-checked locking: tokens with less than five
+* minutes remaining lock, re-check expiry under the lock, refresh once
+* globally, and persist the rotated credential before release.
+*/
+async function resolveStoredOAuth(credentials, providerId, oauth, stored, signal, minOAuthValidityMs) {
+	const minimumValidityMs = Math.max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS, minOAuthValidityMs ?? 0);
+	const expiresSoon = (credential) => Date.now() + minimumValidityMs >= credential.expires;
+	let credential = stored;
+	if (expiresSoon(credential)) {
+		let post;
+		try {
+			post = await credentials.modify(providerId, async (current) => {
+				if (current?.type !== "oauth") return void 0;
+				if (!expiresSoon(current)) return void 0;
+				try {
+					const refreshSignal = AbortSignal.any([signal, AbortSignal.timeout(DEFAULT_OAUTH_REFRESH_TIMEOUT_MS)]);
+					return await oauth.refresh(current, refreshSignal);
+				} catch (error) {
+					throw new ModelsError("oauth", `OAuth refresh failed for ${providerId}`, { cause: error });
+				}
+			}, { signal });
+		} catch (error) {
+			if (error instanceof ModelsError) throw error;
+			throw new ModelsError("auth", `Credential store modify failed for ${providerId}`, { cause: error });
+		}
+		if (post?.type !== "oauth") return void 0;
+		credential = post;
+		if (minOAuthValidityMs !== void 0 && expiresSoon(credential)) throw new ModelsError("oauth", `OAuth refresh returned a token that expires too soon for ${providerId}`);
+	}
+	try {
+		return {
+			auth: await oauth.toAuth(credential),
+			source: "OAuth"
+		};
+	} catch (error) {
+		throw new ModelsError("oauth", `OAuth auth derivation failed for ${providerId}`, { cause: error });
+	}
+}
+async function resolveApiKey(authContext, apiKey, providerId, credential, signal) {
+	try {
+		return await apiKey.resolve({
+			ctx: authContext,
+			credential,
+			signal
+		});
+	} catch (error) {
+		throw new ModelsError("auth", `API key auth failed for provider ${providerId}`, { cause: error });
+	}
+}
+async function readCredential(credentials, providerId, signal) {
+	try {
+		return await credentials.read(providerId, { signal });
+	} catch (error) {
+		throw new ModelsError("auth", `Credential store read failed for ${providerId}`, { cause: error });
+	}
+}
+//#endregion
+//#region src/compat/vendor/pi-oauth-adapt.ts
+function adaptOAuth(config) {
+	return {
+		name: config.name,
+		isSubscription: config.isSubscription,
+		login: async (callbacks) => {
+			return {
+				...await config.login({
+					onAuth: (info) => callbacks.notify({
+						type: "auth_url",
+						...info
+					}),
+					onDeviceCode: (info) => callbacks.notify({
+						type: "device_code",
+						...info
+					}),
+					onPrompt: (prompt) => callbacks.prompt({
+						type: "text",
+						...prompt
+					}),
+					onProgress: (message) => callbacks.notify({
+						type: "progress",
+						message
+					}),
+					onManualCodeInput: () => callbacks.prompt({
+						type: "manual_code",
+						message: "Paste the authorization code"
+					}),
+					onSelect: (prompt) => callbacks.prompt({
+						type: "select",
+						...prompt
+					}),
+					signal: callbacks.signal
+				}),
+				type: "oauth"
+			};
+		},
+		refresh: async (credential, signal) => ({
+			...await config.refreshToken(credential, signal),
+			type: "oauth"
+		}),
+		toAuth: async (credential) => ({ apiKey: config.getApiKey(credential) })
+	};
+}
+//#endregion
+//#region src/oauth-bridge.ts
+var FileCredentialStore = class extends InMemoryCredentialStore {
+	#path;
+	constructor(path) {
+		super();
+		this.#path = path;
+		try {
+			const data = JSON.parse(readFileSync(path, "utf8"));
+			for (const [providerId, credential] of Object.entries(data)) this.credentials.set(providerId, credential);
+		} catch {}
+	}
+	get path() {
+		return this.#path;
+	}
+	async #persist() {
+		const credentials = this.credentials;
+		const data = Object.fromEntries(credentials);
+		await mkdir(dirname(this.#path), { recursive: true });
+		const temp = `${this.#path}.tmp-${process.pid}-${Math.floor(Math.random() * 1e9).toString(36)}`;
+		await writeFile(temp, `${JSON.stringify(data, null, 2)}\n`, { mode: 384 });
+		await rename(temp, this.#path);
+	}
+	modify(providerId, fn, options) {
+		return super.modify(providerId, async (current) => {
+			const next = await fn(current);
+			if (next !== void 0) {
+				this.credentials.set(providerId, next);
+				await this.#persist();
+			}
+			return next;
+		}, options);
+	}
+	delete(providerId, options) {
+		return super.delete(providerId, options).then(() => this.#persist());
+	}
+};
+function oauthInteraction(ui, signal) {
+	return {
+		signal: signal ?? new AbortController().signal,
+		async prompt(prompt) {
+			if (prompt.type === "select") {
+				const options = prompt.options ?? [];
+				const picked = await ui.select(prompt.message, options.map((option) => option.label));
+				return options.find((option) => option.label === picked)?.id ?? picked;
+			}
+			return ui.input(prompt.message, prompt.placeholder);
+		},
+		notify(event) {
+			if (event.type === "auth_url") ui.notify(`Open this URL to authorize: ${event.url}${event.instructions !== void 0 ? `\n${event.instructions}` : ""}`);
+			else if (event.type === "device_code") ui.notify(`Visit ${event.verificationUri} and enter code ${event.userCode}`);
+			else if (event.message !== void 0) ui.notify(event.message);
+		}
+	};
+}
+function oauthConfigOf(providerConfig) {
+	const oauth = providerConfig?.oauth;
+	return typeof oauth === "object" && oauth !== null && typeof oauth.login === "function" ? oauth : void 0;
+}
+function oauthAdapterOf(oauthConfig) {
+	if (typeof oauthConfig.toAuth === "function") return oauthConfig;
+	return adaptOAuth(oauthConfig);
+}
+function providerSupportsOAuth(providerConfig) {
+	return oauthConfigOf(providerConfig) !== void 0;
+}
+async function loginPiProvider(options) {
+	const oauthConfig = oauthConfigOf(options.providerConfig);
+	if (oauthConfig === void 0) throw new Error(`${options.providerName ?? options.providerId} does not support oauth login`);
+	const credential = await oauthAdapterOf(oauthConfig).login(oauthInteraction(options.ui, options.signal));
+	await options.store.modify(options.providerId, async () => credential);
+	return credential;
+}
+async function resolveOAuthApiKey(options) {
+	const oauthConfig = oauthConfigOf(options.providerConfig);
+	if (oauthConfig === void 0) return void 0;
+	return (await resolveProviderAuth({
+		id: options.providerId,
+		name: options.providerName ?? options.providerId,
+		auth: { oauth: oauthAdapterOf(oauthConfig) }
+	}, options.store, { env: async () => void 0 }, options.signal !== void 0 ? { signal: options.signal } : void 0))?.auth?.apiKey;
+}
+async function storedOAuthCredential(store, providerId) {
+	const stored = await store.read(providerId, void 0);
+	return stored?.type === "oauth" ? stored : void 0;
+}
+//#endregion
+export { storedOAuthCredential as a, resolveOAuthApiKey as i, loginPiProvider as n, providerSupportsOAuth as r, FileCredentialStore as t };
+
+//# sourceMappingURL=oauth-bridge-BpPrppjR.mjs.map