poe-code 4.0.19 → 4.0.21

package/dist/credentials.js

@@ -0,0 +1,2586 @@
+// packages/auth-store/src/encrypted-file-store.ts
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID, scrypt } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import path from "node:path";
+
+// packages/auth-store/src/error-codes.ts
+function hasOwnErrorCode(error2, code) {
+  return error2 instanceof Error && Object.prototype.hasOwnProperty.call(error2, "code") && error2.code === code;
+}
+
+// packages/auth-store/src/encrypted-file-store.ts
+var derivedKeyCache = /* @__PURE__ */ new Map();
+var ENCRYPTION_ALGORITHM = "aes-256-gcm";
+var ENCRYPTION_VERSION = 1;
+var ENCRYPTION_KEY_BYTES = 32;
+var ENCRYPTION_IV_BYTES = 12;
+var ENCRYPTION_AUTH_TAG_BYTES = 16;
+var ENCRYPTION_FILE_MODE = 384;
+var EncryptedFileStore = class {
+  fs;
+  filePath;
+  symbolicLinkCheckStartPath;
+  salt;
+  getMachineIdentity;
+  getRandomBytes;
+  keyPromise = null;
+  constructor(input) {
+    this.fs = input.fs ?? fs;
+    this.salt = input.salt;
+    if (input.filePath === void 0) {
+      const homeDirectory = (input.getHomeDirectory ?? homedir)();
+      const defaultDirectory = input.defaultDirectory ?? ".auth-store";
+      const defaultFileName = input.defaultFileName ?? "credentials.enc";
+      assertSafeDefaultDirectory(defaultDirectory);
+      assertSafeDefaultFileName(defaultFileName);
+      this.filePath = path.join(
+        homeDirectory,
+        defaultDirectory,
+        defaultFileName
+      );
+      this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(
+        homeDirectory,
+        defaultDirectory
+      );
+    } else {
+      this.filePath = input.filePath;
+      this.symbolicLinkCheckStartPath = null;
+    }
+    this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
+    this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+  }
+  async get() {
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    let rawDocument;
+    try {
+      rawDocument = await this.fs.readFile(this.filePath, "utf8");
+    } catch (error2) {
+      if (isNotFoundError(error2)) {
+        return null;
+      }
+      throw error2;
+    }
+    const document = parseEncryptedDocument(rawDocument);
+    if (!document) {
+      return null;
+    }
+    const key2 = await this.getEncryptionKey();
+    try {
+      const iv = Buffer.from(document.iv, "base64");
+      const authTag = Buffer.from(document.authTag, "base64");
+      const ciphertext = Buffer.from(document.ciphertext, "base64");
+      if (iv.byteLength !== ENCRYPTION_IV_BYTES || authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+        return null;
+      }
+      const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key2, iv);
+      decipher.setAuthTag(authTag);
+      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      return plaintext.toString("utf8");
+    } catch {
+      return null;
+    }
+  }
+  async set(value) {
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    const key2 = await this.getEncryptionKey();
+    const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
+    const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key2, iv);
+    const ciphertext = Buffer.concat([
+      cipher.update(value, "utf8"),
+      cipher.final()
+    ]);
+    const authTag = cipher.getAuthTag();
+    const document = {
+      version: ENCRYPTION_VERSION,
+      iv: iv.toString("base64"),
+      authTag: authTag.toString("base64"),
+      ciphertext: ciphertext.toString("base64")
+    };
+    await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+    let temporaryCreated = false;
+    try {
+      await this.assertCredentialPathHasNoSymbolicLinks(temporaryPath);
+      await this.fs.writeFile(temporaryPath, JSON.stringify(document), {
+        encoding: "utf8",
+        flag: "wx",
+        mode: ENCRYPTION_FILE_MODE
+      });
+      temporaryCreated = true;
+      await this.fs.chmod(temporaryPath, ENCRYPTION_FILE_MODE);
+      await this.fs.rename(temporaryPath, this.filePath);
+    } catch (error2) {
+      if (temporaryCreated || !isAlreadyExistsError(error2)) {
+        await removeIfPresent(this.fs, temporaryPath).catch(() => void 0);
+      }
+      throw error2;
+    }
+  }
+  async delete() {
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    try {
+      await this.fs.unlink(this.filePath);
+    } catch (error2) {
+      if (!isNotFoundError(error2)) {
+        throw error2;
+      }
+    }
+  }
+  async assertCredentialPathHasNoSymbolicLinks(targetPath) {
+    const resolvedPath = path.resolve(targetPath);
+    const protectedPaths = getProtectedCredentialPaths(
+      resolvedPath,
+      this.symbolicLinkCheckStartPath
+    );
+    for (const currentPath of protectedPaths) {
+      try {
+        const stats = await this.fs.lstat(currentPath);
+        if (stats.isSymbolicLink()) {
+          throw new Error(`Refusing to use encrypted credential path through symbolic link: ${currentPath}`);
+        }
+      } catch (error2) {
+        if (isNotFoundError(error2)) {
+          return;
+        }
+        throw error2;
+      }
+    }
+  }
+  getEncryptionKey() {
+    if (!this.keyPromise) {
+      const retryableKeyPromise = deriveEncryptionKey(this.getMachineIdentity, this.salt).catch((error2) => {
+        if (this.keyPromise === retryableKeyPromise) {
+          this.keyPromise = null;
+        }
+        throw error2;
+      });
+      this.keyPromise = retryableKeyPromise;
+    }
+    return this.keyPromise;
+  }
+};
+function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
+  const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
+  return path.resolve(homeDirectory, firstSegment ?? ".");
+}
+function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
+  if (symbolicLinkCheckStartPath === null) {
+    return getExplicitProtectedCredentialPaths(resolvedPath);
+  }
+  const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
+  if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
+    return [path.dirname(resolvedPath), resolvedPath];
+  }
+  const protectedPaths = [resolvedStartPath];
+  let currentPath = resolvedStartPath;
+  for (const segment of path.relative(resolvedStartPath, resolvedPath).split(path.sep).filter(Boolean)) {
+    currentPath = path.join(currentPath, segment);
+    protectedPaths.push(currentPath);
+  }
+  return protectedPaths;
+}
+function assertSafeDefaultDirectory(defaultDirectory) {
+  if (path.isAbsolute(defaultDirectory) || path.win32.isAbsolute(defaultDirectory)) {
+    throw new Error("defaultDirectory must be a relative path inside the home directory");
+  }
+  for (const segment of splitPathSegments(defaultDirectory)) {
+    if (segment === "..") {
+      throw new Error("defaultDirectory must be a relative path inside the home directory");
+    }
+  }
+}
+function assertSafeDefaultFileName(defaultFileName) {
+  if (defaultFileName.trim().length === 0 || defaultFileName === "." || defaultFileName === ".." || splitPathSegments(defaultFileName).length !== 1) {
+    throw new Error("defaultFileName must be a file name without path separators");
+  }
+}
+function splitPathSegments(value) {
+  return value.split("/").flatMap((segment) => segment.split("\\")).filter((segment) => segment.length > 0);
+}
+function getExplicitProtectedCredentialPaths(resolvedPath) {
+  const parsed = path.parse(resolvedPath);
+  const segments = resolvedPath.slice(parsed.root.length).split(path.sep).filter((segment) => segment.length > 0);
+  if (segments.length <= 1) {
+    return [resolvedPath];
+  }
+  const protectedPaths = [];
+  let currentPath = parsed.root;
+  for (const [index, segment] of segments.entries()) {
+    currentPath = path.join(currentPath, segment);
+    if (index === 0) {
+      continue;
+    }
+    protectedPaths.push(currentPath);
+  }
+  return protectedPaths;
+}
+function isPathInsideOrEqual(childPath, parentPath) {
+  const relativePath = path.relative(parentPath, childPath);
+  return relativePath === "" || !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+}
+async function removeIfPresent(fileSystem, filePath) {
+  try {
+    await fileSystem.unlink(filePath);
+  } catch (error2) {
+    if (!isNotFoundError(error2)) {
+      throw error2;
+    }
+  }
+}
+function defaultMachineIdentity() {
+  return {
+    hostname: hostname(),
+    username: userInfo().username
+  };
+}
+async function deriveEncryptionKey(getMachineIdentity, salt) {
+  const machineIdentity = await getMachineIdentity();
+  const secret = `${machineIdentity.hostname}:${machineIdentity.username}`;
+  const cacheKey = JSON.stringify([machineIdentity.hostname, machineIdentity.username, salt]);
+  const cached2 = derivedKeyCache.get(cacheKey);
+  if (cached2) {
+    return cached2;
+  }
+  const keyPromise = new Promise((resolve2, reject) => {
+    scrypt(secret, salt, ENCRYPTION_KEY_BYTES, (error2, derivedKey) => {
+      if (error2) {
+        reject(error2);
+        return;
+      }
+      resolve2(Buffer.from(derivedKey));
+    });
+  });
+  derivedKeyCache.set(cacheKey, keyPromise);
+  return keyPromise.catch((error2) => {
+    if (derivedKeyCache.get(cacheKey) === keyPromise) {
+      derivedKeyCache.delete(cacheKey);
+    }
+    throw error2;
+  });
+}
+function parseEncryptedDocument(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry(parsed, "version");
+    const iv = getOwnEntry(parsed, "iv");
+    const authTag = getOwnEntry(parsed, "authTag");
+    const ciphertext = getOwnEntry(parsed, "ciphertext");
+    if (version !== ENCRYPTION_VERSION) {
+      return null;
+    }
+    if (typeof iv !== "string" || typeof authTag !== "string" || typeof ciphertext !== "string") {
+      return null;
+    }
+    return {
+      version,
+      iv,
+      authTag,
+      ciphertext
+    };
+  } catch {
+    return null;
+  }
+}
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function getOwnEntry(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function isNotFoundError(error2) {
+  return hasOwnErrorCode(error2, "ENOENT");
+}
+function isAlreadyExistsError(error2) {
+  return hasOwnErrorCode(error2, "EEXIST");
+}
+
+// packages/auth-store/src/keychain-store.ts
+import { spawn } from "node:child_process";
+var SECURITY_CLI = "security";
+var KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE = 44;
+var KeychainStore = class {
+  runCommand;
+  service;
+  account;
+  constructor(input) {
+    this.runCommand = input.runCommand ?? runSecurityCommand;
+    this.service = input.service.trim();
+    this.account = input.account.trim();
+    if (this.service.length === 0) {
+      throw new Error("Keychain service must not be empty");
+    }
+    if (this.account.length === 0) {
+      throw new Error("Keychain account must not be empty");
+    }
+  }
+  async get() {
+    const result = await this.executeSecurityCommand(
+      ["find-generic-password", "-s", this.service, "-a", this.account, "-w"],
+      "read secret from macOS Keychain"
+    );
+    if (getCommandExitCode(result) === 0) {
+      return stripTrailingLineBreak(getCommandOutput(result, "stdout"));
+    }
+    if (isKeychainEntryNotFound(result)) {
+      return null;
+    }
+    throw createSecurityCliFailure("read secret from macOS Keychain", result);
+  }
+  async set(value) {
+    if (value.includes("\n") || value.includes("\r")) {
+      throw new Error("Keychain secrets cannot contain line breaks");
+    }
+    const result = await this.executeSecurityCommand(
+      [
+        "add-generic-password",
+        "-s",
+        this.service,
+        "-a",
+        this.account,
+        "-U",
+        "-w",
+        value
+      ],
+      "store secret in macOS Keychain"
+    );
+    if (getCommandExitCode(result) !== 0) {
+      throw createSecurityCliFailure("store secret in macOS Keychain", result);
+    }
+  }
+  async delete() {
+    const result = await this.executeSecurityCommand(
+      ["delete-generic-password", "-s", this.service, "-a", this.account],
+      "delete secret from macOS Keychain"
+    );
+    if (getCommandExitCode(result) === 0 || isKeychainEntryNotFound(result)) {
+      return;
+    }
+    throw createSecurityCliFailure("delete secret from macOS Keychain", result);
+  }
+  async executeSecurityCommand(args, operation, options) {
+    try {
+      if (options === void 0) {
+        return await this.runCommand(SECURITY_CLI, args);
+      }
+      return await this.runCommand(SECURITY_CLI, args, options);
+    } catch (error2) {
+      const message2 = error2 instanceof Error ? error2.message : String(error2);
+      throw new Error(`Failed to ${operation}: ${message2}`);
+    }
+  }
+};
+function runSecurityCommand(command, args, options) {
+  return new Promise((resolve2) => {
+    const child = spawn(command, args, {
+      stdio: [options?.stdin === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let stdinErrorMessage;
+    const appendStderr = (message2) => {
+      stderr = stderr.length === 0 ? message2 : `${stderr}${stderr.endsWith("\n") ? "" : "\n"}${message2}`;
+    };
+    const appendStdinError = () => {
+      if (stdinErrorMessage === void 0) {
+        return;
+      }
+      appendStderr(stdinErrorMessage);
+      stdinErrorMessage = void 0;
+    };
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    if (options?.stdin !== void 0) {
+      child.stdin?.once("error", (error2) => {
+        stdinErrorMessage = error2 instanceof Error ? error2.message : String(error2);
+      });
+      child.stdin?.end(options.stdin);
+    }
+    child.on("error", (error2) => {
+      const message2 = error2 instanceof Error ? error2.message : String(error2 ?? "Unknown error");
+      appendStdinError();
+      appendStderr(message2);
+      resolve2({
+        stdout,
+        stderr,
+        exitCode: 127
+      });
+    });
+    child.on("close", (code) => {
+      appendStdinError();
+      resolve2({
+        stdout,
+        stderr,
+        exitCode: code ?? 1
+      });
+    });
+  });
+}
+function stripTrailingLineBreak(value) {
+  if (value.endsWith("\r\n")) {
+    return value.slice(0, -2);
+  }
+  if (value.endsWith("\n") || value.endsWith("\r")) {
+    return value.slice(0, -1);
+  }
+  return value;
+}
+function isKeychainEntryNotFound(result) {
+  return getCommandExitCode(result) === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
+}
+function createSecurityCliFailure(operation, result) {
+  const exitCode = getCommandExitCode(result);
+  const details = getCommandOutput(result, "stderr").trim() || getCommandOutput(result, "stdout").trim();
+  if (details) {
+    return new Error(
+      `Failed to ${operation}: security exited with code ${exitCode}: ${details}`
+    );
+  }
+  return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
+}
+function getCommandExitCode(result) {
+  const value = getOwnEntry2(result, "exitCode");
+  return typeof value === "number" && Number.isInteger(value) ? value : 1;
+}
+function getCommandOutput(result, key2) {
+  const value = getOwnEntry2(result, key2);
+  return typeof value === "string" ? value : "";
+}
+function getOwnEntry2(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+
+// packages/auth-store/src/create-secret-store.ts
+var DEFAULT_BACKEND_ENV_VAR = "AUTH_BACKEND";
+var MACOS_PLATFORM = "darwin";
+var storeFactories = {
+  file: (input) => {
+    if (!input.fileStore) {
+      throw new Error("fileStore configuration is required for file backend");
+    }
+    return new EncryptedFileStore(input.fileStore);
+  },
+  keychain: (input) => {
+    if (!input.keychainStore) {
+      throw new Error("keychainStore configuration is required for keychain backend");
+    }
+    return new KeychainStore(input.keychainStore);
+  }
+};
+function createSecretStore(input) {
+  const backend = resolveBackend(input);
+  const platform = input.platform ?? process.platform;
+  if (backend === "keychain" && platform !== MACOS_PLATFORM) {
+    throw new Error(
+      `Keychain backend is only supported on macOS. Current platform: ${platform}`
+    );
+  }
+  const store = storeFactories[backend](input);
+  return { backend, store };
+}
+function resolveBackend(input) {
+  const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
+  const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
+  const backend = configuredBackend?.trim();
+  if (backend === "keychain") {
+    return "keychain";
+  }
+  if (backend === void 0 || backend === "file") {
+    return "file";
+  }
+  throw new Error(`Unsupported auth store backend: ${backend}`);
+}
+function getOwnEnvValue(env, key2) {
+  return env !== void 0 && Object.prototype.hasOwnProperty.call(env, key2) ? env[key2] : void 0;
+}
+
+// src/cli/errors.ts
+var CliError = class extends Error {
+  context;
+  isUserError;
+  constructor(message2, context, options) {
+    super(message2);
+    this.name = this.constructor.name;
+    this.context = context;
+    this.isUserError = options?.isUserError ?? false;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+  }
+};
+var ApiError = class extends CliError {
+  httpStatus;
+  endpoint;
+  constructor(message2, options) {
+    super(message2, {
+      ...options?.context,
+      httpStatus: options?.httpStatus,
+      apiEndpoint: options?.endpoint
+    });
+    this.httpStatus = options?.httpStatus;
+    this.endpoint = options?.endpoint;
+  }
+};
+var AuthenticationError = class extends CliError {
+  constructor(message2, context) {
+    super(message2, context, { isUserError: true });
+  }
+};
+
+// src/cli/environment.ts
+import path16 from "node:path";
+
+// packages/poe-code-config/src/runtime.ts
+import { existsSync, realpathSync } from "node:fs";
+import path2 from "node:path";
+var defaultWorkspaceExclude = [
+  ".git",
+  "node_modules",
+  "dist",
+  ".turbo",
+  ".next",
+  ".poe-code/state.json"
+];
+var runtimeConfigScope = deepFreeze({
+  scope: "runtime",
+  schema: {
+    type: {
+      type: "string",
+      default: "host",
+      doc: "Runtime backend: host or docker"
+    },
+    build_args: {
+      type: "json",
+      default: {},
+      parse: parseBuildArgs,
+      doc: "Build arguments passed to the runtime image build"
+    },
+    mounts: {
+      type: "json",
+      default: [],
+      parse: parseMounts,
+      doc: "Additional runtime mounts"
+    },
+    runner: {
+      type: "json",
+      default: createDefaultRunnerScope(),
+      parse: parseRunner,
+      doc: "Runner process and workspace transfer settings"
+    },
+    link: {
+      type: "string",
+      default: "",
+      doc: "Informational link for the runtime definition"
+    },
+    image: {
+      type: "string",
+      default: "",
+      doc: "Prebuilt Docker image"
+    },
+    dockerfile: {
+      type: "string",
+      default: "",
+      doc: "Path to the Dockerfile used for Docker builds"
+    },
+    build_context: {
+      type: "string",
+      default: "",
+      doc: "Path to the Docker build context"
+    },
+    engine: {
+      type: "string",
+      default: "",
+      doc: "Container engine for Docker runtime"
+    },
+    network: {
+      type: "string",
+      default: "",
+      doc: "Docker network"
+    },
+    extra_args: {
+      type: "json",
+      default: void 0,
+      parse: parseOptionalStringArray,
+      doc: "Extra Docker runtime arguments"
+    }
+  }
+});
+function parseRunner(raw) {
+  if (raw === void 0) {
+    return createDefaultRunnerScope();
+  }
+  const record = asRecord(raw);
+  if (record === void 0) {
+    throw new Error("runner: expected an object.");
+  }
+  const uploadMaxFileMb = parseOptionalNumber(getOwnEntry3(record, "upload_max_file_mb"), "runner.upload_max_file_mb") ?? 100;
+  if (uploadMaxFileMb <= 0) {
+    throw new Error("runner.upload_max_file_mb: expected a positive finite number.");
+  }
+  return omitUndefined({
+    detach: parseOptionalBoolean(getOwnEntry3(record, "detach"), "runner.detach") ?? false,
+    upload_max_file_mb: uploadMaxFileMb,
+    download_conflict: parseDownloadConflict(getOwnEntry3(record, "download_conflict")),
+    sync: parseRunnerSync(getOwnEntry3(record, "sync")),
+    workspace: parseRunnerWorkspace(getOwnEntry3(record, "workspace"))
+  });
+}
+function createDefaultRunnerScope() {
+  return {
+    detach: false,
+    upload_max_file_mb: 100,
+    download_conflict: "refuse",
+    sync: "both",
+    workspace: {
+      exclude: [...defaultWorkspaceExclude]
+    }
+  };
+}
+function parseRunnerWorkspace(value) {
+  if (value === void 0) {
+    return {
+      exclude: [...defaultWorkspaceExclude]
+    };
+  }
+  const record = asRecord(value);
+  if (record === void 0) {
+    throw new Error("runner.workspace: expected an object.");
+  }
+  return {
+    exclude: parseOptionalStringArray(getOwnEntry3(record, "exclude"), "runner.workspace.exclude") ?? [...defaultWorkspaceExclude]
+  };
+}
+function parseDownloadConflict(value) {
+  if (value === void 0) {
+    return "refuse";
+  }
+  if (value === "refuse" || value === "overwrite") {
+    return value;
+  }
+  throw new Error('runner.download_conflict: expected "refuse" or "overwrite".');
+}
+function parseRunnerSync(value) {
+  if (value === void 0) {
+    return "both";
+  }
+  if (value === "both" || value === "upload" || value === "none") {
+    return value;
+  }
+  throw new Error('runner.sync: expected "both", "upload", or "none".');
+}
+function parseBuildArgs(value) {
+  if (value === void 0) {
+    return {};
+  }
+  const record = asRecord(value);
+  if (record === void 0) {
+    throw new Error("build_args: expected an object.");
+  }
+  const parsed = {};
+  for (const [key2, entry] of Object.entries(record)) {
+    assertBuildArgName(key2);
+    if (typeof entry !== "string") {
+      throw new Error(`build_args.${key2}: expected a string.`);
+    }
+    defineDataProperty(parsed, key2, entry);
+  }
+  return parsed;
+}
+function parseMounts(value) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    throw new Error("mounts: expected an array.");
+  }
+  return value.map((entry, index) => {
+    const record = asRecord(entry);
+    if (record === void 0) {
+      throw new Error(`mounts[${index}]: expected an object.`);
+    }
+    const source = getOwnEntry3(record, "source");
+    const target = getOwnEntry3(record, "target");
+    if (typeof source !== "string") {
+      throw new Error(`mounts[${index}].source: expected a string.`);
+    }
+    if (source.trim().length === 0) {
+      throw new Error(`mounts[${index}].source: expected a non-empty string.`);
+    }
+    if (typeof target !== "string") {
+      throw new Error(`mounts[${index}].target: expected a string.`);
+    }
+    if (target.trim().length === 0 || target !== target.trim() || !path2.posix.isAbsolute(target)) {
+      throw new Error(`mounts[${index}].target: expected a non-empty absolute sandbox path.`);
+    }
+    return omitUndefined({
+      source,
+      target,
+      readonly: parseOptionalBoolean(getOwnEntry3(record, "readonly"), `mounts[${index}].readonly`)
+    });
+  });
+}
+function assertBuildArgName(key2) {
+  if (key2.length === 0 || key2 !== key2.trim()) {
+    throw new Error(`build_args.${key2}: expected an environment-style argument name.`);
+  }
+  for (let index = 0; index < key2.length; index += 1) {
+    const charCode = key2.charCodeAt(index);
+    const isUppercase = charCode >= 65 && charCode <= 90;
+    const isLowercase = charCode >= 97 && charCode <= 122;
+    const isDigit = charCode >= 48 && charCode <= 57;
+    const isUnderscore = charCode === 95;
+    if (!isUppercase && !isLowercase && !isDigit && !isUnderscore) {
+      throw new Error(`build_args.${key2}: expected an environment-style argument name.`);
+    }
+  }
+}
+function defineDataProperty(object, key2, value) {
+  Object.defineProperty(object, key2, {
+    configurable: true,
+    enumerable: true,
+    value,
+    writable: true
+  });
+}
+function deepFreeze(value) {
+  if (!value || typeof value !== "object" || Object.isFrozen(value)) {
+    return value;
+  }
+  for (const entry of Object.values(value)) {
+    deepFreeze(entry);
+  }
+  return Object.freeze(value);
+}
+function parseOptionalStringArray(value, key2 = "") {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value)) {
+    throw new Error(`${key2 ? `${key2}: ` : ""}expected an array.`);
+  }
+  return value.map((entry, index) => {
+    if (typeof entry !== "string") {
+      throw new Error(`${key2}[${index}]: expected a string.`);
+    }
+    return entry;
+  });
+}
+function parseOptionalNumber(value, key2 = "") {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new Error(`${key2 ? `${key2}: ` : ""}expected a finite number.`);
+  }
+  return value;
+}
+function parseOptionalBoolean(value, key2) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "boolean") {
+    throw new Error(`${key2}: expected a boolean.`);
+  }
+  return value;
+}
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  return value;
+}
+function getOwnEntry3(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function omitUndefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0));
+}
+
+// packages/poe-code-config/src/schema.ts
+function defineScope(scope, schema) {
+  return {
+    scope,
+    schema
+  };
+}
+var integrationsConfigScope = defineScope("integrations", {
+  braintrust: {
+    type: "json",
+    default: {
+      enabled: false
+    },
+    parse: parseBraintrustIntegrationConfig,
+    doc: "Braintrust integration configuration"
+  }
+});
+function parseBraintrustIntegrationConfig(value) {
+  if (!isRecord2(value)) {
+    throw new Error("expected an object");
+  }
+  const enabled = value.enabled === void 0 ? false : value.enabled;
+  if (typeof enabled !== "boolean") {
+    throw new Error("enabled must be a boolean");
+  }
+  return {
+    enabled,
+    ...optionalStringEntry("apiKey", value.apiKey),
+    ...optionalStringEntry("apiUrl", value.apiUrl),
+    ...optionalStringEntry("project", value.project)
+  };
+}
+function optionalStringEntry(key2, value) {
+  if (value === void 0) {
+    return {};
+  }
+  if (typeof value !== "string") {
+    throw new Error(`${key2} must be a string`);
+  }
+  return { [key2]: value };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// packages/poe-code-config/src/compile/schema-compiler.ts
+import { existsSync as existsSync2, readFileSync } from "node:fs";
+import path3 from "node:path";
+import { Node, Project, ScriptKind, SyntaxKind, ts } from "ts-morph";
+
+// packages/toolcraft-schema/src/json-schema/compiler.ts
+var draftTypes = ["null", "boolean", "object", "array", "number", "integer", "string"];
+var draftTypeSet = new Set(draftTypes);
+var metaSchemaKeywordProperties = {
+  type: {
+    anyOf: [
+      { enum: draftTypes },
+      { type: "array", items: { enum: draftTypes }, minItems: 1, uniqueItems: true }
+    ]
+  },
+  minLength: { type: "integer", minimum: 0 },
+  maxLength: { type: "integer", minimum: 0 },
+  minItems: { type: "integer", minimum: 0 },
+  maxItems: { type: "integer", minimum: 0 },
+  minProperties: { type: "integer", minimum: 0 },
+  maxProperties: { type: "integer", minimum: 0 }
+};
+var builtInRegistry = {
+  "https://json-schema.org/draft/2020-12/schema": {
+    $id: "https://json-schema.org/draft/2020-12/schema",
+    type: ["object", "boolean"],
+    properties: {
+      ...metaSchemaKeywordProperties,
+      $defs: { type: "object", additionalProperties: { $ref: "#" } }
+    }
+  },
+  "http://json-schema.org/draft-07/schema": {
+    $id: "http://json-schema.org/draft-07/schema#",
+    type: ["object", "boolean"],
+    properties: {
+      ...metaSchemaKeywordProperties,
+      definitions: { type: "object", additionalProperties: { $ref: "#" } }
+    }
+  }
+};
+
+// packages/poe-code-config/src/plan-scope.ts
+var planConfigScope = defineScope("plan", {
+  plan_directory: {
+    type: "string",
+    default: "docs/plans",
+    env: "POE_PLAN_DIRECTORY",
+    doc: "Directory where planning documents are stored"
+  }
+});
+
+// packages/poe-code-config/src/store.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import path10 from "node:path";
+
+// packages/config-extends/src/discover.ts
+import path4 from "node:path";
+
+// packages/config-extends/src/parse.ts
+import path5 from "node:path";
+
+// packages/frontmatter/src/parse.ts
+import { LineCounter, parse, parseDocument } from "yaml";
+
+// packages/frontmatter/src/stringify.ts
+import { stringify } from "yaml";
+
+// packages/config-extends/src/parse.ts
+import { parse as parseYaml } from "yaml";
+
+// packages/config-extends/src/resolve.ts
+import path6 from "node:path";
+
+// packages/toolcraft-design/src/internal/color-support.ts
+function supportsColor(env = process.env, stream = process.stdout) {
+  if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") {
+    return true;
+  }
+  if (env.NO_COLOR !== void 0) {
+    return false;
+  }
+  if (stream.isTTY !== true) {
+    return false;
+  }
+  return typeof env.TERM === "string" && env.TERM.length > 0 && env.TERM !== "dumb";
+}
+
+// packages/toolcraft-design/src/components/color.ts
+var reset = "\x1B[0m";
+var ansiStyles = {
+  reset: { open: reset },
+  bold: { open: "\x1B[1m" },
+  dim: { open: "\x1B[2m" },
+  italic: { open: "\x1B[3m" },
+  underline: { open: "\x1B[4m" },
+  inverse: { open: "\x1B[7m" },
+  strikethrough: { open: "\x1B[9m" },
+  black: { open: "\x1B[30m" },
+  red: { open: "\x1B[31m" },
+  green: { open: "\x1B[32m" },
+  yellow: { open: "\x1B[33m" },
+  blue: { open: "\x1B[34m" },
+  magenta: { open: "\x1B[35m" },
+  cyan: { open: "\x1B[36m" },
+  white: { open: "\x1B[37m" },
+  gray: { open: "\x1B[90m" },
+  magentaBright: { open: "\x1B[95m" },
+  cyanBright: { open: "\x1B[96m" },
+  bgRed: { open: "\x1B[41m" },
+  bgGreen: { open: "\x1B[42m" },
+  bgYellow: { open: "\x1B[43m" },
+  bgBlue: { open: "\x1B[44m" },
+  bgMagenta: { open: "\x1B[45m" }
+};
+var styleNames = Object.keys(ansiStyles);
+function replaceAll(value, search, replacement) {
+  return value.split(search).join(replacement);
+}
+function applyStyles(text3, styles) {
+  if (!supportsColor() || styles.length === 0) {
+    return text3;
+  }
+  const open = styles.map((style) => style.open).join("");
+  const output = text3.includes(reset) ? replaceAll(text3, reset, `${reset}${open}`) : text3;
+  return `${open}${output}${reset}`;
+}
+function clampRgb(value) {
+  if (Number.isNaN(value)) {
+    return 0;
+  }
+  return Math.min(255, Math.max(0, Math.round(value)));
+}
+function hexChannel(value, offset) {
+  return Number.parseInt(value.slice(offset, offset + 2), 16);
+}
+function normalizeHex(value) {
+  const normalized = value.startsWith("#") ? value.slice(1) : value;
+  if (normalized.length !== 3 && normalized.length !== 6 || Array.from(normalized).some((char) => !"0123456789abcdefABCDEF".includes(char))) {
+    throw new Error(`Invalid hexadecimal color: ${value}`);
+  }
+  if (normalized.length === 3) {
+    const red = normalized[0];
+    const green = normalized[1];
+    const blue = normalized[2];
+    return [
+      Number.parseInt(`${red}${red}`, 16),
+      Number.parseInt(`${green}${green}`, 16),
+      Number.parseInt(`${blue}${blue}`, 16)
+    ];
+  }
+  return [
+    hexChannel(normalized, 0),
+    hexChannel(normalized, 2),
+    hexChannel(normalized, 4)
+  ];
+}
+function rgbStyle(red, green, blue) {
+  return {
+    open: `\x1B[38;2;${clampRgb(red)};${clampRgb(green)};${clampRgb(blue)}m`
+  };
+}
+function bgRgbStyle(red, green, blue) {
+  return {
+    open: `\x1B[48;2;${clampRgb(red)};${clampRgb(green)};${clampRgb(blue)}m`
+  };
+}
+function createColor(styles = []) {
+  const builder = ((text3) => applyStyles(String(text3), styles));
+  for (const name of styleNames) {
+    Object.defineProperty(builder, name, {
+      configurable: true,
+      enumerable: true,
+      get: () => createColor([...styles, ansiStyles[name]])
+    });
+  }
+  builder.hex = (value) => {
+    const [red, green, blue] = normalizeHex(value);
+    return createColor([...styles, rgbStyle(red, green, blue)]);
+  };
+  builder.rgb = (red, green, blue) => createColor([...styles, rgbStyle(red, green, blue)]);
+  builder.bgHex = (value) => {
+    const [red, green, blue] = normalizeHex(value);
+    return createColor([...styles, bgRgbStyle(red, green, blue)]);
+  };
+  builder.bgRgb = (red, green, blue) => createColor([...styles, bgRgbStyle(red, green, blue)]);
+  return builder;
+}
+var color = createColor();
+
+// packages/toolcraft-design/src/tokens/brand.ts
+var brands = {
+  purple: { name: "purple", primary: "#a200ff" },
+  blue: { name: "blue", primary: "#2f6fed" },
+  green: { name: "green", primary: "#1f9d57" }
+};
+
+// packages/toolcraft-design/src/internal/theme-state.ts
+var defaults = {
+  brand: "purple",
+  label: "Poe"
+};
+var config = { ...defaults };
+var revision = 0;
+var brandConfigured = false;
+function getThemeConfig() {
+  return { ...config };
+}
+function getThemeRevision() {
+  return revision;
+}
+function isThemeBrandConfigured() {
+  return brandConfigured;
+}
+
+// packages/toolcraft-design/src/tokens/colors.ts
+var brand = brands.purple.primary;
+function withStyles(palette, styles) {
+  return Object.defineProperty(palette, "styles", {
+    value: styles,
+    enumerable: false
+  });
+}
+function brandColor(activeBrand, purple) {
+  return activeBrand.name === "purple" ? purple : color.hex(activeBrand.primary);
+}
+function brandBackground(activeBrand, purple) {
+  return activeBrand.name === "purple" ? purple : color.bgHex(activeBrand.primary);
+}
+function createPalette(activeBrand, mode) {
+  const isPurple = activeBrand.name === "purple";
+  if (mode === "light") {
+    const active2 = color.hex(activeBrand.primary);
+    const prompt2 = isPurple ? color.hex("#006699") : active2;
+    const number2 = isPurple ? color.hex("#0077cc") : active2;
+    return withStyles(
+      {
+        header: (text3) => active2.bold(text3),
+        divider: (text3) => color.hex("#666666")(text3),
+        prompt: (text3) => prompt2.bold(text3),
+        number: (text3) => number2.bold(text3),
+        intro: (text3) => color.bgHex(activeBrand.primary).white(` ${getThemeConfig().label} - ${text3} `),
+        get resolvedSymbol() {
+          return active2("\u25C7");
+        },
+        get errorSymbol() {
+          return color.hex("#cc0000")("\u25A0");
+        },
+        accent: (text3) => prompt2.bold(text3),
+        muted: (text3) => color.hex("#666666")(text3),
+        success: (text3) => color.hex("#008800")(text3),
+        warning: (text3) => color.hex("#cc6600")(text3),
+        error: (text3) => color.hex("#cc0000")(text3),
+        info: (text3) => active2(text3),
+        badge: (text3) => color.bgHex("#cc6600").white(` ${text3} `)
+      },
+      {
+        accent: { fg: isPurple ? "#006699" : activeBrand.primary, bold: true },
+        muted: { fg: "#666666" },
+        success: { fg: "#008800" },
+        warning: { fg: "#cc6600" },
+        error: { fg: "#cc0000" },
+        info: { fg: activeBrand.primary }
+      }
+    );
+  }
+  const active = brandColor(activeBrand, color.magenta);
+  const activeBright = brandColor(activeBrand, color.magentaBright);
+  const activeBackground = brandBackground(activeBrand, color.bgMagenta);
+  const prompt = isPurple ? color.cyan : active;
+  const number = isPurple ? color.cyanBright : active;
+  return withStyles(
+    {
+      header: (text3) => activeBright.bold(text3),
+      divider: (text3) => color.dim(text3),
+      prompt: (text3) => prompt(text3),
+      number: (text3) => number(text3),
+      intro: (text3) => activeBackground.white(` ${getThemeConfig().label} - ${text3} `),
+      get resolvedSymbol() {
+        return active("\u25C7");
+      },
+      get errorSymbol() {
+        return color.red("\u25A0");
+      },
+      accent: (text3) => prompt(text3),
+      muted: (text3) => color.dim(text3),
+      success: (text3) => color.green(text3),
+      warning: (text3) => color.yellow(text3),
+      error: (text3) => color.red(text3),
+      info: (text3) => active(text3),
+      badge: (text3) => color.bgYellow.black(` ${text3} `)
+    },
+    {
+      accent: { fg: isPurple ? "cyan" : activeBrand.primary, bold: true },
+      muted: { dim: true },
+      success: { fg: "green" },
+      warning: { fg: "yellow" },
+      error: { fg: "red" },
+      info: { fg: isPurple ? "magenta" : activeBrand.primary }
+    }
+  );
+}
+var dark = createPalette(brands.purple, "dark");
+var light = createPalette(brands.purple, "light");
+
+// packages/toolcraft-design/src/internal/output-format.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var VALID_FORMATS = /* @__PURE__ */ new Set(["terminal", "markdown", "json"]);
+var formatStorage = new AsyncLocalStorage();
+var cached;
+function resolveOutputFormat(env = process.env) {
+  const scoped = formatStorage.getStore();
+  if (scoped) {
+    return scoped;
+  }
+  if (cached) {
+    return cached;
+  }
+  const raw = env.OUTPUT_FORMAT?.toLowerCase();
+  cached = VALID_FORMATS.has(raw) ? raw : "terminal";
+  return cached;
+}
+
+// packages/toolcraft-design/src/internal/theme-detect.ts
+function detectThemeFromEnv(env) {
+  const apple = env.APPLE_INTERFACE_STYLE;
+  if (typeof apple === "string") {
+    return apple.toLowerCase() === "dark" ? "dark" : "light";
+  }
+  const vscodeKind = env.VSCODE_COLOR_THEME_KIND;
+  if (typeof vscodeKind === "string") {
+    const normalized = vscodeKind.toLowerCase();
+    if (normalized.includes("light")) {
+      return "light";
+    }
+    if (normalized.includes("dark")) {
+      return "dark";
+    }
+  }
+  const colorFGBG = env.COLORFGBG;
+  if (typeof colorFGBG === "string") {
+    const parts = colorFGBG.split(";").map((part) => Number.parseInt(part, 10));
+    const background = parts.at(-1);
+    if (Number.isFinite(background)) {
+      return background >= 8 ? "light" : "dark";
+    }
+  }
+  return void 0;
+}
+function resolveThemeName(env = process.env) {
+  const raw = (env.POE_CODE_THEME ?? env.POE_THEME)?.toLowerCase();
+  if (raw === "light" || raw === "dark") {
+    return raw;
+  }
+  const detected = detectThemeFromEnv(env);
+  if (detected) {
+    return detected;
+  }
+  return "dark";
+}
+var themeCache = /* @__PURE__ */ new Map();
+var cachedRevision = -1;
+function getTheme(env) {
+  const themeName = resolveThemeName(env);
+  const config2 = getThemeConfig();
+  const requestedBrand = env?.POE_BRAND?.toLowerCase();
+  const activeBrandName = !isThemeBrandConfigured() && requestedBrand && Object.hasOwn(brands, requestedBrand) ? requestedBrand : config2.brand;
+  const revision2 = getThemeRevision();
+  if (revision2 !== cachedRevision) {
+    themeCache.clear();
+    cachedRevision = revision2;
+  }
+  const cacheKey = `${activeBrandName}:${themeName}`;
+  const cachedTheme = themeCache.get(cacheKey);
+  if (cachedTheme) {
+    return cachedTheme;
+  }
+  const activeBrand = brands[activeBrandName];
+  const theme = activeBrandName === "purple" ? themeName === "light" ? light : dark : createPalette(activeBrand, themeName);
+  themeCache.set(cacheKey, theme);
+  return theme;
+}
+
+// packages/toolcraft-design/src/components/symbols.ts
+var symbols = {
+  get info() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "info";
+    if (format === "markdown") return "(i)";
+    return color.magenta("\u25CF");
+  },
+  get success() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "success";
+    if (format === "markdown") return "[ok]";
+    return color.magenta("\u25C6");
+  },
+  get resolved() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "resolved";
+    if (format === "markdown") return ">";
+    return getTheme().resolvedSymbol;
+  },
+  get errorResolved() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "error";
+    if (format === "markdown") return "[!]";
+    return getTheme().errorSymbol;
+  },
+  get bar() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "";
+    if (format === "markdown") return "|";
+    return "\u2502";
+  },
+  cornerTopRight: "\u256E",
+  cornerBottomRight: "\u256F",
+  get warning() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "warning";
+    if (format === "markdown") return "[!]";
+    return "\u25B2";
+  },
+  get active() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "active";
+    if (format === "markdown") return "[x]";
+    return "\u25C6";
+  },
+  get inactive() {
+    const format = resolveOutputFormat();
+    if (format === "json") return "inactive";
+    if (format === "markdown") return "[ ]";
+    return "\u25CB";
+  }
+};
+
+// packages/toolcraft-design/src/internal/strip-ansi.ts
+function stripAnsi(value) {
+  let output = "";
+  let index = 0;
+  while (index < value.length) {
+    const char = value[index];
+    if (char === "\x1B") {
+      index = skipEscapeSequence(value, index);
+      continue;
+    }
+    if (char === "\x9B") {
+      index = skipCsiSequence(value, index + 1);
+      continue;
+    }
+    output += char;
+    index += char.length;
+  }
+  return output;
+}
+function skipEscapeSequence(value, index) {
+  const next = value[index + 1];
+  if (next === "[") {
+    return skipCsiSequence(value, index + 2);
+  }
+  if (next === "]") {
+    return skipOscSequence(value, index + 2);
+  }
+  return Math.min(value.length, index + 2);
+}
+function skipCsiSequence(value, index) {
+  while (index < value.length) {
+    const codePoint = value.charCodeAt(index);
+    index += 1;
+    if (codePoint >= 64 && codePoint <= 126) {
+      break;
+    }
+  }
+  return index;
+}
+function skipOscSequence(value, index) {
+  while (index < value.length) {
+    if (value[index] === "\x07") {
+      return index + 1;
+    }
+    if (value[index] === "\x1B" && value[index + 1] === "\\") {
+      return index + 2;
+    }
+    index += 1;
+  }
+  return index;
+}
+
+// packages/toolcraft-design/src/prompts/primitives/log.ts
+function renderMarkdownInline(value) {
+  return stripAnsi(value).replaceAll("\r\n", " ").replaceAll("\n", " ").replaceAll("\r", " ");
+}
+function writeTerminalMessage(msg, {
+  symbol: symbol2 = color.gray("\u2502"),
+  secondarySymbol = color.gray("\u2502"),
+  spacing: spacing2 = 1,
+  withGuide = true
+} = {}) {
+  const lines = [];
+  const showGuide = withGuide !== false;
+  const contentLines = msg.split("\n");
+  const prefix = showGuide ? `${symbol2}  ` : "";
+  const continuationPrefix = showGuide ? `${secondarySymbol}  ` : "";
+  const emptyGuide = showGuide ? secondarySymbol : "";
+  for (let index = 0; index < spacing2; index += 1) {
+    lines.push(emptyGuide);
+  }
+  if (contentLines.length === 0) {
+    process.stdout.write("\n");
+    return;
+  }
+  const [firstLine = "", ...continuationLines] = contentLines;
+  if (firstLine.length > 0) {
+    lines.push(`${prefix}${firstLine}`);
+  } else {
+    lines.push(showGuide ? symbol2 : "");
+  }
+  for (const line of continuationLines) {
+    if (line.length > 0) {
+      lines.push(`${continuationPrefix}${line}`);
+      continue;
+    }
+    lines.push(emptyGuide);
+  }
+  process.stdout.write(`${lines.join("\n")}
+`);
+}
+function message(msg, options) {
+  const format = resolveOutputFormat();
+  if (format === "markdown") {
+    process.stdout.write(`- ${renderMarkdownInline(msg)}
+`);
+    return;
+  }
+  if (format === "json") {
+    process.stdout.write(
+      `${JSON.stringify({ level: "message", message: stripAnsi(msg) })}
+`
+    );
+    return;
+  }
+  writeTerminalMessage(msg, options);
+}
+function info(msg) {
+  const format = resolveOutputFormat();
+  if (format === "markdown") {
+    process.stdout.write(`- **info:** ${renderMarkdownInline(msg)}
+`);
+    return;
+  }
+  if (format === "json") {
+    process.stdout.write(
+      `${JSON.stringify({ level: "info", message: stripAnsi(msg) })}
+`
+    );
+    return;
+  }
+  message(msg, { symbol: symbols.info });
+}
+function success(msg) {
+  const format = resolveOutputFormat();
+  if (format === "markdown") {
+    process.stdout.write(`- **success:** ${renderMarkdownInline(msg)}
+`);
+    return;
+  }
+  if (format === "json") {
+    process.stdout.write(
+      `${JSON.stringify({ level: "success", message: stripAnsi(msg) })}
+`
+    );
+    return;
+  }
+  message(msg, { symbol: symbols.success });
+}
+function warn(msg) {
+  const format = resolveOutputFormat();
+  if (format === "markdown") {
+    process.stdout.write(`- **warning:** ${renderMarkdownInline(msg)}
+`);
+    return;
+  }
+  if (format === "json") {
+    process.stdout.write(
+      `${JSON.stringify({ level: "warn", message: stripAnsi(msg) })}
+`
+    );
+    return;
+  }
+  message(msg, { symbol: color.yellow("\u25B2") });
+}
+function error(msg) {
+  const format = resolveOutputFormat();
+  if (format === "markdown") {
+    process.stdout.write(`- **error:** ${renderMarkdownInline(msg)}
+`);
+    return;
+  }
+  if (format === "json") {
+    process.stdout.write(
+      `${JSON.stringify({ level: "error", message: stripAnsi(msg) })}
+`
+    );
+    return;
+  }
+  message(msg, { symbol: color.red("\u25A0") });
+}
+var log = {
+  info,
+  success,
+  message,
+  warn,
+  error
+};
+
+// packages/toolcraft-design/src/components/logger.ts
+function createLogger(emitter) {
+  const emit = (level, message2) => {
+    if (emitter) {
+      emitter(message2);
+      return;
+    }
+    if (level === "success") {
+      log.success(message2);
+      return;
+    }
+    if (level === "warn") {
+      log.warn(message2);
+      return;
+    }
+    if (level === "error") {
+      log.error(message2);
+      return;
+    }
+    log.info(message2);
+  };
+  return {
+    info(message2) {
+      emit("info", message2);
+    },
+    success(message2) {
+      emit("success", message2);
+    },
+    warn(message2) {
+      emit("warn", message2);
+    },
+    error(message2) {
+      emit("error", message2);
+    },
+    resolved(label, value) {
+      if (emitter) {
+        emitter(`${label}: ${value}`);
+        return;
+      }
+      log.message(`${label}
+   ${value}`, { symbol: symbols.resolved });
+    },
+    errorResolved(label, value) {
+      if (emitter) {
+        emitter(`${label}: ${value}`);
+        return;
+      }
+      log.message(`${label}
+   ${value}`, { symbol: symbols.errorResolved });
+    },
+    message(message2, symbol2) {
+      if (emitter) {
+        emitter(message2);
+        return;
+      }
+      log.message(message2, { symbol: symbol2 ?? color.gray("\u2502") });
+    }
+  };
+}
+var logger = createLogger();
+
+// packages/toolcraft-design/src/components/help-formatter.ts
+var graphemeSegmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+
+// packages/toolcraft-design/src/components/table.ts
+var graphemeSegmenter2 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+
+// packages/toolcraft-design/src/components/detail-card.ts
+import stringWidth from "fast-string-width";
+import { wrapAnsi } from "fast-wrap-ansi";
+
+// packages/toolcraft-design/src/components/browser.ts
+import { spawn as spawn2 } from "node:child_process";
+import process2 from "node:process";
+
+// packages/toolcraft-design/src/terminal-markdown/parser/code-highlight.ts
+var codeLanguages = [
+  {
+    id: "javascript",
+    aliases: ["js", "javascript", "mjs", "cjs", "es6"],
+    family: "lexical",
+    spec: "javascript"
+  },
+  { id: "javascriptreact", aliases: ["jsx"], family: "lexical", spec: "javascript" },
+  {
+    id: "typescript",
+    aliases: ["ts", "typescript", "mts", "cts"],
+    family: "lexical",
+    spec: "typescript"
+  },
+  { id: "typescriptreact", aliases: ["tsx"], family: "lexical", spec: "typescript" },
+  { id: "json", aliases: ["json"], family: "data", spec: "json" },
+  { id: "jsonc", aliases: ["jsonc"], family: "data", spec: "jsonc" },
+  { id: "jsonl", aliases: ["jsonl"], family: "data", spec: "json" },
+  { id: "yaml", aliases: ["yaml", "yml"], family: "data", spec: "yaml" },
+  { id: "css", aliases: ["css"], family: "style", spec: "css" },
+  { id: "scss", aliases: ["scss"], family: "style", spec: "css" },
+  { id: "sass", aliases: ["sass"], family: "style", spec: "css" },
+  { id: "less", aliases: ["less"], family: "style", spec: "css" },
+  { id: "postcss", aliases: ["postcss"], family: "style", spec: "css" },
+  { id: "shellscript", aliases: ["sh", "bash", "shell", "shellscript", "zsh", "fish"], family: "lexical", spec: "shell" },
+  { id: "python", aliases: ["py", "python"], family: "lexical", spec: "python" },
+  { id: "sql", aliases: ["sql", "ddl", "dml"], family: "lexical", spec: "sql" },
+  { id: "html", aliases: ["html"], family: "markup", spec: "html" },
+  { id: "xml", aliases: ["xml", "svg"], family: "markup", spec: "xml" },
+  { id: "markdown", aliases: ["md", "markdown"], family: "line", spec: "markdown" },
+  { id: "diff", aliases: ["diff", "patch"], family: "line", spec: "diff" },
+  { id: "dockerfile", aliases: ["dockerfile", "docker"], family: "line", spec: "dockerfile" },
+  { id: "ini", aliases: ["ini", "properties"], family: "data", spec: "ini" },
+  { id: "toml", aliases: ["toml"], family: "data", spec: "toml" },
+  { id: "plaintext", aliases: ["text", "txt", "plain", "plaintext"], plain: true },
+  { id: "ruby", aliases: ["rb", "ruby"], family: "lexical", spec: "ruby" },
+  { id: "go", aliases: ["go", "golang"], family: "lexical", spec: "go" },
+  { id: "java", aliases: ["java"], family: "lexical", spec: "java" },
+  { id: "kotlin", aliases: ["kt", "kotlin", "kts"], family: "lexical", spec: "kotlin" },
+  { id: "swift", aliases: ["swift"], family: "lexical", spec: "swift" },
+  { id: "dart", aliases: ["dart"], family: "lexical", spec: "dart" },
+  { id: "scala", aliases: ["scala", "sc"], family: "lexical", spec: "scala" },
+  { id: "groovy", aliases: ["groovy", "gvy", "gy", "gsp"], family: "lexical", spec: "groovy" },
+  { id: "c", aliases: ["c"], family: "lexical", spec: "c" },
+  { id: "cpp", aliases: ["cpp", "c++", "cc", "cxx"], family: "lexical", spec: "cpp" },
+  { id: "csharp", aliases: ["cs", "csharp", "c#"], family: "lexical", spec: "csharp" },
+  { id: "objective-c", aliases: ["objc", "objectivec", "objective-c", "m", "mm"], family: "lexical", spec: "objectivec" },
+  { id: "rust", aliases: ["rs", "rust"], family: "lexical", spec: "rust" },
+  { id: "php", aliases: ["php"], family: "lexical", spec: "php" },
+  { id: "lua", aliases: ["lua"], family: "lexical", spec: "lua" },
+  { id: "perl", aliases: ["pl", "perl", "pm"], family: "lexical", spec: "perl" },
+  { id: "r", aliases: ["r", "rscript"], family: "lexical", spec: "r" },
+  { id: "powershell", aliases: ["ps1", "powershell", "pwsh"], family: "lexical", spec: "powershell" },
+  { id: "elixir", aliases: ["ex", "exs", "elixir"], family: "lexical", spec: "elixir" },
+  { id: "erlang", aliases: ["erl", "erlang", "hrl"], family: "lexical", spec: "erlang" },
+  { id: "haskell", aliases: ["hs", "haskell"], family: "lexical", spec: "haskell" },
+  { id: "clojure", aliases: ["clj", "cljs", "cljc", "clojure"], family: "lexical", spec: "clojure" },
+  { id: "fsharp", aliases: ["fs", "fsi", "fsx", "fsharp"], family: "lexical", spec: "fsharp" },
+  { id: "vb", aliases: ["vb", "vbnet"], family: "lexical", spec: "vb" },
+  { id: "graphql", aliases: ["graphql", "gql"], family: "lexical", spec: "graphql" },
+  { id: "protobuf", aliases: ["proto", "protobuf"], family: "lexical", spec: "protobuf" },
+  { id: "hcl", aliases: ["hcl", "tf", "terraform"], family: "lexical", spec: "hcl" },
+  { id: "nginx", aliases: ["nginx", "nginxconf"], family: "lexical", spec: "nginx" },
+  { id: "makefile", aliases: ["makefile", "mk"], family: "lexical", spec: "makefile" },
+  { id: "cmake", aliases: ["cmake"], family: "lexical", spec: "cmake" },
+  { id: "gradle", aliases: ["gradle"], family: "lexical", spec: "groovy" },
+  { id: "env", aliases: ["env", "dotenv"], family: "data", spec: "ini" },
+  { id: "vue", aliases: ["vue"], family: "markup", spec: "html" },
+  { id: "svelte", aliases: ["svelte"], family: "markup", spec: "html" }
+];
+var languageByAlias = /* @__PURE__ */ new Map();
+for (const language of codeLanguages) {
+  languageByAlias.set(language.id.toLowerCase(), language);
+  for (const alias of language.aliases) {
+    languageByAlias.set(alias.toLowerCase(), language);
+  }
+}
+var jsKeywords = /* @__PURE__ */ new Set([
+  "as",
+  "async",
+  "await",
+  "break",
+  "case",
+  "catch",
+  "class",
+  "const",
+  "continue",
+  "debugger",
+  "default",
+  "delete",
+  "do",
+  "else",
+  "export",
+  "extends",
+  "finally",
+  "for",
+  "from",
+  "function",
+  "get",
+  "if",
+  "import",
+  "in",
+  "instanceof",
+  "let",
+  "new",
+  "of",
+  "return",
+  "set",
+  "static",
+  "super",
+  "switch",
+  "throw",
+  "try",
+  "typeof",
+  "var",
+  "void",
+  "while",
+  "with",
+  "yield"
+]);
+var tsKeywords = /* @__PURE__ */ new Set([
+  ...jsKeywords,
+  "abstract",
+  "declare",
+  "enum",
+  "implements",
+  "interface",
+  "keyof",
+  "namespace",
+  "private",
+  "protected",
+  "public",
+  "readonly",
+  "satisfies",
+  "type"
+]);
+var cKeywords = /* @__PURE__ */ new Set(["auto", "break", "case", "const", "continue", "default", "do", "else", "enum", "extern", "for", "goto", "if", "inline", "register", "restrict", "return", "sizeof", "static", "struct", "switch", "typedef", "union", "volatile", "while"]);
+var cTypes = /* @__PURE__ */ new Set(["bool", "char", "double", "float", "int", "int16_t", "int32_t", "int64_t", "int8_t", "long", "short", "size_t", "uint16_t", "uint32_t", "uint64_t", "uint8_t", "void"]);
+var cppKeywords = /* @__PURE__ */ new Set([...cKeywords, "alignas", "alignof", "and", "bitand", "bitor", "catch", "class", "concept", "constexpr", "consteval", "constinit", "decltype", "delete", "explicit", "export", "friend", "mutable", "namespace", "new", "noexcept", "not", "operator", "or", "private", "protected", "public", "requires", "template", "this", "throw", "try", "typename", "using", "virtual", "xor"]);
+var cppTypes = /* @__PURE__ */ new Set([...cTypes, "auto", "bool", "char16_t", "char32_t", "std", "string", "wstring"]);
+var objectiveCKeywords = /* @__PURE__ */ new Set([...cKeywords, "@autoreleasepool", "@catch", "@class", "@dynamic", "@end", "@finally", "@implementation", "@import", "@interface", "@optional", "@package", "@private", "@property", "@protected", "@protocol", "@public", "@selector", "@synthesize", "@throw", "@try", "YES", "NO", "nil", "self", "super"]);
+var objectiveCTypes = /* @__PURE__ */ new Set([...cTypes, "BOOL", "Class", "CGFloat", "NSInteger", "NSObject", "NSString", "NSUInteger", "SEL", "id"]);
+
+// packages/toolcraft-design/src/dashboard/terminal-width.ts
+var graphemeSegmenter3 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+
+// packages/toolcraft-design/src/acp/writer.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage = new AsyncLocalStorage2();
+
+// packages/toolcraft-design/src/dashboard/terminal.ts
+import readline from "node:readline";
+import { PassThrough } from "node:stream";
+
+// packages/toolcraft-design/src/explorer/state.ts
+var REGION_HEADER = 1 << 0;
+var REGION_LIST = 1 << 1;
+var REGION_DETAIL = 1 << 2;
+var REGION_FOOTER = 1 << 3;
+var REGION_MODAL = 1 << 4;
+var REGION_TOAST = 1 << 5;
+var REGION_ALL = REGION_HEADER | REGION_LIST | REGION_DETAIL | REGION_FOOTER | REGION_MODAL | REGION_TOAST;
+
+// packages/toolcraft-design/src/prompts/interactive/glyphs.ts
+function supportsUnicode() {
+  if (!process.platform.startsWith("win")) {
+    return process.env.TERM !== "linux";
+  }
+  return Boolean(
+    process.env.CI || process.env.WT_SESSION || process.env.TERMINUS_SUBLIME || process.env.ConEmuTask === "{cmd::Cmder}" || process.env.TERM_PROGRAM === "Terminus-Sublime" || process.env.TERM_PROGRAM === "vscode" || process.env.TERM === "xterm-256color" || process.env.TERM === "alacritty" || process.env.TERMINAL_EMULATOR === "JetBrains-JediTerm"
+  );
+}
+var UNICODE = supportsUnicode();
+function glyph(unicode, ascii) {
+  return UNICODE ? unicode : ascii;
+}
+var GLYPHS = {
+  stepActive: glyph("\u25C6", "*"),
+  stepCancel: glyph("\u25A0", "x"),
+  stepError: glyph("\u25B2", "x"),
+  stepSubmit: glyph("\u25C7", "o"),
+  barStart: glyph("\u250C", "T"),
+  bar: glyph("\u2502", "|"),
+  barEnd: glyph("\u2514", "-"),
+  radioActive: glyph("\u25CF", ">"),
+  radioInactive: glyph("\u25CB", " "),
+  checkboxActive: "[ ]",
+  checkboxSelected: "[x]",
+  checkboxInactive: "[ ]",
+  passwordMask: glyph("\u2022", "*"),
+  ellipsis: "..."
+};
+
+// packages/toolcraft-design/src/prompts/interactive/core.ts
+import { EventEmitter } from "node:events";
+import * as readline2 from "node:readline";
+
+// packages/toolcraft-design/src/prompts/interactive/wrap.ts
+import { wrapAnsi as wrapAnsi2 } from "fast-wrap-ansi";
+import stringWidth2 from "fast-string-width";
+
+// packages/toolcraft-design/src/prompts/interactive/pagination.ts
+import { wrapAnsi as wrapAnsi3 } from "fast-wrap-ansi";
+
+// packages/toolcraft-design/src/static/spinner.ts
+var SPINNER_FRAMES = Object.freeze(["\u25D2", "\u25D0", "\u25D3", "\u25D1"]);
+
+// packages/config-extends/src/prompt-document.ts
+import { readFile, realpath } from "node:fs/promises";
+import path7 from "node:path";
+
+// packages/config-mutations/src/execution/apply-mutation.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import path9 from "node:path";
+
+// packages/config-mutations/src/formats/json.ts
+import * as jsonc from "jsonc-parser";
+
+// packages/config-mutations/src/formats/toml.ts
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+
+// packages/config-mutations/src/formats/yaml.ts
+import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
+
+// packages/config-mutations/src/execution/path-utils.ts
+import path8 from "node:path";
+
+// packages/poe-code-config/src/store.ts
+var EMPTY_DOCUMENT = `${JSON.stringify({}, null, 2)}
+`;
+
+// packages/poe-code-config/src/inspect.ts
+import path11 from "node:path";
+var EMPTY_DOCUMENT2 = `${JSON.stringify({}, null, 2)}
+`;
+
+// packages/poe-code-config/src/configured-services.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import path12 from "node:path";
+
+// packages/agent-defs/src/agents/claude-code.ts
+var claudeCodeAgent = {
+  id: "claude-code",
+  name: "claude-code",
+  label: "Claude Code",
+  summary: "Anthropic's agentic coding tool for the terminal.",
+  aliases: ["claude"],
+  binaryName: "claude",
+  apiShapes: ["anthropic-messages"],
+  otelCapture: {
+    env: {
+      CLAUDE_CODE_ENABLE_TELEMETRY: "1"
+    }
+  },
+  configPath: "~/.claude.json",
+  capabilities: ["spawn", "configure", "install", "test", "skill", "mcp"],
+  branding: {
+    colors: {
+      dark: "#C15F3C",
+      light: "#C15F3C"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/claude-desktop.ts
+var claudeDesktopAgent = {
+  id: "claude-desktop",
+  name: "claude-desktop",
+  label: "Claude Desktop",
+  summary: "Anthropic's official desktop application for Claude",
+  configPath: "~/.config/Claude/claude_desktop_config.json",
+  configPaths: {
+    darwin: "~/Library/Application Support/Claude/claude_desktop_config.json",
+    linux: "~/.config/Claude/claude_desktop_config.json",
+    win32: "~/AppData/Roaming/Claude/claude_desktop_config.json"
+  },
+  capabilities: ["mcp"],
+  branding: {
+    colors: {
+      dark: "#D97757",
+      light: "#D97757"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/codex.ts
+var codexAgent = {
+  id: "codex",
+  name: "codex",
+  label: "Codex",
+  summary: "OpenAI's coding agent for the terminal.",
+  binaryName: "codex",
+  apiShapes: ["openai-responses"],
+  otelCapture: {
+    args: (endpoint, content) => [
+      "-c",
+      `otel.trace_exporter={"otlp-http"={endpoint=${JSON.stringify(`${endpoint}/v1/traces`)},protocol="json"}}`,
+      "-c",
+      `otel.exporter={"otlp-http"={endpoint=${JSON.stringify(`${endpoint}/v1/logs`)},protocol="json"}}`,
+      "-c",
+      `otel.log_user_prompt=${content}`
+    ]
+  },
+  configPath: "~/.codex/config.toml",
+  capabilities: ["spawn", "configure", "install", "test", "skill", "mcp"],
+  branding: {
+    colors: {
+      dark: "#D5D9DF",
+      light: "#7A7F86"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/cursor.ts
+var cursorAgent = {
+  id: "cursor",
+  name: "cursor",
+  aliases: ["cursor-agent"],
+  label: "Cursor",
+  summary: "Cursor's CLI coding agent.",
+  binaryName: "cursor-agent",
+  configPath: "~/.cursor/mcp.json",
+  capabilities: ["spawn", "configure", "install", "test", "skill", "mcp"],
+  branding: {
+    colors: {
+      dark: "#FFFFFF",
+      light: "#000000"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/gemini-cli.ts
+var geminiCliAgent = {
+  id: "gemini-cli",
+  name: "gemini-cli",
+  aliases: ["gemini"],
+  label: "Gemini CLI",
+  summary: "Google's open-source AI agent for the terminal.",
+  binaryName: "gemini",
+  configPath: "~/.gemini/settings.json",
+  apiShapes: ["google-generations"],
+  capabilities: ["spawn", "configure", "install", "test", "skill"],
+  branding: {
+    colors: {
+      dark: "#8AB4F8",
+      light: "#1A73E8"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/opencode.ts
+var openCodeAgent = {
+  id: "opencode",
+  name: "opencode",
+  label: "OpenCode CLI",
+  summary: "Open-source AI coding agent for the terminal.",
+  binaryName: "opencode",
+  apiShapes: ["openai-chat-completions"],
+  otelCapture: {
+    env: {
+      OPENCODE_CONFIG_CONTENT: '{"experimental":{"openTelemetry":true}}'
+    }
+  },
+  configPath: "~/.config/opencode/opencode.json",
+  capabilities: ["spawn", "configure", "install", "test", "skill", "mcp"],
+  branding: {
+    colors: {
+      dark: "#4A4F55",
+      light: "#2F3338"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/kimi.ts
+var kimiAgent = {
+  id: "kimi",
+  name: "kimi",
+  label: "Kimi",
+  summary: "Moonshot AI's coding agent for the terminal.",
+  aliases: ["kimi-cli"],
+  binaryName: "kimi",
+  apiShapes: ["openai-chat-completions"],
+  configPath: "~/.kimi/mcp.json",
+  capabilities: ["spawn", "configure", "install", "test", "mcp"],
+  branding: {
+    colors: {
+      dark: "#7B68EE",
+      light: "#6A5ACD"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/goose.ts
+var gooseAgent = {
+  id: "goose",
+  name: "goose",
+  label: "Goose",
+  summary: "Block's open-source AI agent with ACP support.",
+  binaryName: "goose",
+  apiShapes: ["openai-chat-completions"],
+  otelCapture: {},
+  configPath: "~/.config/goose/config.yaml",
+  capabilities: ["spawn", "configure", "install", "test", "skill", "mcp"],
+  branding: {
+    colors: {
+      dark: "#FF6B35",
+      light: "#E85D26"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/pi.ts
+var piAgent = {
+  id: "pi",
+  name: "pi",
+  aliases: ["pi-agent"],
+  label: "Pi",
+  summary: "Minimal AI coding agent for the terminal.",
+  binaryName: "pi",
+  capabilities: ["spawn"],
+  branding: {
+    colors: {
+      dark: "#F2F2F2",
+      light: "#242424"
+    }
+  }
+};
+
+// packages/agent-defs/src/agents/poe-agent.ts
+var poeAgentAgent = {
+  id: "poe-agent",
+  name: "poe-agent",
+  label: "Poe Agent",
+  summary: "Run one-shot prompts with the built-in Poe agent runtime.",
+  apiShapes: ["openai-responses", "openai-chat-completions"],
+  configPath: "~/.poe-code/config.json",
+  capabilities: ["configure"],
+  branding: {
+    colors: {
+      dark: "#A465F7",
+      light: "#7A3FD3"
+    }
+  }
+};
+
+// packages/agent-defs/src/registry.ts
+function freezeAgent(agent) {
+  if (agent.aliases !== void 0) {
+    Object.freeze(agent.aliases);
+  }
+  if (agent.apiShapes !== void 0) {
+    Object.freeze(agent.apiShapes);
+  }
+  if (agent.capabilities !== void 0) {
+    Object.freeze(agent.capabilities);
+  }
+  if (agent.otelCapture?.env !== void 0) {
+    Object.freeze(agent.otelCapture.env);
+  }
+  if (agent.otelCapture !== void 0) {
+    Object.freeze(agent.otelCapture);
+  }
+  Object.freeze(agent.branding.colors);
+  Object.freeze(agent.branding);
+  return Object.freeze(agent);
+}
+var allAgents = Object.freeze([
+  freezeAgent(claudeCodeAgent),
+  freezeAgent(claudeDesktopAgent),
+  freezeAgent(codexAgent),
+  freezeAgent(cursorAgent),
+  freezeAgent(geminiCliAgent),
+  freezeAgent(openCodeAgent),
+  freezeAgent(kimiAgent),
+  freezeAgent(gooseAgent),
+  freezeAgent(piAgent),
+  freezeAgent(poeAgentAgent)
+]);
+var lookup = /* @__PURE__ */ new Map();
+for (const agent of allAgents) {
+  const values = [agent.id, agent.name, ...agent.aliases ?? []];
+  for (const value of values) {
+    const normalized = value.toLowerCase();
+    if (!lookup.has(normalized)) {
+      lookup.set(normalized, agent.id);
+    }
+  }
+}
+
+// packages/providers/src/auth/api-key.ts
+function requireApiKeyAuth(provider) {
+  if (provider.auth.kind !== "api-key") {
+    throw new Error(
+      `Provider ${provider.id} does not use api-key auth (got ${provider.auth.kind}).`
+    );
+  }
+  return provider.auth;
+}
+async function acquireApiKey(provider, options, context) {
+  const auth = requireApiKeyAuth(provider);
+  const candidate = options.apiKey ?? await context.promptForSecret?.(auth.prompt);
+  const trimmed = candidate?.trim();
+  if (!trimmed) {
+    throw new Error(
+      `No API key available for provider "${provider.id}". Pass --api-key or run interactively.`
+    );
+  }
+  return trimmed;
+}
+var apiKeyAuthStrategy = {
+  async login(provider, options, context) {
+    const apiKey = await acquireApiKey(provider, options, context);
+    await context.secretStore.set(apiKey);
+    return apiKey;
+  },
+  async logout(_provider, context) {
+    await context.secretStore.delete();
+  },
+  async isLoggedIn(_provider, context) {
+    const value = await context.secretStore.get({ readOnly: context.readOnly });
+    return typeof value === "string" && value.trim().length > 0;
+  },
+  async resolveCredential(provider, context) {
+    requireApiKeyAuth(provider);
+    const value = await context.secretStore.get({ readOnly: context.readOnly });
+    if (!value || value.trim().length === 0) {
+      throw new Error(
+        `No stored credential for provider "${provider.id}". Run \`poe-code provider login ${provider.id}\`.`
+      );
+    }
+    return value.trim();
+  }
+};
+
+// packages/providers/src/compatibility.ts
+function resolveApiShape(provider, agent) {
+  if (!provider.apiShapes || !agent.apiShapes) {
+    return void 0;
+  }
+  for (const shapeId of agent.apiShapes) {
+    if (provider.apiShapes.some((shape) => shape.id === shapeId)) {
+      return shapeId;
+    }
+  }
+  return void 0;
+}
+
+// packages/providers/src/registry.ts
+var ProviderRegistry = class {
+  providers;
+  byId;
+  storeFactory;
+  envVars;
+  constructor(providers, storeFactory, options) {
+    const byId = /* @__PURE__ */ new Map();
+    const storageKeys = /* @__PURE__ */ new Map();
+    for (const provider of providers) {
+      const providerId = provider.id.trim();
+      if (providerId.length === 0) {
+        throw new Error("Provider id must not be blank.");
+      }
+      if (provider.id !== providerId) {
+        throw new Error(
+          `Provider id must not include surrounding whitespace: ${JSON.stringify(provider.id)}`
+        );
+      }
+      if (byId.has(providerId)) {
+        throw new Error(`Duplicate provider id: ${providerId}`);
+      }
+      if (provider.auth.kind === "api-key") {
+        if (storageKeys.has(provider.auth.storageKey)) {
+          throw new Error(
+            `Duplicate provider credential storage key: ${provider.auth.storageKey}`
+          );
+        }
+        storageKeys.set(provider.auth.storageKey, providerId);
+      }
+      byId.set(providerId, provider);
+    }
+    this.providers = Object.freeze([...providers]);
+    this.byId = byId;
+    this.storeFactory = storeFactory;
+    this.envVars = options?.envVars ?? {};
+  }
+  list() {
+    return this.providers;
+  }
+  get(id) {
+    return this.byId.get(id);
+  }
+  forAgent(agent) {
+    return this.providers.filter((provider) => {
+      return resolveApiShape(provider, agent) !== void 0;
+    });
+  }
+  async isLoggedIn(id, options = {}) {
+    const provider = this.requireProvider(id);
+    if (provider.auth.kind === "api-key") {
+      const envValue = readOwnEnvValue(this.envVars, provider.auth.envVar);
+      if (typeof envValue === "string" && envValue.trim().length > 0) {
+        return true;
+      }
+    }
+    const store = this.requireStore(provider);
+    const credential = await store.get({ readOnly: options.readOnly });
+    return typeof credential === "string" && credential.trim().length > 0;
+  }
+  async login(id, options, context) {
+    const provider = this.requireProvider(id);
+    const store = context?.store ?? this.requireStore(provider);
+    if (provider.auth.kind !== "api-key") {
+      throw new Error(`Provider "${id}" does not use api-key auth.`);
+    }
+    const auth = provider.auth;
+    const envApiKey = readOwnEnvValue(context?.envVars ?? this.envVars, auth.envVar);
+    const resolvedApiKey = options.apiKey ?? (typeof envApiKey === "string" && envApiKey.trim() ? envApiKey : void 0);
+    if (auth.preferredLogin && context?.resolvePreferredLogin) {
+      const apiKey = normalizeRequiredCredential(provider.id, await context.resolvePreferredLogin({
+        provider,
+        apiKey: options.apiKey,
+        envValue: typeof envApiKey === "string" ? envApiKey : void 0
+      }));
+      await store.set(apiKey);
+      return;
+    }
+    await apiKeyAuthStrategy.login(
+      provider,
+      { apiKey: resolvedApiKey },
+      { secretStore: store, promptForSecret: context?.promptForSecret }
+    );
+  }
+  async resolveCredential(id, options = {}, context) {
+    const provider = this.requireProvider(id);
+    if (provider.auth.kind !== "api-key") {
+      throw new Error(`Provider "${id}" does not use api-key auth.`);
+    }
+    if (options.apiKey !== void 0) {
+      return normalizeRequiredCredential(provider.id, options.apiKey);
+    }
+    const envVars = context?.envVars ?? this.envVars;
+    const envApiKey = readOwnEnvValue(envVars, provider.auth.envVar);
+    if (typeof envApiKey === "string" && envApiKey.trim().length > 0) {
+      return envApiKey.trim();
+    }
+    const store = this.requireStore(provider);
+    return apiKeyAuthStrategy.resolveCredential(provider, {
+      secretStore: store,
+      readOnly: context?.readOnly
+    });
+  }
+  async logout(id, options = {}) {
+    const provider = this.requireProvider(id);
+    const store = options.store ?? this.requireStore(provider);
+    await store.delete();
+  }
+  requireProvider(id) {
+    const provider = this.byId.get(id);
+    if (!provider) {
+      throw new Error(`Unknown provider: "${id}".`);
+    }
+    return provider;
+  }
+  requireStore(provider) {
+    if (!this.storeFactory) {
+      throw new Error(`No store factory configured for ProviderRegistry.`);
+    }
+    return this.storeFactory(provider);
+  }
+};
+function normalizeRequiredCredential(providerId, value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    throw new Error(`No API key available for provider "${providerId}".`);
+  }
+  return trimmed;
+}
+function readOwnEnvValue(envVars, name) {
+  return Object.prototype.hasOwnProperty.call(envVars, name) ? envVars[name] : void 0;
+}
+
+// packages/providers/src/types.ts
+function defineProvider(provider) {
+  if (provider.auth.kind === "api-key") {
+    Object.freeze(provider.auth.prompt);
+  }
+  Object.freeze(provider.auth);
+  for (const shape of provider.apiShapes ?? []) {
+    Object.freeze(shape);
+  }
+  if (provider.apiShapes !== void 0) {
+    Object.freeze(provider.apiShapes);
+  }
+  if (provider.modelInput !== void 0) {
+    Object.freeze(provider.modelInput);
+  }
+  for (const source of Object.values(provider.env ?? {})) {
+    Object.freeze(source);
+  }
+  if (provider.env !== void 0) {
+    Object.freeze(provider.env);
+  }
+  return Object.freeze(provider);
+}
+
+// packages/providers/src/providers/poe.ts
+var POE_PROVIDER_ID = "poe";
+var poeProvider = defineProvider({
+  id: POE_PROVIDER_ID,
+  label: "Poe",
+  summary: "Route AI coding agents through Poe's API.",
+  baseUrl: "https://api.poe.com",
+  agentBaseUrl: "https://api.poe.com",
+  baseUrlEnvVar: "POE_BASE_URL",
+  baseUrlEnvPath: "v1",
+  agentBaseUrlPath: "",
+  auth: {
+    kind: "api-key",
+    envVar: "POE_API_KEY",
+    storageKey: "provider:poe",
+    prompt: { title: "Poe API key" },
+    preferredLogin: "oauth"
+  },
+  env: {
+    ANTHROPIC_CUSTOM_HEADERS: {
+      kind: "providerCredential",
+      prefix: "Authorization: Bearer "
+    }
+  },
+  apiShapes: [
+    {
+      id: "openai-chat-completions",
+      envBaseUrlPath: "v1"
+    },
+    {
+      id: "openai-responses",
+      envBaseUrlPath: "v1"
+    },
+    {
+      id: "anthropic-messages",
+      envBaseUrlPath: "anthropic"
+    }
+  ]
+});
+
+// packages/providers/src/provider-order.ts
+function orderAuthProviders(providers) {
+  return Object.freeze([...providers].sort(compareAuthProviders));
+}
+function compareAuthProviders(left, right) {
+  const rankDifference = authProviderRank(left) - authProviderRank(right);
+  if (rankDifference !== 0) {
+    return rankDifference;
+  }
+  return left.id.localeCompare(right.id);
+}
+function authProviderRank(provider) {
+  if (provider.auth.kind === "api-key" && provider.auth.preferredLogin === "oauth") {
+    return 0;
+  }
+  if (provider.requiresBaseUrl === true) {
+    return 2;
+  }
+  return 1;
+}
+
+// packages/providers/src/providers/anthropic.ts
+var anthropicProvider = defineProvider({
+  id: "anthropic",
+  label: "Anthropic",
+  summary: "Route AI coding agents through Anthropic's API.",
+  baseUrl: "https://api.anthropic.com",
+  auth: {
+    kind: "api-key",
+    envVar: "ANTHROPIC_API_KEY",
+    storageKey: "provider:anthropic",
+    prompt: { title: "Anthropic API key" }
+  },
+  env: {
+    ANTHROPIC_API_KEY: { kind: "providerCredential" }
+  },
+  apiShapes: [
+    {
+      id: "anthropic-messages"
+    }
+  ]
+});
+
+// packages/providers/src/providers/cloudflare.ts
+var cloudflareProvider = defineProvider({
+  id: "cloudflare",
+  label: "Cloudflare AI Gateway",
+  summary: "Route coding agents through Cloudflare AI Gateway.",
+  baseUrlEnvVar: "CF_AIG_BASE_URL",
+  requiresBaseUrl: true,
+  modelInput: { kind: "freeform" },
+  auth: {
+    kind: "api-key",
+    envVar: "CF_AIG_TOKEN",
+    storageKey: "provider:cloudflare",
+    prompt: { title: "Cloudflare AI Gateway token" }
+  },
+  env: {
+    ANTHROPIC_CUSTOM_HEADERS: {
+      kind: "providerCredential",
+      prefix: "Authorization: Bearer "
+    }
+  },
+  apiShapes: [
+    {
+      id: "openai-chat-completions",
+      baseUrlPath: "compat"
+    },
+    {
+      id: "openai-responses",
+      baseUrlPath: "openai"
+    },
+    {
+      id: "anthropic-messages",
+      baseUrlPath: "anthropic"
+    },
+    {
+      id: "google-generations",
+      baseUrlPath: "google-ai-studio"
+    }
+  ]
+});
+
+// packages/providers/src/providers/openai.ts
+var openaiProvider = defineProvider({
+  id: "openai",
+  label: "OpenAI",
+  summary: "Route AI coding agents through OpenAI's API.",
+  baseUrl: "https://api.openai.com/v1",
+  auth: {
+    kind: "api-key",
+    envVar: "OPENAI_API_KEY",
+    storageKey: "provider:openai",
+    prompt: { title: "OpenAI API key" }
+  },
+  apiShapes: [
+    {
+      id: "openai-responses"
+    },
+    {
+      id: "openai-chat-completions"
+    }
+  ]
+});
+
+// packages/providers/src/providers/generated.ts
+var allAuthProviders = orderAuthProviders([
+  anthropicProvider,
+  cloudflareProvider,
+  openaiProvider,
+  poeProvider
+]);
+
+// packages/poe-code-config/src/configured-services.ts
+var agentsById = new Map(allAgents.map((agent) => [agent.id, agent]));
+var defaultProviderRegistry = new ProviderRegistry(allAuthProviders);
+var EMPTY_DOCUMENT3 = `${JSON.stringify({}, null, 2)}
+`;
+
+// packages/poe-code-config/src/state/index.ts
+import os from "node:os";
+
+// packages/poe-code-config/src/state/jobs.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
+import path14 from "node:path";
+
+// packages/poe-code-config/src/state/fs.ts
+import * as nodeFs from "node:fs/promises";
+import path13 from "node:path";
+
+// packages/poe-code-config/src/state/templates.ts
+import { randomUUID as randomUUID6 } from "node:crypto";
+import path15 from "node:path";
+
+// src/cli/environment.ts
+var DEFAULT_POE_API_BASE_URL = "https://api.poe.com/v1";
+function resolvePoeApiBaseUrl(variables = process.env) {
+  return resolvePoeBaseUrls(variables).poeApiBaseUrl;
+}
+function resolvePoeBaseUrls(variables) {
+  const raw = Object.hasOwn(variables, "POE_BASE_URL") ? variables.POE_BASE_URL : void 0;
+  const baseInput = typeof raw === "string" && raw.trim().length > 0 ? raw.trim() : DEFAULT_POE_API_BASE_URL;
+  const parsed = parseUrl(baseInput);
+  if (!parsed) {
+    const trimmed = trimTrailingSlash(baseInput.trim());
+    return {
+      poeApiBaseUrl: ensureV1Suffix(trimmed),
+      poeBaseUrl: stripV1Suffix(trimmed)
+    };
+  }
+  const normalizedPath = normalizePath(parsed.pathname);
+  return {
+    poeApiBaseUrl: buildApiBaseUrl(parsed.origin, normalizedPath),
+    poeBaseUrl: buildPoeBaseUrl(parsed.origin, normalizedPath)
+  };
+}
+function parseUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+function normalizePath(pathname) {
+  if (pathname === "/" || pathname === "") {
+    return "";
+  }
+  if (pathname.endsWith("/")) {
+    return pathname.slice(0, -1);
+  }
+  return pathname;
+}
+function buildApiBaseUrl(origin, pathname) {
+  if (pathname === "" || pathname === "/") {
+    return `${origin}/v1`;
+  }
+  if (pathname.endsWith("/v1")) {
+    return `${origin}${pathname}`;
+  }
+  return `${origin}${pathname}/v1`;
+}
+function buildPoeBaseUrl(origin, pathname) {
+  if (pathname.endsWith("/v1")) {
+    const trimmed = pathname.slice(0, -3);
+    return trimmed.length > 0 ? `${origin}${trimmed}` : origin;
+  }
+  return pathname.length > 0 ? `${origin}${pathname}` : origin;
+}
+function trimTrailingSlash(value) {
+  if (value.length > 1 && value.endsWith("/")) {
+    return value.slice(0, -1);
+  }
+  if (value === "/") {
+    return "";
+  }
+  return value;
+}
+function ensureV1Suffix(value) {
+  if (value.endsWith("/v1")) {
+    return value;
+  }
+  if (value === "") {
+    return "/v1";
+  }
+  return `${value}/v1`;
+}
+function stripV1Suffix(value) {
+  if (value.endsWith("/v1")) {
+    return value.slice(0, -3);
+  }
+  return value;
+}
+
+// src/sdk/credentials.ts
+async function getPoeApiKey() {
+  const envKey = Object.hasOwn(process.env, "POE_API_KEY") ? process.env.POE_API_KEY : void 0;
+  if (typeof envKey === "string" && envKey.trim().length > 0) {
+    return envKey.trim();
+  }
+  const { store } = createSecretStore({
+    backendEnvVar: "POE_AUTH_BACKEND",
+    fileStore: {
+      salt: "poe-code:encrypted-file-auth-store:v1",
+      defaultDirectory: ".poe-code",
+      defaultFileName: "credentials.enc"
+    }
+  });
+  const storedKey = await store.get();
+  if (typeof storedKey === "string" && storedKey.trim().length > 0) {
+    return storedKey.trim();
+  }
+  throw new AuthenticationError("No API key found. Set POE_API_KEY or run 'poe-code login'.");
+}
+async function ensurePoeApiKeyEnv() {
+  const envKey = Object.hasOwn(process.env, "POE_API_KEY") ? process.env.POE_API_KEY : void 0;
+  if (typeof envKey === "string" && envKey.trim().length > 0) {
+    return;
+  }
+  process.env.POE_API_KEY = await getPoeApiKey();
+}
+async function getPoeAuthIdentity(options = {}) {
+  const apiKey = options.apiKey ?? await getPoeApiKey();
+  return fetchPoeAuthIdentity({
+    apiKey,
+    baseUrl: options.baseUrl ?? resolvePoeApiBaseUrl(options.variables),
+    httpClient: options.httpClient
+  });
+}
+async function fetchPoeAuthIdentity(options) {
+  const httpClient = options.httpClient ?? createDefaultHttpClient();
+  const response = await httpClient(`${trimTrailingSlashes(options.baseUrl ?? resolvePoeApiBaseUrl())}/whoami`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${options.apiKey}`
+    }
+  });
+  if (!response.ok) {
+    throw new ApiError(`Failed to fetch identity (HTTP ${response.status})`, {
+      httpStatus: response.status,
+      endpoint: "/v1/whoami"
+    });
+  }
+  return parsePoeAuthIdentity(await response.json());
+}
+function parsePoeAuthIdentity(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ApiError("Malformed identity response from Poe API.", {
+      endpoint: "/v1/whoami"
+    });
+  }
+  const identity = value;
+  if (typeof identity.user_id !== "number" || !Number.isFinite(identity.user_id) || typeof identity.handle !== "string" || identity.handle.trim().length === 0 || typeof identity.name !== "string" || identity.name.trim().length === 0 || typeof identity.profile_picture !== "string") {
+    throw new ApiError("Malformed identity response from Poe API.", {
+      endpoint: "/v1/whoami"
+    });
+  }
+  return value;
+}
+function createDefaultHttpClient() {
+  return async (url, init) => {
+    const response = await globalThis.fetch(url, init);
+    return {
+      ok: response.ok,
+      status: response.status,
+      json: () => response.json()
+    };
+  };
+}
+function trimTrailingSlashes(value) {
+  return value.replace(/\/+$/, "");
+}
+export {
+  ensurePoeApiKeyEnv,
+  fetchPoeAuthIdentity,
+  getPoeApiKey,
+  getPoeAuthIdentity
+};
+//# sourceMappingURL=credentials.js.map