zidane 5.13.26 → 5.14.0

package/dist/providers-DgmdYGKm.js

@@ -0,0 +1,168 @@
+import { m as openaiCompat } from "./openai-compat-0Y7jcncn.js";
+import { i as resolveOAuthApiKey } from "./oauth-8LqbeI_Q.js";
+import { r as generatePkce } from "./xai-tPdbAGkq.js";
+//#region src/chat/oauth-page/cursor.ts
+/** pi-ai / zidane OAuth provider id. Also the credentials-file key. */
+const CURSOR_OAUTH_PROVIDER_ID = "cursor";
+const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
+const CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
+const CURSOR_REFRESH_URL = "https://api2.cursor.sh/auth/exchange_user_api_key";
+const POLL_MAX_ATTEMPTS = 150;
+const POLL_BASE_DELAY_MS = 1e3;
+const POLL_MAX_DELAY_MS = 1e4;
+const POLL_BACKOFF_MULTIPLIER = 1.2;
+const POLL_MAX_CONSECUTIVE_ERRORS = 3;
+/** Fallback lifetime when the JWT carries no `exp`. */
+const DEFAULT_TOKEN_TTL_MS = 3600 * 1e3;
+/** Refresh slightly early so requests don't race expiry. */
+const TOKEN_EXPIRY_SKEW_MS = 300 * 1e3;
+/**
+* Derive expiry (epoch ms) from a JWT's `exp` claim, minus a safety skew.
+* Returns `now + 1h` for malformed tokens so a missing claim never wedges
+* refresh into an immediate-expire loop.
+*/
+function cursorTokenExpiry(token) {
+	try {
+		const parts = token.split(".");
+		const payload = parts[1];
+		if (parts.length !== 3 || !payload) return Date.now() + DEFAULT_TOKEN_TTL_MS;
+		const json = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+		if (typeof json.exp === "number") return json.exp * 1e3 - TOKEN_EXPIRY_SKEW_MS;
+	} catch {}
+	return Date.now() + DEFAULT_TOKEN_TTL_MS;
+}
+function delay(ms) {
+	return new Promise((r) => setTimeout(r, ms));
+}
+/**
+* Poll Cursor's auth endpoint until login completes. `404` means the user
+* hasn't finished the browser flow yet; anything else non-2xx is a hard error.
+*/
+async function pollForTokens(uuid, verifier, callbacks) {
+	let wait = POLL_BASE_DELAY_MS;
+	let consecutiveErrors = 0;
+	for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
+		if (callbacks.signal?.aborted) throw new Error("Cursor login aborted");
+		await delay(wait);
+		try {
+			const url = `${CURSOR_POLL_URL}?uuid=${encodeURIComponent(uuid)}&verifier=${encodeURIComponent(verifier)}`;
+			const response = await fetch(url, { signal: callbacks.signal });
+			if (response.status === 404) {
+				consecutiveErrors = 0;
+				wait = Math.min(wait * POLL_BACKOFF_MULTIPLIER, POLL_MAX_DELAY_MS);
+				continue;
+			}
+			if (response.ok) {
+				const data = await response.json();
+				if (!data.accessToken || !data.refreshToken) throw new Error(`Cursor poll response missing tokens: ${JSON.stringify(data)}`);
+				return {
+					accessToken: data.accessToken,
+					refreshToken: data.refreshToken
+				};
+			}
+			throw new Error(`Cursor poll failed (${response.status})`);
+		} catch (err) {
+			if (callbacks.signal?.aborted) throw new Error("Cursor login aborted");
+			consecutiveErrors++;
+			if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS) throw err instanceof Error ? err : new Error(String(err));
+			callbacks.onProgress?.("Waiting for Cursor login to complete…");
+		}
+	}
+	throw new Error("Cursor authentication timed out");
+}
+async function loginCursor(callbacks) {
+	const { verifier, challenge } = await generatePkce();
+	const uuid = crypto.randomUUID();
+	const authUrl = new URL(CURSOR_LOGIN_URL);
+	authUrl.searchParams.set("challenge", challenge);
+	authUrl.searchParams.set("uuid", uuid);
+	authUrl.searchParams.set("mode", "login");
+	authUrl.searchParams.set("redirectTarget", "cli");
+	callbacks.onAuth({
+		url: authUrl.toString(),
+		instructions: "A browser window should open. Complete login in Cursor to finish."
+	});
+	const tokens = await pollForTokens(uuid, verifier, callbacks);
+	return {
+		access: tokens.accessToken,
+		refresh: tokens.refreshToken,
+		expires: cursorTokenExpiry(tokens.accessToken)
+	};
+}
+async function refreshCursorToken(credentials) {
+	const response = await fetch(CURSOR_REFRESH_URL, {
+		method: "POST",
+		headers: {
+			"Authorization": `Bearer ${credentials.refresh}`,
+			"Content-Type": "application/json"
+		},
+		body: "{}"
+	});
+	if (!response.ok) {
+		const text = await response.text().catch(() => "");
+		throw new Error(`Cursor token refresh failed (${response.status}): ${text || response.statusText}`);
+	}
+	const data = await response.json();
+	if (!data.accessToken) throw new Error(`Cursor token refresh response missing access token: ${JSON.stringify(data)}`);
+	return {
+		access: data.accessToken,
+		refresh: data.refreshToken || credentials.refresh,
+		expires: cursorTokenExpiry(data.accessToken)
+	};
+}
+/**
+* Build a Cursor `OAuthProviderInterface`. Shape matches Anthropic / Codex so
+* it drops into `BUILTIN_PROVIDERS` and `src/auth.ts` unchanged.
+*
+* No `renderPage` parameter: Cursor's poll flow has no local callback server,
+* so there is no post-redirect page to theme.
+*/
+function createCursorOAuthProvider() {
+	return {
+		id: CURSOR_OAUTH_PROVIDER_ID,
+		name: "Cursor",
+		usesCallbackServer: false,
+		login: loginCursor,
+		refreshToken: refreshCursorToken,
+		getApiKey: (credentials) => credentials.access
+	};
+}
+//#endregion
+//#region src/providers/cursor.ts
+const DEFAULT_MODEL = "claude-4.6-sonnet";
+const NOT_IMPLEMENTED_MESSAGE = "Cursor OAuth login works, but inference over Cursor is not implemented yet. Cursor uses a protobuf/HTTP-2 agent protocol (not an OpenAI-compatible API), so the streaming transport still needs to be ported. Use another provider for now.";
+function cursor(params) {
+	const defaultModel = params?.defaultModel || DEFAULT_MODEL;
+	const base = openaiCompat({
+		name: "cursor",
+		apiKey: params?.apiKey ?? "oauth",
+		baseURL: "https://api2.cursor.sh",
+		defaultModel,
+		capabilities: {
+			vision: true,
+			imageInToolResult: false
+		},
+		extraHeaders: params?.extraHeaders
+	});
+	return {
+		...base,
+		meta: {
+			...base.meta,
+			defaultModel
+		},
+		async stream(options, callbacks) {
+			await resolveOAuthApiKey({
+				provider: "cursor",
+				providerId: CURSOR_OAUTH_PROVIDER_ID,
+				params,
+				missingError: "No Cursor credentials found. Run `bun run auth --cursor` first.",
+				refreshError: (reason) => `Cursor OAuth token refresh failed. Run \`bun run auth --cursor\` again. ${reason}`
+			}, callbacks);
+			throw new Error(NOT_IMPLEMENTED_MESSAGE);
+		}
+	};
+}
+//#endregion
+export { createCursorOAuthProvider as n, cursor as t };
+
+//# sourceMappingURL=providers-DgmdYGKm.js.map

package/dist/providers-DgmdYGKm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers-DgmdYGKm.js","names":[],"sources":["../src/chat/oauth-page/cursor.ts","../src/providers/cursor.ts"],"sourcesContent":["/**\n * Cursor OAuth flow.\n *\n * Unlike Anthropic / OpenAI Codex (loopback-redirect PKCE), Cursor uses a\n * **poll-based** PKCE flow with no local callback server:\n *\n *   1. Generate a PKCE verifier + challenge and a random UUID.\n *   2. Open the browser to `cursor.com/loginDeepControl?challenge&uuid&mode&redirectTarget`.\n *   3. Poll `api2.cursor.sh/auth/poll?uuid&verifier` until tokens come back\n *      (HTTP 404 = \"not ready yet\", keep polling with backoff).\n *   4. Refresh via `POST api2.cursor.sh/auth/exchange_user_api_key` with\n *      `Authorization: Bearer <refresh>`.\n *\n * Token expiry is derived from the access token's JWT `exp` claim (minus a\n * 5-minute safety margin), falling back to +1h when the claim is missing.\n *\n * Flow adapted from https://github.com/ndraiman/pi-cursor-provider, itself\n * derived from https://github.com/ephraimduncan/opencode-cursor.\n *\n * Cursor's auth + inference protocol is unofficial and undocumented — re-verify\n * the endpoints/params below if login starts failing.\n */\n\nimport type {\n  OAuthCredentials,\n  OAuthLoginCallbacks,\n  OAuthProviderInterface,\n} from '@earendil-works/pi-ai/oauth'\nimport { generatePkce } from './pkce'\n\n/** pi-ai / zidane OAuth provider id. Also the credentials-file key. */\nexport const CURSOR_OAUTH_PROVIDER_ID = 'cursor'\n\nconst CURSOR_LOGIN_URL = 'https://cursor.com/loginDeepControl'\nconst CURSOR_POLL_URL = 'https://api2.cursor.sh/auth/poll'\nconst CURSOR_REFRESH_URL = 'https://api2.cursor.sh/auth/exchange_user_api_key'\n\nconst POLL_MAX_ATTEMPTS = 150\nconst POLL_BASE_DELAY_MS = 1000\nconst POLL_MAX_DELAY_MS = 10_000\nconst POLL_BACKOFF_MULTIPLIER = 1.2\nconst POLL_MAX_CONSECUTIVE_ERRORS = 3\n\n/** Fallback lifetime when the JWT carries no `exp`. */\nconst DEFAULT_TOKEN_TTL_MS = 3600 * 1000\n/** Refresh slightly early so requests don't race expiry. */\nconst TOKEN_EXPIRY_SKEW_MS = 5 * 60 * 1000\n\ninterface CursorTokenResponse {\n  accessToken: string\n  refreshToken: string\n}\n\n/**\n * Derive expiry (epoch ms) from a JWT's `exp` claim, minus a safety skew.\n * Returns `now + 1h` for malformed tokens so a missing claim never wedges\n * refresh into an immediate-expire loop.\n */\nexport function cursorTokenExpiry(token: string): number {\n  try {\n    const parts = token.split('.')\n    const payload = parts[1]\n    if (parts.length !== 3 || !payload)\n      return Date.now() + DEFAULT_TOKEN_TTL_MS\n\n    const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/'))) as { exp?: unknown }\n    if (typeof json.exp === 'number')\n      return json.exp * 1000 - TOKEN_EXPIRY_SKEW_MS\n  }\n  catch {\n    // fall through to default\n  }\n  return Date.now() + DEFAULT_TOKEN_TTL_MS\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise(r => setTimeout(r, ms))\n}\n\n/**\n * Poll Cursor's auth endpoint until login completes. `404` means the user\n * hasn't finished the browser flow yet; anything else non-2xx is a hard error.\n */\nasync function pollForTokens(\n  uuid: string,\n  verifier: string,\n  callbacks: OAuthLoginCallbacks,\n): Promise<CursorTokenResponse> {\n  let wait = POLL_BASE_DELAY_MS\n  let consecutiveErrors = 0\n\n  for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {\n    if (callbacks.signal?.aborted)\n      throw new Error('Cursor login aborted')\n\n    await delay(wait)\n\n    try {\n      const url = `${CURSOR_POLL_URL}?uuid=${encodeURIComponent(uuid)}&verifier=${encodeURIComponent(verifier)}`\n      const response = await fetch(url, { signal: callbacks.signal })\n\n      if (response.status === 404) {\n        consecutiveErrors = 0\n        wait = Math.min(wait * POLL_BACKOFF_MULTIPLIER, POLL_MAX_DELAY_MS)\n        continue\n      }\n\n      if (response.ok) {\n        const data = await response.json() as Partial<CursorTokenResponse>\n        if (!data.accessToken || !data.refreshToken)\n          throw new Error(`Cursor poll response missing tokens: ${JSON.stringify(data)}`)\n        return { accessToken: data.accessToken, refreshToken: data.refreshToken }\n      }\n\n      throw new Error(`Cursor poll failed (${response.status})`)\n    }\n    catch (err) {\n      if (callbacks.signal?.aborted)\n        throw new Error('Cursor login aborted')\n      consecutiveErrors++\n      if (consecutiveErrors >= POLL_MAX_CONSECUTIVE_ERRORS)\n        throw err instanceof Error ? err : new Error(String(err))\n      callbacks.onProgress?.('Waiting for Cursor login to complete…')\n    }\n  }\n\n  throw new Error('Cursor authentication timed out')\n}\n\nexport async function loginCursor(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {\n  const { verifier, challenge } = await generatePkce()\n  const uuid = crypto.randomUUID()\n\n  const authUrl = new URL(CURSOR_LOGIN_URL)\n  authUrl.searchParams.set('challenge', challenge)\n  authUrl.searchParams.set('uuid', uuid)\n  authUrl.searchParams.set('mode', 'login')\n  authUrl.searchParams.set('redirectTarget', 'cli')\n\n  callbacks.onAuth({\n    url: authUrl.toString(),\n    instructions: 'A browser window should open. Complete login in Cursor to finish.',\n  })\n\n  const tokens = await pollForTokens(uuid, verifier, callbacks)\n\n  return {\n    access: tokens.accessToken,\n    refresh: tokens.refreshToken,\n    expires: cursorTokenExpiry(tokens.accessToken),\n  }\n}\n\nexport async function refreshCursorToken(credentials: OAuthCredentials): Promise<OAuthCredentials> {\n  const response = await fetch(CURSOR_REFRESH_URL, {\n    method: 'POST',\n    headers: {\n      'Authorization': `Bearer ${credentials.refresh}`,\n      'Content-Type': 'application/json',\n    },\n    body: '{}',\n  })\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => '')\n    throw new Error(`Cursor token refresh failed (${response.status}): ${text || response.statusText}`)\n  }\n\n  const data = await response.json() as Partial<CursorTokenResponse>\n  if (!data.accessToken)\n    throw new Error(`Cursor token refresh response missing access token: ${JSON.stringify(data)}`)\n\n  return {\n    access: data.accessToken,\n    // Cursor may omit a rotated refresh token — keep the existing one.\n    refresh: data.refreshToken || credentials.refresh,\n    expires: cursorTokenExpiry(data.accessToken),\n  }\n}\n\n/**\n * Build a Cursor `OAuthProviderInterface`. Shape matches Anthropic / Codex so\n * it drops into `BUILTIN_PROVIDERS` and `src/auth.ts` unchanged.\n *\n * No `renderPage` parameter: Cursor's poll flow has no local callback server,\n * so there is no post-redirect page to theme.\n */\nexport function createCursorOAuthProvider(): OAuthProviderInterface {\n  return {\n    id: CURSOR_OAUTH_PROVIDER_ID,\n    name: 'Cursor',\n    usesCallbackServer: false,\n    login: loginCursor,\n    refreshToken: refreshCursorToken,\n    getApiKey: credentials => credentials.access,\n  }\n}\n","import type { Provider, StreamCallbacks } from '.'\nimport { CURSOR_OAUTH_PROVIDER_ID } from '../chat/oauth-page/cursor'\nimport { resolveOAuthApiKey } from './oauth'\nimport { openaiCompat } from './openai-compat'\n\n/**\n * Cursor provider (OAuth).\n *\n * Auth is fully wired: `bun run auth --cursor` (or the TUI wizard) logs in via\n * Cursor's poll-based PKCE flow and persists credentials; this provider resolves\n * + refreshes the OAuth token on every turn via {@link resolveOAuthApiKey}.\n *\n * Inference is **not** wired yet. Cursor does not expose an OpenAI-compatible\n * HTTP endpoint — it speaks a protobuf/Connect agent protocol over HTTP/2 to\n * `api2.cursor.sh`. Implementing `stream()` requires porting that transport\n * (generated protobuf schemas + an HTTP/2 streaming client) in-process, which\n * is intentionally left as a follow-up. Until then `stream()` resolves the\n * token (proving auth works) and then throws a clear, actionable error.\n *\n * The `openaiCompat` base supplies the message-format helpers (`formatTools`,\n * `userMessage`, `toolResultsMessage`, …) so the provider satisfies the full\n * `Provider` contract and slots into the registry; only `stream` is overridden.\n */\nexport interface CursorParams {\n  /** Bypass OAuth resolution with an explicit token (mainly for tests). */\n  apiKey?: string\n  defaultModel?: string\n  /**\n   * Extra HTTP headers for the eventual Cursor transport. Accepted for API\n   * parity with the other providers and forwarded to the openai-compat base,\n   * but inert until Cursor inference is implemented (the `stream` override\n   * currently throws before any request is made).\n   */\n  extraHeaders?: Record<string, string>\n}\n\nconst DEFAULT_MODEL = 'claude-4.6-sonnet'\n\nconst NOT_IMPLEMENTED_MESSAGE\n  = 'Cursor OAuth login works, but inference over Cursor is not implemented yet. '\n    + 'Cursor uses a protobuf/HTTP-2 agent protocol (not an OpenAI-compatible API), '\n    + 'so the streaming transport still needs to be ported. Use another provider for now.'\n\nexport function cursor(params?: CursorParams): Provider {\n  const defaultModel = params?.defaultModel || DEFAULT_MODEL\n\n  // Base only provides the format/serialization methods; `baseURL` is never\n  // hit because we override `stream` below.\n  const base = openaiCompat({\n    name: 'cursor',\n    apiKey: params?.apiKey ?? 'oauth',\n    baseURL: 'https://api2.cursor.sh',\n    defaultModel,\n    capabilities: { vision: true, imageInToolResult: false },\n    extraHeaders: params?.extraHeaders,\n  })\n\n  return {\n    ...base,\n    meta: { ...base.meta, defaultModel },\n    async stream(options, callbacks: StreamCallbacks) {\n      // Resolve (and lazily refresh) the OAuth token so auth failures surface\n      // here with the right remediation, distinct from the not-implemented path.\n      await resolveOAuthApiKey(\n        {\n          provider: 'cursor',\n          providerId: CURSOR_OAUTH_PROVIDER_ID,\n          params,\n          missingError: 'No Cursor credentials found. Run `bun run auth --cursor` first.',\n          refreshError: reason => `Cursor OAuth token refresh failed. Run \\`bun run auth --cursor\\` again. ${reason}`,\n        },\n        callbacks,\n      )\n      void options\n      throw new Error(NOT_IMPLEMENTED_MESSAGE)\n    },\n  }\n}\n"],"mappings":";;;;;AA+BA,MAAa,2BAA2B;AAExC,MAAM,mBAAmB;AACzB,MAAM,kBAAkB;AACxB,MAAM,qBAAqB;AAE3B,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,oBAAoB;AAC1B,MAAM,0BAA0B;AAChC,MAAM,8BAA8B;;AAGpC,MAAM,uBAAuB,OAAO;;AAEpC,MAAM,uBAAuB,MAAS;;;;;;AAYtC,SAAgB,kBAAkB,OAAuB;CACvD,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,GAAG;EAC7B,MAAM,UAAU,MAAM;EACtB,IAAI,MAAM,WAAW,KAAK,CAAC,SACzB,OAAO,KAAK,IAAI,IAAI;EAEtB,MAAM,OAAO,KAAK,MAAM,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC,CAAC;EAC3E,IAAI,OAAO,KAAK,QAAQ,UACtB,OAAO,KAAK,MAAM,MAAO;CAC7B,QACM,CAEN;CACA,OAAO,KAAK,IAAI,IAAI;AACtB;AAEA,SAAS,MAAM,IAA2B;CACxC,OAAO,IAAI,SAAQ,MAAK,WAAW,GAAG,EAAE,CAAC;AAC3C;;;;;AAMA,eAAe,cACb,MACA,UACA,WAC8B;CAC9B,IAAI,OAAO;CACX,IAAI,oBAAoB;CAExB,KAAK,IAAI,UAAU,GAAG,UAAU,mBAAmB,WAAW;EAC5D,IAAI,UAAU,QAAQ,SACpB,MAAM,IAAI,MAAM,sBAAsB;EAExC,MAAM,MAAM,IAAI;EAEhB,IAAI;GACF,MAAM,MAAM,GAAG,gBAAgB,QAAQ,mBAAmB,IAAI,EAAE,YAAY,mBAAmB,QAAQ;GACvG,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,UAAU,OAAO,CAAC;GAE9D,IAAI,SAAS,WAAW,KAAK;IAC3B,oBAAoB;IACpB,OAAO,KAAK,IAAI,OAAO,yBAAyB,iBAAiB;IACjE;GACF;GAEA,IAAI,SAAS,IAAI;IACf,MAAM,OAAO,MAAM,SAAS,KAAK;IACjC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,cAC7B,MAAM,IAAI,MAAM,wCAAwC,KAAK,UAAU,IAAI,GAAG;IAChF,OAAO;KAAE,aAAa,KAAK;KAAa,cAAc,KAAK;IAAa;GAC1E;GAEA,MAAM,IAAI,MAAM,uBAAuB,SAAS,OAAO,EAAE;EAC3D,SACO,KAAK;GACV,IAAI,UAAU,QAAQ,SACpB,MAAM,IAAI,MAAM,sBAAsB;GACxC;GACA,IAAI,qBAAqB,6BACvB,MAAM,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;GAC1D,UAAU,aAAa,uCAAuC;EAChE;CACF;CAEA,MAAM,IAAI,MAAM,iCAAiC;AACnD;AAEA,eAAsB,YAAY,WAA2D;CAC3F,MAAM,EAAE,UAAU,cAAc,MAAM,aAAa;CACnD,MAAM,OAAO,OAAO,WAAW;CAE/B,MAAM,UAAU,IAAI,IAAI,gBAAgB;CACxC,QAAQ,aAAa,IAAI,aAAa,SAAS;CAC/C,QAAQ,aAAa,IAAI,QAAQ,IAAI;CACrC,QAAQ,aAAa,IAAI,QAAQ,OAAO;CACxC,QAAQ,aAAa,IAAI,kBAAkB,KAAK;CAEhD,UAAU,OAAO;EACf,KAAK,QAAQ,SAAS;EACtB,cAAc;CAChB,CAAC;CAED,MAAM,SAAS,MAAM,cAAc,MAAM,UAAU,SAAS;CAE5D,OAAO;EACL,QAAQ,OAAO;EACf,SAAS,OAAO;EAChB,SAAS,kBAAkB,OAAO,WAAW;CAC/C;AACF;AAEA,eAAsB,mBAAmB,aAA0D;CACjG,MAAM,WAAW,MAAM,MAAM,oBAAoB;EAC/C,QAAQ;EACR,SAAS;GACP,iBAAiB,UAAU,YAAY;GACvC,gBAAgB;EAClB;EACA,MAAM;CACR,CAAC;CAED,IAAI,CAAC,SAAS,IAAI;EAChB,MAAM,OAAO,MAAM,SAAS,KAAK,EAAE,YAAY,EAAE;EACjD,MAAM,IAAI,MAAM,gCAAgC,SAAS,OAAO,KAAK,QAAQ,SAAS,YAAY;CACpG;CAEA,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,IAAI,CAAC,KAAK,aACR,MAAM,IAAI,MAAM,uDAAuD,KAAK,UAAU,IAAI,GAAG;CAE/F,OAAO;EACL,QAAQ,KAAK;EAEb,SAAS,KAAK,gBAAgB,YAAY;EAC1C,SAAS,kBAAkB,KAAK,WAAW;CAC7C;AACF;;;;;;;;AASA,SAAgB,4BAAoD;CAClE,OAAO;EACL,IAAI;EACJ,MAAM;EACN,oBAAoB;EACpB,OAAO;EACP,cAAc;EACd,YAAW,gBAAe,YAAY;CACxC;AACF;;;AChKA,MAAM,gBAAgB;AAEtB,MAAM,0BACF;AAIJ,SAAgB,OAAO,QAAiC;CACtD,MAAM,eAAe,QAAQ,gBAAgB;CAI7C,MAAM,OAAO,aAAa;EACxB,MAAM;EACN,QAAQ,QAAQ,UAAU;EAC1B,SAAS;EACT;EACA,cAAc;GAAE,QAAQ;GAAM,mBAAmB;EAAM;EACvD,cAAc,QAAQ;CACxB,CAAC;CAED,OAAO;EACL,GAAG;EACH,MAAM;GAAE,GAAG,KAAK;GAAM;EAAa;EACnC,MAAM,OAAO,SAAS,WAA4B;GAGhD,MAAM,mBACJ;IACE,UAAU;IACV,YAAY;IACZ;IACA,cAAc;IACd,eAAc,WAAU,2EAA2E;GACrG,GACA,SACF;GAEA,MAAM,IAAI,MAAM,uBAAuB;EACzC;CACF;AACF"}

package/dist/providers.d.ts

@@ -1,2 +1,2 @@
-import { $t as cerebras, At as TurnResult, Bt as OpenAICompatAuthHeader, Ct as ProviderCapabilities, Dt as ToolCall, Et as TokenCountPayload, Ft as SchemaSanitizeResult, Gt as openaiCompat, Ht as OpenAICompatParams, It as sanitizeToolSchema, Jt as LocalParams, Kt as OpenAIParams, Lt as sanitizeToolSpecs, Mt as xai, Nt as SchemaSanitizeOptions, Ot as ToolResult, Pt as SchemaSanitizeProfile, Qt as CerebrasParams, Rt as OpenRouterParams, St as Provider, Tt as StreamOptions, Ut as classifyOpenAICompatError, Vt as OpenAICompatHttpError, Wt as mapOAIFinishReason, Xt as CursorParams, Yt as local, Zt as cursor, an as AnthropicParams, en as BasetenParams, in as arcee, jt as XaiParams, kt as ToolSpec, nn as planBasetenReasoning, on as anthropic, qt as openai, rn as ArceeParams, sn as applyAnthropicCacheBreakpoints, tn as baseten, wt as StreamCallbacks, zt as openrouter } from "./agent-DQIL5BFk.js";
+import { $t as classifyOpenAICompatError, At as TurnResult, Bt as openrouter, Cn as arcee, Ct as ProviderCapabilities, Dn as anthropic, Dt as ToolCall, Et as TokenCountPayload, Ft as SchemaSanitizeResult, Gt as OpenAICompatHttpError, It as sanitizeToolSchema, Kt as OpenAICompatParams, Lt as sanitizeToolSpecs, Mt as xai, Nt as SchemaSanitizeOptions, On as applyAnthropicCacheBreakpoints, Ot as ToolResult, Pt as SchemaSanitizeProfile, Rt as OpenRouterParams, Sn as ArceeParams, St as Provider, Tn as AnthropicParams, Tt as StreamOptions, Wt as OpenAICompatAuthHeader, _n as CerebrasParams, bn as baseten, cn as OpenAIParams, dn as openai, gn as cursor, hn as CursorParams, in as openaiCompat, jt as XaiParams, kt as ToolSpec, mn as local, nn as mapOAIFinishReason, pn as LocalParams, vn as cerebras, wt as StreamCallbacks, xn as planBasetenReasoning, yn as BasetenParams } from "./agent-BAgOgS37.js";
 export { type AnthropicParams, type ArceeParams, type BasetenParams, type CerebrasParams, type CursorParams, type LocalParams, type OpenAICompatAuthHeader, OpenAICompatHttpError, type OpenAICompatParams, type OpenAIParams, type OpenRouterParams, Provider, ProviderCapabilities, type SchemaSanitizeOptions, type SchemaSanitizeProfile, type SchemaSanitizeResult, StreamCallbacks, StreamOptions, TokenCountPayload, ToolCall, ToolResult, ToolSpec, TurnResult, type XaiParams, anthropic, applyAnthropicCacheBreakpoints, arcee, baseten, cerebras, classifyOpenAICompatError, cursor, local, mapOAIFinishReason, openai, openaiCompat, openrouter, planBasetenReasoning, sanitizeToolSchema, sanitizeToolSpecs, xai };

package/dist/providers.js

@@ -1,3 +1,11 @@
-import { C as sanitizeToolSchema, b as openaiCompat, g as OpenAICompatHttpError, v as classifyOpenAICompatError, w as sanitizeToolSpecs, y as mapOAIFinishReason } from "./messages-Iy_vEycX.js";
-import { a as local, d as planBasetenReasoning, f as arcee, i as openai, l as cerebras, m as applyAnthropicCacheBreakpoints, o as cursor, p as anthropic, r as openrouter, t as xai, u as baseten } from "./providers-BMw1D_lj.js";
+import { f as mapOAIFinishReason, l as classifyOpenAICompatError, m as openaiCompat, n as OpenAICompatHttpError, v as sanitizeToolSchema, y as sanitizeToolSpecs } from "./openai-compat-0Y7jcncn.js";
+import { n as applyAnthropicCacheBreakpoints, t as anthropic } from "./anthropic-RGqsJlC8.js";
+import { arcee } from "./providers/arcee.js";
+import { baseten, planBasetenReasoning } from "./providers/baseten.js";
+import { cerebras } from "./providers/cerebras.js";
+import { t as xai } from "./xai-tPdbAGkq.js";
+import { t as cursor } from "./providers-DgmdYGKm.js";
+import { local } from "./providers/local.js";
+import { openai } from "./providers/openai.js";
+import { openrouter } from "./providers/openrouter.js";
 export { OpenAICompatHttpError, anthropic, applyAnthropicCacheBreakpoints, arcee, baseten, cerebras, classifyOpenAICompatError, cursor, local, mapOAIFinishReason, openai, openaiCompat, openrouter, planBasetenReasoning, sanitizeToolSchema, sanitizeToolSpecs, xai };

package/dist/restate.d.ts

@@ -1,4 +1,4 @@
-import { K as SessionStore, Kn as ToolBatchExecutor, St as Provider, T as ToolDef, Tt as StreamOptions, Xn as ToolResultContent, cn as AgentBehavior, ln as AgentClock, o as McpToolMeta, s as McpToolWrap, w as ToolContext } from "./agent-DQIL5BFk.js";
+import { K as SessionStore, Mn as AgentBehavior, Nn as AgentClock, Sr as ToolResultContent, St as Provider, T as ToolDef, Tt as StreamOptions, o as McpToolMeta, s as McpToolWrap, vr as ToolBatchExecutor, w as ToolContext } from "./agent-BAgOgS37.js";
 import { h as TaskExitInfo, l as ExecutionHandle, m as TaskEntry, o as DetachedTasksCapability } from "./types-Bs2oY7Ux.js";
 
 //#region src/restate/types.d.ts

package/dist/run-summary-DAnBZnrt.d.ts

@@ -0,0 +1,249 @@
+import { Tt as StreamOptions, r as AgentHooks } from "./agent-BAgOgS37.js";
+import { Hookable } from "hookable";
+
+//#region src/cache-telemetry.d.ts
+/**
+ * Snapshot of per-request dimensions that contribute to the provider-side
+ * prompt cache key. Hashed at `turn:before` and stashed for diffing on the
+ * next request.
+ *
+ * Hashes are FNV-1a 32-bit (cheap, no allocations on the hot path,
+ * collision rate good enough for diff detection — we're not signing
+ * anything). For verbose output the helper also captures byte lengths so
+ * `system: 1024 → 1031` reads like a real diff line.
+ */
+interface CacheDimensionSnapshot {
+  /** Hash of `options.system` (with boundary marker preserved). */
+  systemHash: number;
+  /** Byte length of `options.system`. */
+  systemBytes: number;
+  /** Hash of the JSON-serialized `options.tools` array. */
+  toolsHash: number;
+  /** Number of tools in the array. */
+  toolsCount: number;
+  /** Model id. */
+  model: string;
+  /** Thinking level — `'off'` when absent. */
+  thinking: string;
+  /** Exact thinking budget — `0` when absent. */
+  thinkingBudget: number;
+}
+/** Result of {@link diffCacheDimensions}. */
+interface CacheDimensionDiff {
+  /** Dimension names whose hashes differ between the two snapshots. */
+  changed: readonly CacheDimensionName[];
+  /** Per-dimension details — only filled for changed dimensions. */
+  details: Readonly<Partial<Record<CacheDimensionName, string>>>;
+}
+/** Cache-affecting dimension names. */
+type CacheDimensionName = 'system' | 'tools' | 'model' | 'thinking' | 'thinkingBudget';
+interface CacheBreakLoggerOptions {
+  /**
+   * Sink for log lines. Defaults to `console.error`. Use a {@link Logger} or
+   * a test buffer here when you want the output to land somewhere other than
+   * stderr.
+   */
+  log?: (line: string) => void;
+  /**
+   * When `true`, emit a log line on EVERY turn (not just cache breaks) with
+   * the per-dimension hashes. Useful for offline correlation; off by default
+   * to keep the logger zero-noise on happy paths.
+   */
+  verbose?: boolean;
+  /**
+   * Threshold for "this turn missed cache". The logger reports when
+   * `cacheRead < expectedReadAtLeast` AND the dimensions differ from the
+   * previous turn. Defaults to `1` — any cache read at all means the
+   * provider matched some prefix, so a strict "did we get any cache?" check
+   * is the right signal. Raise to detect partial-prefix breaks (e.g. the
+   * tools cache hit but the system prompt didn't, which lowers `cacheRead`
+   * without zeroing it).
+   */
+  expectedReadAtLeast?: number;
+}
+/**
+ * FNV-1a-style 32-bit hash over UTF-16 code units. Pure, allocation-free,
+ * ~10 ns per KB. Cryptographic strength is irrelevant here — we only need
+ * change detection, and this has effectively zero collision risk for the
+ * small number of dimensions tracked.
+ *
+ * Feeds the FULL char code into the mix (same as read-state's
+ * `hashContent`) — masking to the low byte would collapse code points that
+ * share a low byte, so a non-ASCII system-prompt change could hash
+ * identically and silently hide a cache-dimension drift.
+ *
+ * Exported for tests; callers shouldn't typically import directly.
+ */
+declare function fnv1a32(s: string): number;
+/**
+ * Build a {@link CacheDimensionSnapshot} from a `turn:before` payload.
+ *
+ * Pure — exported so hosts can compute snapshots outside the logger (e.g.
+ * stamping them onto custom telemetry spans). The hash is deterministic on
+ * byte-identical inputs.
+ */
+declare function snapshotCacheDimensions(options: StreamOptions): CacheDimensionSnapshot;
+/**
+ * Compare two snapshots and return the list of dimensions whose bytes
+ * differ. The `details` map carries a short human-readable description per
+ * changed dimension (e.g. `system: 1024 → 1031 bytes`).
+ *
+ * Pure / no I/O. Use this in tests to assert the diff logic; the logger
+ * itself just formats and emits the result.
+ */
+declare function diffCacheDimensions(prev: CacheDimensionSnapshot, curr: CacheDimensionSnapshot): CacheDimensionDiff;
+/**
+ * Install the cache-break logger on an agent's hook bus.
+ *
+ * Subscribes to `turn:before` (snapshot) + `turn:after` (compare with prior
+ * snapshot, log breaks). Returns an `uninstall` fn that detaches both
+ * listeners. Idempotent w.r.t. agent lifecycle — installs/uninstalls cleanly
+ * across runs.
+ *
+ * Recommended setup:
+ *
+ * ```ts
+ * const uninstall = installCacheBreakLogger(agent.hooks, {
+ *   log: line => logger.debug(line),
+ *   verbose: !!process.env.ZIDANE_DEBUG?.includes('cache'),
+ * })
+ * // ...
+ * uninstall()
+ * ```
+ *
+ * Performance: hashing runs on each `turn:before` and is bounded by the
+ * input size (system + tools serialization). Disabled callers pay nothing
+ * (don't install).
+ */
+declare function installCacheBreakLogger(hooks: Hookable<AgentHooks>, options?: CacheBreakLoggerOptions): () => void;
+//#endregion
+//#region src/run-summary.d.ts
+interface RunSummaryTokens {
+  input: number;
+  output: number;
+  cacheRead: number;
+  cacheCreation: number;
+  cost?: number;
+  /** First observable byte from the provider, ms from run start. */
+  ttftMs?: number;
+}
+interface RunSummaryByModel {
+  modelId: string;
+  input: number;
+  output: number;
+  cacheRead: number;
+  cacheCreation: number;
+  cost: number;
+  turns: number;
+}
+interface RunSummaryError {
+  kind: 'stream' | 'tool' | 'mcp-tool' | 'mcp' | 'spawn';
+  message: string;
+  errorType?: string;
+  turnId?: string;
+  callId?: string;
+  server?: string;
+  toolName?: string;
+  childId?: string;
+  statusCode?: number;
+  requestId?: string;
+}
+interface RunSummaryBlock {
+  callId: string;
+  toolName: string;
+  outcome: 'gate-block' | 'unknown' | 'invalid-input';
+  reason?: string;
+}
+interface RunSummaryValidation {
+  callId: string;
+  toolName: string;
+  reason: string;
+}
+interface RunSummaryBudget {
+  kind: 'bytes' | 'tool-count';
+  /** Tool name (for `'tool-count'`); absent for byte budgets. */
+  toolName?: string;
+  /** `mode` for `'tool-count'`; absent for byte budgets. */
+  mode?: 'steer' | 'block';
+  observed: number;
+  limit: number;
+  turnId?: string;
+}
+interface RunSummaryRepeatGuard {
+  toolName: string;
+  /** Observed repeat count that tripped the guard. */
+  count: number;
+  threshold: number;
+  action: 'block' | 'steer' | 'abort';
+  turnId?: string;
+}
+/**
+ * Postmortem snapshot of one `agent.run()`. Strictly serializable — every
+ * field round-trips through `JSON.stringify` / `JSON.parse` without loss
+ * so a log aggregator can ingest it as-is.
+ */
+interface RunSummary {
+  runId?: string;
+  parentRunId?: string;
+  depth: number;
+  agentName?: string;
+  startedAt: number;
+  endedAt: number;
+  durationMs: number;
+  status: 'completed' | 'aborted';
+  turns: number;
+  totals: RunSummaryTokens;
+  byModel: RunSummaryByModel[];
+  errors: RunSummaryError[];
+  blocks: RunSummaryBlock[];
+  validationRejects: RunSummaryValidation[];
+  budgetEvents: RunSummaryBudget[];
+  /**
+   * Repeat-guard escalations. An `action: 'steer'` entry means the tool still
+   * executed and got a steering message appended to its result. An
+   * `action: 'abort'` entry means the guard terminated the run via the agent's
+   * AbortController (the run finalizes as `'aborted'`).
+   */
+  repeatGuardEvents: RunSummaryRepeatGuard[];
+  /** Counts of pairing repairs, keyed by repair mode. */
+  pairingRepairs: Record<string, number>;
+  /**
+   * Postmortem snapshots of child runs that bubbled their stats up via
+   * `spawn:complete`. Only present when the run actually spawned.
+   */
+  children?: RunSummary[];
+}
+interface RunSummaryCollectorOptions {
+  /**
+   * Called with the assembled {@link RunSummary} on every `agent:done`.
+   * Synchronous — heavy I/O should be deferred (e.g. via `setImmediate`).
+   */
+  onSummary?: (summary: RunSummary) => void;
+}
+interface RunSummaryCollector {
+  /** Install the collector's hook handlers. Returns an uninstall fn. */
+  install: (hooks: Hookable<AgentHooks>) => () => void;
+  /** Most-recent summary; `undefined` until the first `agent:done` fires. */
+  latest: () => RunSummary | undefined;
+}
+/**
+ * Build a run-summary collector. State is created fresh inside each
+ * `install()` call, so a single collector instance can be installed
+ * across multiple agents without attribution cross-talk. `latest()`
+ * returns the most-recent summary across **any** install — install
+ * per-agent collectors if you need separate post-run snapshots.
+ *
+ * @example
+ * ```ts
+ * const collector = createRunSummaryCollector({
+ *   onSummary: s => console.log(JSON.stringify(s)),
+ * })
+ * const uninstall = collector.install(agent.hooks)
+ * try { await agent.run({ prompt }) }
+ * finally { uninstall() }
+ * ```
+ */
+declare function createRunSummaryCollector(options?: RunSummaryCollectorOptions): RunSummaryCollector;
+//#endregion
+export { fnv1a32 as _, RunSummaryCollector as a, RunSummaryRepeatGuard as c, createRunSummaryCollector as d, CacheBreakLoggerOptions as f, diffCacheDimensions as g, CacheDimensionSnapshot as h, RunSummaryByModel as i, RunSummaryTokens as l, CacheDimensionName as m, RunSummaryBlock as n, RunSummaryCollectorOptions as o, CacheDimensionDiff as p, RunSummaryBudget as r, RunSummaryError as s, RunSummary as t, RunSummaryValidation as u, installCacheBreakLogger as v, snapshotCacheDimensions as y };
+//# sourceMappingURL=run-summary-DAnBZnrt.d.ts.map

package/dist/run-summary-DAnBZnrt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-summary-DAnBZnrt.d.ts","names":[],"sources":["../src/cache-telemetry.ts","../src/run-summary.ts"],"mappings":";;;;AA8EA;;;;AAA8B;AAW9B;;;;;AAXA,UA1BiB,sBAAA;EAiDf;EA/CA,UAAA;EAyDmB;EAvDnB,WAAA;EA8Ec;EA5Ed,SAAA;;EAEA,UAAA;EA0E+B;EAxE/B,KAAA;EA2FqC;EAzFrC,QAAA;EAyFqF;EAvFrF,cAAA;AAAA;;UAIe,kBAAA;EAmFsE;EAjFrF,OAAA,WAAkB,kBAAA;EA0Ge;EAxGjC,OAAA,EAAS,QAAA,CAAS,OAAA,CAAQ,MAAA,CAAO,kBAAA;AAAA;;KAIvB,kBAAA;AAAA,UAWK,uBAAA;EA4FI;;;;;EAtFnB,GAAA,IAAO,IAAA;EAsFY;AAAA;AA2DrB;;;EA3IE,OAAA;EA4IO;;;;;;;;;EAlIP,mBAAA;AAAA;;;;AC7EF;;;;;;;;;;iBDoGgB,OAAA,CAAQ,CAAS;AC7FzB;AAGR;;;;;;AAHQ,iBDgHQ,uBAAA,CAAwB,OAAA,EAAS,aAAA,GAAgB,sBAAsB;;;;;;ACtGhF;AAGP;;iBD4HgB,mBAAA,CACd,IAAA,EAAM,sBAAA,EACN,IAAA,EAAM,sBAAA,GACL,kBAAA;;;;;;;;;;;;;ACrHQ;AAGX;;;;;;;;;AAIQ;iBDyKQ,uBAAA,CACd,KAAA,EAAO,QAAA,CAAS,UAAA,GAChB,OAAA,GAAS,uBAAA;;;UChNM,gBAAA;EACf,KAAA;EACA,MAAA;EACA,SAAA;EACA,aAAA;EACA,IAAA;EDmC0B;ECjC1B,MAAA;AAAA;AAAA,UAGe,iBAAA;EACf,OAAA;EACA,KAAA;EACA,MAAA;EACA,SAAA;EACA,aAAA;EACA,IAAA;EACA,KAAA;AAAA;AAAA,UAGe,eAAA;EACf,IAAA;EACA,OAAA;EACA,SAAA;EACA,MAAA;EACA,MAAA;EACA,MAAA;EACA,QAAA;EACA,OAAA;EACA,UAAA;EACA,SAAA;AAAA;AAAA,UAGe,eAAA;EACf,MAAA;EACA,QAAA;EACA,OAAA;EACA,MAAA;AAAA;AAAA,UAGe,oBAAA;EACf,MAAA;EACA,QAAA;EACA,MAAA;AAAA;AAAA,UAGe,gBAAA;EACf,IAAA;EDmGM;ECjGN,QAAA;EDkGmB;EChGnB,IAAA;EACA,QAAA;EACA,KAAA;EACA,MAAA;AAAA;AAAA,UAGe,qBAAA;EACf,QAAA;EDyFmB;ECvFnB,KAAA;EACA,SAAA;EACA,MAAA;EACA,MAAA;AAAA;;;;;;UAQe,UAAA;EACf,KAAA;EACA,WAAA;EACA,KAAA;EACA,SAAA;EACA,SAAA;EACA,OAAA;EACA,UAAA;EACA,MAAA;EACA,KAAA;EACA,MAAA,EAAQ,gBAAA;EACR,OAAA,EAAS,iBAAA;EACT,MAAA,EAAQ,eAAA;EACR,MAAA,EAAQ,eAAA;EACR,iBAAA,EAAmB,oBAAA;EACnB,YAAA,EAAc,gBAAA;EAjFd;;;AAEM;AAGR;;EAmFE,iBAAA,EAAmB,qBAAA;EAnFa;EAqFhC,cAAA,EAAgB,MAAA;EAnFhB;;;;EAwFA,QAAA,GAAW,UAAA;AAAA;AAAA,UAOI,0BAAA;EA1FV;AAGP;;;EA4FE,SAAA,IAAa,OAAA,EAAS,UAAU;AAAA;AAAA,UAGjB,mBAAA;EA5Ff;EA8FA,OAAA,GAAU,KAAA,EAAO,QAAA,CAAS,UAAA;EA5F1B;EA8FA,MAAA,QAAc,UAAA;AAAA;;;;;AAzFL;AAGX;;;;;;;;;AAIQ;AAGR;;iBAmGgB,yBAAA,CACd,OAAA,GAAS,0BAAA,GACR,mBAAmB"}