zidane 6.5.4 → 6.5.6

package/dist/{auth-BLy7X1SY.js → auth-BAclQnl3.js}

@@ -1,13 +1,14 @@
-import { A as mergeCatalogEntry, D as listModelOverlay, O as listModels, k as lookupModel } from "./openai-compat-CnHeo4Lz.js";
+import { A as mergeCatalogEntry, D as listModelOverlay, O as listModels, k as lookupModel } from "./openai-compat-BoTi-9fd.js";
+import { cn as ALTERNATE_CRED_KEY_SUFFIX, ln as alternateCredKey, un as isReservedCredKey } from "./agent-CcTWL-Z6.js";
 import { t as writeFileAtomic } from "./atomic-write-B7zr1ddF.js";
-import { f as ANTHROPIC_EXTRA_MODELS, n as anthropic, p as FAST_MODE_OPTIONS } from "./anthropic-qaw8XAc9.js";
-import { d as refreshAnthropicToken, f as refreshOpenAICodexToken, p as registerOAuthProvider } from "./oauth-ZebH9NHb.js";
+import { f as ANTHROPIC_EXTRA_MODELS, n as anthropic, p as FAST_MODE_OPTIONS } from "./anthropic-DLc_Kw-1.js";
+import { d as refreshAnthropicToken, f as refreshOpenAICodexToken, p as registerOAuthProvider } from "./oauth-C4GvY_p1.js";
 import { arcee } from "./providers/arcee.js";
 import { baseten } from "./providers/baseten.js";
 import { cerebras } from "./providers/cerebras.js";
 import { t as generatePkce } from "./pkce-t8BcPyEi.js";
 import { n as createCursorOAuthProvider } from "./cursor-iojRXHF9.js";
-import { n as zai, r as mistral } from "./providers-Bxs-XHir.js";
+import { n as zai, r as mistral } from "./providers-CmhdtD7w.js";
 import { local } from "./providers/local.js";
 import { openai } from "./providers/openai.js";
 import { openrouter } from "./providers/openrouter.js";
@@ -1414,11 +1415,36 @@ function normalizeCredentials(parsed) {
 	else result[key] = value;
 	return result;
 }
+/**
+* Canonical file key for a descriptor, rejecting the reserved alternate suffix.
+*
+* Loud on a misconfigured provider instead of quietly mixing its credentials
+* into another provider's alternate slot (extension registration refuses the
+* suffix upfront; this covers descriptors passed in directly). Read paths stay
+* tolerant — only the functions that can WRITE a pair go through here.
+*/
+function assertableCredKey(descriptor) {
+	const fileKey = credKeyOf(descriptor);
+	if (isReservedCredKey(fileKey)) throw new Error(`Provider "${descriptor.key}" uses credential key "${fileKey}", but the "${ALTERNATE_CRED_KEY_SUFFIX}" suffix is reserved for a provider's second credential slot.`);
+	return fileKey;
+}
 /** Read a single provider's credential (translating via the descriptor). */
 function readProviderCredential(dataDir, descriptor) {
 	return readCredentials(dataDir)[credKeyOf(descriptor)];
 }
 /**
+* Both stored credentials for a provider: `active` is the one every reader
+* resolves, `alternate` is the stored-but-not-preferred one (if any).
+*/
+function readProviderCredentialPair(dataDir, descriptor) {
+	const all = readCredentials(dataDir);
+	const fileKey = credKeyOf(descriptor);
+	return {
+		active: all[fileKey],
+		alternate: all[alternateCredKey(fileKey)]
+	};
+}
+/**
 * Write credentials atomically (write-then-rename) with mode 0o600.
 *
 * Atomic on the same filesystem — readers either see the previous file or the
@@ -1431,16 +1457,64 @@ function writeCredentials(dataDir, creds) {
 		mode: FILE_MODE
 	});
 }
+/**
+* Store a credential as the provider's preferred one.
+*
+* A credential of the OTHER kind already in the canonical slot is demoted to
+* {@link alternateCredKey}, not destroyed: authenticating with OAuth used to
+* silently delete a working API key (and vice versa), leaving the user to
+* re-enter it. Replacing a credential of the SAME kind is a plain overwrite —
+* that's a re-auth, not a second source.
+*
+* The pair holds AT MOST ONE credential of each kind. A same-kind alternate is
+* therefore stale — no code path here can produce one, but a file written by an
+* older build can carry it, and it would surface as two identical source rows
+* that "switch" between each other. Dropping it on the next write self-heals.
+*/
 function setProviderCredential(dataDir, descriptor, cred) {
 	const all = readCredentials(dataDir);
-	all[credKeyOf(descriptor)] = cred;
+	const fileKey = assertableCredKey(descriptor);
+	const altKey = alternateCredKey(fileKey);
+	const previous = all[fileKey];
+	if (previous && previous.kind !== cred.kind) all[altKey] = previous;
+	else if (all[altKey]?.kind === cred.kind) delete all[altKey];
+	all[fileKey] = cred;
 	writeCredentials(dataDir, all);
 }
+/**
+* Make the provider's stored `source` credential the preferred one.
+*
+* No-op unless a credential of that kind is sitting in the alternate slot, so
+* calling it for the already-active source is harmless.
+*/
+function setPreferredCredential(dataDir, descriptor, source) {
+	const all = readCredentials(dataDir);
+	const fileKey = assertableCredKey(descriptor);
+	const altKey = alternateCredKey(fileKey);
+	const alternate = all[altKey];
+	if (!alternate || alternate.kind !== source) return;
+	const active = all[fileKey];
+	all[fileKey] = alternate;
+	if (active) all[altKey] = active;
+	else delete all[altKey];
+	writeCredentials(dataDir, all);
+}
+/**
+* Sign a provider out — drops BOTH stored credentials.
+*
+* "Signed out" has to mean the provider resolves nothing afterwards, which is
+* what this has always guaranteed and what callers named it for; promoting the
+* alternate instead would silently leave the provider authenticated through the
+* other source. Callers that want the fall-back behavior can read the pair
+* first ({@link readProviderCredentialPair}) and re-store the survivor.
+*/
 function removeProviderCredential(dataDir, descriptor) {
 	const all = readCredentials(dataDir);
 	const fileKey = credKeyOf(descriptor);
-	if (!(fileKey in all)) return;
+	const altKey = alternateCredKey(fileKey);
+	if (!(fileKey in all) && !(altKey in all)) return;
 	delete all[fileKey];
+	delete all[altKey];
 	writeCredentials(dataDir, all);
 }
 /**
@@ -1474,7 +1548,8 @@ function removeProviderCredential(dataDir, descriptor) {
 * Descriptors without an `envKey` (OAuth-only providers, custom providers
 * that bypass env-var resolution) are skipped silently.
 */
-function applyApiKeyEnv(dataDir, registry) {
+function applyApiKeyEnv(dataDir, registry, opts = {}) {
+	const log = opts.log ?? ((message) => void process.stderr.write(message));
 	const creds = readCredentials(dataDir);
 	for (const descriptor of Object.values(registry)) {
 		const cred = creds[credKeyOf(descriptor)];
@@ -1484,7 +1559,7 @@ function applyApiKeyEnv(dataDir, registry) {
 				const value = stored[field.key];
 				if (typeof value === "string" && value.length > 0) {
 					const ambient = process.env[field.envVar];
-					if (ambient && ambient !== value && process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/chat] applyApiKeyEnv: overriding ambient \`${field.envVar}\` with stored value from credentials.json (provider=${descriptor.key}, field=${field.key}).\n`);
+					if (ambient && ambient !== value && process.env.ZIDANE_DEBUG) log(`[zidane/chat] applyApiKeyEnv: overriding ambient \`${field.envVar}\` with stored value from credentials.json (provider=${descriptor.key}, field=${field.key}).\n`);
 					process.env[field.envVar] = value;
 				}
 			}
@@ -1493,12 +1568,12 @@ function applyApiKeyEnv(dataDir, registry) {
 		const envKey = descriptor.envKey;
 		const ambient = process.env[envKey];
 		if (cred?.kind === "apikey" && cred.value) {
-			if (ambient && ambient !== cred.value && process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/chat] applyApiKeyEnv: overriding ambient \`${envKey}\` with stored API key from credentials.json (provider=${descriptor.key}). Sign out via the auth wizard if the ambient value was intended to win.\n`);
+			if (ambient && ambient !== cred.value && process.env.ZIDANE_DEBUG) log(`[zidane/chat] applyApiKeyEnv: overriding ambient \`${envKey}\` with stored API key from credentials.json (provider=${descriptor.key}). Sign out via the auth wizard if the ambient value was intended to win.\n`);
 			process.env[envKey] = cred.value;
 			continue;
 		}
 		if (cred?.kind === "oauth" && cred.access) {
-			if (ambient !== void 0 && process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/chat] applyApiKeyEnv: clearing ambient \`${envKey}\` because credentials.json has stored OAuth for ${descriptor.key} — refresh path needs the file.\n`);
+			if (ambient !== void 0 && process.env.ZIDANE_DEBUG) log(`[zidane/chat] applyApiKeyEnv: clearing ambient \`${envKey}\` because credentials.json has stored OAuth for ${descriptor.key} — refresh path needs the file.\n`);
 			delete process.env[envKey];
 			continue;
 		}
@@ -1570,13 +1645,17 @@ function isOAuthLegacy(value) {
 /**
 * Detect available auth for every registered provider.
 *
-* Resolution order per provider (a method appears in `methods` for each
-* layer that has a credential — the agent itself resolves them in the same
-* order via its provider factories):
+* A method appears in `methods` for every layer that has a credential:
 *
-*   1. `kind: 'apikey'` from `credentials.json` (injected into env at TUI launch)
-*   2. explicit env var (descriptor's `envKey`)
-*   3. `kind: 'oauth'` from `credentials.json` (or legacy `cwd/.credentials.json`)
+*   - `kind: 'apikey'` from `credentials.json` (injected into env at TUI launch)
+*   - explicit env var (descriptor's `envKey`)
+*   - `kind: 'oauth'` from `credentials.json` (or legacy `cwd/.credentials.json`)
+*
+* A provider may store one of EACH kind. The preferred one lives in the
+* canonical file key and is flagged {@link AuthMethod.active}; the other sits
+* in `alternateCredKey` and is reported too, so the UI can offer to promote it.
+* Order within `methods` is presentational — it is no longer a resolution
+* order, because the active flag answers that directly.
 *
 * Pure read — never refreshes or rewrites the credentials file.
 */
@@ -1584,45 +1663,58 @@ function detectAuth(dataDir, registry, env = process.env) {
 	const creds = readCredentials(dataDir);
 	return Object.values(registry).map((descriptor) => {
 		const methods = [];
-		const fileEntry = creds[credKeyOf(descriptor)];
-		if (fileEntry?.kind === "apikey" && fileEntry.value) methods.push({
-			source: "apikey",
-			detail: "credentials.json"
-		});
+		const fileKey = credKeyOf(descriptor);
+		const fileEntry = creds[fileKey];
+		const altEntry = creds[alternateCredKey(fileKey)];
+		const describeStored = (entry, active) => {
+			if (entry?.kind === "apikey" && entry.value) return {
+				source: "apikey",
+				detail: "credentials.json",
+				active
+			};
+			if (entry?.kind === "oauth" && entry.access) return {
+				source: "oauth",
+				detail: typeof entry.expires === "number" ? `oauth · expires ${new Date(entry.expires).toLocaleString()}` : "oauth · credentials.json",
+				active
+			};
+		};
+		const activeMethod = describeStored(fileEntry, true);
+		if (activeMethod) methods.push(activeMethod);
 		if (fileEntry?.kind === "apikey" && !fileEntry.value && descriptor.customFields && descriptor.customFields.length > 0) {
 			const stored = fileEntry.customFields ?? {};
 			if (descriptor.customFields.filter((f) => f.required).every((f) => typeof stored[f.key] === "string" && stored[f.key].length > 0)) methods.push({
 				source: "apikey",
-				detail: "credentials.json (configured)"
+				detail: "credentials.json (configured)",
+				active: true
 			});
 		}
 		if (descriptor.customFields && descriptor.customFields.length > 0) {
 			const required = descriptor.customFields.filter((f) => f.required);
 			if (required.length > 0 && required.every((f) => typeof env[f.envVar] === "string" && env[f.envVar].length > 0)) methods.push({
 				source: "env",
-				detail: required.map((f) => f.envVar).join(", ")
+				detail: required.map((f) => f.envVar).join(", "),
+				active: false
 			});
 		}
+		const alternateMethod = describeStored(altEntry, false);
+		if (alternateMethod) methods.push(alternateMethod);
 		if (descriptor.envKey && env[descriptor.envKey]) methods.push({
 			source: "env",
-			detail: descriptor.envKey
+			detail: descriptor.envKey,
+			active: false
 		});
-		if (fileEntry?.kind === "oauth" && fileEntry.access) {
-			const detail = typeof fileEntry.expires === "number" ? `oauth · expires ${new Date(fileEntry.expires).toLocaleString()}` : "oauth · credentials.json";
-			methods.push({
-				source: "oauth",
-				detail
-			});
-		}
+		const unique = [];
+		for (const method of methods) if (!unique.some((seen) => seen.source === method.source)) unique.push(method);
 		return {
 			key: descriptor.key,
 			label: descriptor.label,
-			available: methods.length > 0,
-			methods
+			available: unique.length > 0,
+			methods: unique,
+			...descriptor.envKey ? { envKey: descriptor.envKey } : {}
 		};
 	});
 }
 //#endregion
-export { restoreModelOptions as C, piIdOf as S, modelOptionsFor as _, readProviderCredential as a, openaiDescriptor as b, writeCredentials as c, cerebrasDescriptor as d, credKeyOf as f, localDescriptor as g, getModelInfo as h, readCredentials as i, BUILTIN_PROVIDERS as l, getContextWindow as m, applyApiKeyEnv as n, removeProviderCredential as o, enabledModelOptions as p, credentialsPath as r, setProviderCredential as s, detectAuth as t, anthropicDescriptor as u, modelSupportsReasoning as v, renderDefaultCallbackPage as w, openrouterDescriptor as x, modelsForDescriptor as y };
+export { openrouterDescriptor as C, renderDefaultCallbackPage as E, openaiDescriptor as S, restoreModelOptions as T, getModelInfo as _, readProviderCredential as a, modelSupportsReasoning as b, setPreferredCredential as c, BUILTIN_PROVIDERS as d, anthropicDescriptor as f, getContextWindow as g, enabledModelOptions as h, readCredentials as i, setProviderCredential as l, credKeyOf as m, applyApiKeyEnv as n, readProviderCredentialPair as o, cerebrasDescriptor as p, credentialsPath as r, removeProviderCredential as s, detectAuth as t, writeCredentials as u, localDescriptor as v, piIdOf as w, modelsForDescriptor as x, modelOptionsFor as y };
 
-//# sourceMappingURL=auth-BLy7X1SY.js.map
+//# sourceMappingURL=auth-BAclQnl3.js.map