zidane 7.1.3 → 7.1.5

package/dist/{auth-HRKkOErn.js → auth-DvMdkpGD.js}

@@ -1,14 +1,14 @@
 import { A as mergeCatalogEntry, D as listModelOverlay, O as listModels, k as lookupModel } from "./openai-compat-Dy56weK8.js";
-import { gn as isReservedCredKey, hn as alternateCredKey, mn as ALTERNATE_CRED_KEY_SUFFIX } from "./agent-_xxElOgH.js";
+import { c as isReservedCredKey, l as nextAccountCredKey, n as ALTERNATE_CRED_KEY_SUFFIX, o as alternateCredKey, s as isAccountCredKey, t as ACCOUNT_CRED_KEY_INFIX, u as oauthAccountLabel } from "./cred-keys-BbbBr4q3.js";
 import { t as writeFileAtomic } from "./atomic-write-B7zr1ddF.js";
-import { _ as FAST_MODE_OPTIONS, g as ANTHROPIC_EXTRA_MODELS, r as anthropic } from "./anthropic-DPPs3wjJ.js";
-import { c as withCredentialsLock, h as registerOAuthProvider, m as refreshOpenAICodexToken, p as refreshAnthropicToken } from "./oauth-B6F43fti.js";
+import { _ as FAST_MODE_OPTIONS, g as ANTHROPIC_EXTRA_MODELS, r as anthropic } from "./anthropic-BQdAnY-w.js";
+import { c as withCredentialsLock, h as registerOAuthProvider, m as refreshOpenAICodexToken, p as refreshAnthropicToken } from "./oauth-DxHO17JE.js";
 import { arcee } from "./providers/arcee.js";
 import { baseten } from "./providers/baseten.js";
 import { cerebras } from "./providers/cerebras.js";
 import { t as generatePkce } from "./pkce-t8BcPyEi.js";
 import { n as createCursorOAuthProvider } from "./cursor-iojRXHF9.js";
-import { n as zai, r as mistral } from "./providers-DP9kwXYo.js";
+import { n as zai, r as mistral } from "./providers-BVhnFyiY.js";
 import { local } from "./providers/local.js";
 import { openai } from "./providers/openai.js";
 import { openrouter } from "./providers/openrouter.js";
@@ -1437,16 +1437,16 @@ function normalizeCredentials(parsed) {
 	return result;
 }
 /**
-* Canonical file key for a descriptor, rejecting the reserved alternate suffix.
+* Canonical file key for a descriptor, rejecting the reserved slot separator.
 *
 * Loud on a misconfigured provider instead of quietly mixing its credentials
-* into another provider's alternate slot (extension registration refuses the
-* suffix upfront; this covers descriptors passed in directly). Read paths stay
-* tolerant — only the functions that can WRITE a pair go through here.
+* into another provider's slot (extension registration refuses the separator
+* upfront; this covers descriptors passed in directly). Read paths stay
+* tolerant — only the functions that WRITE slots go through here.
 */
 function assertableCredKey(descriptor) {
 	const fileKey = credKeyOf(descriptor);
-	if (isReservedCredKey(fileKey)) throw new Error(`Provider "${descriptor.key}" uses credential key "${fileKey}", but the "${ALTERNATE_CRED_KEY_SUFFIX}" suffix is reserved for a provider's second credential slot.`);
+	if (isReservedCredKey(fileKey)) throw new Error(`Provider "${descriptor.key}" uses credential key "${fileKey}", but "#" is reserved for a provider's extra credential slots (\`${ALTERNATE_CRED_KEY_SUFFIX}\`, \`${ACCOUNT_CRED_KEY_INFIX}N\`).`);
 	return fileKey;
 }
 /** Read a single provider's credential (translating via the descriptor). */
@@ -1456,6 +1456,9 @@ function readProviderCredential(dataDir, descriptor) {
 /**
 * Both stored credentials for a provider: `active` is the one every reader
 * resolves, `alternate` is the stored-but-not-preferred one (if any).
+*
+* Predates multi-account and only sees the `#alt` slot; use
+* {@link readProviderCredentials} to list every stored account.
 */
 function readProviderCredentialPair(dataDir, descriptor) {
 	const all = readCredentials(dataDir);
@@ -1466,6 +1469,40 @@ function readProviderCredentialPair(dataDir, descriptor) {
 	};
 }
 /**
+* Every file key holding one of `fileKey`'s credentials, in display order:
+* canonical, `#alt`, then `#account:N` ascending. Only keys present in `all`.
+*/
+function slotKeysOf(all, fileKey) {
+	const altKey = alternateCredKey(fileKey);
+	const accounts = Object.keys(all).filter((key) => isAccountCredKey(fileKey, key)).sort((a, b) => Number(a.slice(a.lastIndexOf(":") + 1)) - Number(b.slice(b.lastIndexOf(":") + 1)));
+	return [
+		...fileKey in all ? [fileKey] : [],
+		...altKey in all ? [altKey] : [],
+		...accounts
+	];
+}
+function isSlotOf(fileKey, key) {
+	return key === fileKey || key === alternateCredKey(fileKey) || isAccountCredKey(fileKey, key);
+}
+/**
+* Every stored credential of a provider, active first.
+*
+* Tolerant of any kind in any slot: `#alt` is meant for the API key and
+* `#account:N` for OAuth accounts, but a file written by an older build (which
+* parked the OAuth alternate in `#alt`) must still list everything it holds.
+*/
+function readProviderCredentials(dataDir, descriptor) {
+	return storedCredentialsOf(readCredentials(dataDir), credKeyOf(descriptor));
+}
+/** Pure form of {@link readProviderCredentials} over an already-read file. */
+function storedCredentialsOf(all, fileKey) {
+	return slotKeysOf(all, fileKey).map((key) => ({
+		key,
+		credential: all[key],
+		active: key === fileKey
+	}));
+}
+/**
 * Write credentials atomically (write-then-rename) with mode 0o600.
 *
 * Atomic on the same filesystem — readers either see the previous file or the
@@ -1482,76 +1519,196 @@ function writeCredentialsUnlocked(dataDir, creds) {
 	});
 }
 /**
-* Store a credential as the provider's preferred one.
-*
-* A credential of the OTHER kind already in the canonical slot is demoted to
-* {@link alternateCredKey}, not destroyed: authenticating with OAuth used to
-* silently delete a working API key (and vice versa), leaving the user to
-* re-enter it. Replacing a credential of the SAME kind is a plain overwrite —
-* that's a re-auth, not a second source.
-*
-* The pair holds AT MOST ONE credential of each kind. A same-kind alternate is
-* therefore stale — no code path here can produce one, but a file written by an
-* older build can carry it, and it would surface as two identical source rows
-* that "switch" between each other. Dropping it on the next write self-heals.
+* Run `fn` against the on-disk file under the mutation lock and persist what it
+* returns. Migrates the legacy file first (migration takes the same lock).
 */
-function setProviderCredential(dataDir, descriptor, cred) {
+function mutateCredentials(dataDir, fn) {
 	readCredentials(dataDir);
 	return withCredentialsLock(credentialsPath(dataDir), () => {
 		const all = readStoredCredentials(credentialsPath(dataDir));
+		const { result, write } = fn(all);
+		if (write) writeCredentialsUnlocked(dataDir, all);
+		return result;
+	});
+}
+/**
+* Move an OAuth grant out of `#alt` into an account slot.
+*
+* Before multi-account, `#alt` held whichever kind was not active — so a file
+* from that era can have an OAuth grant there. `#alt` is now the API key's
+* slot, and every writer below relies on that; relocating first means the
+* grant is preserved instead of overwritten when an API key gets demoted.
+*/
+function relocateLegacyOAuthAlternate(all, fileKey) {
+	const altKey = alternateCredKey(fileKey);
+	const alt = all[altKey];
+	if (alt?.kind !== "oauth") return;
+	delete all[altKey];
+	all[nextAccountCredKey(fileKey, Object.keys(all))] = alt;
+}
+/**
+* Park a credential that just lost the canonical slot.
+*
+* API keys go to `#alt` (there is at most one, so the slot is free once
+* `relocateLegacyOAuthAlternate` has run). OAuth grants reuse the slot the
+* promoted credential vacated when that was an account slot — a swap, no new
+* numbering — and otherwise take the next free `#account:N`.
+*/
+function parkDemoted(all, fileKey, cred, vacated) {
+	if (cred.kind === "apikey") {
+		all[alternateCredKey(fileKey)] = cred;
+		return;
+	}
+	if (vacated && isAccountCredKey(fileKey, vacated)) {
+		all[vacated] = cred;
+		return;
+	}
+	all[nextAccountCredKey(fileKey, Object.keys(all))] = cred;
+}
+/**
+* Store a credential as the provider's preferred one.
+*
+* The previous active credential is demoted, not destroyed: authenticating
+* with OAuth used to silently delete a working API key (and vice versa), and a
+* second OAuth login used to overwrite the first account. An API key moves to
+* {@link alternateCredKey}; an OAuth grant moves to the next free account slot.
+* Replacing an API key with an API key is a plain overwrite — there is only
+* ever one — and so is an OAuth login that names its predecessor via
+* `replaceKey`.
+*/
+function setProviderCredential(dataDir, descriptor, cred, opts = {}) {
+	mutateCredentials(dataDir, (all) => {
 		const fileKey = assertableCredKey(descriptor);
-		const altKey = alternateCredKey(fileKey);
+		relocateLegacyOAuthAlternate(all, fileKey);
+		if (opts.replaceKey !== void 0) {
+			if (!isSlotOf(fileKey, opts.replaceKey)) throw new Error(`"${opts.replaceKey}" is not a credential slot of provider "${descriptor.key}"`);
+			if (opts.replaceKey in all) {
+				all[opts.replaceKey] = cred;
+				return {
+					result: void 0,
+					write: true
+				};
+			}
+		}
 		const previous = all[fileKey];
-		if (previous && previous.kind !== cred.kind) all[altKey] = previous;
-		else if (all[altKey]?.kind === cred.kind) delete all[altKey];
+		if (previous && !(previous.kind === "apikey" && cred.kind === "apikey")) parkDemoted(all, fileKey, previous);
+		else if (cred.kind === "apikey") delete all[alternateCredKey(fileKey)];
 		all[fileKey] = cred;
-		writeCredentialsUnlocked(dataDir, all);
+		return {
+			result: void 0,
+			write: true
+		};
 	});
 }
 /**
-* Make the provider's stored `source` credential the preferred one.
+* Make one of the provider's stored credentials the preferred one.
 *
-* Only promotes when a credential of that kind is sitting in the alternate
-* slot; calling it for the already-active source is harmless. Returns which of
-* those happened so a caller cannot report a swap that provably did not occur
-* — the write is silent either way, and a success-shaped `void` was a trap for
-* any caller that trusted it instead of refetching.
+* Swaps the target into the canonical slot and parks the previous active one
+* (see {@link parkDemoted}). Returns which of the three outcomes happened so a
+* caller cannot report a swap that provably did not occur — the write is
+* silent either way, and a success-shaped `void` was a trap for any caller that
+* trusted it instead of refetching.
 */
-function setPreferredCredential(dataDir, descriptor, source) {
-	readCredentials(dataDir);
-	return withCredentialsLock(credentialsPath(dataDir), () => {
-		const all = readStoredCredentials(credentialsPath(dataDir));
+function setPreferredCredential(dataDir, descriptor, target) {
+	return mutateCredentials(dataDir, (all) => {
 		const fileKey = assertableCredKey(descriptor);
-		const altKey = alternateCredKey(fileKey);
-		const alternate = all[altKey];
-		if (!alternate || alternate.kind !== source) return all[fileKey]?.kind === source ? "already-active" : "not-stored";
+		relocateLegacyOAuthAlternate(all, fileKey);
 		const active = all[fileKey];
-		all[fileKey] = alternate;
-		if (active) all[altKey] = active;
-		else delete all[altKey];
-		writeCredentialsUnlocked(dataDir, all);
-		return "promoted";
+		let key;
+		if (typeof target === "string") {
+			if (active?.kind === target) return {
+				result: "already-active",
+				write: false
+			};
+			key = slotKeysOf(all, fileKey).find((k) => k !== fileKey && all[k]?.kind === target);
+		} else {
+			if (target.key === fileKey && active) return {
+				result: "already-active",
+				write: false
+			};
+			key = isSlotOf(fileKey, target.key) && target.key in all ? target.key : void 0;
+		}
+		if (key === void 0) return {
+			result: "not-stored",
+			write: false
+		};
+		const promoted = all[key];
+		delete all[key];
+		all[fileKey] = promoted;
+		if (active) parkDemoted(all, fileKey, active, key);
+		return {
+			result: "promoted",
+			write: true
+		};
+	});
+}
+/**
+* Drop ONE stored credential. Removing the active one promotes a survivor —
+* another credential of the same kind when there is one (a second OAuth
+* account), else whatever is left — so the provider does not go dark while it
+* still holds a working credential. Returns false when `key` was not stored.
+*/
+function removeStoredCredential(dataDir, descriptor, key) {
+	return mutateCredentials(dataDir, (all) => {
+		const fileKey = credKeyOf(descriptor);
+		if (!isSlotOf(fileKey, key) || !(key in all)) return {
+			result: false,
+			write: false
+		};
+		const removed = all[key];
+		delete all[key];
+		if (key === fileKey) {
+			const rest = slotKeysOf(all, fileKey);
+			const successor = rest.find((k) => all[k]?.kind === removed.kind) ?? rest[0];
+			if (successor !== void 0) {
+				all[fileKey] = all[successor];
+				delete all[successor];
+			}
+		}
+		return {
+			result: true,
+			write: true
+		};
 	});
 }
 /**
-* Sign a provider out — drops BOTH stored credentials.
+* Name a stored OAuth account. An empty label drops the field, which reads
+* back as {@link DEFAULT_OAUTH_ACCOUNT_LABEL}. Returns false when `key` holds
+* no OAuth credential.
+*/
+function setCredentialLabel(dataDir, descriptor, key, label) {
+	return mutateCredentials(dataDir, (all) => {
+		const entry = isSlotOf(credKeyOf(descriptor), key) ? all[key] : void 0;
+		if (entry?.kind !== "oauth") return {
+			result: false,
+			write: false
+		};
+		const trimmed = label.trim();
+		if (trimmed) entry.label = trimmed;
+		else delete entry.label;
+		return {
+			result: true,
+			write: true
+		};
+	});
+}
+/**
+* Sign a provider out — drops EVERY stored credential.
 *
 * "Signed out" has to mean the provider resolves nothing afterwards, which is
-* what this has always guaranteed and what callers named it for; promoting the
-* alternate instead would silently leave the provider authenticated through the
-* other source. Callers that want the fall-back behavior can read the pair
-* first ({@link readProviderCredentialPair}) and re-store the survivor.
+* what this has always guaranteed and what callers named it for; promoting a
+* survivor instead would silently leave the provider authenticated through
+* another source. Callers that want that behavior use
+* {@link removeStoredCredential} on the one slot they mean.
 */
 function removeProviderCredential(dataDir, descriptor) {
-	readCredentials(dataDir);
-	return withCredentialsLock(credentialsPath(dataDir), () => {
-		const all = readStoredCredentials(credentialsPath(dataDir));
-		const fileKey = credKeyOf(descriptor);
-		const altKey = alternateCredKey(fileKey);
-		if (!(fileKey in all) && !(altKey in all)) return;
-		delete all[fileKey];
-		delete all[altKey];
-		writeCredentialsUnlocked(dataDir, all);
+	mutateCredentials(dataDir, (all) => {
+		const keys = slotKeysOf(all, credKeyOf(descriptor));
+		for (const key of keys) delete all[key];
+		return {
+			result: void 0,
+			write: keys.length > 0
+		};
 	});
 }
 /**
@@ -1689,13 +1846,14 @@ function isOAuthLegacy(value) {
 *
 *   - `kind: 'apikey'` from `credentials.json` (injected into env at TUI launch)
 *   - explicit env var (descriptor's `envKey`)
-*   - `kind: 'oauth'` from `credentials.json` (or legacy `cwd/.credentials.json`)
+*   - `kind: 'oauth'` from `credentials.json` (or legacy `cwd/.credentials.json`),
+*     one per stored account
 *
-* A provider may store one of EACH kind. The preferred one lives in the
-* canonical file key and is flagged {@link AuthMethod.active}; the other sits
-* in `alternateCredKey` and is reported too, so the UI can offer to promote it.
-* Order within `methods` is presentational — it is no longer a resolution
-* order, because the active flag answers that directly.
+* The preferred credential lives in the canonical file key and is flagged
+* {@link AuthMethod.active}; the others sit in sibling slots and are reported
+* too, keyed by {@link AuthMethod.key}, so the UI can offer to promote or
+* remove them. Order within `methods` is presentational — active first — not a
+* resolution order, because the active flag answers that directly.
 *
 * Pure read — never refreshes or rewrites the credentials file.
 */
@@ -1703,23 +1861,30 @@ function detectAuth(dataDir, registry, env = process.env) {
 	const creds = readCredentials(dataDir);
 	return Object.values(registry).map((descriptor) => {
 		const methods = [];
-		const fileKey = credKeyOf(descriptor);
-		const fileEntry = creds[fileKey];
-		const altEntry = creds[alternateCredKey(fileKey)];
-		const describeStored = (entry, active) => {
-			if (entry?.kind === "apikey" && entry.value) return {
+		const stored = storedCredentialsOf(creds, credKeyOf(descriptor));
+		const fileEntry = stored.find((s) => s.active)?.credential;
+		const describeStored = (key, entry, active) => {
+			if (entry.kind === "apikey" && entry.value) return {
 				source: "apikey",
 				detail: "credentials.json",
-				active
-			};
-			if (entry?.kind === "oauth" && entry.access) return {
-				source: "oauth",
-				detail: typeof entry.expires === "number" ? `oauth · expires ${new Date(entry.expires).toLocaleString()}` : "oauth · credentials.json",
-				active
+				active,
+				key
 			};
+			if (entry.kind === "oauth" && entry.access) {
+				const label = oauthAccountLabel(entry);
+				return {
+					source: "oauth",
+					detail: `${label} · ${typeof entry.expires === "number" ? `expires ${new Date(entry.expires).toLocaleString()}` : "credentials.json"}`,
+					active,
+					key,
+					label
+				};
+			}
 		};
-		const activeMethod = describeStored(fileEntry, true);
-		if (activeMethod) methods.push(activeMethod);
+		for (const slot of stored) {
+			const method = describeStored(slot.key, slot.credential, slot.active);
+			if (method) methods.push(method);
+		}
 		if (fileEntry?.kind === "apikey" && !fileEntry.value && descriptor.customFields && descriptor.customFields.length > 0) {
 			const stored = fileEntry.customFields ?? {};
 			if (descriptor.customFields.filter((f) => f.required).every((f) => typeof stored[f.key] === "string" && stored[f.key].length > 0)) methods.push({
@@ -1736,15 +1901,13 @@ function detectAuth(dataDir, registry, env = process.env) {
 				active: false
 			});
 		}
-		const alternateMethod = describeStored(altEntry, false);
-		if (alternateMethod) methods.push(alternateMethod);
 		if (descriptor.envKey && env[descriptor.envKey]) methods.push({
 			source: "env",
 			detail: descriptor.envKey,
 			active: false
 		});
 		const unique = [];
-		for (const method of methods) if (!unique.some((seen) => seen.source === method.source)) unique.push(method);
+		for (const method of methods) if (!unique.some((seen) => method.source === "oauth" ? seen.key !== void 0 && seen.key === method.key : seen.source === method.source)) unique.push(method);
 		return {
 			key: descriptor.key,
 			label: descriptor.label,
@@ -1755,6 +1918,6 @@ function detectAuth(dataDir, registry, env = process.env) {
 	});
 }
 //#endregion
-export { openrouterDescriptor as C, renderDefaultCallbackPage as E, openaiDescriptor as S, restoreModelOptions as T, getModelInfo as _, readProviderCredential as a, modelSupportsReasoning as b, setPreferredCredential as c, BUILTIN_PROVIDERS as d, anthropicDescriptor as f, getContextWindow as g, enabledModelOptions as h, readCredentials as i, setProviderCredential as l, credKeyOf as m, applyApiKeyEnv as n, readProviderCredentialPair as o, cerebrasDescriptor as p, credentialsPath as r, removeProviderCredential as s, detectAuth as t, writeCredentials as u, localDescriptor as v, piIdOf as w, modelsForDescriptor as x, modelOptionsFor as y };
+export { renderDefaultCallbackPage as A, modelOptionsFor as C, openrouterDescriptor as D, openaiDescriptor as E, piIdOf as O, localDescriptor as S, modelsForDescriptor as T, cerebrasDescriptor as _, readProviderCredential as a, getContextWindow as b, removeProviderCredential as c, setPreferredCredential as d, setProviderCredential as f, anthropicDescriptor as g, BUILTIN_PROVIDERS as h, readCredentials as i, restoreModelOptions as k, removeStoredCredential as l, writeCredentials as m, applyApiKeyEnv as n, readProviderCredentialPair as o, storedCredentialsOf as p, credentialsPath as r, readProviderCredentials as s, detectAuth as t, setCredentialLabel as u, credKeyOf as v, modelSupportsReasoning as w, getModelInfo as x, enabledModelOptions as y };
 
-//# sourceMappingURL=auth-HRKkOErn.js.map
+//# sourceMappingURL=auth-DvMdkpGD.js.map