lm15 1.0.0-rc.7

One request and response model for every LLM provider (OpenAI, Anthropic, Gemini, xAI, Groq, Bedrock, Azure, Vertex, local servers), with visible adaptations. Implements the lm15 contract.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86

//! lm15-contract auth surface, module 3a (playbooks/port.md; spec/auth.md,
//! ratified 2026-08-31, amendments through 2026-09-19):
//!
//! - AUTH-2 credential values ([`Credential`]) and providers
//!   ([`CredentialProvider`]), with the D1 scheme selection ([`select_scheme`]);
//! - AUTH-10 access policies as data ([`AccessPolicy`], [`access_policy`]),
//!   every column of the reference table since module 4 ([`HostSpec`],
//!   [`EndpointSupport`], headers, backend, base URL);
//! - AUTH-1 resolution for the `key`, `oauth` and `oauth-unless-explicit`
//!   policies, explained rung by rung by [`explain_auth`] (AUTH-7);
//! - AUTH-8 read side of the borrowed CLI files and the lm15-owned store.
//!
//! Secrecy invariant (AUTH-5): no secret value is stored on a [`Report`],
//! rendered by `describe`, or emitted by any `Debug`/`Display` impl here.
//!
//! - AUTH-3/AUTH-4 write side: [`StoredLogin::refreshing`] refreshes an
//!   expired login under the cross-process [`FileLock`] with the
//!   double-checked re-read and writes it back atomically (0600);
//! - AUTH-9: [`login`] — the one uniform door; xAI's device-code flow is
//!   the flow this port owns, every other provider fails typed naming the
//!   real path. [`pkce_challenge`] (S256) is the only other primitive
//!   shipped: no flow here needs a loopback listener, so none is built.
//!
//! The cloud chains and their named subsets (AUTH-1 `platform`, `workload`,
//! `environment`, `cli`), AUTH-11, SigV4 and RS256 live in `crate::cloud`.
//! [`CredentialSource`] records the identity without its secret; the generic
//! [`CredentialFileStore`] shares AUTH-4 locks with stored-login refresh.

mod credential;
mod device;
mod doctor;
mod error;
pub(crate) mod file_store;
pub(crate) mod lock;
pub(crate) mod login;
pub(crate) mod policy;
pub(crate) mod refresh;
pub(crate) mod stores;
pub(crate) mod time;

pub use credential::{
    is_jwt, looks_like_access_token, select_scheme, AuthScheme, Credential, CredentialKind,
    CredentialProvider, CredentialSource, FnCredential, SourcedCredential, StaticCredential,
    EXPIRY_SKEW_SECONDS,
};
pub use device::{
    login, login_xai, pkce_challenge, poll_device_code, poll_xai_device_login,
    start_xai_device_login, DeviceAuthorization, DevicePoll, Echo, LoginOptions, Sleeper,
};
pub use doctor::{explain_auth, ExplainOptions, Report, Step, StepState};
pub use error::AuthError;
pub use file_store::{default_credentials_path, CredentialFileStore};
pub use lock::{
    lock_dir, lock_path_for, try_lock_path_for, write_private_json_atomic, FileLock,
    DEFAULT_LOCK_TIMEOUT,
};
pub use login::{stored_login_paths, StoredLogin, StoredState};
pub use policy::{
    access_policy, canonical_provider, claude_code_version_guidance, known_providers, AccessPolicy,
    AnthropicVersionIn, CredentialPolicy, EndpointSupport, HostSetting, HostSpec, ModelPlacement,
    StreamFraming, ACCESS_POLICIES, ANTHROPIC_API, AWS_ANTHROPIC, AZURE, AZURE_ANTHROPIC,
    AZURE_CHAT, BEDROCK_ANTHROPIC, BEDROCK_CHAT, BEDROCK_MANTLE_CHAT, CLAUDE_CODE,
    CLAUDE_CODE_VERSION_ENV, CODEX_CLIENT_VERSION_ENV, DEEPINFRA, DEEPSEEK, DEEPSEEK_ANTHROPIC,
    DEFAULT_CLAUDE_CODE_SYSTEM_PROMPT, DEFAULT_CLAUDE_CODE_VERSION, DEFAULT_CODEX_BASE_URL,
    DEFAULT_CODEX_CLIENT_VERSION, DEFAULT_CODEX_INSTRUCTIONS, DEFAULT_CODEX_ORIGINATOR,
    DEFAULT_XAI_BASE_URL, FIREWORKS, GEMINI_API, GITHUB_COPILOT, GROQ, KIMI_CODE, META,
    META_ANTHROPIC, META_CHAT, MOONSHOTAI, MOONSHOTAI_ANTHROPIC, MOONSHOTAI_RESPONSES, OLLAMA,
    OPENAI_API, OPENAI_CHAT_API, OPENAI_CODEX, OPENROUTER, PARASAIL, SGLANG, TOGETHER, TYPESAFE,
    VERTEX, VERTEX_ANTHROPIC, VERTEX_EXPRESS, VLLM, XAI, ZAI,
};
pub use refresh::{
    credential_from_token_response, merged_file, refresh_request, LoginProvider,
    CLAUDE_CODE_CLIENT_ID, CLAUDE_CODE_TOKEN_URL, OPENAI_CODEX_CLIENT_ID, OPENAI_CODEX_TOKEN_URL,
    XAI_CLIENT_ID, XAI_DEVICE_CODE_URL, XAI_OAUTH_SCOPE, XAI_TOKEN_URL,
};
pub use stores::{
    extract_chatgpt_account_id, jwt_expires_at_ms, read_claude_code_credential,
    read_codex_cli_credential, read_xai_credential, Expiry, LocalOAuthCredential,
    CLAUDE_CODE_LOGIN_HINT, OPENAI_CODEX_LOGIN_HINT, XAI_LOGIN_HINT,
};
pub use time::{format_rfc3339, parse_rfc3339};

/// The wall clock as Unix seconds.
pub fn time_now() -> i64 {
    time::now_unix()
}