@kodax-ai/kodax 0.7.97-beta.2 → 0.7.97-beta.3

package/dist/chunks/{chunk-R42S4BLA.js → chunk-SQGESMNC.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{i as F,k as A,o as p}from"./chunk-SDPZFH6M.js";import{c as k}from"./chunk-J2L2NK6E.js";import{B as E,Da as h,E as R,Ea as K,Fa as $,Ka as D,La as j,Q as x,R as U,Ua as m}from"./chunk-SK3RRGHJ.js";import{a as l}from"./chunk-V4WSBIXB.js";import{createHash as T,randomUUID as O}from"node:crypto";import{mkdir as M,readFile as X,open as N,rename as b,unlink as B,rm as L,lstat as V}from"node:fs/promises";import w from"node:path";import{spawn as Z}from"node:child_process";import{setTimeout as G}from"node:timers/promises";function v(e){return!!e&&typeof e=="object"&&"code"in e&&e.code==="ENOENT"}l(v,"missing");function u(e){let i=new h("storage_failed");return e&&(i.message+=` Retained lock: ${e}. Inspect with kodax doctor before offline repair.`),i}l(u,"storageError");async function S(e){let i=await V(e);if(i.isSymbolicLink())throw u(e);return i.isDirectory()?w.join(e,"owner.json"):e}l(S,"lockOwnerFile");async function Q(e){let i=Date.now()+3e4;for(;;)try{let t=O();if(A({rootDir:w.dirname(e),lockFile:e},{runtimeId:t,pid:process.pid,createdAt:new Date().toISOString()}))return async()=>{if(p(await S(e))?.runtimeId!==t)throw u(e);let r=`${e}.released.${t}`;await b(e,r),await L(r,{recursive:!0,force:!0,maxRetries:3,retryDelay:20})};let a=await S(e),c=p(a);if(c&&F(c)==="gone"){let r=T("sha256").update(JSON.stringify(c)).digest("hex"),n=`${e}.reclaim.${r}`;if(A({rootDir:w.dirname(e),lockFile:n},{runtimeId:O(),pid:process.pid,createdAt:new Date().toISOString()})){if(JSON.stringify(p(await S(e)))!==JSON.stringify(c))throw u(e);let o=`${e}.abandoned.${r}`;await b(e,o),await L(o,{recursive:!0,force:!0,maxRetries:3,retryDelay:20});continue}}if(Date.now()>=i)throw u(e);await G(20)}catch(t){if(v(t))continue;throw t instanceof h?t:u(e)}}l(Q,"lock");function _(e,i){if(!e||typeof e!="object"||!("id"in e)||e.id!==i||!("clientId"in e)||typeof e.clientId!="string"||!e.clientId.trim()||!("accountId"in e)||typeof e.accountId!="string"||!e.accountId.trim()||!("service"in e)||typeof e.service!="string")throw u();return e}l(_,"registration");async function Y(e,i,t){let s;try{s=await X(e)}catch(a){if(v(a))return;throw u()}try{if(s.length>1024*1024)throw u();let a=await t.unseal(s);try{return _(JSON.parse(Buffer.from(a).toString("utf8")),i)}finally{a.fill(0)}}catch{throw u()}}l(Y,"readRecord");async function ee(e,i,t){if(!i){try{await B(e)}catch(c){if(!v(c))throw u()}return}let s=`${e}.${O()}.tmp`,a=Buffer.from(JSON.stringify(i));try{let c=await t.seal(a),r=await N(s,"wx",384);try{await r.writeFile(c),await r.sync()}finally{await r.close()}if(await b(s,e),process.platform!=="win32"){let n=await N(w.dirname(e),"r");try{await n.sync()}finally{await n.close()}}}catch{throw u()}finally{a.fill(0);try{await B(s)}catch(c){if(!v(c))throw u()}}}l(ee,"commit");function re(e,i){if(!w.isAbsolute(e))throw new Error("OAuth store requires an absolute trusted directory.");return{async transact(t,s){if(!t.trim()||t.length>512)throw u();await M(e,{recursive:!0,mode:448});let a=w.join(e,`${T("sha256").update(t).digest("hex")}.sealed`),c=await Q(`${a}.lock`);try{let r=await Y(a,t,i),n=await s(r?structuredClone(r):void 0);if(n.record&&(_(n.record,t),r&&(r.service!==n.record.service||r.clientId!==n.record.clientId||r.accountId!==n.record.accountId||r.issuer!==n.record.issuer||r.identityKind!==n.record.identityKind||r.profile!==n.record.profile)))throw u();return await ee(a,n.record,i),n.result}finally{await c()}}}}l(re,"createEncryptedOAuthSessionStore");function z(e,i){let t=process.env.SystemRoot;if(!t||!w.isAbsolute(t))return Promise.reject(u());let a=`Add-Type -AssemblyName System.Security; $data = [Convert]::FromBase64String([Console]::In.ReadToEnd()); $result = [Security.Cryptography.ProtectedData]::${i?"Protect":"Unprotect"}($data, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser); [Console]::Out.Write([Convert]::ToBase64String($result))`;return new Promise((c,r)=>{let n=Z(w.join(t,"System32","WindowsPowerShell","v1.0","powershell.exe"),["-NoLogo","-NoProfile","-NonInteractive","-EncodedCommand",Buffer.from(a,"utf16le").toString("base64")],{windowsHide:!0,stdio:["pipe","pipe","pipe"],timeout:15e3}),o=[],d=0;n.stdout.on("data",f=>{d+=f.length,d>2*1024*1024?n.kill():o.push(f)}),n.stderr.resume(),n.on("error",()=>r(u())),n.stdin.on("error",()=>r(u())),n.on("close",f=>{let g=Buffer.concat(o).toString().trim();f!==0||!g||d>2*1024*1024||!/^[A-Za-z0-9+/]+={0,2}$/.test(g)?r(u()):c(Buffer.from(g,"base64"))}),n.stdin.end(Buffer.from(e).toString("base64"))})}l(z,"dpapi");function q(e){if(process.platform!=="win32")throw new Error("Windows DPAPI is unavailable. Supply the trusted Main OS secure-store adapter.");return re(e,{seal:l(i=>z(i,!0),"seal"),unseal:l(i=>z(i,!1),"unseal")})}l(q,"createWindowsOAuthSessionStore");import{createHash as ie}from"node:crypto";import{lstat as te}from"node:fs/promises";import y from"node:path";function ne(e){return m(y.join(y.dirname(e),"auth.json")).oauth}l(ne,"providerOAuthStore");function Oe(e,i){if(e.service!==i.service)throw new Error("OAuth source and session must match.");if(e.profile!==void 0&&(i.profile??"default")!==e.profile)throw new Error("OAuth registration belongs to another profile.");if(e.service==="radius"){if(e.issuer===void 0)throw new Error("Radius requires an approved OAuth issuer.");let t=l(s=>{try{return new URL(s??"").href.replace(/\/$/,"")}catch{throw new Error("Invalid OAuth issuer metadata.")}},"normalize");if(t(e.issuer)!==t(i.issuer))throw new Error("OAuth registration issuer does not match the approved connection.")}}l(Oe,"assertProviderOAuthSessionScope");async function be(e){let i=ne(e.configPath),t=e.registrationId;if(await i.transact(t,async a=>({record:a,result:a!==void 0})))return"current";let s=e.legacyStore;if(!s){let a=y.join(y.dirname(e.configPath),"provider-oauth"),c=y.join(a,`${ie("sha256").update(t).digest("hex")}.sealed`);try{let r=await te(c);if(!r.isFile()||r.isSymbolicLink())throw new Error("Invalid legacy OAuth registration file.")}catch(r){if(r&&typeof r=="object"&&"code"in r&&r.code==="ENOENT")return"absent";throw r}s=q(a)}return s.transact(t,async a=>{if(!a)return{record:a,result:"absent"};let c=await i.transact(t,async r=>r?{record:r,result:!1}:{record:a,result:!0});return{record:a,result:c?"migrated":"current"}})}l(be,"migrateProviderOAuthRegistration");import{randomUUID as J}from"node:crypto";async function Ee(e){if(!e.clientId?.trim()||!!e.browser==!!e.device)throw new h("invalid_session");if(e.profile!==void 0&&(typeof e.profile!="string"||!e.profile.trim()))throw new h("invalid_session");let i,t,s={service:e.service,clientId:e.clientId,scopes:[...e.scopes],issuer:e.issuer,fetch:e.fetch,signal:e.signal};if(e.browser){if(!e.redirectUri)throw new h("invalid_session");let d=await D({...s,redirectUri:e.redirectUri});t=d.nonce;try{i=await d.exchange(await e.browser({authorizationUrl:d.authorizationUrl,signal:e.signal}),e.signal)}finally{d.close()}}else{let d=await j(s);try{await e.device({verificationUri:d.verificationUriComplete??d.verificationUri,userCode:d.userCode,expiresAt:d.expiresAt}),i=await d.poll(e.signal)}finally{d.close()}}e.signal?.throwIfAborted();let a=e.clientId.trim(),c=e.verifyIdentity?await e.verifyIdentity(i,{service:e.service,clientId:a,nonce:t,signal:e.signal}):`grant:${J()}`;if(typeof c!="string"||!c.trim()||c.length>1024)throw new h("invalid_session");let r={id:J(),service:e.service,clientId:a,accountId:c,identityKind:e.verifyIdentity?"account":"grant",credentials:i.tokens,...e.issuer?{issuer:e.issuer}:{},...e.profile?{profile:e.profile}:{}};e.signal?.throwIfAborted(),await e.store.transact(r.id,async d=>{if(d)throw new h("invalid_session");return e.signal?.throwIfAborted(),{record:r,result:void 0}});let n=l(()=>K({id:r.id,store:e.store,driver:$(r.service,{fetch:e.fetch})}),"open"),o;try{return e.signal?.throwIfAborted(),o=await n(),e.signal?.throwIfAborted(),{registrationId:r.id,accountId:r.accountId,identityKind:r.identityKind,session:o}}catch(d){throw e.signal?.aborted&&(o??=await n(),await o.revoke()),d}}l(Ee,"loginProviderOAuth");import{createHash as oe}from"node:crypto";import{readFile as se}from"node:fs/promises";import P from"node:path";async function H(e){let i="";try{i=await se(e,"utf8")}catch(s){if(!s||typeof s!="object"||!("code"in s)||s.code!=="ENOENT")throw new Error("Cannot read provider configuration.")}let t;try{t=i?JSON.parse(i):{}}catch{throw new Error("Invalid provider configuration.")}if(!t||typeof t!="object"||Array.isArray(t))throw new Error("Invalid provider configuration.");return{config:t,revision:oe("sha256").update(i).digest("hex")}}l(H,"readConfig");function ae(e,i){let t=Object.entries(E).find(([r])=>r===i)?.[1];if(t)return{provider:R(i),apiKeyEnv:t.apiKeyEnv,kind:t.capabilityProfile.transport==="cli-bridge"?"external":"key"};let s=e.customProviders;if(!Array.isArray(s))throw new Error("Unknown configured provider.");let a=s.filter(r=>r&&typeof r=="object"&&"name"in r&&r.name===i);if(a.length!==1)throw new Error("Unknown or duplicate configured provider.");let c=a[0];return x(c),{provider:U(c),apiKeyEnv:c.apiKeyEnv,kind:c.oauth?"oauth":c.cloud?"cloud":"key"}}l(ae,"configuredTarget");function Fe(e={}){let i=e.configPath??k("config.json"),t=e.profile??"default";if(!P.isAbsolute(i)||!t.trim())throw new Error("Credential manager requires a trusted config path and profile.");let s=m(P.join(P.dirname(i),"auth.json")),a=l(async n=>{let o=await H(i),d=ae(o.config,n);return{...d,configRevision:o.revision,binding:{profile:t,provider:n,connectionFingerprint:d.provider.getCredentialConnectionFingerprint()}}},"target"),c=l(async n=>{let o=await a(n),d=await s.describeApiKey(o.binding),f=(e.environment?.()??process.env)[o.apiKeyEnv]?.trim(),g=o.kind==="oauth"||o.kind==="external"?o.kind:d.configured?"file":f?"environment":o.kind==="cloud"?"cloud":"missing";return{binding:o.binding,configRevision:o.configRevision,revision:d.revision??null,apiKeyEnv:o.apiKeyEnv,stored:d.configured,configured:g==="file"||g==="environment",source:g}},"describe"),r=l(async(n,o,d)=>{if(!o||o.revision!==null&&(typeof o.revision!="string"||!o.revision.trim()))throw new Error("Credential update requires an expected revision. Refresh its state before retrying.");let f=await a(n);if(f.kind==="oauth"||f.kind==="external")throw new Error(`Use the provider's ${f.kind==="oauth"?"OAuth":"external"} authentication flow.`);if(o.configRevision!==f.configRevision||o.binding.profile!==f.binding.profile||o.binding.provider!==f.binding.provider||o.binding.connectionFingerprint!==f.binding.connectionFingerprint)throw new Error("Provider configuration or connection changed. Refresh its state before retrying.");let g=await s.readApiKey(f.binding),I=d===void 0?await s.removeApiKey(f.binding,o.revision):await s.setApiKey(f.binding,d.key,o.revision);try{if((await H(i)).revision!==f.configRevision)throw new Error("Provider configuration changed while saving credentials.");return await c(n)}catch(C){try{g?await s.setApiKey(f.binding,g.key,I.revision):await s.removeApiKey(f.binding,I.revision)}catch(W){throw new AggregateError([C,W],"Credential update failed and rollback conflicted. Refresh its state before retrying.")}throw C}},"mutate");return{filePath:s.filePath,describe:c,setApiKey:l((n,o,d)=>r(n,d,{key:o}),"setApiKey"),removeApiKey:l((n,o)=>r(n,o),"removeApiKey")}}l(Fe,"createProviderCredentialManager");export{re as a,q as b,ne as c,Oe as d,be as e,Ee as f,Fe as g};
+import{i as F,k as A,o as p}from"./chunk-5E2P4RYS.js";import{c as k}from"./chunk-OMVAPRQI.js";import{B as E,Da as h,E as R,Ea as K,Fa as $,Ka as D,La as j,Q as x,R as U,Ua as m}from"./chunk-PFBZ4ZXO.js";import{a as l}from"./chunk-V4WSBIXB.js";import{createHash as T,randomUUID as O}from"node:crypto";import{mkdir as M,readFile as X,open as N,rename as b,unlink as B,rm as L,lstat as V}from"node:fs/promises";import w from"node:path";import{spawn as Z}from"node:child_process";import{setTimeout as G}from"node:timers/promises";function v(e){return!!e&&typeof e=="object"&&"code"in e&&e.code==="ENOENT"}l(v,"missing");function u(e){let i=new h("storage_failed");return e&&(i.message+=` Retained lock: ${e}. Inspect with kodax doctor before offline repair.`),i}l(u,"storageError");async function S(e){let i=await V(e);if(i.isSymbolicLink())throw u(e);return i.isDirectory()?w.join(e,"owner.json"):e}l(S,"lockOwnerFile");async function Q(e){let i=Date.now()+3e4;for(;;)try{let t=O();if(A({rootDir:w.dirname(e),lockFile:e},{runtimeId:t,pid:process.pid,createdAt:new Date().toISOString()}))return async()=>{if(p(await S(e))?.runtimeId!==t)throw u(e);let r=`${e}.released.${t}`;await b(e,r),await L(r,{recursive:!0,force:!0,maxRetries:3,retryDelay:20})};let a=await S(e),c=p(a);if(c&&F(c)==="gone"){let r=T("sha256").update(JSON.stringify(c)).digest("hex"),n=`${e}.reclaim.${r}`;if(A({rootDir:w.dirname(e),lockFile:n},{runtimeId:O(),pid:process.pid,createdAt:new Date().toISOString()})){if(JSON.stringify(p(await S(e)))!==JSON.stringify(c))throw u(e);let o=`${e}.abandoned.${r}`;await b(e,o),await L(o,{recursive:!0,force:!0,maxRetries:3,retryDelay:20});continue}}if(Date.now()>=i)throw u(e);await G(20)}catch(t){if(v(t))continue;throw t instanceof h?t:u(e)}}l(Q,"lock");function _(e,i){if(!e||typeof e!="object"||!("id"in e)||e.id!==i||!("clientId"in e)||typeof e.clientId!="string"||!e.clientId.trim()||!("accountId"in e)||typeof e.accountId!="string"||!e.accountId.trim()||!("service"in e)||typeof e.service!="string")throw u();return e}l(_,"registration");async function Y(e,i,t){let s;try{s=await X(e)}catch(a){if(v(a))return;throw u()}try{if(s.length>1024*1024)throw u();let a=await t.unseal(s);try{return _(JSON.parse(Buffer.from(a).toString("utf8")),i)}finally{a.fill(0)}}catch{throw u()}}l(Y,"readRecord");async function ee(e,i,t){if(!i){try{await B(e)}catch(c){if(!v(c))throw u()}return}let s=`${e}.${O()}.tmp`,a=Buffer.from(JSON.stringify(i));try{let c=await t.seal(a),r=await N(s,"wx",384);try{await r.writeFile(c),await r.sync()}finally{await r.close()}if(await b(s,e),process.platform!=="win32"){let n=await N(w.dirname(e),"r");try{await n.sync()}finally{await n.close()}}}catch{throw u()}finally{a.fill(0);try{await B(s)}catch(c){if(!v(c))throw u()}}}l(ee,"commit");function re(e,i){if(!w.isAbsolute(e))throw new Error("OAuth store requires an absolute trusted directory.");return{async transact(t,s){if(!t.trim()||t.length>512)throw u();await M(e,{recursive:!0,mode:448});let a=w.join(e,`${T("sha256").update(t).digest("hex")}.sealed`),c=await Q(`${a}.lock`);try{let r=await Y(a,t,i),n=await s(r?structuredClone(r):void 0);if(n.record&&(_(n.record,t),r&&(r.service!==n.record.service||r.clientId!==n.record.clientId||r.accountId!==n.record.accountId||r.issuer!==n.record.issuer||r.identityKind!==n.record.identityKind||r.profile!==n.record.profile)))throw u();return await ee(a,n.record,i),n.result}finally{await c()}}}}l(re,"createEncryptedOAuthSessionStore");function z(e,i){let t=process.env.SystemRoot;if(!t||!w.isAbsolute(t))return Promise.reject(u());let a=`Add-Type -AssemblyName System.Security; $data = [Convert]::FromBase64String([Console]::In.ReadToEnd()); $result = [Security.Cryptography.ProtectedData]::${i?"Protect":"Unprotect"}($data, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser); [Console]::Out.Write([Convert]::ToBase64String($result))`;return new Promise((c,r)=>{let n=Z(w.join(t,"System32","WindowsPowerShell","v1.0","powershell.exe"),["-NoLogo","-NoProfile","-NonInteractive","-EncodedCommand",Buffer.from(a,"utf16le").toString("base64")],{windowsHide:!0,stdio:["pipe","pipe","pipe"],timeout:15e3}),o=[],d=0;n.stdout.on("data",f=>{d+=f.length,d>2*1024*1024?n.kill():o.push(f)}),n.stderr.resume(),n.on("error",()=>r(u())),n.stdin.on("error",()=>r(u())),n.on("close",f=>{let g=Buffer.concat(o).toString().trim();f!==0||!g||d>2*1024*1024||!/^[A-Za-z0-9+/]+={0,2}$/.test(g)?r(u()):c(Buffer.from(g,"base64"))}),n.stdin.end(Buffer.from(e).toString("base64"))})}l(z,"dpapi");function q(e){if(process.platform!=="win32")throw new Error("Windows DPAPI is unavailable. Supply the trusted Main OS secure-store adapter.");return re(e,{seal:l(i=>z(i,!0),"seal"),unseal:l(i=>z(i,!1),"unseal")})}l(q,"createWindowsOAuthSessionStore");import{createHash as ie}from"node:crypto";import{lstat as te}from"node:fs/promises";import y from"node:path";function ne(e){return m(y.join(y.dirname(e),"auth.json")).oauth}l(ne,"providerOAuthStore");function Oe(e,i){if(e.service!==i.service)throw new Error("OAuth source and session must match.");if(e.profile!==void 0&&(i.profile??"default")!==e.profile)throw new Error("OAuth registration belongs to another profile.");if(e.service==="radius"){if(e.issuer===void 0)throw new Error("Radius requires an approved OAuth issuer.");let t=l(s=>{try{return new URL(s??"").href.replace(/\/$/,"")}catch{throw new Error("Invalid OAuth issuer metadata.")}},"normalize");if(t(e.issuer)!==t(i.issuer))throw new Error("OAuth registration issuer does not match the approved connection.")}}l(Oe,"assertProviderOAuthSessionScope");async function be(e){let i=ne(e.configPath),t=e.registrationId;if(await i.transact(t,async a=>({record:a,result:a!==void 0})))return"current";let s=e.legacyStore;if(!s){let a=y.join(y.dirname(e.configPath),"provider-oauth"),c=y.join(a,`${ie("sha256").update(t).digest("hex")}.sealed`);try{let r=await te(c);if(!r.isFile()||r.isSymbolicLink())throw new Error("Invalid legacy OAuth registration file.")}catch(r){if(r&&typeof r=="object"&&"code"in r&&r.code==="ENOENT")return"absent";throw r}s=q(a)}return s.transact(t,async a=>{if(!a)return{record:a,result:"absent"};let c=await i.transact(t,async r=>r?{record:r,result:!1}:{record:a,result:!0});return{record:a,result:c?"migrated":"current"}})}l(be,"migrateProviderOAuthRegistration");import{randomUUID as J}from"node:crypto";async function Ee(e){if(!e.clientId?.trim()||!!e.browser==!!e.device)throw new h("invalid_session");if(e.profile!==void 0&&(typeof e.profile!="string"||!e.profile.trim()))throw new h("invalid_session");let i,t,s={service:e.service,clientId:e.clientId,scopes:[...e.scopes],issuer:e.issuer,fetch:e.fetch,signal:e.signal};if(e.browser){if(!e.redirectUri)throw new h("invalid_session");let d=await D({...s,redirectUri:e.redirectUri});t=d.nonce;try{i=await d.exchange(await e.browser({authorizationUrl:d.authorizationUrl,signal:e.signal}),e.signal)}finally{d.close()}}else{let d=await j(s);try{await e.device({verificationUri:d.verificationUriComplete??d.verificationUri,userCode:d.userCode,expiresAt:d.expiresAt}),i=await d.poll(e.signal)}finally{d.close()}}e.signal?.throwIfAborted();let a=e.clientId.trim(),c=e.verifyIdentity?await e.verifyIdentity(i,{service:e.service,clientId:a,nonce:t,signal:e.signal}):`grant:${J()}`;if(typeof c!="string"||!c.trim()||c.length>1024)throw new h("invalid_session");let r={id:J(),service:e.service,clientId:a,accountId:c,identityKind:e.verifyIdentity?"account":"grant",credentials:i.tokens,...e.issuer?{issuer:e.issuer}:{},...e.profile?{profile:e.profile}:{}};e.signal?.throwIfAborted(),await e.store.transact(r.id,async d=>{if(d)throw new h("invalid_session");return e.signal?.throwIfAborted(),{record:r,result:void 0}});let n=l(()=>K({id:r.id,store:e.store,driver:$(r.service,{fetch:e.fetch})}),"open"),o;try{return e.signal?.throwIfAborted(),o=await n(),e.signal?.throwIfAborted(),{registrationId:r.id,accountId:r.accountId,identityKind:r.identityKind,session:o}}catch(d){throw e.signal?.aborted&&(o??=await n(),await o.revoke()),d}}l(Ee,"loginProviderOAuth");import{createHash as oe}from"node:crypto";import{readFile as se}from"node:fs/promises";import P from"node:path";async function H(e){let i="";try{i=await se(e,"utf8")}catch(s){if(!s||typeof s!="object"||!("code"in s)||s.code!=="ENOENT")throw new Error("Cannot read provider configuration.")}let t;try{t=i?JSON.parse(i):{}}catch{throw new Error("Invalid provider configuration.")}if(!t||typeof t!="object"||Array.isArray(t))throw new Error("Invalid provider configuration.");return{config:t,revision:oe("sha256").update(i).digest("hex")}}l(H,"readConfig");function ae(e,i){let t=Object.entries(E).find(([r])=>r===i)?.[1];if(t)return{provider:R(i),apiKeyEnv:t.apiKeyEnv,kind:t.capabilityProfile.transport==="cli-bridge"?"external":"key"};let s=e.customProviders;if(!Array.isArray(s))throw new Error("Unknown configured provider.");let a=s.filter(r=>r&&typeof r=="object"&&"name"in r&&r.name===i);if(a.length!==1)throw new Error("Unknown or duplicate configured provider.");let c=a[0];return x(c),{provider:U(c),apiKeyEnv:c.apiKeyEnv,kind:c.oauth?"oauth":c.cloud?"cloud":"key"}}l(ae,"configuredTarget");function Fe(e={}){let i=e.configPath??k("config.json"),t=e.profile??"default";if(!P.isAbsolute(i)||!t.trim())throw new Error("Credential manager requires a trusted config path and profile.");let s=m(P.join(P.dirname(i),"auth.json")),a=l(async n=>{let o=await H(i),d=ae(o.config,n);return{...d,configRevision:o.revision,binding:{profile:t,provider:n,connectionFingerprint:d.provider.getCredentialConnectionFingerprint()}}},"target"),c=l(async n=>{let o=await a(n),d=await s.describeApiKey(o.binding),f=(e.environment?.()??process.env)[o.apiKeyEnv]?.trim(),g=o.kind==="oauth"||o.kind==="external"?o.kind:d.configured?"file":f?"environment":o.kind==="cloud"?"cloud":"missing";return{binding:o.binding,configRevision:o.configRevision,revision:d.revision??null,apiKeyEnv:o.apiKeyEnv,stored:d.configured,configured:g==="file"||g==="environment",source:g}},"describe"),r=l(async(n,o,d)=>{if(!o||o.revision!==null&&(typeof o.revision!="string"||!o.revision.trim()))throw new Error("Credential update requires an expected revision. Refresh its state before retrying.");let f=await a(n);if(f.kind==="oauth"||f.kind==="external")throw new Error(`Use the provider's ${f.kind==="oauth"?"OAuth":"external"} authentication flow.`);if(o.configRevision!==f.configRevision||o.binding.profile!==f.binding.profile||o.binding.provider!==f.binding.provider||o.binding.connectionFingerprint!==f.binding.connectionFingerprint)throw new Error("Provider configuration or connection changed. Refresh its state before retrying.");let g=await s.readApiKey(f.binding),I=d===void 0?await s.removeApiKey(f.binding,o.revision):await s.setApiKey(f.binding,d.key,o.revision);try{if((await H(i)).revision!==f.configRevision)throw new Error("Provider configuration changed while saving credentials.");return await c(n)}catch(C){try{g?await s.setApiKey(f.binding,g.key,I.revision):await s.removeApiKey(f.binding,I.revision)}catch(W){throw new AggregateError([C,W],"Credential update failed and rollback conflicted. Refresh its state before retrying.")}throw C}},"mutate");return{filePath:s.filePath,describe:c,setApiKey:l((n,o,d)=>r(n,d,{key:o}),"setApiKey"),removeApiKey:l((n,o)=>r(n,o),"removeApiKey")}}l(Fe,"createProviderCredentialManager");export{re as a,q as b,ne as c,Oe as d,be as e,Ee as f,Fe as g};

package/dist/chunks/{chunk-XZSFUGPN.js → chunk-U73VEVMP.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Bb as r,Rb as o}from"./chunk-6TITQQAI.js";import{a as n}from"./chunk-D425EZGC.js";import{a as e}from"./chunk-V4WSBIXB.js";function u(t){return o(n(t))}e(u,"runInteractiveMode");function a(t){return r(n(t))}e(a,"runInkInteractiveMode");export{u as a,a as b};
+import{Bb as r,Rb as o}from"./chunk-BSCSKJNC.js";import{a as n}from"./chunk-V2TG7GNW.js";import{a as e}from"./chunk-V4WSBIXB.js";function u(t){return o(n(t))}e(u,"runInteractiveMode");function a(t){return r(n(t))}e(a,"runInkInteractiveMode");export{u as a,a as b};

package/dist/chunks/{chunk-D425EZGC.js → chunk-V2TG7GNW.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{a as m}from"./chunk-AGUM5SWX.js";import{b as C}from"./chunk-3CP7AUWY.js";import{B as k,I as O,o as X}from"./chunk-QSZCR5GC.js";import{b as K}from"./chunk-C6JGLEYD.js";import{Db as g,Fb as p}from"./chunk-D36OIMV7.js";import{d as x,za as f}from"./chunk-OGTRDK4Q.js";import{a as s}from"./chunk-V4WSBIXB.js";import{isDeepStrictEqual as R}from"node:util";function y(e,o){let a=e.events,r=new Map;return{...e,guardrails:e.guardrails?.map(t=>{if(t.kind!=="tool"||t.name!=="auto-mode")return t;let n=t.beforeTool;return n?{...t,kind:"tool",async beforeTool(d,i){let T=f(d),c=T?.ok?T.call:d;o.revoke(c.id),r.delete(c.id);let l=await n.call(t,d,i);return l.action==="allow"&&r.set(c.id,structuredClone(c)),l}}:t}),events:{...a,async beforeToolExecute(t,n,d){let i=d?.toolId,T=i===void 0?void 0:r.get(i);i!==void 0&&(o.revoke(i),r.delete(i));let c=await a?.beforeToolExecute?.(t,n,d);if(i!==void 0){let l={id:i,name:t,input:n};(c===!0||c===void 0&&R(l,T))&&o.grant(l)}return c??!0},onToolExecutionEnd(t,n){o.revoke(t.id),a?.onToolExecutionEnd?.(t,n)}}}}s(y,"withDirectTextApprovals");function u(e){if(e.context?.trustedTextMutationHost!==void 0)return e;let o=e.context?.gitRoot??e.context?.executionCwd??process.cwd(),a=e.context?.executionCwd??o,r=m(a,()=>e.context?.resolveShellPermissionMode?.()==="auto"),t=C(()=>[o,a,...e.context?.workspaceSandboxRoots?.list()??[]],n=>x(n,a,[],e.context?.resolveShellPermissionMode?.()==="full-access"),()=>e.context?.resolveShellPermissionMode?.()==="full-access",r.authorize);return y({...e,context:{...e.context,trustedTextMutationHost:t}},r)}s(u,"withTrustedTextMutationHost");function v(e,o){return p(u(e),o)}s(v,"runKodaX");function P(e,o){return K(u(e),o)}s(P,"startKodaX");function S(e,o){return k(u(e),o)}s(S,"runManagedTask");function E(e){let o=e.runAgent??p,a=e.createOptions;return O({...e,createOptions:s((r,t,n)=>u(a?.(r,t,n)??n),"createOptions"),runAgent:s((r,t)=>o(u(r),t),"runAgent")})}s(E,"createKodaXTaskRunner");function D(e={}){let o=g(e),a=o.substrateExecutor;return Object.freeze({...o,substrateExecutor:s(((r,t,n,d)=>{let i=n?.presetOptions??{};return a(r,t,{...n,presetOptions:u(i)},d)}),"substrateExecutor")})}s(D,"createDefaultCodingAgent");var A=class extends X{static{s(this,"KodaXClient")}constructor(o){super(o,v)}};export{u as a,v as b,P as c,S as d,E as e,D as f,A as g};
+import{a as m}from"./chunk-AGUM5SWX.js";import{b as C}from"./chunk-7BA4TSKC.js";import{B as k,I as O,o as X}from"./chunk-VRO2CDBY.js";import{b as K}from"./chunk-P6R6V7EW.js";import{Db as g,Fb as p}from"./chunk-BP3NAYKY.js";import{Aa as f,d as x}from"./chunk-HJLYZ5AX.js";import{a as s}from"./chunk-V4WSBIXB.js";import{isDeepStrictEqual as R}from"node:util";function y(e,o){let a=e.events,r=new Map;return{...e,guardrails:e.guardrails?.map(t=>{if(t.kind!=="tool"||t.name!=="auto-mode")return t;let n=t.beforeTool;return n?{...t,kind:"tool",async beforeTool(d,i){let T=f(d),c=T?.ok?T.call:d;o.revoke(c.id),r.delete(c.id);let l=await n.call(t,d,i);return l.action==="allow"&&r.set(c.id,structuredClone(c)),l}}:t}),events:{...a,async beforeToolExecute(t,n,d){let i=d?.toolId,T=i===void 0?void 0:r.get(i);i!==void 0&&(o.revoke(i),r.delete(i));let c=await a?.beforeToolExecute?.(t,n,d);if(i!==void 0){let l={id:i,name:t,input:n};(c===!0||c===void 0&&R(l,T))&&o.grant(l)}return c??!0},onToolExecutionEnd(t,n){o.revoke(t.id),a?.onToolExecutionEnd?.(t,n)}}}}s(y,"withDirectTextApprovals");function u(e){if(e.context?.trustedTextMutationHost!==void 0)return e;let o=e.context?.gitRoot??e.context?.executionCwd??process.cwd(),a=e.context?.executionCwd??o,r=m(a,()=>e.context?.resolveShellPermissionMode?.()==="auto"),t=C(()=>[o,a,...e.context?.workspaceSandboxRoots?.list()??[]],n=>x(n,a,[],e.context?.resolveShellPermissionMode?.()==="full-access"),()=>e.context?.resolveShellPermissionMode?.()==="full-access",r.authorize);return y({...e,context:{...e.context,trustedTextMutationHost:t}},r)}s(u,"withTrustedTextMutationHost");function v(e,o){return p(u(e),o)}s(v,"runKodaX");function P(e,o){return K(u(e),o)}s(P,"startKodaX");function S(e,o){return k(u(e),o)}s(S,"runManagedTask");function E(e){let o=e.runAgent??p,a=e.createOptions;return O({...e,createOptions:s((r,t,n)=>u(a?.(r,t,n)??n),"createOptions"),runAgent:s((r,t)=>o(u(r),t),"runAgent")})}s(E,"createKodaXTaskRunner");function D(e={}){let o=g(e),a=o.substrateExecutor;return Object.freeze({...o,substrateExecutor:s(((r,t,n,d)=>{let i=n?.presetOptions??{};return a(r,t,{...n,presetOptions:u(i)},d)}),"substrateExecutor")})}s(D,"createDefaultCodingAgent");var A=class extends X{static{s(this,"KodaXClient")}constructor(o){super(o,v)}};export{u as a,v as b,P as c,S as d,E as e,D as f,A as g};