@theokit/agents 13.0.0-next.9 → 13.0.0

package/dist/auth.d.ts

@@ -1,6 +1,8 @@
 import { OAuthProviderConfig, CredentialStoreConfig, ResolvedCredential, ensureFreshCredential, OpenAIDeviceConfig, openaiDeviceLogin, OAuthTokens, DeviceDeps } from '@theokit/sdk/auth';
 export { CredentialError, CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolveCredentialOptions, ResolvedCredential, StoredCredential, StoredOAuthCredential, assertSecureModes, authFilePath, credentialHome, deviceLogin, ensureFreshCredential, extractAccountId, openaiDeviceLogin, persistOAuthTokens, pollDeviceToken, providerFromApiKeyPrefix, readAuthFile, readStoredOAuth, refreshOAuthTokens, requestDeviceCode, writeCredential } from '@theokit/sdk/auth';
 import { TheokitAgentError } from '@theokit/sdk/errors';
+import { PermissionMode } from '@theokit/sdk';
+export { PermissionMode } from '@theokit/sdk';
 
 /**
  * M60 — `AuthProvider`, the OO contract that unifies the SDK's free OAuth-lifecycle functions
@@ -443,4 +445,149 @@ declare class PermissionStore {
     expired(): readonly Grant[];
 }
 
-export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Grant, type GrantOptions, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, credentialSources, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential };
+/**
+ * Turns a {@link PermissionStore} into a `pre_tool_call` handler — the seam that can actually refuse
+ * a tool.
+ *
+ * ## Why an adapter, and not a gate of its own
+ *
+ * The store shipped with a careful key, a deny-by-default posture and no reader: measured
+ * 2026-09-10, `isGranted` had zero callers outside its own unit test, and `PermissionStore` appeared
+ * in zero files across six sibling repositories. It described a control that was not in force.
+ *
+ * What was missing was never a mechanism. `pre_tool_call` is documented in `bridge/hook-handlers.ts`
+ * as the ONLY hook with veto power, and it runs before the tool by construction — so a refusal here
+ * is a refusal before the side effect. This file is the two lines that connect the two, plus the one
+ * decision neither of them could make alone.
+ *
+ * The alternative — a required `granted` argument mirroring `BuildHookHandlersOptions.approved` —
+ * was rejected because it breaks every consumer's compile for a store none of them uses. The hook
+ * path could afford a required argument because it shipped WITH one; retrofitting is a different
+ * proposition.
+ *
+ * ## The decision only the consumer can make
+ *
+ * A `PermissionQuery` is keyed by `(tool, scope, command)`. A `PreToolCallContext` carries
+ * `{ name, args }` — no scope, and no notion of which argument IS the command, which differs per
+ * tool. So the mapping is the consumer's, and it is passed in.
+ *
+ * `classify` returns a query OR an explicit `{ governed: false }`, never a bare `undefined`. A
+ * mapper returning `undefined` would say "this tool needs no permission" and "I forgot this tool" in
+ * the same word, and the second one would silently pass — on a security gate. The discriminated
+ * result makes forgetting a compile error while keeping "not governed" expressible, which a
+ * deny-everything default would not: a gate that refuses ordinary work is a gate somebody disables.
+ *
+ * ## Composing with a `pre_tool_call` you already have
+ *
+ * `HookHandlers.pre_tool_call` is a SINGLE field, so assigning this gate over an existing handler
+ * loses one of the two, silently — the failure `bridge/delegation-hooks.ts` records for delegated
+ * hooks, *"nothing throws, nothing warns"*, and worse here because the handler that loses may be the
+ * one that refuses. Compose them explicitly:
+ *
+ * ```ts
+ * pre_tool_call: async (ctx) => (await gate(ctx)) ?? (await mine(ctx))
+ * ```
+ *
+ * First veto wins; `undefined` falls through. No helper ships for this: it is one line, and a
+ * `composePreToolCall` would be a second way to do what `??` already does.
+ */
+
+/**
+ * Minimal shape mirrored from `@theokit/sdk`.
+ *
+ * The reason used to read "type-only, no runtime import, so the SDK peer stays optional", and that
+ * does not justify mirroring anything: `bridge/hook-handlers.ts` imports these very two SDK types
+ * (`PreToolCallContext`, `PreToolCallDecision`) with `import type` and costs the optional peer
+ * nothing. A type-only import IS type-only.
+ *
+ * The real reason is the NAME, and it is written out three paragraphs down: `@theokit/sdk` already
+ * exports `PermissionGateContext` with a different shape, so a consumer importing both would get a
+ * duplicate identifier or silently the wrong one. What is mirrored here is also a deliberate
+ * SUBSET — the fields this gate reads — rather than a copy kept in step with the SDK's.
+ *
+ * A mirror can drift into a consumer-side compile error that no gate here would see first, so the
+ * assignment this docblock instructs a consumer to make is pinned by
+ * `tests/type/the-grant-gate-fits-the-hook-it-is-for.test-d.ts`.
+ *
+ * NOT named `PermissionGateContext`: `@theokit/sdk` already exports a type by that name, with a
+ * different shape (`{ toolName, mode }`), alongside `PermissionGate`, `PermissionGateDecision`,
+ * `PermissionEngine` and `PermissionPlugin`. A consumer importing both would get a duplicate
+ * identifier, or silently the wrong shape.
+ *
+ * The rename says something true rather than merely avoiding a clash. This gates on a STANDING
+ * GRANT the operator made; the SDK's permission engine is a separate system with its own rules, and
+ * the two do not consult each other — an engine `allow` does not satisfy a missing grant, and a
+ * grant does not satisfy the engine.
+ */
+interface GrantGateContext {
+    readonly name: string;
+    readonly args: Record<string, unknown>;
+    readonly agentId: string;
+    readonly runId: string;
+    /**
+     * The run's resolved permission mode, carried by the real context. Mirrored so the shapes match
+     * and so its absence from the gate's logic is a decision rather than an oversight: `bypass` does
+     * NOT disable this gate, because a standing grant is the operator's, not the run's.
+     *
+     * B-057 — the SDK's own `PermissionMode`, not a bare `string` and not a union restated here. The
+     * loose type was the half that made this look like an oversight: a mirror that accepts any word
+     * mirrors nothing in particular, and `"readonly"` — what somebody writes when they mean `plan` —
+     * would have sat here looking applied.
+     *
+     * Restating the union was the first attempt and the type test refused it: this shape must fit
+     * `PreToolCallContext` structurally, and a hand-written copy that drifts by one member stops
+     * fitting. Importing the source makes it a mirror BY CONSTRUCTION — it narrows when the SDK
+     * narrows, and cannot disagree.
+     *
+     * This layer's own three-mode surface reaches these through `approvalModeToPermissionMode`, so a
+     * reader of either vocabulary meets the other.
+     */
+    readonly permissionMode?: PermissionMode;
+}
+/** This tool is deliberately outside the gate's remit — distinct from "I forgot to map it". */
+interface NotGoverned {
+    readonly governed: false;
+}
+/** This tool IS governed, by the grant key inside. */
+interface Governed {
+    readonly governed: true;
+    readonly query: PermissionQuery;
+}
+/**
+ * BOTH arms carry `governed`, and that is the whole point.
+ *
+ * The first version was `PermissionQuery | NotGoverned` — discriminated by whether the `governed`
+ * KEY was present. It failed open, measured against the built artifact: a consumer who writes a
+ * policy record `{ governed: true, scope }` and spreads it into the query — the most natural
+ * reading of "yes, govern this" — got `undefined` back, and an ungranted destructive command ran.
+ * `governed: undefined` did the same. TypeScript does not stop it: a fresh literal with an excess
+ * property errors, the same object through a variable or a spread does not.
+ *
+ * The presence check arrived by obeying a linter. `'governed' in c && c.governed === false` was
+ * flagged as "always true given the type", which was true of the DECLARED type and false of every
+ * value that reaches it. A type-based lint rule cannot see excess properties, and the safety of a
+ * gate is not a type-level fact.
+ *
+ * With the discriminant on both arms there is no key to be accidentally present: `governed` is
+ * declared either way, the check is on its VALUE, and `governed: true` without a `query` is a
+ * compile error rather than a silent pass.
+ */
+type Classification = Governed | NotGoverned;
+/**
+ * A veto, in the shape `pre_tool_call` returns.
+ *
+ * Exported because it appears in {@link grantGate}'s public signature — an unexported type there
+ * leaves a consumer unable to name the return value. `hooks/secure-store.ts` documents the same
+ * case.
+ */
+interface Veto {
+    readonly block: true;
+    readonly message: string;
+}
+/**
+ * @param store the grants to consult; re-read per call, so a grant made mid-run is seen
+ * @param classify maps a tool call to the grant key it needs, or declares it ungoverned
+ */
+declare function grantGate(store: PermissionStore, classify: (ctx: GrantGateContext) => Classification): (ctx: GrantGateContext) => Promise<Veto | undefined>;
+
+export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type Classification, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Governed, type Grant, type GrantGateContext, type GrantOptions, type NotGoverned, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, type Veto, credentialSources, grantGate, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential };

package/dist/auth.js

@@ -2,6 +2,9 @@ import {
   readSecureJson,
   writeSecureJson
 } from "./chunk-D2EFYZBV.js";
+import {
+  debugLog
+} from "./chunk-M5J3Q6YC.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";
@@ -572,6 +575,38 @@ var PermissionStore = class {
 `);
   }
 };
+
+// src/auth/permission-gate.ts
+function grantGate(store, classify) {
+  return (ctx) => {
+    try {
+      const classification = classify(ctx);
+      if (classification.governed === false) return Promise.resolve(void 0);
+      if (store.isGranted(classification.query)) return Promise.resolve(void 0);
+      const because = store.lastReadError === void 0 ? "no standing grant matches" : "the permission store could not be read, so no grant applies";
+      debugLog("[theokit] permission gate vetoed", {
+        tool: ctx.name,
+        scope: classification.query.scope,
+        because
+      });
+      return Promise.resolve({
+        block: true,
+        message: `"${ctx.name}" is not permitted in ${classification.query.scope}: ${because}`
+      });
+    } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
+      debugLog("[theokit] permission gate could not classify", {
+        tool: ctx.name,
+        why
+      });
+      return Promise.resolve({
+        block: true,
+        message: `permission gate could not classify "${ctx.name}": ${why}`
+      });
+    }
+  };
+}
+__name(grantGate, "grantGate");
 export {
   AuthProvider,
   CODEX_CLIENT_ID_ENV_VAR,
@@ -590,6 +625,7 @@ export {
   deviceLogin,
   ensureFreshCredential2 as ensureFreshCredential,
   extractAccountId,
+  grantGate,
   loginWithDevice,
   openaiDeviceLogin3 as openaiDeviceLogin,
   persistOAuthTokens2 as persistOAuthTokens,

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/permission-store.ts"],"mappings":";;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EA3FjD,OA2FiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAvG9C,OAuG8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAzH3C,OAyH2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAvI7C,OAuI6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;ACriBhB,SAASC,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA9Eb,OA8EaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/permission-store.ts","../src/auth/permission-gate.ts"],"mappings":";;;;;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EA3FjD,OA2FiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAvG9C,OAuG8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAzH3C,OAyH2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAvI7C,OAuI6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;ACzfhB,SAASC,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA1Hb,OA0HaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;;;ACtFO,SAASwB,UACdC,OACAC,UAAmD;AAEnD,SAAO,CAACC,QAAAA;AACN,QAAI;AACF,YAAMC,iBAAiCF,SAASC,GAAAA;AAkBhD,UAAIC,eAAeC,aAAa,MAAO,QAAOC,QAAQC,QAAQC,MAAAA;AAC9D,UAAIP,MAAMQ,UAAUL,eAAeM,KAAK,EAAG,QAAOJ,QAAQC,QAAQC,MAAAA;AAIlE,YAAMG,UACJV,MAAMW,kBAAkBJ,SACpB,8BACA;AAQNK,eAAS,oCAAoC;QAC3CC,MAAMX,IAAIY;QACVC,OAAOZ,eAAeM,MAAMM;QAC5BL;MACF,CAAA;AACA,aAAOL,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,IAAIf,IAAIY,IAAI,yBAAyBX,eAAeM,MAAMM,KAAK,KAAKL,OAAAA;MAC/E,CAAA;IACF,SAASQ,OAAO;AAGd,YAAMC,MAAMD,iBAAiBE,QAAQF,MAAMD,UAAUI,OAAOH,KAAAA;AAI5DN,eAAS,gDAAgD;QAAEC,MAAMX,IAAIY;QAAMK;MAAI,CAAA;AAC/E,aAAOd,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,uCAAuCf,IAAIY,IAAI,MAAMK,GAAAA;MAChE,CAAA;IACF;EACF;AACF;AA/DgBpB;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify","grantGate","store","classify","ctx","classification","governed","Promise","resolve","undefined","isGranted","query","because","lastReadError","debugLog","tool","name","scope","block","message","cause","why","Error","String"]}

package/dist/{bridge-entry-B0FqqPlt.d.ts → bridge-entry-DBkqwe6b.d.ts}

@@ -1,13 +1,14 @@
 import { ExecutionContext } from '@theokit/http';
 import { c as AgentOptions, T as ToolOptions, P as ProjectContextOptions, H as HumanInTheLoopOptions, R as ReasoningEffort, M as McpServersMap } from './types-C16Wuh9E.js';
-import { C as CompiledAgentOptions, b as CompiledTool, G as Guardrail, S as SkillsSelection, a as SettingSourcesSelection, H as HookApprovalGate } from './agent-compiler-DZorqtK2.js';
-import { SkillsSettings, ContextSettings, SystemPromptResolver, ModelSelection, PluginsSettings, Plugin, ProviderRoutingSettings, AgentDefinition as AgentDefinition$1, BudgetTracker, CustomTool, RunEventSink, MemorySettings } from '@theokit/sdk';
-import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-MbnqL68u.js';
+import { a as CompiledAgentOptions, b as CompiledTool, G as Guardrail, S as SkillsSelection, H as HookApprovalGate, C as CodePlugin } from './agent-compiler-B0hb6HCo.js';
+import { SkillsSettings, ContextSettings, SystemPromptResolver, ModelSelection, PluginsSettings, Plugin, ProviderRoutingSettings, AgentDefinition as AgentDefinition$1, BudgetTracker, CustomTool, RunEventSink, MemorySettings, TelemetrySettings } from '@theokit/sdk';
+import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-BzJEheml.js';
 import { RetryOptions } from '@theokit/sdk/retry';
 import { SandboxPosture } from '@theokit/sdk/sandbox';
-import { A as AgentDefinition } from './define-agent-D9b3h3VU.js';
+import { A as AgentDefinition } from './define-agent-DhwNmdej.js';
 import { z } from 'zod';
 import { H as HookHandlers } from './hook-handlers-Cw2FsnE5.js';
+import { S as SettingSourcesSelection } from './setting-sources-gate-DFu51i50.js';
 import { WireChunk } from '@theokit/presenter/wire';
 import { TheokitAgentError } from '@theokit/sdk/errors';
 
@@ -82,6 +83,20 @@ declare function compileSkills(options: SkillsOptions): SkillsSettings;
 interface ContextWindowOptions {
     /** Maximum tokens before compaction triggers. */
     maxTokens?: number;
+    /**
+     * Per-file truncation cap in CHARACTERS (SDK default 40 000, ~10k tokens). Larger files are
+     * truncated head/tail with a marker.
+     *
+     * Reachable here because the surface that turns instruction discovery on is the same surface that
+     * decides when an instruction file gets cut: a 60 000-character `CLAUDE.md` was silently
+     * truncated to 40 000, and the only knob on offer was named after tokens.
+     */
+    maxBytesPerFile?: number;
+    /**
+     * Aggregate cap across all context files in CHARACTERS (SDK default 120 000). Past it,
+     * lower-priority sources are DROPPED — not truncated.
+     */
+    maxBytesTotal?: number;
 }
 interface CompiledContextWindow {
     /** SDK-shaped context budget passed to `Agent.create({ context })`. */
@@ -508,6 +523,35 @@ interface SdkTurnHandle {
 type SdkSendOptions = Record<string, unknown>;
 interface SdkAgentHandle {
     readonly agentId: string;
+    /**
+     * B-062 — a tool-using run that returns schema-validated output.
+     *
+     * The SDK's `agent.generate(input, { output })` "runs the agent's NORMAL tool loop (the user's
+     * tools run first) and then coerces the final answer into a Zod schema". It existed and this
+     * handle did not declare it, so a consumer of `@theokit/agents` could reach it only by importing
+     * `@theokit/sdk` directly — the one thing this layer's doctrine forbids.
+     *
+     * The survey that filed this concluded the capability was absent, having measured `generateObject`
+     * — which is the TOOLLESS path by design: it builds a transient agent whose only tool is the
+     * synthetic output tool. Both paths exist and answer different questions.
+     *
+     * OPTIONAL, because a caller-injected handle (tests, a custom transport) need not implement it,
+     * and requiring it would break every such double to add a method most of them never call.
+     *
+     * BOTH wrappers below forward it. A wrapper that rebuilds the handle silently removes every method
+     * it does not name, and the consumer meets the loss at runtime as "the handle has no `generate`"
+     * after the types said it had one. Each forward is pinned by its own mutation.
+     *
+     * It is NOT put through the output guards, stated rather than assumed: `generate` resolves to a
+     * validated OBJECT and those guards moderate TEXT, so running them over a serialised object would
+     * moderate a shape no guard was written against. Guarding the structured path needs its own
+     * decision about what a redaction means to a schema, and inventing one would be the gate that
+     * reports without gating this module already refuses to build.
+     */
+    readonly generate?: (message: string, options: {
+        output: unknown;
+        [key: string]: unknown;
+    }) => Promise<unknown>;
     /**
      * M91 — era `(msg: string, opts?: unknown) => unknown`.
      *
@@ -934,6 +978,17 @@ interface AgentBuilder<TInput extends z.ZodType | UnsetMarker = UnsetMarker, TMo
      * `MemorySettings` verbatim — `{ enabled: true }` is the minimal opt-in.
      */
     memory(settings: MemorySettings): AgentBuilder<TInput, TModel, TContext, TTools>;
+    /**
+     * B-072 — emit OpenTelemetry spans for this agent's runs (`agent.send`, `llm.call`, `tool.call`,
+     * `memory.search`). Takes the SDK's `TelemetrySettings` verbatim; `{ enabled: true }` is the
+     * minimal opt-in, and content (prompts, responses, tool args) is omitted unless
+     * `includeContent: true` is set.
+     *
+     * Distinct from a diagnostics sink, which answers "what did this run LOG". A trace answers "where
+     * did this run SPEND its time, and which call was the slow one" — two questions, and the sink
+     * could never answer the second.
+     */
+    telemetry(settings: TelemetrySettings): AgentBuilder<TInput, TModel, TContext, TTools>;
     /**
      * Attach LIFECYCLE HOOKS in code, keyed by `HookName` — the builder-chain seam for intercepting
      * the agent loop. `pre_tool_call` may VETO a tool by returning `{ block: true, message }` before
@@ -960,8 +1015,13 @@ interface AgentBuilder<TInput extends z.ZodType | UnsetMarker = UnsetMarker, TMo
      * For lifecycle interception prefer {@link AgentBuilder.hooks} — a hook needs a plugin only as its
      * transport, and `plugins()` makes the caller assemble that transport by hand. Reach for this when
      * you genuinely have a plugin (a provider, a memory adapter, a tool-registering extension).
+     *
+     * NOT the Claude Code filesystem-bundle form (B-055). `[{ type: 'local', path: './p' }]` used to
+     * typecheck here against `readonly unknown[]` and do nothing — the typecheck that should have
+     * caught it was what let it through. A bundle is declared by living in a `plugins/` directory
+     * under `.theokit/` or `.claude/`, where its `skills/` and `agents/` are discovered.
      */
-    plugins(list: readonly unknown[]): AgentBuilder<TInput, TModel, TContext, TTools>;
+    plugins(list: readonly CodePlugin[]): AgentBuilder<TInput, TModel, TContext, TTools>;
     /**
      * Declare MCP (Model Context Protocol) servers available to this agent — the builder-chain
      * equivalent of the `@MCP` class decorator. Each key is a server name; the value is its config
@@ -1403,6 +1463,12 @@ declare function mcpToolApprovals(specs: Record<string, McpApprovalSpec>): Recor
  */
 interface LoadMcpJsonOptions {
     onWarn?: (warning: string) => void;
+    /**
+     * The environment `${VAR}` references resolve against. Injected rather than read from
+     * `process.env` so a test can prove the expansion without mutating the process it runs in —
+     * the convention `diagnostic-sink.ts` and `transcript-root-hint.ts` already follow.
+     */
+    env?: Record<string, string | undefined>;
 }
 /**
  * Raised when `<cwd>/.mcp.json` exists but cannot be read, is not valid JSON, or does not match the
@@ -1573,4 +1639,4 @@ declare function agentsPlugin(opts: AgentsPluginOptions): {
     register(app: PluginApp): void;
 };
 
-export { compileProjectContext as $, type AgentManifestEntry as A, type BeforeToolCallContext as B, type ContextWindowOptions as C, type DefinitionOrThunk as D, type EphemeralAgent as E, type McpSelection as F, type SdkAgentHandle as G, type HitlDecision as H, type SdkMessage as I, type SdkSendOptions as J, type SdkTurnHandle as K, type LLMCallContext as L, type McpApprovalSpec as M, type Segment as N, type ShouldAutoApproveOptions as O, type ProcessInputContext as P, type ToolHooks as Q, type ToolHooksPlugin as R, type SkillsOptions as S, type ToolCallVeto as T, agentsPlugin as U, applyPosture as V, WRITE_SCOPED_TOOLS as W, buildModelSelection as X, compileAgentModule as Y, compileContextWindow as Z, compileLoadedAgentModule as _, type ApprovalPosture as a, compileSkills as a0, createAgentExecutionContext as a1, createApiErrorHandler as a2, createSdkAgentStream as a3, createThinkTagExtractor as a4, createToolHooksPlugin as a5, extractThinkTagStream as a6, generateAgentManifest as a7, generateAgentRoutes as a8, isAgentContext as a9, loadMcpJson as aa, mcpRegistry as ab, mcpToolApprovals as ac, projectContextMetadataOnlyKnobs as ad, reasoningEffortOf as ae, resolveMcpServers as af, runWithApiErrorHandling as ag, shouldAutoApprove as ah, toAgentFactory as ai, translateSdkEvent as aj, withClockCap as ak, withEphemeralAgent as al, type AgentModule as b, APPROVAL_MODES as c, type AfterToolCallContext as d, AgentBuilder as e, AgentDefinitionError as f, type AgentExecutionContext as g, type AgentManifest as h, type AgentManifestSource as i, type AgentManifestTool as j, type AgentRoute as k, type AgentRouteContext as l, type AgentRunInfo as m, type AgentsPluginOptions as n, type ApiErrorContext as o, type ApiErrorDecision as p, type ApiErrorPolicy as q, type ApprovalMode as r, streamAgentUIMessages as s, type ApprovalRequest as t, type CompiledContextWindow as u, ContextualTool as v, DelegationTimeoutError as w, McpFileError as x, type McpRegistryConfig as y, type McpRequestContext as z };
+export { compileLoadedAgentModule as $, type AgentManifestEntry as A, type BeforeToolCallContext as B, type ContextWindowOptions as C, type DefinitionOrThunk as D, type EphemeralAgent as E, type McpSelection as F, type SdkAgentHandle as G, type HitlDecision as H, type SdkMessage as I, type SdkSendOptions as J, type SdkTurnHandle as K, type LLMCallContext as L, type McpApprovalSpec as M, type Segment as N, type ShouldAutoApproveOptions as O, type ProcessInputContext as P, type ToolHooks as Q, type RuntimeOverrides as R, type SkillsOptions as S, type ToolCallVeto as T, type ToolHooksPlugin as U, agentsPlugin as V, WRITE_SCOPED_TOOLS as W, applyPosture as X, buildModelSelection as Y, compileAgentModule as Z, compileContextWindow as _, type ApprovalPosture as a, compileProjectContext as a0, compileSkills as a1, createAgentExecutionContext as a2, createApiErrorHandler as a3, createSdkAgentStream as a4, createThinkTagExtractor as a5, createToolHooksPlugin as a6, extractThinkTagStream as a7, generateAgentManifest as a8, generateAgentRoutes as a9, isAgentContext as aa, loadMcpJson as ab, mcpRegistry as ac, mcpToolApprovals as ad, projectContextMetadataOnlyKnobs as ae, reasoningEffortOf as af, resolveMcpServers as ag, runWithApiErrorHandling as ah, shouldAutoApprove as ai, toAgentFactory as aj, translateSdkEvent as ak, withClockCap as al, withEphemeralAgent as am, type AgentModule as b, APPROVAL_MODES as c, type AfterToolCallContext as d, AgentBuilder as e, AgentDefinitionError as f, type AgentExecutionContext as g, type AgentManifest as h, type AgentManifestSource as i, type AgentManifestTool as j, type AgentRoute as k, type AgentRouteContext as l, type AgentRunInfo as m, type AgentsPluginOptions as n, type ApiErrorContext as o, type ApiErrorDecision as p, type ApiErrorPolicy as q, type ApprovalMode as r, streamAgentUIMessages as s, type ApprovalRequest as t, type CompiledContextWindow as u, ContextualTool as v, DelegationTimeoutError as w, McpFileError as x, type McpRegistryConfig as y, type McpRequestContext as z };

package/dist/bridge.d.ts

@@ -1,7 +1,8 @@
-export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, R as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, U as agentsPlugin, V as applyPosture, X as buildModelSelection, Y as compileAgentModule, Z as compileContextWindow, _ as compileLoadedAgentModule, $ as compileProjectContext, a0 as compileSkills, a1 as createAgentExecutionContext, a2 as createApiErrorHandler, a3 as createSdkAgentStream, a4 as createThinkTagExtractor, a5 as createToolHooksPlugin, a6 as extractThinkTagStream, a7 as generateAgentManifest, a8 as generateAgentRoutes, a9 as isAgentContext, aa as loadMcpJson, ab as mcpRegistry, ac as mcpToolApprovals, ad as projectContextMetadataOnlyKnobs, ae as reasoningEffortOf, af as resolveMcpServers, ag as runWithApiErrorHandling, ah as shouldAutoApprove, s as streamAgentUIMessages, ai as toAgentFactory, aj as translateSdkEvent, ak as withClockCap, al as withEphemeralAgent } from './bridge-entry-B0FqqPlt.js';
-export { c as CompatSurface, C as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, i as HookApprovalRequest, j as HookGateUnsupportedError, P as ProjectSettingsGrant, R as ResolvedCompatSource, k as SettingSourceCapability, a as SettingSourcesSelection, T as ToolWalkResult, m as ToolboxWalkResult, U as UntrustedSettingSourceError, n as compileTools, r as resolveCompatSources, p as resolveSettingSources } from './agent-compiler-DZorqtK2.js';
-export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-MbnqL68u.js';
-export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-D9b3h3VU.js';
+export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, U as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, V as agentsPlugin, X as applyPosture, Y as buildModelSelection, Z as compileAgentModule, _ as compileContextWindow, $ as compileLoadedAgentModule, a0 as compileProjectContext, a1 as compileSkills, a2 as createAgentExecutionContext, a3 as createApiErrorHandler, a4 as createSdkAgentStream, a5 as createThinkTagExtractor, a6 as createToolHooksPlugin, a7 as extractThinkTagStream, a8 as generateAgentManifest, a9 as generateAgentRoutes, aa as isAgentContext, ab as loadMcpJson, ac as mcpRegistry, ad as mcpToolApprovals, ae as projectContextMetadataOnlyKnobs, af as reasoningEffortOf, ag as resolveMcpServers, ah as runWithApiErrorHandling, ai as shouldAutoApprove, s as streamAgentUIMessages, aj as toAgentFactory, ak as translateSdkEvent, al as withClockCap, am as withEphemeralAgent } from './bridge-entry-DBkqwe6b.js';
+export { c as CompatImportUnsupportedError, a as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, j as HookApprovalRequest, k as HookGateUnsupportedError, T as ToolWalkResult, m as ToolboxWalkResult, n as compileTools } from './agent-compiler-B0hb6HCo.js';
+export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-BzJEheml.js';
+export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-DhwNmdej.js';
+export { C as CompatSurface, a as GatedCompatSource, G as GatedSettingSource, P as ProjectSettingsGrant, R as ResolvedCompatSource, b as SettingSourceCapability, S as SettingSourcesSelection, U as UntrustedSettingSourceError, r as resolveCompatSources, c as resolveSettingSources } from './setting-sources-gate-DFu51i50.js';
 import '@theokit/http';
 import './types-C16Wuh9E.js';
 import '@theokit/sdk';
@@ -11,3 +12,4 @@ import '@theokit/sdk/sandbox';
 import './hook-handlers-Cw2FsnE5.js';
 import '@theokit/presenter/wire';
 import '@theokit/sdk/errors';
+import '@theokit/sdk/subagents-loader';

package/dist/bridge.js

@@ -29,10 +29,12 @@ import {
   runWithApiErrorHandling,
   streamAgentResponse,
   streamAgentUIMessages
-} from "./chunk-TZCHACY7.js";
+} from "./chunk-G7QBDGZ4.js";
+import "./chunk-HGVT4VCE.js";
 import {
   APPROVAL_MODES,
   BudgetExceededError,
+  CompatImportUnsupportedError,
   DelegationBudgetExceededError,
   DelegationError,
   DelegationTimeoutError,
@@ -55,8 +57,8 @@ import {
   translateSdkEvent,
   withClockCap,
   withEphemeralAgent
-} from "./chunk-6WFRR24F.js";
-import "./chunk-RKWCXVYG.js";
+} from "./chunk-KTQID5V3.js";
+import "./chunk-MJ6FRILJ.js";
 import {
   AGENT_BRAND,
   UntrustedSettingSourceError,
@@ -64,7 +66,9 @@ import {
   isAgentDefinition,
   resolveCompatSources,
   resolveSettingSources
-} from "./chunk-LPS65NGG.js";
+} from "./chunk-PMMOOXR6.js";
+import "./chunk-M5J3Q6YC.js";
+import "./chunk-U72XTMYB.js";
 import "./chunk-OXNDJSAJ.js";
 import "./chunk-Z4QWC7IK.js";
 export {
@@ -73,6 +77,7 @@ export {
   AgentBuilder,
   AgentDefinitionError,
   BudgetExceededError,
+  CompatImportUnsupportedError,
   ContextualTool,
   DelegationBudgetExceededError,
   DelegationError,