@theokit/agents 13.0.0 → 13.1.0

package/CHANGELOG.md

@@ -1,5 +1,144 @@
 # @theokit/agents
 
+## 13.1.0
+
+### Minor Changes
+
+- 62f64de: `loadOutputStyle` reads `.claude/output-styles/*.md`, so a configured output style is no longer
+  ignored.
+
+  Measured for B-022 against the parity reference, which loads the project and home directories with
+  the project winning and honours the `outputStyle` key of a `settings.json`. This layer read none of
+  it: a grep for `output-style`, `outputStyle` and `output_style` over every package source tree
+  returned **0 files** against a control of **26** for `skills`, and the same query over the SDK's
+  built output returned **0** against a control of **22** for `SKILL.md`.
+
+  The failure was the silent kind. An author writes a style, selects it, gets ordinary responses back,
+  and cannot tell "my style is wrong" from "nothing reads styles".
+
+  - The **project wins** over the home directory, as the reference resolves them. Searched rather than
+    merged: a style is one document, and two files with one name are a choice, not a composition.
+  - **A named style with no file THROWS** a typed `OutputStyleError` listing the directories searched.
+    Returning `undefined` there would reproduce the exact state this fixes. A style that was never
+    requested still returns `undefined` — not configuring one is the ordinary case, not an error.
+  - **`keep-coding-instructions` is carried**, because a style REPLACES the built-in
+    software-engineering instructions by default. A consumer who does not know that loses them
+    silently, so the flag travels and the decision stays with the caller.
+  - **A style with no frontmatter is still a style** — the whole file is the body and every key takes
+    its default. `tsc` found that case, not a test: `splitFrontmatter` returns `undefined` for a file
+    with no fence, and esbuild strips types so vitest never saw it.
+
+  Composing the text into the prompt stays with `composeInstructions`, which already owns the
+  character budget and the drop report. A style pushed past the ceiling is reported through the same
+  path as every other source rather than through a second one invented here.
+
+- b3a61c3: An operator can declare `apiKeyHelper` — a command that prints a credential — in the operator policy,
+  and `resolveOperatorApiKey` from `@theokit/agents/auth` runs it.
+
+  Measured before (B-069): `apiKeyHelper`, `awsAuthRefresh`, `gcpAuthRefresh` and `otelHeadersHelper`
+  all returned zero occurrences against a control of 31 on the word `hooks`. An agent holding a token
+  that rotates failed mid-run, and the only answer was to restart the process with a fresh environment
+  variable.
+
+  It is an OPERATOR declaration, not a `defineAgent` argument, per the decision B-065 recorded: the
+  person answerable for what runs on a machine is frequently not the person who wrote the code, and a
+  command that mints a secret is the most operator-shaped thing in the system.
+
+  Three refusals are part of the contract, each pinned by a test:
+
+  - **A helper that hangs** is killed at 10 s (configurable) and fails with a typed error naming the
+    command. A credential helper runs before every request that needs the key; "the agent is slow" is
+    the hardest symptom to trace back to a line in a policy file.
+  - **A helper that prints nothing** fails rather than returning `''`, which would surface later as a
+    401 whose message says nothing about the helper.
+  - **The output never reaches the error text.** A failure is read from logs, issue trackers and
+    screenshots. `stderr` is not even named as a callback parameter.
+
+  `runCredentialHelper` — which takes an arbitrary command string — is deliberately NOT exported.
+  Offering it publicly would hand a caller the choice of what to execute, the exact decision the
+  operator tier exists to take away from them.
+
+  `awsAuthRefresh`, `gcpAuthRefresh` and `otelHeadersHelper` are still absent, and the module says so
+  rather than leaving silence: the first two refresh an ambient cloud session instead of returning a
+  value, and the third supplies headers for a telemetry exporter this layer does not own.
+
+### Patch Changes
+
+- 996538d: An `.mcp.json` field this runtime does not carry is now REPORTED instead of silently dropped.
+
+  `buildEntry` assembled each server from a fixed set of keys and let everything else fall off the end
+  in silence. Measured (B-071): `alwaysLoad` is declared by the reference format, allowlisted away
+  here, and nothing said so. That is the shape B-032 closed for hooks — an author who writes a field
+  and sees the server start has been told, by the absence of any complaint, that the setting took
+  effect.
+
+  The report is general rather than a special case for the one field somebody measured: naming only
+  `alwaysLoad` would fix the instance and leave the class, and the format gains keys faster than this
+  layer does. The server still starts — refusing an entry over an unknown key would turn a cosmetic
+  mistake into an outage.
+
+  `alwaysLoad` gets its reason named in the message: it marks a server whose tools load eagerly rather
+  than through TOOL SEARCH, and tool search does not exist here, so there is nothing for "always" to be
+  relative to. Honouring it would mean inventing a behaviour and shipping it under the format's name.
+
+  Two absences are now stated in the module rather than left implicit:
+
+  - **Tool search.** This runtime always sends every server's full tool list. The cost is context, not
+    correctness — and it is why `alwaysLoad` is refused rather than accepted.
+  - **The user-level `.mcp.json`.** Only the project file is read. A second location is a precedence
+    decision, not a second `readFileSync` — which file wins per key, whether a user may add a server
+    the project did not declare, how that composes with the operator gates that already decide which
+    servers may start. It belongs in the named settings stack, not in a merge rule invented inside a
+    loader.
+
+- bdd160d: Report a `.claude/workflows/` directory instead of passing over it in silence
+
+  A project that declares the `claude-code` dialect and ships workflow scripts now learns, on load,
+  that they were found and not executed — with the reason and with the supported alternative. It was
+  previously the one surface of the dialect that produced no message at all, so an author who watched
+  rules, skills, subagents and commands load out of the same folder had no way to tell a broken
+  workflow from a workflow nothing reads.
+
+  The scripts are still not executed, deliberately. Every configuration surface this package loads is
+  data; a workflow file is code, and executing JavaScript found under a caller-supplied directory is a
+  trust decision that belongs to the consumer rather than to a library. The orchestration itself is
+  unaffected — `Workflow`, `agentStep` and `createSquad` from `@theokit/sdk` build the same pipeline
+  from an import the consumer writes.
+
+- a50c6af: `AgentBuilder.plugins()` and `defineAgent({ plugins })` accept all three plugin kinds the SDK
+  defines, not just one.
+
+  `CodePlugin` required `register`, so it admitted `kind: "general"` and refused `kind:
+"model-provider"` (which carries `profile`) and `kind: "memory"` (which carries `createProvider`).
+  The docblock on `AgentBuilder.plugins`, written in the same change, already described the parameter
+  as taking "a model provider / memory adapter (`kind: 'general' | 'model-provider' | 'memory'`)" — so
+  the prose promised three kinds while the type admitted one.
+
+  Found by a real consumer rather than by a gate. On `@theokit/agents@13.0.0`, TheoCode's build stopped
+  with `Property 'register' is missing in type 'BasePlugin & { kind: "model-provider"; profile:
+ProviderProfile }'`. Nothing in this package caught it: 1 799 tests, `tsc`, eslint, knip and CodeQL
+  were all green over a type that refused two thirds of its own contract.
+
+  What the guard is FOR is unchanged: the Claude Code filesystem-bundle form (`{ type, path, source,
+marketplace }`) is still refused with a message naming where a bundle belongs. An object carrying a
+  `name` and none of the three capability keys is still refused too — widening to three kinds must not
+  widen to "anything with a name", which would let the bundle form back in through the front door.
+
+- e0813b5: Say at `DelegateOptions.cwd` that a worktree gets no gitignored files
+
+  Pointing a sub-agent at a git worktree you created gives it a checkout without `.env`, without local
+  config, without credentials — and the resulting failure reads as a broken agent rather than as a
+  missing file. The option now says so.
+
+  No copier was built, and the reason is that there is nothing to copy into: this layer creates no
+  worktree. Measured with controls — zero `git worktree` invocations, zero `isolation` options, the
+  four files mentioning the word being a trust comment, a memory-scope comment, a detector for running
+  inside one, and a sentence in a prompt. A `.worktreeinclude` implementation would be a mechanism for
+  an event that never happens here.
+
+  The absence is held falsifiable rather than merely asserted: a test fails the day something does
+  create a worktree, and names the obligation that arrives with it.
+
 ## 13.0.0
 
 ### Minor Changes

package/dist/{agent-compiler-B0hb6HCo.d.ts → agent-compiler-B_Z3OZel.d.ts}

@@ -170,10 +170,33 @@ declare function resolveEnabledSkills(selection: SkillsSelection | undefined, ct
  * here would be a second declaration to drift from. What this needs to know is the one thing that
  * tells a code plugin from a bundle reference.
  */
-interface CodePlugin {
+/**
+ * A code plugin, in any of the three kinds `@theokit/sdk`'s `Plugin` union defines.
+ *
+ *   `general`         `register(ctx)`     registers tools, commands, hooks
+ *   `model-provider`  `profile`           supplies a model provider
+ *   `memory`          `createProvider`    supplies a memory adapter
+ *
+ * The first version of this type required `register`, which accepted the first kind and refused the
+ * other two — while the docblock on `AgentBuilder.plugins`, written in the same commit, already
+ * described all three. A real consumer found it: on `@theokit/agents@13.0.0` a `model-provider`
+ * plugin failed to compile with "Property 'register' is missing". A guard written to refuse the
+ * FILESYSTEM-bundle form was refusing two thirds of the CODE form instead.
+ *
+ * Modelled here as name-plus-one-capability rather than by importing the SDK union, for the reason
+ * the module header gives: this layer must not depend on the SDK's value side, and the published
+ * floor is `^4.52.1` where the union's shape is not guaranteed identical. The capability keys ARE
+ * the discriminator, so the refusal below stays exact.
+ */
+type CodePlugin = {
     readonly name: string;
+} & ({
     readonly register: (...args: never[]) => unknown;
-}
+} | {
+    readonly profile: unknown;
+} | {
+    readonly createProvider: (...args: never[]) => unknown;
+});
 
 /**
  * Project the M8 fields from `CompiledAgentOptions` into `Agent.create()` arguments. Only the async

package/dist/auth.d.ts

@@ -398,6 +398,33 @@ interface AgentCredentialInput {
  */
 declare function resolveAgentCredential(input: AgentCredentialInput): CredentialResolution;
 
+interface RunCredentialHelperOptions {
+    /**
+     * Milliseconds before the helper is killed and the call fails.
+     *
+     * A helper that hangs stalls every request that needs the credential, and "the agent is slow" is
+     * the hardest symptom to trace back to a command in a policy file. Defaults to 10 s, which is
+     * generous for minting a token and short enough to name the cause.
+     */
+    readonly timeoutMs?: number;
+    /** Working directory for the helper. Defaults to the process's own. */
+    readonly cwd?: string;
+}
+/**
+ * The credential an operator's `apiKeyHelper` produces, or `undefined` when none is declared.
+ *
+ * This — not {@link runCredentialHelper} — is what a consumer calls, and the narrowing is the point.
+ * A function taking an arbitrary command string puts the choice of WHAT to execute in the caller's
+ * hands, which is exactly the decision the operator tier exists to take away from them. Here the
+ * command can only come from the policy file, so "this runs an operator-declared command" is a
+ * property of the code rather than a promise in a docblock.
+ *
+ * `runCredentialHelper` stays exported for the tests that exercise its failure modes directly; a
+ * runner whose timeout and redaction could not be tested in isolation would be a guard nobody can
+ * check.
+ */
+declare function resolveOperatorApiKey(warn: (message: string) => void, options?: RunCredentialHelperOptions): Promise<string | undefined>;
+
 /** What a caller asks about: may THIS tool run THIS command in THIS place? */
 interface PermissionQuery {
     readonly tool: string;
@@ -590,4 +617,4 @@ interface Veto {
  */
 declare function grantGate(store: PermissionStore, classify: (ctx: GrantGateContext) => Classification): (ctx: GrantGateContext) => Promise<Veto | undefined>;
 
-export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type Classification, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Governed, type Grant, type GrantGateContext, type GrantOptions, type NotGoverned, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, type Veto, credentialSources, grantGate, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential };
+export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type Classification, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Governed, type Grant, type GrantGateContext, type GrantOptions, type NotGoverned, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type RunCredentialHelperOptions, type SourceOrigin, type Veto, credentialSources, grantGate, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential, resolveOperatorApiKey };

package/dist/auth.js

@@ -2,9 +2,15 @@ import {
   readSecureJson,
   writeSecureJson
 } from "./chunk-D2EFYZBV.js";
+import {
+  currentOperatorPolicy
+} from "./chunk-M5DRNOIU.js";
 import {
   debugLog
 } from "./chunk-M5J3Q6YC.js";
+import {
+  ConfigurationError
+} from "./chunk-U72XTMYB.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";
@@ -478,6 +484,57 @@ function resolveAgentCredential(input) {
 }
 __name(resolveAgentCredential, "resolveAgentCredential");
 
+// src/auth/credential-helper.ts
+import { execFile } from "child_process";
+var DEFAULT_TIMEOUT_MS = 1e4;
+async function runCredentialHelper(command, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const printed = await new Promise((resolve, reject) => {
+    execFile(
+      command,
+      [],
+      {
+        shell: true,
+        timeout: timeoutMs,
+        cwd: options.cwd,
+        encoding: "utf8"
+      },
+      // `stderr` is deliberately NOT a parameter. A helper commonly echoes context that includes the
+      // credential, and anything named here is one careless template literal away from a log.
+      (error, stdout) => {
+        if (error === null) {
+          resolve(stdout);
+          return;
+        }
+        if (error.killed === true) {
+          reject(new ConfigurationError(`the credential helper "${command}" timed out after ${timeoutMs}ms and was killed. It is declared in the operator policy; a helper that cannot finish in that budget blocks every request that needs the credential.`, {
+            code: "credential_helper_timeout"
+          }));
+          return;
+        }
+        const code = typeof error.code === "number" ? error.code : "a non-zero status";
+        reject(new ConfigurationError(`the credential helper "${command}" exited ${code}. It is declared in the operator policy. Its output is not reproduced here, because a helper's stdout is a secret.`, {
+          code: "credential_helper_failed"
+        }));
+      }
+    );
+  });
+  const credential = printed.trim();
+  if (credential.length === 0) {
+    throw new ConfigurationError(`the credential helper "${command}" printed nothing. A helper's stdout IS the credential, so an empty run produces no credential \u2014 returning the empty string would surface later as a 401 whose message says nothing about this command.`, {
+      code: "credential_helper_empty"
+    });
+  }
+  return credential;
+}
+__name(runCredentialHelper, "runCredentialHelper");
+async function resolveOperatorApiKey(warn, options = {}) {
+  const { apiKeyHelper } = currentOperatorPolicy(warn);
+  if (apiKeyHelper === void 0) return void 0;
+  return runCredentialHelper(apiKeyHelper, options);
+}
+__name(resolveOperatorApiKey, "resolveOperatorApiKey");
+
 // src/auth/permission-store.ts
 import { realpathSync } from "fs";
 import { join as join2 } from "path";
@@ -638,6 +695,7 @@ export {
   requireCredential,
   resolveAgentCredential,
   resolveCredential,
+  resolveOperatorApiKey,
   writeCredential
 };
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/permission-store.ts","../src/auth/permission-gate.ts"],"mappings":";;;;;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EA3FjD,OA2FiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAvG9C,OAuG8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAzH3C,OAyH2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAvI7C,OAuI6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;ACzfhB,SAASC,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA1Hb,OA0HaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;;;ACtFO,SAASwB,UACdC,OACAC,UAAmD;AAEnD,SAAO,CAACC,QAAAA;AACN,QAAI;AACF,YAAMC,iBAAiCF,SAASC,GAAAA;AAkBhD,UAAIC,eAAeC,aAAa,MAAO,QAAOC,QAAQC,QAAQC,MAAAA;AAC9D,UAAIP,MAAMQ,UAAUL,eAAeM,KAAK,EAAG,QAAOJ,QAAQC,QAAQC,MAAAA;AAIlE,YAAMG,UACJV,MAAMW,kBAAkBJ,SACpB,8BACA;AAQNK,eAAS,oCAAoC;QAC3CC,MAAMX,IAAIY;QACVC,OAAOZ,eAAeM,MAAMM;QAC5BL;MACF,CAAA;AACA,aAAOL,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,IAAIf,IAAIY,IAAI,yBAAyBX,eAAeM,MAAMM,KAAK,KAAKL,OAAAA;MAC/E,CAAA;IACF,SAASQ,OAAO;AAGd,YAAMC,MAAMD,iBAAiBE,QAAQF,MAAMD,UAAUI,OAAOH,KAAAA;AAI5DN,eAAS,gDAAgD;QAAEC,MAAMX,IAAIY;QAAMK;MAAI,CAAA;AAC/E,aAAOd,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,uCAAuCf,IAAIY,IAAI,MAAMK,GAAAA;MAChE,CAAA;IACF;EACF;AACF;AA/DgBpB;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify","grantGate","store","classify","ctx","classification","governed","Promise","resolve","undefined","isGranted","query","because","lastReadError","debugLog","tool","name","scope","block","message","cause","why","Error","String"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/credential-helper.ts","../src/auth/permission-store.ts","../src/auth/permission-gate.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EA3FjD,OA2FiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAvG9C,OAuG8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAzH3C,OAyH2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAvI7C,OAuI6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;AC1iBhB,SAASC,gBAAgB;AAMzB,IAAMC,qBAAqB;AAsB3B,eAAsBC,oBACpBC,SACAC,UAAsC,CAAC,GAAC;AAExC,QAAMC,YAAYD,QAAQC,aAAaJ;AACvC,QAAMK,UAAU,MAAM,IAAIC,QAAgB,CAACC,SAASC,WAAAA;AAYlDC;MACEP;MACA,CAAA;MACA;QAAEQ,OAAO;QAAMC,SAASP;QAAWQ,KAAKT,QAAQS;QAAKC,UAAU;MAAO;;;MAGtE,CAACC,OAAOC,WAAAA;AACN,YAAID,UAAU,MAAM;AAClBP,kBAAQQ,MAAAA;AACR;QACF;AAGA,YAAID,MAAME,WAAW,MAAM;AACzBR,iBACE,IAAIS,mBACF,0BAA0Bf,OAAAA,qBAA4BE,SAAAA,wJAGtD;YAAEc,MAAM;UAA4B,CAAA,CAAA;AAGxC;QACF;AACA,cAAMA,OAAO,OAAOJ,MAAMI,SAAS,WAAWJ,MAAMI,OAAO;AAC3DV,eACE,IAAIS,mBACF,0BAA0Bf,OAAAA,YAAmBgB,IAAAA,sHAE7C;UAAEA,MAAM;QAA2B,CAAA,CAAA;MAGzC;IAAA;EAEJ,CAAA;AAEA,QAAMC,aAAad,QAAQe,KAAI;AAC/B,MAAID,WAAWE,WAAW,GAAG;AAC3B,UAAM,IAAIJ,mBACR,0BAA0Bf,OAAAA,gNAG1B;MAAEgB,MAAM;IAA0B,CAAA;EAEtC;AACA,SAAOC;AACT;AA/DsBlB;AA8EtB,eAAsBqB,sBACpBC,MACApB,UAAsC,CAAC,GAAC;AAExC,QAAM,EAAEqB,aAAY,IAAKC,sBAAsBF,IAAAA;AAC/C,MAAIC,iBAAiBE,OAAW,QAAOA;AACvC,SAAOzB,oBAAoBuB,cAAcrB,OAAAA;AAC3C;AAPsBmB;;;ACzDtB,SAASK,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA1Hb,OA0HaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;;;ACtFO,SAASwB,UACdC,OACAC,UAAmD;AAEnD,SAAO,CAACC,QAAAA;AACN,QAAI;AACF,YAAMC,iBAAiCF,SAASC,GAAAA;AAkBhD,UAAIC,eAAeC,aAAa,MAAO,QAAOC,QAAQC,QAAQC,MAAAA;AAC9D,UAAIP,MAAMQ,UAAUL,eAAeM,KAAK,EAAG,QAAOJ,QAAQC,QAAQC,MAAAA;AAIlE,YAAMG,UACJV,MAAMW,kBAAkBJ,SACpB,8BACA;AAQNK,eAAS,oCAAoC;QAC3CC,MAAMX,IAAIY;QACVC,OAAOZ,eAAeM,MAAMM;QAC5BL;MACF,CAAA;AACA,aAAOL,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,IAAIf,IAAIY,IAAI,yBAAyBX,eAAeM,MAAMM,KAAK,KAAKL,OAAAA;MAC/E,CAAA;IACF,SAASQ,OAAO;AAGd,YAAMC,MAAMD,iBAAiBE,QAAQF,MAAMD,UAAUI,OAAOH,KAAAA;AAI5DN,eAAS,gDAAgD;QAAEC,MAAMX,IAAIY;QAAMK;MAAI,CAAA;AAC/E,aAAOd,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,uCAAuCf,IAAIY,IAAI,MAAMK,GAAAA;MAChE,CAAA;IACF;EACF;AACF;AA/DgBpB;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","execFile","DEFAULT_TIMEOUT_MS","runCredentialHelper","command","options","timeoutMs","printed","Promise","resolve","reject","execFile","shell","timeout","cwd","encoding","error","stdout","killed","ConfigurationError","code","credential","trim","length","resolveOperatorApiKey","warn","apiKeyHelper","currentOperatorPolicy","undefined","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify","grantGate","store","classify","ctx","classification","governed","Promise","resolve","undefined","isGranted","query","because","lastReadError","debugLog","tool","name","scope","block","message","cause","why","Error","String"]}

package/dist/{bridge-entry-DBkqwe6b.d.ts → bridge-entry-vzdHNu_x.d.ts}

@@ -1,11 +1,11 @@
 import { ExecutionContext } from '@theokit/http';
 import { c as AgentOptions, T as ToolOptions, P as ProjectContextOptions, H as HumanInTheLoopOptions, R as ReasoningEffort, M as McpServersMap } from './types-C16Wuh9E.js';
-import { a as CompiledAgentOptions, b as CompiledTool, G as Guardrail, S as SkillsSelection, H as HookApprovalGate, C as CodePlugin } from './agent-compiler-B0hb6HCo.js';
+import { a as CompiledAgentOptions, b as CompiledTool, G as Guardrail, S as SkillsSelection, H as HookApprovalGate, C as CodePlugin } from './agent-compiler-B_Z3OZel.js';
 import { SkillsSettings, ContextSettings, SystemPromptResolver, ModelSelection, PluginsSettings, Plugin, ProviderRoutingSettings, AgentDefinition as AgentDefinition$1, BudgetTracker, CustomTool, RunEventSink, MemorySettings, TelemetrySettings } from '@theokit/sdk';
-import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-BzJEheml.js';
+import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-195_ROT3.js';
 import { RetryOptions } from '@theokit/sdk/retry';
 import { SandboxPosture } from '@theokit/sdk/sandbox';
-import { A as AgentDefinition } from './define-agent-DhwNmdej.js';
+import { A as AgentDefinition } from './define-agent-Cm7UGHx-.js';
 import { z } from 'zod';
 import { H as HookHandlers } from './hook-handlers-Cw2FsnE5.js';
 import { S as SettingSourcesSelection } from './setting-sources-gate-DFu51i50.js';

package/dist/bridge.d.ts

@@ -1,7 +1,7 @@
-export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, U as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, V as agentsPlugin, X as applyPosture, Y as buildModelSelection, Z as compileAgentModule, _ as compileContextWindow, $ as compileLoadedAgentModule, a0 as compileProjectContext, a1 as compileSkills, a2 as createAgentExecutionContext, a3 as createApiErrorHandler, a4 as createSdkAgentStream, a5 as createThinkTagExtractor, a6 as createToolHooksPlugin, a7 as extractThinkTagStream, a8 as generateAgentManifest, a9 as generateAgentRoutes, aa as isAgentContext, ab as loadMcpJson, ac as mcpRegistry, ad as mcpToolApprovals, ae as projectContextMetadataOnlyKnobs, af as reasoningEffortOf, ag as resolveMcpServers, ah as runWithApiErrorHandling, ai as shouldAutoApprove, s as streamAgentUIMessages, aj as toAgentFactory, ak as translateSdkEvent, al as withClockCap, am as withEphemeralAgent } from './bridge-entry-DBkqwe6b.js';
-export { c as CompatImportUnsupportedError, a as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, j as HookApprovalRequest, k as HookGateUnsupportedError, T as ToolWalkResult, m as ToolboxWalkResult, n as compileTools } from './agent-compiler-B0hb6HCo.js';
-export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-BzJEheml.js';
-export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-DhwNmdej.js';
+export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, U as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, V as agentsPlugin, X as applyPosture, Y as buildModelSelection, Z as compileAgentModule, _ as compileContextWindow, $ as compileLoadedAgentModule, a0 as compileProjectContext, a1 as compileSkills, a2 as createAgentExecutionContext, a3 as createApiErrorHandler, a4 as createSdkAgentStream, a5 as createThinkTagExtractor, a6 as createToolHooksPlugin, a7 as extractThinkTagStream, a8 as generateAgentManifest, a9 as generateAgentRoutes, aa as isAgentContext, ab as loadMcpJson, ac as mcpRegistry, ad as mcpToolApprovals, ae as projectContextMetadataOnlyKnobs, af as reasoningEffortOf, ag as resolveMcpServers, ah as runWithApiErrorHandling, ai as shouldAutoApprove, s as streamAgentUIMessages, aj as toAgentFactory, ak as translateSdkEvent, al as withClockCap, am as withEphemeralAgent } from './bridge-entry-vzdHNu_x.js';
+export { c as CompatImportUnsupportedError, a as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, j as HookApprovalRequest, k as HookGateUnsupportedError, T as ToolWalkResult, m as ToolboxWalkResult, n as compileTools } from './agent-compiler-B_Z3OZel.js';
+export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-195_ROT3.js';
+export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-Cm7UGHx-.js';
 export { C as CompatSurface, a as GatedCompatSource, G as GatedSettingSource, P as ProjectSettingsGrant, R as ResolvedCompatSource, b as SettingSourceCapability, S as SettingSourcesSelection, U as UntrustedSettingSourceError, r as resolveCompatSources, c as resolveSettingSources } from './setting-sources-gate-DFu51i50.js';
 import '@theokit/http';
 import './types-C16Wuh9E.js';

package/dist/bridge.js

@@ -29,8 +29,8 @@ import {
   runWithApiErrorHandling,
   streamAgentResponse,
   streamAgentUIMessages
-} from "./chunk-G7QBDGZ4.js";
-import "./chunk-HGVT4VCE.js";
+} from "./chunk-AAW4I45J.js";
+import "./chunk-M5DRNOIU.js";
 import {
   APPROVAL_MODES,
   BudgetExceededError,
@@ -57,7 +57,7 @@ import {
   translateSdkEvent,
   withClockCap,
   withEphemeralAgent
-} from "./chunk-KTQID5V3.js";
+} from "./chunk-HBHZV3KL.js";
 import "./chunk-MJ6FRILJ.js";
 import {
   AGENT_BRAND,

package/dist/{chunk-G7QBDGZ4.js → chunk-AAW4I45J.js}

@@ -1,14 +1,14 @@
 import {
   currentOperatorPolicy,
   mcpServerAdmitted
-} from "./chunk-HGVT4VCE.js";
+} from "./chunk-M5DRNOIU.js";
 import {
   createHitlPlugin,
   createSdkAgentStream,
   moderateOutputStream,
   runInputGuards,
   textPayloadExtractor
-} from "./chunk-KTQID5V3.js";
+} from "./chunk-HBHZV3KL.js";
 import {
   compileAgentDefinition,
   defineAgent,
@@ -1111,7 +1111,32 @@ function validateRemote(entry) {
   return void 0;
 }
 __name(validateRemote, "validateRemote");
+var REMOTE_KEYS = /* @__PURE__ */ new Set([
+  "url",
+  "type",
+  "headers",
+  "auth",
+  "requestTimeoutMs"
+]);
+var STDIO_KEYS = /* @__PURE__ */ new Set([
+  "command",
+  "args",
+  "env",
+  "cwd"
+]);
+var EXPLAINED_KEYS = {
+  alwaysLoad: 'it marks a server whose tools load eagerly instead of through TOOL SEARCH, and tool search is not implemented here \u2014 so there is nothing for "always" to be relative to'
+};
+function reportUncarriedKeys(entry, carried, name, warn) {
+  for (const key of Object.keys(entry)) {
+    if (carried.has(key)) continue;
+    const because = EXPLAINED_KEYS[key];
+    warn(`${MCP_FILENAME}: server "${name}" declares "${key}", which this runtime does not carry \u2014 ` + (because === void 0 ? "it is NOT being applied" : `${because}. It is NOT being applied`) + ".");
+  }
+}
+__name(reportUncarriedKeys, "reportUncarriedKeys");
 function buildEntry(entry, name, env, warn) {
+  reportUncarriedKeys(entry, entry.url !== void 0 ? REMOTE_KEYS : STDIO_KEYS, name, warn);
   if (entry.url !== void 0) {
     const remote = {
       url: entry.url
@@ -1315,4 +1340,4 @@ export {
   generateAgentManifest,
   agentsPlugin
 };
-//# sourceMappingURL=chunk-G7QBDGZ4.js.map
+//# sourceMappingURL=chunk-AAW4I45J.js.map