@theokit/agents 13.4.0 → 14.1.0

package/CHANGELOG.md

@@ -1,5 +1,251 @@
 # @theokit/agents
 
+## 14.1.0
+
+### Minor Changes
+
+- 22a36da: `withPreCompaction` runs your work — and awaits it — before a transcript is rewritten.
+
+  Until now the only signal near compaction was `compact_boundary`, which fires **after** the rewrite
+  and returns `void`. A consumer wanting to persist state that compaction destroys had nowhere to put
+  it, and the workaround was to build a policy on a turn hook and hope the ordering held.
+
+  ```ts
+  import { withPreCompaction } from '@theokit/agents'
+
+  const guarded = withPreCompaction(runner.compaction!, async (messages) => {
+    await archive(messages) // the PRE-compaction transcript, still whole
+  })
+
+  await guarded.compact(transcript, { summarize })
+  ```
+
+  It is a decorator over `TranscriptCompactionStrategy`, so the result satisfies the same interface
+  and every existing consumer accepts it unchanged. Registration is once per strategy rather than per
+  call — a handler you have to remember to pass is a handler that is absent from the call site you
+  forgot.
+
+  **What it does not cover, stated here rather than discovered later.** The SDK's auto-compaction path
+  — the one that fires on its own when usage crosses a threshold — has no consumer callback and none
+  can be added from this layer. A handler registered here never runs on that path. Tracked upstream as
+  `usetheokit/theokit-sdk#653`; the limit is also stated in the docblock where hook events are
+  declared, so it is visible from the file you would be reading when the question occurs to you.
+
+  **Failure is reported, never fatal.** A handler that rejects, throws synchronously, or exceeds its
+  bound (30s by default, configurable) is passed to your `onError` as a typed
+  `PreCompactionHandlerError` carrying `reason: 'timeout' | 'threw'` — and compaction proceeds anyway.
+  A run that cannot compact meets the context wall, which is worse than a run whose handler failed.
+
+  The handler also receives an `AbortSignal` that fires when the bound is reached, so a cooperative
+  handler can drop work that is now pointless instead of running on, detached, after compaction stopped
+  waiting for it. Signalling is not stopping — the timeout is what releases compaction either way.
+
+  The handler receives a readonly copy: `compact` documents that it never mutates its input, and a
+  seam that handed out the live array would open a mutation path through that guarantee.
+
+## 14.0.0
+
+### Major Changes
+
+- ef049e1: The declared `@theokit/sdk` range no longer admits a floor that delivers zero parity.
+
+  `packages/agents` declared `^4.52.1 || ^5.0.0` and `packages/theo` peer-declared the same. Measured
+  by unpacking the published tarballs, against a control of `AgentOptions` (83-86 files in every one):
+
+  | surface                          | 4.52.1 | 5.0.0 | 5.3.0 | 5.4.0 |
+  | -------------------------------- | ------ | ----- | ----- | ----- |
+  | `CompatSurface`                  | 0      | 10    | 10    | 10    |
+  | `.claude/rules/*` discovery spec | 0      | 4     | 4     | 4     |
+  | `settings.local.json`            | 0      | 4     | 4     | 4     |
+  | `CLAUDE_PROJECT_DIR`             | 0      | 14    | 14    | 14    |
+
+  The boundary is the 4→5 major exactly, and the lower half of the declared range delivered **zero**
+  parity. Not one missing surface — every surface at once, invisibly, because the package resolves,
+  compiles and runs. This repository's own lockfile resolved 4.52.1, so its green suite was green
+  against an SDK where `compatSources` does not exist as an option.
+
+  **Why the range rather than a fourth runtime guard.** Three version guards already exist
+  (`HOOK_GATE_SINCE`, `COMPAT_IMPORT_SINCE`, and the `compatSources` warning), and every one is on a
+  path where this layer PASSES AN OPTION to the SDK. The surfaces above are not like that: nothing is
+  passed, the SDK reads a file or it does not, so there is no call site to guard. A fourth check could
+  not have been written. The reason the floor stayed low is recorded in the code and has expired —
+  _"Until this package's floor can name a stable 5.x"_; `@theokit/sdk@5.5.0` is `latest`, and stable
+  5.x has existed since 5.3.0.
+
+  **The floor is `^5.3.0`, and the first attempt at `^5.0.0` was wrong for an instructive reason.**
+  Verifying that the four parity surfaces exist at 5.0.0 — they do — was necessary and not sufficient.
+  The persistence barrel is GENERATED from the resolved copy, so it also ships whatever that copy
+  exports, and six of those names do not exist at 5.0.0. The DTS build fails against the bottom of the
+  range, which a consumer meets as a build error rather than as a typed refusal.
+
+  Caught by `dep-check / suite at the bottom of every declared range`, the job that skips on a pull
+  request into `develop` and runs on one into `main` — it fired exactly where it was designed to.
+
+  Measured with controls at each version (positive `transcriptPath` = 1, invented name = 0): 5.0.0
+  carries **1 of the 7**; 5.3.0, 5.4.0 and 5.5.0 carry **7 of 7**. So 5.3.0 is the lowest version
+  _proven_ to work, not necessarily the first — the two releases between them are not in the measured
+  set, and a declared floor that was proven beats one that was inferred.
+
+  **Why not 5.4.0.** `local.hooks` and the narrowed `compatSources[].import` landed in
+  5.4.0, which is inside the new range — and that is deliberate. Both already throw a typed error
+  naming the version they need. Raising the floor to 5.4.0 would strand every 5.0-5.3 consumer who
+  uses neither, in order to duplicate a refusal that already announces itself. The invariant is that
+  every version the range admits either works or fails with a typed error naming what it needs; none
+  fails in silence. A silent gap is closed by the range, a named one is not.
+
+  **What the narrowing exposed, which is the item's real value.** The workspace itself resolved
+  4.52.1, so raising the floor moved it to 5.5.0 and five test files went red with no production line
+  changed. Each was something never verified:
+
+  - `packages/agents/persistence` gained **7 exports** it had never been able to carry —
+    `LiveTranscriptError`, `legacyTranscriptPath`, `listSessions`, `sessionUuidFor`,
+    `ListSessionsOptions`, `SessionIdSource`, `SessionListing`. None were withheld; they were
+    unreachable. The barrel is generated from the resolved copy, and a barrel generated against the
+    bottom of a range ships the bottom of the range. `LiveTranscriptError` carried a note ending
+    _"revisit when the floor moves past 4.x"_ — this is that revisit.
+  - `assembleM8CreateOptions`'s `deps.sdkVersion`, documented "Injectable for tests", reached the hook
+    gate and **not** the narrowed-import gate. So that gate could only ever read the ambient
+    installation, and its test passed because the machine happened to resolve 4.52.1. The seam now
+    reaches both, and the refusal is pinned with a version on each side rather than one.
+  - `effectiveToolNames` entered the root bar in 5.x and was invisible here. Recorded `out` with
+    measured evidence (0 callers in this repo, 0 in the downstream product, against probe controls of
+    3 and 90) rather than by taste.
+
+  **Why `theokit` takes a minor and not a major.** Narrowing a dependency range IS breaking, and under
+  semver 0.x the breaking slot is the MINOR — `major` on a 0.x package means declaring 1.0.0, which is a
+  statement about stability, not about this change. `theokit` is at 0.65.0 and has never taken a major:
+  its own CHANGELOG carries entries labelled "BREAKING for hand-built compiled options" that shipped as
+  minors. `public-copy.md § 3` refuses the production-ready claim until there is sustained measured
+  evidence, and a 1.0.0 cut is that claim in the one place every consumer reads it. `@theokit/agents`
+  (13.4.0) and `create-theokit` (2.0.0) are past 1.0, so their majors are the ordinary encoding.
+
+  **Breaking:** a consumer pinned to `@theokit/sdk@4.x` can no longer install these packages. That
+  consumer was already receiving none of the `.claude` compatibility the packages advertise, and
+  `HookGateUnsupportedError` was already refusing them outright if they declared a hook gate. `theo`
+  moves with `agents` because it depends on it: a peer range advertising a major its own dependency
+  rejects is unsatisfiable at install time and says nothing until then.
+
+### Minor Changes
+
+- f28ebd5: `THEO.local.md` and `AGENTS.local.md` are read, and composed after the files they refine.
+
+  The gitignored companion is where an operator keeps the standing corrections that matter most to
+  them — the ones too personal or too situational to commit. Nothing read it. Measured 2026-09-12: a
+  grep for the four `.local` spellings returned **0 files** across every package source tree, against
+  a control of 4 for `AGENTS.md`; the same query over the newly-resolved `@theokit/sdk@5.5.0`
+  returned **0** against a control of 23 for `CLAUDE.md`. The gap is in both layers, and raising the
+  SDK floor did not close it.
+
+  The failure is the silent kind: the file exists, it is named the documented way, nothing loads it,
+  and nothing complains. The agent behaves exactly as it would if the operator had written nothing,
+  which from the outside is indistinguishable from the instructions being wrong.
+
+  **Order shipped with membership, because membership alone would have shipped broken.**
+  `localeCompare` sorts `AGENTS.local.md` BEFORE `AGENTS.md` — `'l' < 'm'` — so adding the names to
+  `DEFAULT_FILE_NAMES` and nothing else would compose the operator's correction _before_ the rule it
+  was written to correct. The file would load and lose: a subtler version of the original defect, and
+  just as quiet. `walkOrder` now emits three bands within a directory — public files, private files,
+  then subdirectories — each boundary carrying its reason. The `lexicographic` mode stays literally
+  alphabetical; it is the documented escape for a caller who wants the raw order.
+
+  **The two chains are independent.** A local file never replaces its public sibling; both load. The
+  trap avoided is one chain falling back to the other, where adding a `THEO.md` would silently orphan
+  an existing `AGENTS.local.md` — a file the operator wrote, disabled by a file they added for an
+  unrelated reason.
+
+  **`CLAUDE.local.md` is deliberately not included.** `CLAUDE.md` is not in the public half of this
+  list either, so a private companion to a file this seam does not read would pair with nothing. If
+  `CLAUDE.md` is ever added, its companion comes with it.
+
+  Also corrects two comments in the same file that `@theokit/sdk@^5.0.0` made false: one described a
+  cast removed when the type began resolving — the symlink-escape **control it guards is untouched**,
+  and the note stays so its removal does not read as the control being relaxed — and one duplicated an
+  ordering rationale that now lives with the ordering.
+
+- 914e177: A caller can now name the foreign root's instructions — `context` is a `CompatSurface`.
+
+  `.claude/rules/*.md` had no name a consumer could write. The union was `'commands' | 'hooks' |
+'plugins' | 'skills' | 'subagents'` — five names for a root that feeds six things — and the gate's
+  own docblock had already written the rule that violated: "An enumeration used to NARROW a root must
+  cover every surface that root feeds: a name absent from the vocabulary is a surface the caller
+  cannot ask for and cannot be told it lost."
+
+  It was measured from the other end. `theokit-sdk` #652: `FileContextManager` consulted no
+  foreign-dialect grant at all, so a cloned repository's `.claude/rules/*.md` reached the system
+  prompt of a consumer who had declared only its own `.theokit/` — while that same directory's hooks,
+  skills, subagents and plugins were correctly withheld. Closing that gate is what makes the missing
+  name here load-bearing: once the SDK honours a `context` grant, a caller with no word for it loses
+  the rules silently.
+
+  **This ships BEFORE the SDK release that honours it, and the ordering is safe in exactly one
+  direction.** The SDK matches a narrowed `import` list per surface, so a name it does not recognise
+  is never matched and changes nothing: on today's SDK the rules load as they always did, and on the
+  next one the grant is what keeps them loading. The reverse order would take `.claude/rules` from
+  every caller here with no name they could write to ask for it back.
+
+  A consumer passing the bare `'claude-code'` literal is unaffected — it still means the whole root.
+  What changes is that `import: ['context']` is now expressible, so taking a foreign repository's
+  house rules no longer requires also granting it command execution.
+
+### Patch Changes
+
+- 6c1a602: Four `.claude` mechanisms are now declared out of scope, with the reason and the owner.
+
+  An absence that reads as an oversight gets re-investigated at full cost by the next person. The
+  `.claude` sweep produced a table with absences in it, and shipping that without separating "we
+  decided not to" from "we have not got to it" reproduces the defect the table exists to prevent.
+
+  Measured 2026-09-12: `keybindings`, `themes/` and `.claude.json` each return **0 files** across every
+  package source tree, against a control of 31 for `skills`.
+
+  | Surface                                       | Verdict                          |
+  | --------------------------------------------- | -------------------------------- |
+  | `keybindings.json`                            | out of scope — `@theokit/tui`    |
+  | `themes/*.json`                               | out of scope — `@theokit/tui`    |
+  | `~/.claude.json` — OAuth state, UI toggles    | out of scope — a CLI's own state |
+  | `~/.claude.json` — personal-scope MCP servers | **not read yet**, and in scope   |
+
+  **A framework has no keyboard and no colour.** It produces text and tool calls; the process that
+  renders them owns which key does what and which escape codes it emits. Reading those here would let
+  this package hold configuration it cannot act on, which is the accepted-and-ignored failure the whole
+  table exists to prevent.
+
+  **`~/.claude.json` is two things under one name, and the split is the point.** One verdict over the
+  whole file would be wrong about one half whichever way it went: the OAuth state is a specific
+  program's own session, and a library reading another program's login state reaches into something it
+  neither owns nor can refresh — while an MCP server the operator registered for themselves is a
+  framework concern, and this package already reads project-scope servers from `.mcp.json`. That half
+  is **not refused; it is not done**, and the two stay distinguishable because the reader deciding
+  whether to file a bug needs to know which one they are looking at.
+
+  Declared in `README.md` and not only in the project's rules directory, because that directory is
+  gitignored — a decision recorded only there is a decision made for one checkout.
+
+  Separately, `SettingSourcesSelection.user`'s docblock stops describing a capability the runtime does
+  not have: nothing reads the operator's root because of that flag (`includesSetting` is called with
+  exactly `"project"` and `"plugins"` at `@theokit/sdk@5.5.0`). What the SDK _does_ read from
+  `~/.theokit/` — model-provider plugins, the provider trust file, transcripts, the HTTP cache — it
+  reads unconditionally, governed by nothing. The flag is still accepted rather than refused: the
+  measured consumer passes it on every run, including the untrusted-directory path where it is the only
+  grant, so refusing would turn a graceful degradation into a throw for the case it exists to survive.
+
+- 24e1fab: State, where hook events are declared, that no seam can run before compaction
+
+  B-002 FR-004. A consumer needing to persist state before the transcript is compacted has no event to
+  bind to, and could only learn that by writing a handler and watching it never fire.
+
+  Measured against `@theokit/sdk@5.5.0`: `HookName` is a closed union of ten names with no compaction
+  member, and `PluginContext.on` keys its callback by that union — so no event name can be added from
+  this package. The SDK's own auto-compaction path is further out of reach: bundle-internal, absent
+  from every emitted `.d.ts` and all 33 export subpaths, and it builds its own summarizer at the call
+  site.
+
+  The docblock now says so and names `usetheokit/theokit-sdk#653`, the issue that unblocks it, so a
+  reader arrives at the nine candidate seams already ruled out rather than repeating the enumeration.
+
+  `hook-events.ts` is split out of `hook-spec.ts`, which had drifted to 616 lines against the 600 its
+  brief caps it at. Every symbol callers import stays importable from `hook-spec.js`.
+
 ## 13.4.0
 
 ### Minor Changes

package/README.md

@@ -99,6 +99,34 @@ configuration that had no effect.
 | `output-styles/*.md` | read, selected by `settings.json` |
 | `agent-memory/` | read — see below |
 | `workflows/*.js` | **refused**, and reported. Every other surface is data; a workflow is code, and executing JavaScript found under a caller-supplied directory is a decision that belongs to you |
+| `keybindings.json` | **out of scope** — `@theokit/tui` |
+| `themes/*.json` | **out of scope** — `@theokit/tui` |
+| `~/.claude.json` — OAuth state, UI toggles | **out of scope** — a CLI's own state |
+| `~/.claude.json` — personal-scope MCP servers | **not read yet**, and in scope |
+
+
+### Out of scope, and who owns it instead
+
+An absence that reads as an oversight gets re-investigated at full cost by the next person. These
+were measured on 2026-09-12 — `keybindings`, `themes/` and `.claude.json` each return **0 files**
+across every package source tree, against a control of 31 for `skills` — and each one is a decision
+rather than a gap.
+
+**`keybindings.json` and `themes/*.json` belong to `@theokit/tui`.** A framework has no keyboard and
+no colour: it produces text and tool calls, and the process that renders them owns which key does
+what and which escape codes it emits. Reading them here would let this package hold configuration it
+cannot act on, which is the accepted-and-ignored failure the table above exists to prevent.
+
+**`~/.claude.json` is two things under one name, and the split is the point.** Its OAuth state and UI
+toggles are a CLI's own state — that file is written by a specific program about its own session, and
+a library reading another program's login state would be reaching into something it neither owns nor
+can refresh. Its **personal-scope MCP servers** are a different matter: an MCP server the operator
+registered for themselves is a framework concern, this package already reads project-scope servers
+from `.mcp.json`, and the personal scope measures 0. That half is **not refused — it is not done**,
+and saying so is the distinction this section exists to make.
+
+The registry entry that prompted this counts four decisions across three files, because
+`~/.claude.json` is split. That is the count, stated so nobody goes looking for a fourth file.
 
 ### `agent-memory/`
 

package/dist/{agent-compiler-BaOZzU7Q.d.ts → agent-compiler-B1F9iumK.d.ts}

@@ -2,7 +2,7 @@ import { InlineSkill, SystemPromptResolver, SessionStore, PermissionGate, Memory
 import { AgentDefinition } from '@theokit/sdk/subagents-loader';
 import { TheokitAgentError } from '@theokit/sdk/errors';
 import { R as ReasoningEffort, a as MemoryOptions, P as ProjectContextOptions, M as McpServersMap, H as HumanInTheLoopOptions, C as CheckpointOptions, T as ToolOptions, A as ApprovalOptions, B as BudgetOptions } from './types-C16Wuh9E.js';
-import { G as GatedSettingSource, a as GatedCompatSource } from './setting-sources-gate-BXdZmY78.js';
+import { G as GatedSettingSource, a as GatedCompatSource } from './setting-sources-gate-BoTngPIn.js';
 
 /**
  * M9 (theokit-ai-first) — guardrail contract + typed errors.

package/dist/auth.js

@@ -438,7 +438,6 @@ function requireCredential(input) {
   if (resolved !== void 0) return resolved;
   throw new CredentialNotFoundError(credentialSources({
     providers: input.providers,
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- `CredentialStoreConfig` does not resolve (see the import note at the top of this file); the value is only forwarded, never inspected
     ...input.store === void 0 ? {} : {
       store: input.store
     }
@@ -476,7 +475,6 @@ function resolveAgentCredential(input) {
     ...input.model === void 0 ? {} : {
       model: input.model
     },
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- same unresolved `CredentialStoreConfig`; forwarded verbatim to the resolver
     ...input.store === void 0 ? {} : {
       store: input.store
     }

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/credential-helper.ts","../src/auth/permission-store.ts","../src/auth/permission-gate.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EA3FjD,OA2FiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAvG9C,OAuG8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAzH3C,OAyH2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAvI7C,OAuI6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;AC1iBhB,SAASC,gBAAgB;AAMzB,IAAMC,qBAAqB;AAsB3B,eAAsBC,oBACpBC,SACAC,UAAsC,CAAC,GAAC;AAExC,QAAMC,YAAYD,QAAQC,aAAaJ;AACvC,QAAMK,UAAU,MAAM,IAAIC,QAAgB,CAACC,SAASC,WAAAA;AAYlDC;MACEP;MACA,CAAA;MACA;QAAEQ,OAAO;QAAMC,SAASP;QAAWQ,KAAKT,QAAQS;QAAKC,UAAU;MAAO;;;MAGtE,CAACC,OAAOC,WAAAA;AACN,YAAID,UAAU,MAAM;AAClBP,kBAAQQ,MAAAA;AACR;QACF;AAGA,YAAID,MAAME,WAAW,MAAM;AACzBR,iBACE,IAAIS,mBACF,0BAA0Bf,OAAAA,qBAA4BE,SAAAA,wJAGtD;YAAEc,MAAM;UAA4B,CAAA,CAAA;AAGxC;QACF;AACA,cAAMA,OAAO,OAAOJ,MAAMI,SAAS,WAAWJ,MAAMI,OAAO;AAC3DV,eACE,IAAIS,mBACF,0BAA0Bf,OAAAA,YAAmBgB,IAAAA,sHAE7C;UAAEA,MAAM;QAA2B,CAAA,CAAA;MAGzC;IAAA;EAEJ,CAAA;AAEA,QAAMC,aAAad,QAAQe,KAAI;AAC/B,MAAID,WAAWE,WAAW,GAAG;AAC3B,UAAM,IAAIJ,mBACR,0BAA0Bf,OAAAA,gNAG1B;MAAEgB,MAAM;IAA0B,CAAA;EAEtC;AACA,SAAOC;AACT;AA/DsBlB;AA8EtB,eAAsBqB,sBACpBC,MACApB,UAAsC,CAAC,GAAC;AAExC,QAAM,EAAEqB,aAAY,IAAKC,sBAAsBF,IAAAA;AAC/C,MAAIC,iBAAiBE,OAAW,QAAOA;AACvC,SAAOzB,oBAAoBuB,cAAcrB,OAAAA;AAC3C;AAPsBmB;;;ACzDtB,SAASK,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA1Hb,OA0HaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;;;ACtFO,SAASwB,UACdC,OACAC,UAAmD;AAEnD,SAAO,CAACC,QAAAA;AACN,QAAI;AACF,YAAMC,iBAAiCF,SAASC,GAAAA;AAkBhD,UAAIC,eAAeC,aAAa,MAAO,QAAOC,QAAQC,QAAQC,MAAAA;AAC9D,UAAIP,MAAMQ,UAAUL,eAAeM,KAAK,EAAG,QAAOJ,QAAQC,QAAQC,MAAAA;AAIlE,YAAMG,UACJV,MAAMW,kBAAkBJ,SACpB,8BACA;AAQNK,eAAS,oCAAoC;QAC3CC,MAAMX,IAAIY;QACVC,OAAOZ,eAAeM,MAAMM;QAC5BL;MACF,CAAA;AACA,aAAOL,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,IAAIf,IAAIY,IAAI,yBAAyBX,eAAeM,MAAMM,KAAK,KAAKL,OAAAA;MAC/E,CAAA;IACF,SAASQ,OAAO;AAGd,YAAMC,MAAMD,iBAAiBE,QAAQF,MAAMD,UAAUI,OAAOH,KAAAA;AAI5DN,eAAS,gDAAgD;QAAEC,MAAMX,IAAIY;QAAMK;MAAI,CAAA;AAC/E,aAAOd,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,uCAAuCf,IAAIY,IAAI,MAAMK,GAAAA;MAChE,CAAA;IACF;EACF;AACF;AA/DgBpB;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","execFile","DEFAULT_TIMEOUT_MS","runCredentialHelper","command","options","timeoutMs","printed","Promise","resolve","reject","execFile","shell","timeout","cwd","encoding","error","stdout","killed","ConfigurationError","code","credential","trim","length","resolveOperatorApiKey","warn","apiKeyHelper","currentOperatorPolicy","undefined","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify","grantGate","store","classify","ctx","classification","governed","Promise","resolve","undefined","isGranted","query","because","lastReadError","debugLog","tool","name","scope","block","message","cause","why","Error","String"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/credential-helper.ts","../src/auth/permission-store.ts","../src/auth/permission-gate.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAC7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EACF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACnLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAgBrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EApGjD,OAoGiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAhH9C,OAgH8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAlI3C,OAkI2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAhJ7C,OAgJ6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;ACnjBhB,SAASC,gBAAgB;AAMzB,IAAMC,qBAAqB;AAsB3B,eAAsBC,oBACpBC,SACAC,UAAsC,CAAC,GAAC;AAExC,QAAMC,YAAYD,QAAQC,aAAaJ;AACvC,QAAMK,UAAU,MAAM,IAAIC,QAAgB,CAACC,SAASC,WAAAA;AAYlDC;MACEP;MACA,CAAA;MACA;QAAEQ,OAAO;QAAMC,SAASP;QAAWQ,KAAKT,QAAQS;QAAKC,UAAU;MAAO;;;MAGtE,CAACC,OAAOC,WAAAA;AACN,YAAID,UAAU,MAAM;AAClBP,kBAAQQ,MAAAA;AACR;QACF;AAGA,YAAID,MAAME,WAAW,MAAM;AACzBR,iBACE,IAAIS,mBACF,0BAA0Bf,OAAAA,qBAA4BE,SAAAA,wJAGtD;YAAEc,MAAM;UAA4B,CAAA,CAAA;AAGxC;QACF;AACA,cAAMA,OAAO,OAAOJ,MAAMI,SAAS,WAAWJ,MAAMI,OAAO;AAC3DV,eACE,IAAIS,mBACF,0BAA0Bf,OAAAA,YAAmBgB,IAAAA,sHAE7C;UAAEA,MAAM;QAA2B,CAAA,CAAA;MAGzC;IAAA;EAEJ,CAAA;AAEA,QAAMC,aAAad,QAAQe,KAAI;AAC/B,MAAID,WAAWE,WAAW,GAAG;AAC3B,UAAM,IAAIJ,mBACR,0BAA0Bf,OAAAA,gNAG1B;MAAEgB,MAAM;IAA0B,CAAA;EAEtC;AACA,SAAOC;AACT;AA/DsBlB;AA8EtB,eAAsBqB,sBACpBC,MACApB,UAAsC,CAAC,GAAC;AAExC,QAAM,EAAEqB,aAAY,IAAKC,sBAAsBF,IAAAA;AAC/C,MAAIC,iBAAiBE,OAAW,QAAOA;AACvC,SAAOzB,oBAAoBuB,cAAcrB,OAAAA;AAC3C;AAPsBmB;;;ACzDtB,SAASK,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA1Hb,OA0HaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;;;ACtFO,SAASwB,UACdC,OACAC,UAAmD;AAEnD,SAAO,CAACC,QAAAA;AACN,QAAI;AACF,YAAMC,iBAAiCF,SAASC,GAAAA;AAkBhD,UAAIC,eAAeC,aAAa,MAAO,QAAOC,QAAQC,QAAQC,MAAAA;AAC9D,UAAIP,MAAMQ,UAAUL,eAAeM,KAAK,EAAG,QAAOJ,QAAQC,QAAQC,MAAAA;AAIlE,YAAMG,UACJV,MAAMW,kBAAkBJ,SACpB,8BACA;AAQNK,eAAS,oCAAoC;QAC3CC,MAAMX,IAAIY;QACVC,OAAOZ,eAAeM,MAAMM;QAC5BL;MACF,CAAA;AACA,aAAOL,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,IAAIf,IAAIY,IAAI,yBAAyBX,eAAeM,MAAMM,KAAK,KAAKL,OAAAA;MAC/E,CAAA;IACF,SAASQ,OAAO;AAGd,YAAMC,MAAMD,iBAAiBE,QAAQF,MAAMD,UAAUI,OAAOH,KAAAA;AAI5DN,eAAS,gDAAgD;QAAEC,MAAMX,IAAIY;QAAMK;MAAI,CAAA;AAC/E,aAAOd,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,uCAAuCf,IAAIY,IAAI,MAAMK,GAAAA;MAChE,CAAA;IACF;EACF;AACF;AA/DgBpB;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","execFile","DEFAULT_TIMEOUT_MS","runCredentialHelper","command","options","timeoutMs","printed","Promise","resolve","reject","execFile","shell","timeout","cwd","encoding","error","stdout","killed","ConfigurationError","code","credential","trim","length","resolveOperatorApiKey","warn","apiKeyHelper","currentOperatorPolicy","undefined","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify","grantGate","store","classify","ctx","classification","governed","Promise","resolve","undefined","isGranted","query","because","lastReadError","debugLog","tool","name","scope","block","message","cause","why","Error","String"]}

package/dist/{bridge-entry-BgWauyLQ.d.ts → bridge-entry-C0MwIOpc.d.ts}

@@ -1,14 +1,14 @@
 import { ExecutionContext } from '@theokit/http';
 import { c as AgentOptions, T as ToolOptions, P as ProjectContextOptions, H as HumanInTheLoopOptions, R as ReasoningEffort, M as McpServersMap } from './types-C16Wuh9E.js';
-import { a as CompiledAgentOptions, b as CompiledTool, G as Guardrail, S as SkillsSelection, H as HookApprovalGate, C as CodePlugin } from './agent-compiler-BaOZzU7Q.js';
+import { a as CompiledAgentOptions, b as CompiledTool, G as Guardrail, S as SkillsSelection, H as HookApprovalGate, C as CodePlugin } from './agent-compiler-B1F9iumK.js';
 import { SkillsSettings, ContextSettings, SystemPromptResolver, ModelSelection, PluginsSettings, Plugin, ProviderRoutingSettings, AgentDefinition as AgentDefinition$1, BudgetTracker, CustomTool, RunEventSink, MemorySettings, TelemetrySettings } from '@theokit/sdk';
-import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-DLsMQ4BJ.js';
+import { S as StreamEvent, f as ApprovalRequiredEvent, a4 as MaskError } from './delegation-scoring-BTuTKWkZ.js';
 import { RetryOptions } from '@theokit/sdk/retry';
 import { SandboxPosture } from '@theokit/sdk/sandbox';
-import { A as AgentDefinition } from './define-agent-DOZL_0uP.js';
+import { A as AgentDefinition } from './define-agent-D1zBG-Ys.js';
 import { z } from 'zod';
 import { H as HookHandlers } from './hook-handlers-Cw2FsnE5.js';
-import { S as SettingSourcesSelection } from './setting-sources-gate-BXdZmY78.js';
+import { S as SettingSourcesSelection } from './setting-sources-gate-BoTngPIn.js';
 import { WireChunk } from '@theokit/presenter/wire';
 import { TheokitAgentError } from '@theokit/sdk/errors';
 

package/dist/bridge.d.ts

@@ -1,8 +1,8 @@
-export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, U as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, V as agentsPlugin, X as applyPosture, Y as buildModelSelection, Z as compileAgentModule, _ as compileContextWindow, $ as compileLoadedAgentModule, a0 as compileProjectContext, a1 as compileSkills, a2 as createAgentExecutionContext, a3 as createApiErrorHandler, a4 as createSdkAgentStream, a5 as createThinkTagExtractor, a6 as createToolHooksPlugin, a7 as extractThinkTagStream, a8 as generateAgentManifest, a9 as generateAgentRoutes, aa as isAgentContext, ab as loadMcpJson, ac as mcpRegistry, ad as mcpToolApprovals, ae as projectContextMetadataOnlyKnobs, af as reasoningEffortOf, ag as resolveMcpServers, ah as runWithApiErrorHandling, ai as shouldAutoApprove, s as streamAgentUIMessages, aj as toAgentFactory, ak as translateSdkEvent, al as withClockCap, am as withEphemeralAgent } from './bridge-entry-BgWauyLQ.js';
-export { c as CompatImportUnsupportedError, a as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, j as HookApprovalRequest, k as HookGateUnsupportedError, T as ToolWalkResult, m as ToolboxWalkResult, n as compileTools } from './agent-compiler-BaOZzU7Q.js';
-export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-DLsMQ4BJ.js';
-export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-DOZL_0uP.js';
-export { C as CompatSurface, a as GatedCompatSource, G as GatedSettingSource, P as ProjectSettingsGrant, R as ResolvedCompatSource, b as SettingSourceCapability, S as SettingSourcesSelection, U as UntrustedSettingSourceError, r as resolveCompatSources, c as resolveSettingSources } from './setting-sources-gate-BXdZmY78.js';
+export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, U as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, V as agentsPlugin, X as applyPosture, Y as buildModelSelection, Z as compileAgentModule, _ as compileContextWindow, $ as compileLoadedAgentModule, a0 as compileProjectContext, a1 as compileSkills, a2 as createAgentExecutionContext, a3 as createApiErrorHandler, a4 as createSdkAgentStream, a5 as createThinkTagExtractor, a6 as createToolHooksPlugin, a7 as extractThinkTagStream, a8 as generateAgentManifest, a9 as generateAgentRoutes, aa as isAgentContext, ab as loadMcpJson, ac as mcpRegistry, ad as mcpToolApprovals, ae as projectContextMetadataOnlyKnobs, af as reasoningEffortOf, ag as resolveMcpServers, ah as runWithApiErrorHandling, ai as shouldAutoApprove, s as streamAgentUIMessages, aj as toAgentFactory, ak as translateSdkEvent, al as withClockCap, am as withEphemeralAgent } from './bridge-entry-C0MwIOpc.js';
+export { c as CompatImportUnsupportedError, a as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, j as HookApprovalRequest, k as HookGateUnsupportedError, T as ToolWalkResult, m as ToolboxWalkResult, n as compileTools } from './agent-compiler-B1F9iumK.js';
+export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-BTuTKWkZ.js';
+export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-D1zBG-Ys.js';
+export { C as CompatSurface, a as GatedCompatSource, G as GatedSettingSource, P as ProjectSettingsGrant, R as ResolvedCompatSource, b as SettingSourceCapability, S as SettingSourcesSelection, U as UntrustedSettingSourceError, r as resolveCompatSources, c as resolveSettingSources } from './setting-sources-gate-BoTngPIn.js';
 import '@theokit/http';
 import './types-C16Wuh9E.js';
 import '@theokit/sdk';

package/dist/bridge.js

@@ -29,7 +29,7 @@ import {
   runWithApiErrorHandling,
   streamAgentResponse,
   streamAgentUIMessages
-} from "./chunk-SL3QW5WZ.js";
+} from "./chunk-DFGIED4E.js";
 import {
   APPROVAL_MODES,
   BudgetExceededError,
@@ -56,7 +56,7 @@ import {
   translateSdkEvent,
   withClockCap,
   withEphemeralAgent
-} from "./chunk-CBP72LFM.js";
+} from "./chunk-72QVLTDI.js";
 import "./chunk-MJ6FRILJ.js";
 import {
   AGENT_BRAND,
@@ -65,7 +65,7 @@ import {
   isAgentDefinition,
   resolveCompatSources,
   resolveSettingSources
-} from "./chunk-PYVLRSXZ.js";
+} from "./chunk-NKPNVQBF.js";
 import "./chunk-M5J3Q6YC.js";
 import "./chunk-U72XTMYB.js";
 import "./chunk-2SP5BB6U.js";

package/dist/{chunk-CBP72LFM.js → chunk-72QVLTDI.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-MJ6FRILJ.js";
 import {
   compileAgentDefinition
-} from "./chunk-PYVLRSXZ.js";
+} from "./chunk-NKPNVQBF.js";
 import {
   debugLog
 } from "./chunk-M5J3Q6YC.js";
@@ -722,7 +722,7 @@ function applyPlugins(compiled, options, applied) {
   }
 }
 __name(applyPlugins, "applyPlugins");
-function applyLocalSources(compiled, options, applied) {
+function applyLocalSources(compiled, options, applied, sdkVersion) {
   if (compiled.settingSources !== void 0 && compiled.settingSources.length > 0) {
     options.local = {
       ...options.local,
@@ -742,7 +742,7 @@ function applyLocalSources(compiled, options, applied) {
   if (compiled.compatSources !== void 0 && compiled.compatSources.length > 0) {
     const forSdk = compatSourcesForSdk(compiled.compatSources);
     if (forSdk.some((c) => typeof c === "object" && "import" in c)) {
-      assertSdkCanReadNarrowedImport(installedSdkVersion());
+      assertSdkCanReadNarrowedImport(sdkVersion ?? installedSdkVersion());
     }
     if (forSdk.length > 0) {
       options.local = {
@@ -778,7 +778,7 @@ function assembleM8CreateOptions(compiled, deps = {}) {
     options.agents = compiled.agents;
     applied.push("agents");
   }
-  applyLocalSources(compiled, options, applied);
+  applyLocalSources(compiled, options, applied, deps.sdkVersion);
   applyHookApproval(compiled, options, applied, deps.sdkVersion);
   if (compiled.context) {
     options.context = compiled.context;
@@ -1532,7 +1532,7 @@ async function startTurn(open, retry) {
     }
   }, "attempt");
   const { Retry } = await import("@theokit/sdk/retry");
-  return Retry.create(attempt, retry);
+  return Retry.run(attempt, retry);
 }
 __name(startTurn, "startTurn");
 async function* withTurnStartRetry(open, retry) {
@@ -2139,7 +2139,7 @@ async function startRound(factory, prompt, sessionId, signal, retry) {
   }, "open");
   if (!retry) return open();
   const { Retry } = await import("@theokit/sdk/retry");
-  return Retry.create(open, {
+  return Retry.run(open, {
     ...retry,
     signal: retry.signal ?? signal
   });
@@ -2526,6 +2526,71 @@ function formatUnrecognised(event) {
 }
 __name(formatUnrecognised, "formatUnrecognised");
 
+// src/loop/pre-compaction.ts
+import { TheokitAgentError as TheokitAgentError5 } from "@theokit/sdk/errors";
+var DEFAULT_HANDLER_TIMEOUT_MS = 3e4;
+var PreCompactionHandlerError = class extends TheokitAgentError5 {
+  static {
+    __name(this, "PreCompactionHandlerError");
+  }
+  name = "PreCompactionHandlerError";
+  /** `'timeout'` when the bound was exceeded, `'threw'` when the handler failed on its own. */
+  reason;
+  constructor(message, reason, options) {
+    super(message, {
+      code: "PRE_COMPACTION_HANDLER_FAILED",
+      ...options ?? {}
+    });
+    this.reason = reason;
+  }
+};
+function assertUsableTimeout(timeoutMs) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new TypeError(`withPreCompaction: timeoutMs must be a finite number greater than 0, received ${String(timeoutMs)}`);
+  }
+}
+__name(assertUsableTimeout, "assertUsableTimeout");
+async function runHandlerBounded(handler, messages, timeoutMs, onError) {
+  let timer;
+  const controller = new AbortController();
+  try {
+    await Promise.race([
+      Promise.resolve(handler(messages, controller.signal)),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new PreCompactionHandlerError(`pre-compaction handler exceeded its ${String(timeoutMs)}ms bound; compaction proceeded without it`, "timeout"));
+        }, timeoutMs);
+      })
+    ]);
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    const reported = cause instanceof PreCompactionHandlerError ? cause : new PreCompactionHandlerError(`pre-compaction handler failed: ${detail}`, "threw", {
+      cause
+    });
+    onError?.(reported);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+__name(runHandlerBounded, "runHandlerBounded");
+function withPreCompaction(strategy, handler, options) {
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_HANDLER_TIMEOUT_MS;
+  assertUsableTimeout(timeoutMs);
+  const onError = options?.onError;
+  return {
+    name: strategy.name,
+    keepTokens: strategy.keepTokens,
+    compact: /* @__PURE__ */ __name(async (messages, callOptions) => {
+      await runHandlerBounded(handler, [
+        ...messages
+      ], timeoutMs, onError);
+      return strategy.compact(messages, callOptions);
+    }, "compact")
+  };
+}
+__name(withPreCompaction, "withPreCompaction");
+
 // src/bridge/agent-orchestrator.ts
 function requireApiKey(opts, agentName) {
   if (opts.apiKey === null) return "";
@@ -2606,8 +2671,8 @@ async function moderateDelegationResult(result, guardrails) {
 __name(moderateDelegationResult, "moderateDelegationResult");
 
 // src/bridge/delegation-lifecycle.ts
-import { TheokitAgentError as TheokitAgentError5 } from "@theokit/sdk/errors";
-var DelegationTimeoutError = class extends TheokitAgentError5 {
+import { TheokitAgentError as TheokitAgentError6 } from "@theokit/sdk/errors";
+var DelegationTimeoutError = class extends TheokitAgentError6 {
   static {
     __name(this, "DelegationTimeoutError");
   }
@@ -2769,6 +2834,9 @@ export {
   GoalRunner,
   JudgeCredentialError,
   formatGoalEvent,
+  DEFAULT_HANDLER_TIMEOUT_MS,
+  PreCompactionHandlerError,
+  withPreCompaction,
   delegate,
   DelegationTimeoutError,
   withClockCap,
@@ -2777,4 +2845,4 @@ export {
   delegateBackground,
   delegateWithScoring
 };
-//# sourceMappingURL=chunk-CBP72LFM.js.map
+//# sourceMappingURL=chunk-72QVLTDI.js.map