@theokit/agents 4.2.2 → 4.3.0

package/dist/auth.d.ts

@@ -0,0 +1,49 @@
+import { OAuthProviderConfig, CredentialStoreConfig, ResolvedCredential, ensureFreshCredential, OpenAIDeviceConfig, openaiDeviceLogin, OAuthTokens } from '@theokit/sdk/auth';
+export { CredentialStoreConfig, DeviceDeps, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolvedCredential } from '@theokit/sdk/auth';
+
+/**
+ * M60 — `AuthProvider`, the OO contract that unifies the SDK's free OAuth-lifecycle functions
+ * (`openaiDeviceLogin` → `persistOAuthTokens` → `ensureFreshCredential`). Those are stateful across a
+ * SHARED `config` (`OAuthProviderConfig`) + `store` (`CredentialStoreConfig`); this class holds that
+ * state so a consumer authors `new AuthProvider(config, store).persist(...)` / `.ensureFresh(...)`
+ * instead of threading `config`/`store` through every call — the `SDK → Theokit → AgentBuilder`
+ * boundary applied to the auth domain (ENRICH, per blueprint D2: auth carries orchestration + state).
+ *
+ * It DELEGATES, never reimplements (parsimony Rung 9): each method forwards verbatim to the SDK
+ * function, so login → persist → refresh produces byte-identical state to calling the SDK directly.
+ *
+ * SECRET-SAFETY (hard rule): this class NEVER logs, stringifies, or otherwise surfaces token material.
+ * Methods return exactly what the SDK returns and add no observability — a token is data that flows
+ * through, never something this layer emits. The parity/secret tests pin both properties.
+ */
+/** The HTTP deps of `ensureFreshCredential` (`{ fetch, now }`) — typed off the SDK to avoid drift. */
+type EnsureFreshHttpDeps = Parameters<typeof ensureFreshCredential>[2];
+/** The device-flow deps + prompt hook of `openaiDeviceLogin` — typed off the SDK. */
+type DeviceLoginDeps = Parameters<typeof openaiDeviceLogin>[1];
+type DeviceLoginHooks = Parameters<typeof openaiDeviceLogin>[2];
+declare class AuthProvider {
+    private readonly config;
+    private readonly store;
+    constructor(config: OAuthProviderConfig, store: CredentialStoreConfig);
+    /**
+     * Refresh a resolved credential if stale. Delegates to `ensureFreshCredential` with the held
+     * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps
+     * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.
+     */
+    ensureFresh(resolved: ResolvedCredential, opts: EnsureFreshHttpDeps & {
+        env?: Record<string, string | undefined>;
+    }): Promise<ResolvedCredential>;
+    /**
+     * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the
+     * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the
+     * refresh `config`. Returns `OAuthTokens` — the caller persists them via {@link AuthProvider.persist}.
+     */
+    deviceLogin(deviceConfig: OpenAIDeviceConfig, deps: DeviceLoginDeps, hooks: DeviceLoginHooks): Promise<OAuthTokens>;
+    /**
+     * Persist freshly-obtained tokens through the held `store`. Delegates to `persistOAuthTokens` and
+     * returns the credential-file path (never the token). `env` selects the store's home override.
+     */
+    persist(provider: string, tokens: OAuthTokens, env?: Record<string, string | undefined>): string;
+}
+
+export { AuthProvider };

package/dist/auth.js

@@ -0,0 +1,49 @@
+import {
+  __name
+} from "./chunk-7QVYU63E.js";
+
+// src/auth/auth-provider.ts
+import { ensureFreshCredential, openaiDeviceLogin, persistOAuthTokens } from "@theokit/sdk/auth";
+var AuthProvider = class {
+  static {
+    __name(this, "AuthProvider");
+  }
+  config;
+  store;
+  constructor(config, store) {
+    this.config = config;
+    this.store = store;
+  }
+  /**
+  * Refresh a resolved credential if stale. Delegates to `ensureFreshCredential` with the held
+  * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps
+  * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.
+  */
+  ensureFresh(resolved, opts) {
+    const { env, ...http } = opts;
+    return ensureFreshCredential(resolved, {
+      config: this.config,
+      store: this.store,
+      env
+    }, http);
+  }
+  /**
+  * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the
+  * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the
+  * refresh `config`. Returns `OAuthTokens` — the caller persists them via {@link AuthProvider.persist}.
+  */
+  deviceLogin(deviceConfig, deps, hooks) {
+    return openaiDeviceLogin(deviceConfig, deps, hooks);
+  }
+  /**
+  * Persist freshly-obtained tokens through the held `store`. Delegates to `persistOAuthTokens` and
+  * returns the credential-file path (never the token). `env` selects the store's home override.
+  */
+  persist(provider, tokens, env) {
+    return persistOAuthTokens(provider, tokens, this.store, env);
+  }
+};
+export {
+  AuthProvider
+};
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/auth-provider.ts"],"sourcesContent":["import {\n  ensureFreshCredential,\n  openaiDeviceLogin,\n  persistOAuthTokens,\n} from '@theokit/sdk/auth'\nimport type {\n  CredentialStoreConfig,\n  OAuthProviderConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n  ResolvedCredential,\n} from '@theokit/sdk/auth'\n\n/**\n * M60 — `AuthProvider`, the OO contract that unifies the SDK's free OAuth-lifecycle functions\n * (`openaiDeviceLogin` → `persistOAuthTokens` → `ensureFreshCredential`). Those are stateful across a\n * SHARED `config` (`OAuthProviderConfig`) + `store` (`CredentialStoreConfig`); this class holds that\n * state so a consumer authors `new AuthProvider(config, store).persist(...)` / `.ensureFresh(...)`\n * instead of threading `config`/`store` through every call — the `SDK → Theokit → AgentBuilder`\n * boundary applied to the auth domain (ENRICH, per blueprint D2: auth carries orchestration + state).\n *\n * It DELEGATES, never reimplements (parsimony Rung 9): each method forwards verbatim to the SDK\n * function, so login → persist → refresh produces byte-identical state to calling the SDK directly.\n *\n * SECRET-SAFETY (hard rule): this class NEVER logs, stringifies, or otherwise surfaces token material.\n * Methods return exactly what the SDK returns and add no observability — a token is data that flows\n * through, never something this layer emits. The parity/secret tests pin both properties.\n */\n\n/** The HTTP deps of `ensureFreshCredential` (`{ fetch, now }`) — typed off the SDK to avoid drift. */\ntype EnsureFreshHttpDeps = Parameters<typeof ensureFreshCredential>[2]\n/** The device-flow deps + prompt hook of `openaiDeviceLogin` — typed off the SDK. */\ntype DeviceLoginDeps = Parameters<typeof openaiDeviceLogin>[1]\ntype DeviceLoginHooks = Parameters<typeof openaiDeviceLogin>[2]\n\nexport class AuthProvider {\n  constructor(\n    private readonly config: OAuthProviderConfig,\n    private readonly store: CredentialStoreConfig,\n  ) {}\n\n  /**\n   * Refresh a resolved credential if stale. Delegates to `ensureFreshCredential` with the held\n   * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps\n   * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.\n   */\n  ensureFresh(\n    resolved: ResolvedCredential,\n    opts: EnsureFreshHttpDeps & { env?: Record<string, string | undefined> },\n  ): Promise<ResolvedCredential> {\n    const { env, ...http } = opts\n    return ensureFreshCredential(resolved, { config: this.config, store: this.store, env }, http)\n  }\n\n  /**\n   * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the\n   * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the\n   * refresh `config`. Returns `OAuthTokens` — the caller persists them via {@link AuthProvider.persist}.\n   */\n  deviceLogin(\n    deviceConfig: OpenAIDeviceConfig,\n    deps: DeviceLoginDeps,\n    hooks: DeviceLoginHooks,\n  ): Promise<OAuthTokens> {\n    return openaiDeviceLogin(deviceConfig, deps, hooks)\n  }\n\n  /**\n   * Persist freshly-obtained tokens through the held `store`. Delegates to `persistOAuthTokens` and\n   * returns the credential-file path (never the token). `env` selects the store's home override.\n   */\n  persist(\n    provider: string,\n    tokens: OAuthTokens,\n    env?: Record<string, string | undefined>,\n  ): string {\n    return persistOAuthTokens(provider, tokens, this.store, env)\n  }\n}\n"],"mappings":";;;;;AAAA,SACEA,uBACAC,mBACAC,0BACK;AA+BA,IAAMC,eAAN,MAAMA;EAnCb,OAmCaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOHC,YACEC,UACAC,MAC6B;AAC7B,UAAM,EAAEC,KAAK,GAAGC,KAAAA,IAASF;AACzB,WAAOG,sBAAsBJ,UAAU;MAAEH,QAAQ,KAAKA;MAAQC,OAAO,KAAKA;MAAOI;IAAI,GAAGC,IAAAA;EAC1F;;;;;;EAOAE,YACEC,cACAC,MACAC,OACsB;AACtB,WAAOC,kBAAkBH,cAAcC,MAAMC,KAAAA;EAC/C;;;;;EAMAE,QACEC,UACAC,QACAV,KACQ;AACR,WAAOW,mBAAmBF,UAAUC,QAAQ,KAAKd,OAAOI,GAAAA;EAC1D;AACF;","names":["ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","AuthProvider","config","store","ensureFresh","resolved","opts","env","http","ensureFreshCredential","deviceLogin","deviceConfig","deps","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/agents",
-  "version": "4.2.2",
+  "version": "4.3.0",
   "description": "AI agents as first-class citizens of the TheoKit pipeline. The fluent agent()/tool() builders compile to SDK Agent.create() (M31 builder-only authoring API).",
   "type": "module",
   "sideEffects": false,
@@ -34,6 +34,10 @@
     "./pty": {
       "types": "./dist/pty.d.ts",
       "import": "./dist/pty.js"
+    },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "import": "./dist/auth.js"
     }
   },
   "files": [
@@ -69,8 +73,8 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.6",
     "zod": "^4.4.3",
-    "@theokit/http": "1.0.0",
-    "@theokit/presenter": "0.3.0"
+    "@theokit/presenter": "0.3.0",
+    "@theokit/http": "1.0.0"
   },
   "engines": {
     "node": ">=22.12.0"