@theokit/agents 4.3.0 → 4.3.1

package/dist/auth.d.ts

@@ -30,9 +30,7 @@ declare class AuthProvider {
      * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps
      * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.
      */
-    ensureFresh(resolved: ResolvedCredential, opts: EnsureFreshHttpDeps & {
-        env?: Record<string, string | undefined>;
-    }): Promise<ResolvedCredential>;
+    ensureFresh(resolved: ResolvedCredential, deps: EnsureFreshHttpDeps, env?: Record<string, string | undefined>): Promise<ResolvedCredential>;
     /**
      * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the
      * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the

package/dist/auth.js

@@ -19,13 +19,12 @@ var AuthProvider = class {
   * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps
   * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.
   */
-  ensureFresh(resolved, opts) {
-    const { env, ...http } = opts;
+  ensureFresh(resolved, deps, env) {
     return ensureFreshCredential(resolved, {
       config: this.config,
       store: this.store,
       env
-    }, http);
+    }, deps);
   }
   /**
   * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts"],"sourcesContent":["import {\n  ensureFreshCredential,\n  openaiDeviceLogin,\n  persistOAuthTokens,\n} from '@theokit/sdk/auth'\nimport type {\n  CredentialStoreConfig,\n  OAuthProviderConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n  ResolvedCredential,\n} from '@theokit/sdk/auth'\n\n/**\n * M60 — `AuthProvider`, the OO contract that unifies the SDK's free OAuth-lifecycle functions\n * (`openaiDeviceLogin` → `persistOAuthTokens` → `ensureFreshCredential`). Those are stateful across a\n * SHARED `config` (`OAuthProviderConfig`) + `store` (`CredentialStoreConfig`); this class holds that\n * state so a consumer authors `new AuthProvider(config, store).persist(...)` / `.ensureFresh(...)`\n * instead of threading `config`/`store` through every call — the `SDK → Theokit → AgentBuilder`\n * boundary applied to the auth domain (ENRICH, per blueprint D2: auth carries orchestration + state).\n *\n * It DELEGATES, never reimplements (parsimony Rung 9): each method forwards verbatim to the SDK\n * function, so login → persist → refresh produces byte-identical state to calling the SDK directly.\n *\n * SECRET-SAFETY (hard rule): this class NEVER logs, stringifies, or otherwise surfaces token material.\n * Methods return exactly what the SDK returns and add no observability — a token is data that flows\n * through, never something this layer emits. The parity/secret tests pin both properties.\n */\n\n/** The HTTP deps of `ensureFreshCredential` (`{ fetch, now }`) — typed off the SDK to avoid drift. */\ntype EnsureFreshHttpDeps = Parameters<typeof ensureFreshCredential>[2]\n/** The device-flow deps + prompt hook of `openaiDeviceLogin` — typed off the SDK. */\ntype DeviceLoginDeps = Parameters<typeof openaiDeviceLogin>[1]\ntype DeviceLoginHooks = Parameters<typeof openaiDeviceLogin>[2]\n\nexport class AuthProvider {\n  constructor(\n    private readonly config: OAuthProviderConfig,\n    private readonly store: CredentialStoreConfig,\n  ) {}\n\n  /**\n   * Refresh a resolved credential if stale. Delegates to `ensureFreshCredential` with the held\n   * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps\n   * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.\n   */\n  ensureFresh(\n    resolved: ResolvedCredential,\n    opts: EnsureFreshHttpDeps & { env?: Record<string, string | undefined> },\n  ): Promise<ResolvedCredential> {\n    const { env, ...http } = opts\n    return ensureFreshCredential(resolved, { config: this.config, store: this.store, env }, http)\n  }\n\n  /**\n   * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the\n   * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the\n   * refresh `config`. Returns `OAuthTokens` — the caller persists them via {@link AuthProvider.persist}.\n   */\n  deviceLogin(\n    deviceConfig: OpenAIDeviceConfig,\n    deps: DeviceLoginDeps,\n    hooks: DeviceLoginHooks,\n  ): Promise<OAuthTokens> {\n    return openaiDeviceLogin(deviceConfig, deps, hooks)\n  }\n\n  /**\n   * Persist freshly-obtained tokens through the held `store`. Delegates to `persistOAuthTokens` and\n   * returns the credential-file path (never the token). `env` selects the store's home override.\n   */\n  persist(\n    provider: string,\n    tokens: OAuthTokens,\n    env?: Record<string, string | undefined>,\n  ): string {\n    return persistOAuthTokens(provider, tokens, this.store, env)\n  }\n}\n"],"mappings":";;;;;AAAA,SACEA,uBACAC,mBACAC,0BACK;AA+BA,IAAMC,eAAN,MAAMA;EAnCb,OAmCaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOHC,YACEC,UACAC,MAC6B;AAC7B,UAAM,EAAEC,KAAK,GAAGC,KAAAA,IAASF;AACzB,WAAOG,sBAAsBJ,UAAU;MAAEH,QAAQ,KAAKA;MAAQC,OAAO,KAAKA;MAAOI;IAAI,GAAGC,IAAAA;EAC1F;;;;;;EAOAE,YACEC,cACAC,MACAC,OACsB;AACtB,WAAOC,kBAAkBH,cAAcC,MAAMC,KAAAA;EAC/C;;;;;EAMAE,QACEC,UACAC,QACAV,KACQ;AACR,WAAOW,mBAAmBF,UAAUC,QAAQ,KAAKd,OAAOI,GAAAA;EAC1D;AACF;","names":["ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","AuthProvider","config","store","ensureFresh","resolved","opts","env","http","ensureFreshCredential","deviceLogin","deviceConfig","deps","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts"],"sourcesContent":["import { ensureFreshCredential, openaiDeviceLogin, persistOAuthTokens } from '@theokit/sdk/auth'\nimport type {\n  CredentialStoreConfig,\n  OAuthProviderConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n  ResolvedCredential,\n} from '@theokit/sdk/auth'\n\n/**\n * M60 — `AuthProvider`, the OO contract that unifies the SDK's free OAuth-lifecycle functions\n * (`openaiDeviceLogin` → `persistOAuthTokens` → `ensureFreshCredential`). Those are stateful across a\n * SHARED `config` (`OAuthProviderConfig`) + `store` (`CredentialStoreConfig`); this class holds that\n * state so a consumer authors `new AuthProvider(config, store).persist(...)` / `.ensureFresh(...)`\n * instead of threading `config`/`store` through every call — the `SDK → Theokit → AgentBuilder`\n * boundary applied to the auth domain (ENRICH, per blueprint D2: auth carries orchestration + state).\n *\n * It DELEGATES, never reimplements (parsimony Rung 9): each method forwards verbatim to the SDK\n * function, so login → persist → refresh produces byte-identical state to calling the SDK directly.\n *\n * SECRET-SAFETY (hard rule): this class NEVER logs, stringifies, or otherwise surfaces token material.\n * Methods return exactly what the SDK returns and add no observability — a token is data that flows\n * through, never something this layer emits. The parity/secret tests pin both properties.\n */\n\n/** The HTTP deps of `ensureFreshCredential` (`{ fetch, now }`) — typed off the SDK to avoid drift. */\ntype EnsureFreshHttpDeps = Parameters<typeof ensureFreshCredential>[2]\n/** The device-flow deps + prompt hook of `openaiDeviceLogin` — typed off the SDK. */\ntype DeviceLoginDeps = Parameters<typeof openaiDeviceLogin>[1]\ntype DeviceLoginHooks = Parameters<typeof openaiDeviceLogin>[2]\n\nexport class AuthProvider {\n  constructor(\n    private readonly config: OAuthProviderConfig,\n    private readonly store: CredentialStoreConfig,\n  ) {}\n\n  /**\n   * Refresh a resolved credential if stale. Delegates to `ensureFreshCredential` with the held\n   * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps\n   * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.\n   */\n  ensureFresh(\n    resolved: ResolvedCredential,\n    deps: EnsureFreshHttpDeps,\n    env?: Record<string, string | undefined>,\n  ): Promise<ResolvedCredential> {\n    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- `CredentialStoreConfig` (SDK `/auth` subpath) resolves under tsc (root typecheck is clean) but eslint's type-aware project reads `this.store` as error-typed; the assignment is type-safe per tsc.\n    return ensureFreshCredential(resolved, { config: this.config, store: this.store, env }, deps)\n  }\n\n  /**\n   * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the\n   * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the\n   * refresh `config`. Returns `OAuthTokens` — the caller persists them via {@link AuthProvider.persist}.\n   */\n  deviceLogin(\n    deviceConfig: OpenAIDeviceConfig,\n    deps: DeviceLoginDeps,\n    hooks: DeviceLoginHooks,\n  ): Promise<OAuthTokens> {\n    return openaiDeviceLogin(deviceConfig, deps, hooks)\n  }\n\n  /**\n   * Persist freshly-obtained tokens through the held `store`. Delegates to `persistOAuthTokens` and\n   * returns the credential-file path (never the token). `env` selects the store's home override.\n   */\n  persist(provider: string, tokens: OAuthTokens, env?: Record<string, string | undefined>): string {\n    return persistOAuthTokens(provider, tokens, this.store, env)\n  }\n}\n"],"mappings":";;;;;AAAA,SAASA,uBAAuBC,mBAAmBC,0BAA0B;AA+BtE,IAAMC,eAAN,MAAMA;EA/Bb,OA+BaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOHC,YACEC,UACAC,MACAC,KAC6B;AAE7B,WAAOC,sBAAsBH,UAAU;MAAEH,QAAQ,KAAKA;MAAQC,OAAO,KAAKA;MAAOI;IAAI,GAAGD,IAAAA;EAC1F;;;;;;EAOAG,YACEC,cACAJ,MACAK,OACsB;AACtB,WAAOC,kBAAkBF,cAAcJ,MAAMK,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBR,KAAkD;AAC/F,WAAOS,mBAAmBF,UAAUC,QAAQ,KAAKZ,OAAOI,GAAAA;EAC1D;AACF;","names":["ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","AuthProvider","config","store","ensureFresh","resolved","deps","env","ensureFreshCredential","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/agents",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "description": "AI agents as first-class citizens of the TheoKit pipeline. The fluent agent()/tool() builders compile to SDK Agent.create() (M31 builder-only authoring API).",
   "type": "module",
   "sideEffects": false,
@@ -73,8 +73,8 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.6",
     "zod": "^4.4.3",
-    "@theokit/presenter": "0.3.0",
-    "@theokit/http": "1.0.0"
+    "@theokit/http": "1.0.0",
+    "@theokit/presenter": "0.3.0"
   },
   "engines": {
     "node": ">=22.12.0"