@theokit/agents 7.3.1 → 7.4.1

package/dist/{agent-handle-tgyu8J7q.d.ts → agent-handle-BX4oFqfb.d.ts}

@@ -85,20 +85,20 @@ interface InProcessTransportOptions {
  * `sendMessages` promise — whereas `HttpTransport` throws from `sendMessages` on a non-2xx response.
  */
 /**
- * Uma aprovação estacionada foi descartada porque o turno terminou sem decisão.
+ * A parked approval was discarded because the turn ended with no decision.
  *
- * M92 — tipado de propósito. Antes a promessa simplesmente **nunca** resolvia, e a chamada de tool do
- * SDK pendurava; `resolve(false)` seria pior ainda, porque é indistinguível de "o usuário negou".
+ * M92 — typed on purpose. Before, the promise simply **never** settled and the SDK tool call hung;
+ * `resolve(false)` would be worse still, because it is indistinguishable from "the user denied".
  */
 declare class ApprovalAbortedError extends Error {
     readonly approvalId: string;
-    constructor(approvalId: string, motivo: string);
+    constructor(approvalId: string, reason: string);
 }
 declare class InProcessTransport implements AgentTransport {
     #private;
     constructor(options: InProcessTransportOptions);
-    /** Quantas aprovações estão estacionadas. Existe para o teste poder provar a eviction. */
-    get pendentes(): number;
+    /** How many approvals are parked. Exists so the test can prove the eviction. */
+    get pending(): number;
     sendMessages(options: Parameters<WireTransport['sendMessages']>[0]): Promise<ReadableStream<WireChunk>>;
     reconnectToStream(): Promise<ReadableStream<WireChunk> | null>;
     approve(approvalId: string, decision: ApprovalDecision): Promise<void>;
@@ -181,14 +181,14 @@ interface AgentClientState {
  * framework-agnostic, it is unit-tested without a DOM.
  */
 /**
- * M92 — opções do cliente. Aditivo: sem elas, o comportamento é o de sempre.
+ * M92 — client options. Additive: without them, the behaviour is exactly as before.
  */
 interface AgentClientOptions {
     /**
-     * Janela de coalescing em ms. `0` ou ausente = emite por delta de token (comportamento pré-M92).
+     * Coalescing window in ms. `0` or absent = emit per token delta (the pre-M92 behaviour).
      *
-     * Opt-in de propósito: este é um pacote publicado, e mudar a frequência de emit por padrão mudaria o
-     * comportamento observável de quem conta emits ou depende da latência do primeiro token.
+     * Opt-in on purpose: this is a published package, and changing the emit frequency by default would
+     * change the observable behaviour of anyone counting emits or depending on first-token latency.
      */
     readonly emitIntervalMs?: number;
 }

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import { OAuthProviderConfig, CredentialStoreConfig, ResolvedCredential, ensureFreshCredential, OpenAIDeviceConfig, openaiDeviceLogin, OAuthTokens, DeviceDeps } from '@theokit/sdk/auth';
-export { CredentialError, CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolveCredentialOptions, ResolvedCredential, authFilePath, credentialHome, deviceLogin, openaiDeviceLogin, pollDeviceToken, readAuthFile, readStoredOAuth, requestDeviceCode, writeCredential } from '@theokit/sdk/auth';
+export { CredentialError, CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolveCredentialOptions, ResolvedCredential, authFilePath, credentialHome, deviceLogin, ensureFreshCredential, extractAccountId, openaiDeviceLogin, persistOAuthTokens, pollDeviceToken, readAuthFile, readStoredOAuth, refreshOAuthTokens, requestDeviceCode, writeCredential } from '@theokit/sdk/auth';
 
 /**
  * M60 — `AuthProvider`, the OO contract that unifies the SDK's free OAuth-lifecycle functions
@@ -31,16 +31,17 @@ declare class AuthProvider {
      * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.
      */
     ensureFresh(resolved: ResolvedCredential, deps: EnsureFreshHttpDeps, env?: Record<string, string | undefined>): Promise<ResolvedCredential>;
-    /** Refresh em voo por caminho de store — a chave é o arquivo, não a instância. */
-    private static readonly refreshEmVoo;
+    /** In-flight refresh per store path — the key is the file, not the instance. */
+    private static readonly refreshInFlight;
     /**
-     * O refresh propriamente dito, serializado entre PROCESSOS e com re-leitura.
+     * The refresh itself, serialized across PROCESSES and with a re-read.
      *
-     * A re-leitura não é detalhe: sem ela o lock apenas serializa, e o segundo processo decide com o
-     * estado que leu ANTES de esperar — refrescando de novo e invalidando o token que o primeiro acabou
-     * de gravar. É o double-checked locking clássico, e é o que o teste de dois processos pega.
+     * The re-read is not a detail: without it the lock merely serializes, and the second process
+     * decides using the state it read BEFORE waiting — refreshing again and invalidating the token the
+     * first one just wrote. It is classic double-checked locking, and it is what the two-process test
+     * catches.
      */
-    private refrescarSobLock;
+    private refreshUnderLock;
     /**
      * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the
      * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the
@@ -55,60 +56,61 @@ declare class AuthProvider {
 }
 
 /**
- * M111 — device auth plug-and-play: um provider é um objeto com métodos ROTULADOS, e um login cabe
- * numa chamada.
+ * M111 — device auth plug-and-play: a provider is an object with LABELLED methods, and a login fits
+ * in one call.
  *
- * ## O problema, medido
+ * ## The problem, measured
  *
- * O M110 fez o device flow RFC 8628 atravessar esta camada. Ele não tocou a ergonomia: para
- * autenticar no Codex, o consumidor precisava saber que existem **duas** formas de device flow,
- * copiar um `clientId` e três URLs da OpenAI para dentro do próprio código, montar
- * `{ fetch, sleep, now }`, chamar `deviceLogin` e **lembrar** de chamar `persist` — e esquecer o
- * último custa um round-trip OAuth completo que não guarda nada. O docblock de `AuthProvider`
- * instruía exatamente isso: *"the caller persists them via `AuthProvider.persist`"*.
+ * M110 made the RFC 8628 device flow cross this layer. It did not touch the ergonomics: to
+ * authenticate against Codex, the consumer had to know that **two** device-flow shapes exist, copy a
+ * `clientId` and three OpenAI URLs into its own code, assemble `{ fetch, sleep, now }`, call
+ * `deviceLogin` and **remember** to call `persist` — and forgetting the last one costs a full OAuth
+ * round-trip that stores nothing. The `AuthProvider` docblock instructed exactly that:
+ * *"the caller persists them via `AuthProvider.persist`"*.
  *
- * ## O desenho veio de medição contra três peers, e refutou a proposta original
+ * ## The design came from measuring three peers, and it refuted the original proposal
  *
- * - **`codex`** — `codex-rs/login/src/device_code_auth.rs:234` tem `run_device_code_login`, que
- *   retorna `()`: **nada** sai para o chamador persistir, e as duas metades granulares continuam
- *   públicas. `loginWithDevice` é a cópia dessa forma.
- * - **`opencode`** — cada provider é um objeto com `methods: [{ label, type, authorize }]`, e três
- *   providers escritos por autores diferentes convergem em **3 métodos rotulados** cada. O rótulo é o
- *   que a UI mostra: transforma escolha de protocolo em escolha de frase legível.
- * - **REJEITADO — discriminante `kind`.** Nenhum dos três discrimina protocolo por campo. A medição
- *   que fecha o caso: no `opencode`, browser e headless do Codex carregam o **mesmo** `type: 'oauth'`
- *   — logo o `type` classifica **espécie de credencial**, não protocolo. Um `kind` com despacho
- *   interno seria um `switch`, exatamente o defeito que este milestone remove do consumidor.
- *   Aqui, cada método aponta para a **sua própria** função.
+ * - **`codex`** — `codex-rs/login/src/device_code_auth.rs:234` has `run_device_code_login`, which
+ *   returns `()`: **nothing** comes out for the caller to persist, and the two granular halves stay
+ *   public. `loginWithDevice` copies that shape.
+ * - **`opencode`** — every provider is an object with `methods: [{ label, type, authorize }]`, and
+ *   three providers written by different authors converge on **3 labelled methods** each. The label
+ *   is what the UI shows: it turns a protocol choice into a choice between readable phrases.
+ * - **REJECTED — a `kind` discriminant.** None of the three discriminates protocol by field. The
+ *   measurement that closes the case: in `opencode`, Codex's browser and headless methods carry the
+ *   **same** `type: 'oauth'` — so `type` classifies the **kind of credential**, not the protocol. A
+ *   `kind` with internal dispatch would be a `switch`, exactly the defect this milestone removes
+ *   from the consumer. Here, each method points at **its own** function.
  *
- * ## Por que a identidade pública mora AQUI
+ * ## Why the public identity lives HERE
  *
- * `codex` exporta `CLIENT_ID` do crate que implementa o flow (`login/src/lib.rs:32`) e o CLI o
- * **importa**; o `opencode` o declara dentro do plugin. Os dois chegaram ao mesmo lugar
- * independentemente — e com o mesmo valor que o consumidor tinha copiado. Enquanto morasse no
- * consumidor, todo projeto que quisesse Codex copiaria quatro constantes públicas: é violação de DRY
- * através da fronteira, com dois donos do mesmo fato.
+ * `codex` exports `CLIENT_ID` from the crate that implements the flow (`login/src/lib.rs:32`) and
+ * the CLI **imports** it; `opencode` declares it inside the plugin. The two arrived at the same
+ * place independently — and with the same value the consumer had copied. As long as it lived in the
+ * consumer, every project wanting Codex would copy four public constants: a DRY violation across the
+ * boundary, with two owners of the same fact.
  */
 /**
- * Uma forma rotulada de obter credencial dentro de um provider.
+ * A labelled way of obtaining a credential within a provider.
  *
- * UNIÃO DISCRIMINADA, não um campo `authorize?` opcional. Com opcional, `{ label, type: 'oauth' }`
- * seria representável — um método OAuth que não sabe autorizar, detectado só em runtime, no meio do
- * login do usuário. É a alternativa que o M110 já rejeitou por escrito ao recusar "um tipo só com
- * campos opcionais": tornaria representável um config inválido e moveria a detecção do compilador
+ * A DISCRIMINATED UNION, not an optional `authorize?` field. With an optional field,
+ * `{ label, type: 'oauth' }` would be representable — an OAuth method that cannot authorize,
+ * detected only at runtime, in the middle of the user's login. It is the alternative M110 already
+ * rejected in writing when it refused "one type with optional fields": it would make an invalid
+ * config representable and move detection out of the compiler
  * para o runtime.
  */
 type AuthMethod = {
-    /** O que a interface mostra ao usuário. É a peça que torna o fluxo escolhível sem saber o protocolo. */
+    /** What the interface shows the user. The piece that makes the flow choosable without knowing the protocol. */
     readonly label: string;
     readonly type: 'oauth';
-    /** A função DESTE método. Sem discriminante: o método aponta para a sua, não para um `switch`. */
+    /** THIS method's function. No discriminant: the method points at its own, not at a `switch`. */
     readonly authorize: (deps: DeviceDeps, hooks: PromptHooks) => Promise<OAuthTokens>;
 } | {
     readonly label: string;
     readonly type: 'api';
 };
-/** O que o consumidor liga à sua UI para mostrar o código que o usuário digita no outro dispositivo. */
+/** What the consumer wires into its UI to show the code the user types on the other device. */
 interface PromptHooks {
     onPrompt: (p: {
         userCode: string;
@@ -116,50 +118,50 @@ interface PromptHooks {
         expiresIn?: number;
     }) => void;
 }
-/** Um provider de autenticação: identidade pública + as formas rotuladas de autenticar nele. */
+/** An authentication provider: public identity + the labelled ways of authenticating with it. */
 interface DeviceAuthProvider {
     readonly name: string;
     readonly oauth: OAuthProviderConfig;
     readonly methods: readonly AuthMethod[];
 }
 /**
- * Override do `clientId` por ambiente — adotado do `codex`, que exporta `CLIENT_ID` **e**
- * `CLIENT_ID_OVERRIDE_ENV_VAR` (`login/src/lib.rs:32-33`). Dissolve o falso dilema entre constante
- * fixa (inflexível) e parâmetro obrigatório (que devolve a cópia ao consumidor): default no pacote,
- * escape para quem precisa.
+ * Environment override for `clientId` — adopted from `codex`, which exports `CLIENT_ID` **and**
+ * `CLIENT_ID_OVERRIDE_ENV_VAR` (`login/src/lib.rs:32-33`). It dissolves the false dilemma between a
+ * fixed constant (inflexible) and a mandatory parameter (which hands the copy back to the consumer):
+ * a default in the package, an escape for whoever needs one.
  */
 declare const CODEX_CLIENT_ID_ENV_VAR = "THEOKIT_CODEX_CLIENT_ID";
 /**
- * O provider do Codex, montado e **congelado**.
+ * The Codex provider, assembled and **frozen**.
  *
- * Congelado porque é identidade pública COMPARTILHADA no processo: um consumidor que a mutasse
- * mudaria o login de todos os outros. `Object.freeze` é raso, então a lista de métodos é congelada
- * separadamente — sem isso, `CODEX_PROVIDER.methods.push(...)` passaria.
+ * Frozen because it is a public identity SHARED across the process: a consumer that mutated it
+ * would change everyone else's login. `Object.freeze` is shallow, so the method list is frozen
+ * separately — without that, `CODEX_PROVIDER.methods.push(...)` would go through.
  */
 declare const CODEX_PROVIDER: DeviceAuthProvider;
 /**
- * Opções do Facade. `deps` e `env` viajam juntos num objeto em vez de dois parâmetros posicionais:
- * ambos são opcionais e raramente usados, e seis posicionais é assinatura que o chamador erra em
- * silêncio (o lint do monorepo cobra 5 como teto — o teto existe por este motivo).
+ * Facade options. `deps` and `env` travel together in one object rather than as two positional
+ * parameters: both are optional and rarely used, and six positionals is a signature callers get
+ * wrong in silence (the monorepo lint enforces 5 as the ceiling — the ceiling exists for this reason).
  */
 interface LoginWithDeviceOptions {
-    /** Injeção de I/O para teste. Omitido, usa `fetch`/`setTimeout`/`Date.now` reais. */
+    /** I/O injection for tests. Omitted, it uses the real `fetch`/`setTimeout`/`Date.now`. */
     readonly deps?: Partial<DeviceDeps>;
-    /** Ambiente lido pelo store para resolver o diretório da credencial. */
+    /** The environment the store reads to resolve the credential directory. */
     readonly env?: Record<string, string | undefined>;
 }
 /**
- * Autoriza **e** persiste, numa chamada. Devolve onde a credencial ficou e a conta atribuída —
- * **nunca** material de token.
+ * Authorizes **and** persists, in one call. Returns where the credential landed and the account it
+ * was attributed to — **never** token material.
  *
- * A forma vem de `run_device_code_login` (`codex`), que retorna `()`: se nada sai para o chamador,
- * não há passo que ele possa esquecer. As duas metades continuam públicas em `AuthProvider`
- * (`deviceLogin` / `persist`) para quem precisa da granularidade — mesma escolha que o `codex` faz ao
- * manter `request_device_code` e `complete_device_code_login` públicas ao lado do Facade.
+ * The shape comes from `run_device_code_login` (`codex`), which returns `()`: if nothing comes out
+ * for the caller, there is no step it can forget. The two halves stay public on `AuthProvider`
+ * (`deviceLogin` / `persist`) for whoever needs the granularity — the same choice `codex` makes by
+ * keeping `request_device_code` and `complete_device_code_login` public alongside the facade.
  *
- * Delega verbatim: `method.authorize` roda o flow e `AuthProvider.persist` grava. Copiar a sequência
- * em vez de chamá-la criaria um segundo oráculo sobre o mesmo fato, e dois oráculos divergem no
- * primeiro fix aplicado a um lado só.
+ * It delegates verbatim: `method.authorize` runs the flow and `AuthProvider.persist` writes. Copying
+ * the sequence instead of calling it would create a second oracle over the same fact, and two oracles
+ * diverge on the first fix applied to only one side.
  */
 declare function loginWithDevice(provider: DeviceAuthProvider, method: AuthMethod, store: CredentialStoreConfig, hooks: PromptHooks, opts?: LoginWithDeviceOptions): Promise<{
     path: string;

package/dist/auth.js

@@ -1,21 +1,21 @@
-import {
-  __name
-} from "./chunk-Z4QWC7IK.js";
-
 // src/auth/auth-provider.ts
-import { authFilePath, ensureFreshCredential, openaiDeviceLogin, persistOAuthTokens, readStoredOAuth } from "@theokit/sdk/auth";
+import {
+  authFilePath,
+  ensureFreshCredential,
+  openaiDeviceLogin,
+  persistOAuthTokens,
+  readStoredOAuth
+} from "@theokit/sdk/auth";
 import { withFileLock } from "@theokit/sdk/persistence";
 var RefreshFailure = class extends Error {
-  static {
-    __name(this, "RefreshFailure");
-  }
-  transitorio;
-  constructor(message, transitorio) {
-    super(message), this.transitorio = transitorio;
+  constructor(message, transient) {
+    super(message);
+    this.transient = transient;
     this.name = "RefreshFailure";
   }
+  transient;
 };
-var MOTIVOS_TRANSITORIOS = [
+var TRANSIENT_REASONS = [
   "ETIMEDOUT",
   "ECONNRESET",
   "ECONNREFUSED",
@@ -23,107 +23,119 @@ var MOTIVOS_TRANSITORIOS = [
   "ENOTFOUND",
   "AbortError"
 ];
-function classificarFalhaDeRefresh(err) {
-  const texto = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
-  if (/invalid_grant|invalid_request|unauthorized_client/i.test(texto)) {
-    return new RefreshFailure("o refresh token n\xE3o \xE9 mais v\xE1lido \u2014 refa\xE7a o login. Tentar de novo n\xE3o muda o resultado.", false);
+function classifyRefreshFailure(err) {
+  const text = err instanceof Error ? `${err.name}: ${err.message}` : String(err);
+  if (/invalid_grant|invalid_request|unauthorized_client/i.test(text)) {
+    return new RefreshFailure(
+      "the refresh token is no longer valid \u2014 log in again. Retrying does not change the outcome.",
+      false
+    );
   }
-  const transitorio = MOTIVOS_TRANSITORIOS.some((m) => texto.includes(m)) || /\b(5\d{2})\b|timeout|network/i.test(texto);
-  return new RefreshFailure(transitorio ? "falha transit\xF3ria ao refrescar a credencial" : "falha ao refrescar a credencial", transitorio);
+  const transient = TRANSIENT_REASONS.some((m) => text.includes(m)) || /\b(5\d{2})\b|timeout|network/i.test(text);
+  return new RefreshFailure(
+    transient ? "transient failure refreshing the credential" : "failure refreshing the credential",
+    transient
+  );
 }
-__name(classificarFalhaDeRefresh, "classificarFalhaDeRefresh");
-function esperaComJitter(tentativa, baseMs = 200, aleatorio = Math.random) {
-  const base = baseMs * 2 ** tentativa;
-  return Math.round(base * (0.75 + aleatorio() * 0.5));
+function waitWithJitter(attempt, baseMs = 200, random = Math.random) {
+  const base = baseMs * 2 ** attempt;
+  return Math.round(base * (0.75 + random() * 0.5));
 }
-__name(esperaComJitter, "esperaComJitter");
 var AuthProvider = class _AuthProvider {
-  static {
-    __name(this, "AuthProvider");
-  }
-  config;
-  store;
   constructor(config, store) {
     this.config = config;
     this.store = store;
   }
+  config;
+  store;
   /**
-  * Refresh a resolved credential if stale. Delegates to `ensureFreshCredential` with the held
-  * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps
-  * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.
-  */
+   * Refresh a resolved credential if stale. Delegates to `ensureFreshCredential` with the held
+   * `config` + `store`; `env` (for reading the store's env overrides) + the `{ fetch, now }` HTTP deps
+   * thread through. Returns the fresh `ResolvedCredential` — never logs the rotated token.
+   */
   async ensureFresh(resolved, deps, env) {
     if (resolved.kind !== "oauth") {
-      return ensureFreshCredential(resolved, {
-        config: this.config,
-        store: this.store,
-        env
-      }, deps);
+      return ensureFreshCredential(resolved, { config: this.config, store: this.store, env }, deps);
     }
-    const caminho = authFilePath(this.store, env);
-    const emVoo = _AuthProvider.refreshEmVoo.get(caminho);
-    if (emVoo !== void 0) return emVoo;
-    const promessa = this.refrescarSobLock(caminho, resolved, deps, env);
-    _AuthProvider.refreshEmVoo.set(caminho, promessa);
+    const filePath = authFilePath(this.store, env);
+    const inFlight = _AuthProvider.refreshInFlight.get(filePath);
+    if (inFlight !== void 0) return inFlight;
+    const promise = this.refreshUnderLock(filePath, resolved, deps, env);
+    _AuthProvider.refreshInFlight.set(filePath, promise);
     try {
-      return await promessa;
+      return await promise;
     } finally {
-      _AuthProvider.refreshEmVoo.delete(caminho);
+      _AuthProvider.refreshInFlight.delete(filePath);
     }
   }
-  /** Refresh em voo por caminho de store — a chave é o arquivo, não a instância. */
-  static refreshEmVoo = /* @__PURE__ */ new Map();
+  /** In-flight refresh per store path — the key is the file, not the instance. */
+  static refreshInFlight = /* @__PURE__ */ new Map();
   /**
-  * O refresh propriamente dito, serializado entre PROCESSOS e com re-leitura.
-  *
-  * A re-leitura não é detalhe: sem ela o lock apenas serializa, e o segundo processo decide com o
-  * estado que leu ANTES de esperar — refrescando de novo e invalidando o token que o primeiro acabou
-  * de gravar. É o double-checked locking clássico, e é o que o teste de dois processos pega.
-  */
-  refrescarSobLock(caminho, resolved, deps, env) {
-    return withFileLock(caminho, async () => {
+   * The refresh itself, serialized across PROCESSES and with a re-read.
+   *
+   * The re-read is not a detail: without it the lock merely serializes, and the second process
+   * decides using the state it read BEFORE waiting — refreshing again and invalidating the token the
+   * first one just wrote. It is classic double-checked locking, and it is what the two-process test
+   * catches.
+   */
+  refreshUnderLock(filePath, resolved, deps, env) {
+    return withFileLock(filePath, async () => {
       const doDisco = readStoredOAuth(this.store, env);
-      const atual = doDisco !== void 0 ? {
-        ...resolved,
-        apiKey: doDisco.access,
-        expiresAt: doDisco.expires
-      } : resolved;
-      const MAX_TENTATIVAS = 3;
-      for (let tentativa = 0; ; tentativa++) {
+      const current = doDisco !== void 0 ? { ...resolved, apiKey: doDisco.access, expiresAt: doDisco.expires } : resolved;
+      const MAX_ATTEMPTS = 3;
+      for (let attempt = 0; ; attempt++) {
         try {
-          return await ensureFreshCredential(atual, {
-            config: this.config,
-            store: this.store,
-            env
-          }, deps);
+          return await ensureFreshCredential(
+            current,
+            { config: this.config, store: this.store, env },
+            deps
+          );
         } catch (err) {
-          const falha = classificarFalhaDeRefresh(err);
-          if (!falha.transitorio || tentativa >= MAX_TENTATIVAS - 1) throw falha;
-          await new Promise((resolve) => setTimeout(resolve, esperaComJitter(tentativa)));
+          const failure = classifyRefreshFailure(err);
+          if (!failure.transient || attempt >= MAX_ATTEMPTS - 1) throw failure;
+          await new Promise((resolve) => setTimeout(resolve, waitWithJitter(attempt)));
         }
       }
     });
   }
   /**
-  * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the
-  * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the
-  * refresh `config`. Returns `OAuthTokens` — the caller persists them via {@link AuthProvider.persist}.
-  */
+   * Run the headless OpenAI device-login flow. Delegates to `openaiDeviceLogin` (which JWT-extracts the
+   * account id). `deviceConfig` is passed per-call because it is a distinct endpoint set from the
+   * refresh `config`. Returns `OAuthTokens` — the caller persists them via {@link AuthProvider.persist}.
+   */
   deviceLogin(deviceConfig, deps, hooks) {
     return openaiDeviceLogin(deviceConfig, deps, hooks);
   }
   /**
-  * Persist freshly-obtained tokens through the held `store`. Delegates to `persistOAuthTokens` and
-  * returns the credential-file path (never the token). `env` selects the store's home override.
-  */
+   * Persist freshly-obtained tokens through the held `store`. Delegates to `persistOAuthTokens` and
+   * returns the credential-file path (never the token). `env` selects the store's home override.
+   */
   persist(provider, tokens, env) {
     return persistOAuthTokens(provider, tokens, this.store, env);
   }
 };
 
 // src/auth-entry.ts
-import { authFilePath as authFilePath2, CredentialError, credentialHome, readAuthFile, readStoredOAuth as readStoredOAuth2, writeCredential } from "@theokit/sdk/auth";
-import { deviceLogin, openaiDeviceLogin as openaiDeviceLogin3, pollDeviceToken, requestDeviceCode } from "@theokit/sdk/auth";
+import {
+  authFilePath as authFilePath2,
+  CredentialError,
+  credentialHome,
+  readAuthFile,
+  readStoredOAuth as readStoredOAuth2,
+  writeCredential
+} from "@theokit/sdk/auth";
+import {
+  deviceLogin,
+  openaiDeviceLogin as openaiDeviceLogin3,
+  pollDeviceToken,
+  requestDeviceCode
+} from "@theokit/sdk/auth";
+import {
+  ensureFreshCredential as ensureFreshCredential2,
+  extractAccountId,
+  persistOAuthTokens as persistOAuthTokens2,
+  refreshOAuthTokens
+} from "@theokit/sdk/auth";
 
 // src/auth/device-provider.ts
 import { openaiDeviceLogin as openaiDeviceLogin2 } from "@theokit/sdk/auth";
@@ -135,12 +147,7 @@ var CODEX_OAUTH = {
   clientId: process.env[CODEX_CLIENT_ID_ENV_VAR] ?? CODEX_CLIENT_ID,
   authorizeEndpoint: `${CODEX_ISSUER}/oauth/authorize`,
   tokenEndpoint: `${CODEX_ISSUER}/oauth/token`,
-  scopes: [
-    "openid",
-    "profile",
-    "email",
-    "offline_access"
-  ],
+  scopes: ["openid", "profile", "email", "offline_access"],
   redirectUri: `${CODEX_ISSUER}/deviceauth/callback`
 };
 var CODEX_DEVICE = {
@@ -156,9 +163,9 @@ var CODEX_PROVIDER = Object.freeze({
     Object.freeze({
       label: "ChatGPT Pro/Plus (headless device code)",
       type: "oauth",
-      // Aponta para a variante da OpenAI. Um provider RFC 8628 apontaria para `deviceLogin`, e é
-      // assim que as duas formas coexistem sem discriminante.
-      authorize: /* @__PURE__ */ __name((deps, hooks) => openaiDeviceLogin2(CODEX_DEVICE, deps, hooks), "authorize")
+      // Points at OpenAI's variant. An RFC 8628 provider would point at `deviceLogin`, and that is
+      // how the two shapes coexist with no discriminant.
+      authorize: (deps, hooks) => openaiDeviceLogin2(CODEX_DEVICE, deps, hooks)
     }),
     Object.freeze({
       label: "Manually enter API Key",
@@ -173,27 +180,24 @@ function comDefaults(deps) {
     now: deps?.now ?? Date.now
   };
 }
-__name(comDefaults, "comDefaults");
 async function loginWithDevice(provider, method, store, hooks, opts = {}) {
   if (provider.methods.length === 0) {
-    throw new TypeError(`o provider "${provider.name}" declara nenhum m\xE9todo de autentica\xE7\xE3o \u2014 n\xE3o h\xE1 o que escolher`);
+    throw new TypeError(
+      `provider "${provider.name}" declares no authentication method \u2014 there is nothing to choose`
+    );
   }
   if (!provider.methods.includes(method)) {
-    throw new TypeError(`o m\xE9todo "${method.label}" n\xE3o pertence ao provider "${provider.name}"`);
+    throw new TypeError(`method "${method.label}" does not belong to provider "${provider.name}"`);
   }
   if (method.type !== "oauth") {
-    throw new TypeError(`o m\xE9todo "${method.label}" \xE9 de chave (api key), n\xE3o \xE9 um m\xE9todo de device \u2014 use o caminho de chave`);
+    throw new TypeError(
+      `method "${method.label}" is an api-key method, not a device method \u2014 use the api-key path`
+    );
   }
   const tokens = await method.authorize(comDefaults(opts.deps), hooks);
   const path = new AuthProvider(provider.oauth, store).persist(provider.name, tokens, opts.env);
-  return tokens.accountId === void 0 ? {
-    path
-  } : {
-    path,
-    accountId: tokens.accountId
-  };
+  return tokens.accountId === void 0 ? { path } : { path, accountId: tokens.accountId };
 }
-__name(loginWithDevice, "loginWithDevice");
 export {
   AuthProvider,
   CODEX_CLIENT_ID_ENV_VAR,
@@ -202,11 +206,15 @@ export {
   authFilePath2 as authFilePath,
   credentialHome,
   deviceLogin,
+  ensureFreshCredential2 as ensureFreshCredential,
+  extractAccountId,
   loginWithDevice,
   openaiDeviceLogin3 as openaiDeviceLogin,
+  persistOAuthTokens2 as persistOAuthTokens,
   pollDeviceToken,
   readAuthFile,
   readStoredOAuth2 as readStoredOAuth,
+  refreshOAuthTokens,
   requestDeviceCode,
   writeCredential
 };

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts"],"mappings":";;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAiCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EA/CpC,OA+CoCA;;;;EAClC,YACEC,SAESC,aACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,cAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,uBAAuB;EAC3B;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,0BAA0BC,KAAY;AACpD,QAAMC,QAAQD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC5E,MAAI,qDAAqDG,KAAKF,KAAAA,GAAQ;AACpE,WAAO,IAAIR,eACT,gHACA,KAAA;EAEJ;AACA,QAAMG,cACJE,qBAAqBM,KAAK,CAACC,MAAMJ,MAAMK,SAASD,CAAAA,CAAAA,KAChD,gCAAgCF,KAAKF,KAAAA;AACvC,SAAO,IAAIR,eACTG,cAAc,mDAAgD,mCAC9DA,WAAAA;AAEJ;AAfgBG;AAkBT,SAASQ,gBAAgBC,WAAmBC,SAAS,KAAKC,YAAYC,KAAKC,QAAM;AACtF,QAAMC,OAAOJ,SAAS,KAAKD;AAC3B,SAAOG,KAAKG,MAAMD,QAAQ,OAAOH,UAAAA,IAAc,IAAE;AACnD;AAHgBH;AAKT,IAAMQ,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,UAAkBC,aAAa,KAAKR,OAAOI,GAAAA;AASjD,UAAMK,QAAQX,cAAaY,aAAaC,IAAIJ,OAAAA;AAC5C,QAAIE,UAAUG,OAAW,QAAOH;AAEhC,UAAMI,WAAW,KAAKC,iBAAiBP,SAASL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,aAAaK,IAAIR,SAASM,QAAAA;AACvC,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,aAAaM,OAAOT,OAAAA;IACnC;EACF;;EAGA,OAAwBG,eAAe,oBAAIO,IAAAA;;;;;;;;EASnCH,iBACNP,SACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,SAAS,YAAA;AAE3B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,QACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAON,YAAMwB,iBAAiB;AACvB,eAASnC,YAAY,KAAKA,aAAa;AACrC,YAAI;AACF,iBAAO,MAAMe,sBACXe,OACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASpB,KAAK;AACZ,gBAAM4C,QAAQ7C,0BAA0BC,GAAAA;AACxC,cAAI,CAAC4C,MAAMhD,eAAeY,aAAamC,iBAAiB,EAAG,OAAMC;AACjE,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAASvC,gBAAgBC,SAAAA,CAAAA,CAAAA;QACrE;MACF;IACF,CAAA;EAEF;;;;;;EAOAwC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACvLA,SACEmC,gBAAAA,eACAC,iBACAC,gBACAC,cACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;;;ACnDP,SAASC,qBAAAA,0BAAyB;AA2ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,eAAetC,SAASe,IAAI,qFAAiE;EAEjG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,gBAAaJ,OAAOhB,KAAK,kCAA+BlB,SAASe,IAAI,GAAG;EAC9F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,gBAAaJ,OAAOhB,KAAK,6FAA4E;EAEzG;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transitorio","name","MOTIVOS_TRANSITORIOS","classificarFalhaDeRefresh","err","texto","String","test","some","m","includes","esperaComJitter","tentativa","baseMs","aleatorio","Math","random","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","caminho","authFilePath","emVoo","refreshEmVoo","get","undefined","promessa","refrescarSobLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","atual","apiKey","access","expiresAt","expires","MAX_TENTATIVAS","falha","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,SAAS,oBAAoB;AAkCtB,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YACE,SAES,WACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EAJW;AAKb;AAMA,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,uBAAuB,KAA8B;AACnE,QAAM,OAAO,eAAe,QAAQ,GAAG,IAAI,IAAI,KAAK,IAAI,OAAO,KAAK,OAAO,GAAG;AAC9E,MAAI,qDAAqD,KAAK,IAAI,GAAG;AACnE,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YACJ,kBAAkB,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,KAAK,gCAAgC,KAAK,IAAI;AAC9F,SAAO,IAAI;AAAA,IACT,YAAY,gDAAgD;AAAA,IAC5D;AAAA,EACF;AACF;AAGO,SAAS,eAAe,SAAiB,SAAS,KAAK,SAAS,KAAK,QAAgB;AAC1F,QAAM,OAAO,SAAS,KAAK;AAC3B,SAAO,KAAK,MAAM,QAAQ,OAAO,OAAO,IAAI,IAAI;AAClD;AAEO,IAAM,eAAN,MAAM,cAAa;AAAA,EACxB,YACmB,QACA,OACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQnB,MAAM,YACJ,UACA,MACA,KAC6B;AAC7B,QAAI,SAAS,SAAS,SAAS;AAI7B,aAAO,sBAAsB,UAAU,EAAE,QAAQ,KAAK,QAAQ,OAAO,KAAK,OAAO,IAAI,GAAG,IAAI;AAAA,IAC9F;AAEA,UAAM,WAAmB,aAAa,KAAK,OAAO,GAAG;AAUrD,UAAM,WAAW,cAAa,gBAAgB,IAAI,QAAQ;AAC1D,QAAI,aAAa,OAAW,QAAO;AAEnC,UAAM,UAAU,KAAK,iBAAiB,UAAU,UAAU,MAAM,GAAG;AACnE,kBAAa,gBAAgB,IAAI,UAAU,OAAO;AAClD,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AACA,oBAAa,gBAAgB,OAAO,QAAQ;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA,EAGA,OAAwB,kBAAkB,oBAAI,IAAyC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU/E,iBACN,UACA,UACA,MACA,KAC6B;AAE7B,WAAO,aAAa,UAAU,YAAY;AAExC,YAAM,UAAU,gBAAgB,KAAK,OAAO,GAAG;AAC/C,YAAM,UACJ,YAAY,SACR,EAAE,GAAG,UAAU,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,QAAQ,IAClE;AAQN,YAAM,eAAe;AACrB,eAAS,UAAU,KAAK,WAAW;AACjC,YAAI;AACF,iBAAO,MAAM;AAAA,YACX;AAAA,YACA,EAAE,QAAQ,KAAK,QAAQ,OAAO,KAAK,OAAO,IAAI;AAAA,YAC9C;AAAA,UACF;AAAA,QACF,SAAS,KAAK;AACZ,gBAAM,UAAU,uBAAuB,GAAG;AAC1C,cAAI,CAAC,QAAQ,aAAa,WAAW,eAAe,EAAG,OAAM;AAC7D,gBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,eAAe,OAAO,CAAC,CAAC;AAAA,QAC7E;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YACE,cACA,MACA,OACsB;AACtB,WAAO,kBAAkB,cAAc,MAAM,KAAK;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,UAAkB,QAAqB,KAAkD;AAC/F,WAAO,mBAAmB,UAAU,QAAQ,KAAK,OAAO,GAAG;AAAA,EAC7D;AACF;;;ACzLA;AAAA,EACE,gBAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAAC;AAAA,EACA;AAAA,OACK;AAsBP;AAAA,EACE;AAAA,EACA,qBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAwBP;AAAA,EACE,yBAAAC;AAAA,EACA;AAAA,EACA,sBAAAC;AAAA,EACA;AAAA,OACK;;;ACjFP,SAAS,qBAAAC,0BAAyB;AA4ElC,IAAM,kBAAkB;AACxB,IAAM,eAAe;AAQd,IAAM,0BAA0B;AAEvC,IAAM,cAAmC;AAAA,EACvC,UAAU;AAAA,EACV,UAAU,QAAQ,IAAI,uBAAuB,KAAK;AAAA,EAClD,mBAAmB,GAAG,YAAY;AAAA,EAClC,eAAe,GAAG,YAAY;AAAA,EAC9B,QAAQ,CAAC,UAAU,WAAW,SAAS,gBAAgB;AAAA,EACvD,aAAa,GAAG,YAAY;AAC9B;AAMA,IAAM,eAAmC;AAAA,EACvC,GAAG;AAAA,EACH,wBAAwB,GAAG,YAAY;AAAA,EACvC,oBAAoB,GAAG,YAAY;AAAA,EACnC,iBAAiB,GAAG,YAAY;AAClC;AASO,IAAM,iBAAqC,OAAO,OAAO;AAAA,EAC9D,MAAM;AAAA,EACN,OAAO,OAAO,OAAO,WAAW;AAAA,EAChC,SAAS,OAAO,OAAO;AAAA,IACrB,OAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,MAAM;AAAA;AAAA;AAAA,MAGN,WAAW,CAAC,MAAkB,UAC5BC,mBAAkB,cAAc,MAAM,KAAK;AAAA,IAC/C,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,MACZ,OAAO;AAAA,MACP,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACH,CAAC;AAeD,SAAS,YAAY,MAAwC;AAC3D,SAAO;AAAA,IACL,OAAO,MAAM,SAAS;AAAA,IACtB,OAAO,MAAM,UAAU,CAAC,OAAe,IAAI,QAAc,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAAA,IAC7F,KAAK,MAAM,OAAO,KAAK;AAAA,EACzB;AACF;AAeA,eAAsB,gBACpB,UACA,QACA,OACA,OACA,OAA+B,CAAC,GACe;AAI/C,MAAI,SAAS,QAAQ,WAAW,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,aAAa,SAAS,IAAI;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,CAAC,SAAS,QAAQ,SAAS,MAAM,GAAG;AACtC,UAAM,IAAI,UAAU,WAAW,OAAO,KAAK,kCAAkC,SAAS,IAAI,GAAG;AAAA,EAC/F;AACA,MAAI,OAAO,SAAS,SAAS;AAC3B,UAAM,IAAI;AAAA,MACR,WAAW,OAAO,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,OAAO,UAAU,YAAY,KAAK,IAAI,GAAG,KAAK;AACnE,QAAM,OAAO,IAAI,aAAa,SAAS,OAAO,KAAK,EAAE,QAAQ,SAAS,MAAM,QAAQ,KAAK,GAAG;AAE5F,SAAO,OAAO,cAAc,SAAY,EAAE,KAAK,IAAI,EAAE,MAAM,WAAW,OAAO,UAAU;AACzF;","names":["authFilePath","readStoredOAuth","openaiDeviceLogin","ensureFreshCredential","persistOAuthTokens","openaiDeviceLogin","openaiDeviceLogin"]}