@theokit/agents 7.5.0 → 8.0.0

package/dist/{agent-handle-BX4oFqfb.d.ts → agent-handle-Dgi4ZGbg.d.ts}

@@ -1,4 +1,5 @@
 import { WireTransport, WireChunk, WireMessage } from '@theokit/presenter/wire';
+import { TheokitAgentError } from '@theokit/sdk/errors';
 
 /**
  * M41 (ADR-0050 D2) — a HITL approval decision sent to settle a paused gated-tool call. Mirrors the
@@ -90,8 +91,17 @@ interface InProcessTransportOptions {
  * M92 — typed on purpose. Before, the promise simply **never** settled and the SDK tool call hung;
  * `resolve(false)` would be worse still, because it is indistinguishable from "the user denied".
  */
-declare class ApprovalAbortedError extends Error {
+/**
+ * M80 — extends {@link TheokitAgentError}, not plain `Error`.
+ *
+ * `isTransientError` is defined over `TheokitAgentError`, so a class outside that hierarchy is
+ * INVISIBLE to it and the only recourse left to a consumer is matching on message text. `code` is
+ * stable across a rename; `isRetryable` is DECLARED, because a default would be a retry policy
+ * nobody chose.
+ */
+declare class ApprovalAbortedError extends TheokitAgentError {
     readonly approvalId: string;
+    readonly name = "ApprovalAbortedError";
     constructor(approvalId: string, reason: string);
 }
 declare class InProcessTransport implements AgentTransport {

package/dist/ask.d.ts

@@ -0,0 +1,190 @@
+import { TheokitAgentError } from '@theokit/sdk/errors';
+
+/**
+ * M77 — the ask channel: the agent asks, a human answers, the turn waits.
+ *
+ * ## The asymmetry this closes
+ *
+ * "Pause the turn for a human" existed only for tool APPROVAL. Its sibling — the agent asking a
+ * question mid-turn — had a tool and no channel: the SDK's `createQuestionTool` takes an `askUser`
+ * callback (preferring `ctx.context.askUser`), and nothing in this layer ever supplied one. A tool
+ * that cannot reach a human is a tool that times out, five minutes later, with no diagnosis.
+ *
+ * ## Why this is framework and not runtime
+ *
+ * It makes no model call, dispatches no tool and stores no conversation. It is a rendezvous between
+ * a paused turn and a surface — the "home the agent lives in" (ADR 0038 / ADR-0040 § D2), the same
+ * category as the approval gate this is modelled on.
+ *
+ * ## Modelled on `ApprovalRegistry`, deliberately
+ *
+ * That registry already solved this exact problem for approvals: hold the live resolver in memory,
+ * settle it from outside, and keep ONE instance per process because the promise being awaited and
+ * the promise being settled must be the same object. Inventing a second shape for the same problem
+ * would be the duplication G12 forbids. What differs is the key — a thread, not an approval id —
+ * because a question belongs to a conversation and a surface renders one at a time.
+ *
+ * ## What it refuses, and why refusing beats resolving
+ *
+ * Two questions on one thread have no coherent UI: the answer cannot be attributed to either. Two
+ * listeners on one thread means the prompt is rendered twice and answered by whoever wins. Both are
+ * refused with a typed error rather than resolved by picking a winner — silently replacing a
+ * listener makes the first surface go deaf with no signal at all.
+ */
+/** Raised when a thread already has a question in flight. */
+declare class ConcurrentQuestionError extends TheokitAgentError {
+    readonly name = "ConcurrentQuestionError";
+    constructor(threadId: string);
+}
+/** Raised when a thread already has a listener attached. */
+declare class ConcurrentListenerError extends TheokitAgentError {
+    readonly name = "ConcurrentListenerError";
+    constructor(threadId: string);
+}
+/**
+ * Raised when a pending question will never be answered — the run was cancelled, the surface
+ * detached, or nobody was listening in the first place.
+ */
+declare class QuestionAbandonedError extends TheokitAgentError {
+    readonly name = "QuestionAbandonedError";
+    constructor(threadId: string, why: string);
+}
+/** A question as it reaches the surface. */
+interface PendingQuestion {
+    /** Correlates {@link AskBridge.answer} with the promise the tool is awaiting. */
+    readonly id: string;
+    /** The thread the question belongs to. */
+    readonly threadId: string;
+    /** What to show the human. */
+    readonly question: string;
+}
+/** Extra hooks a surface may attach alongside its listener. */
+interface ListenerOptions {
+    /**
+     * Called when a pending question is abandoned, so the surface can release its slot.
+     *
+     * Without it, cancelling a run leaves the prompt on screen waiting for an answer nobody awaits —
+     * and the next question fails with "one already pending" against a question that is gone.
+     */
+    readonly onAbandon?: (threadId: string) => void;
+}
+/** Detaches a listener. Calling it twice is harmless. */
+type DisposeListener = () => void;
+interface AskBridge {
+    /**
+     * Ask, and resolve when a human answers.
+     *
+     * Rejects — never hangs — when there is no listener, when the thread is already asking, or when
+     * the question is abandoned. Hanging is the failure this module exists to remove.
+     */
+    ask(threadId: string, question: string): Promise<string>;
+    /** Settle a pending question. `false` when the id is unknown or already settled. */
+    answer(id: string, answer: string): boolean;
+    /** Reject whatever is pending on a thread. `false` when nothing was pending. */
+    abandon(threadId: string): boolean;
+    /** Attach the surface that renders questions for a thread. */
+    setListener(threadId: string, listener: (question: PendingQuestion) => void, options?: ListenerOptions): DisposeListener;
+}
+/**
+ * Build a bridge.
+ *
+ * A factory rather than a class with a process singleton baked in: tests get a fresh instance, and
+ * the surface that owns the process decides where the shared one lives — exactly the shape
+ * `createInProcessApprovalRegistry` established.
+ */
+declare function createAskBridge(): AskBridge;
+
+/**
+ * M77 — the client-side ledger of pending human decisions.
+ *
+ * ## Why a surface needs this at all
+ *
+ * The framework's own lookup is STATELESS. `ApprovalRegistry.list()` answers "what is pending right
+ * now", and nothing remembers what a surface already showed or already answered. Two defects fall
+ * straight out of that, and the consumer that prompted this milestone hit both:
+ *
+ * - **the dismissed card comes back** — the surface polls again, the same approval is still in the
+ *   list, and it renders a second time;
+ * - **a second answer is sent for an already-answered request** — the user clicks twice, or two
+ *   surfaces answer, and the second send is a decision nobody made.
+ *
+ * Both are memory problems, and memory is the surface's to keep. Making the registry remember what
+ * each surface has seen would put per-client state inside a process-wide primitive.
+ *
+ * ## What this deliberately is not
+ *
+ * No policy. It never decides whether to approve, never talks to the registry, never knows what an
+ * approval means. It is bookkeeping over ids — which is why it is a pure function of its own state
+ * and tested without a mock.
+ */
+/** A decision waiting for a human, as the surface knows it. */
+interface PendingItem {
+    /** The framework's id for the decision (an approval id, a question id). */
+    readonly id: string;
+    /**
+     * Where in the conversation it belongs.
+     *
+     * Ordering key AND pruning key: a surface shows the oldest first, and a rewind invalidates
+     * everything attached to messages that no longer exist.
+     */
+    readonly messageIndex: number;
+}
+interface PendingLedger {
+    /**
+     * Record what the framework reports as pending.
+     *
+     * Additive and idempotent: the same list arrives on every poll. An id already settled is NOT
+     * re-added — that single rule is what stops the dismissed card from coming back.
+     */
+    ingest(items: readonly PendingItem[]): void;
+    /**
+     * Mark one as answered. `false` when it was unknown or already settled.
+     *
+     * The caller uses that boolean to decide whether to SEND: returning `true` twice would send a
+     * decision the user made once, twice.
+     */
+    settle(id: string): boolean;
+    /** The oldest unsettled item, or `undefined`. A surface shows one at a time. */
+    findNext(): PendingItem | undefined;
+    /**
+     * Forget everything attached to a message before `messageIndex`, settled or not. Returns how many
+     * unsettled items were dropped.
+     *
+     * The cutoff is the first index that STILL EXISTS, so an item sitting exactly on it survives.
+     */
+    pruneBefore(messageIndex: number): number;
+}
+declare function createPendingLedger(): PendingLedger;
+
+/**
+ * M77 — adapt an {@link AskBridge} to the `askUser` shape the question tool expects.
+ *
+ * ## Why an adapter and not a re-export
+ *
+ * The two signatures genuinely differ, and not cosmetically:
+ *
+ * | | question tool | {@link AskBridge} |
+ * |---|---|---|
+ * | shape | `(question, threadId?) => Promise<string>` | `(threadId, question) => Promise<string>` |
+ * | thread | optional | required — it is the routing key |
+ *
+ * The tool's `threadId` is optional because the tool cannot know whether the surface tracks threads.
+ * The bridge's is required because a question with no thread has no listener to reach: the channel
+ * routes BY thread, and "ask whoever" is not a destination.
+ *
+ * That mismatch is the whole reason this function exists. Writing the flip at each call site is how
+ * the argument order eventually gets swapped somewhere and a question is asked with the thread id as
+ * its text.
+ *
+ * ## What it does with a missing thread
+ *
+ * Rejects, naming the cause. The alternative — pick a default thread, or ask the most recent
+ * listener — routes a human question to a conversation it does not belong to, which is worse than
+ * failing: the answer comes back attributed to the wrong turn.
+ *
+ * Pass it as `askUser` when building the question tool, or put it on the run context as
+ * `ctx.context.askUser`, which the tool prefers.
+ */
+declare function askUserVia(bridge: AskBridge): (question: string, threadId?: string) => Promise<string>;
+
+export { type AskBridge, ConcurrentListenerError, ConcurrentQuestionError, type DisposeListener, type ListenerOptions, type PendingItem, type PendingLedger, type PendingQuestion, QuestionAbandonedError, askUserVia, createAskBridge, createPendingLedger };

package/dist/ask.js

@@ -0,0 +1,167 @@
+import {
+  __name
+} from "./chunk-Z4QWC7IK.js";
+
+// src/ask/ask-bridge.ts
+import { TheokitAgentError } from "@theokit/sdk/errors";
+var ConcurrentQuestionError = class extends TheokitAgentError {
+  static {
+    __name(this, "ConcurrentQuestionError");
+  }
+  name = "ConcurrentQuestionError";
+  constructor(threadId) {
+    super(`thread "${threadId}" already has a question awaiting an answer. A surface renders one question at a time, and a second one in flight cannot be attributed to an answer. Answer or abandon the first.`);
+  }
+};
+var ConcurrentListenerError = class extends TheokitAgentError {
+  static {
+    __name(this, "ConcurrentListenerError");
+  }
+  name = "ConcurrentListenerError";
+  constructor(threadId) {
+    super(`thread "${threadId}" already has a question listener. Two listeners render the prompt twice and race to answer it. Dispose the first (call the function \`setListener\` returned) before attaching another.`);
+  }
+};
+var QuestionAbandonedError = class extends TheokitAgentError {
+  static {
+    __name(this, "QuestionAbandonedError");
+  }
+  name = "QuestionAbandonedError";
+  constructor(threadId, why) {
+    super(`question on thread "${threadId}" was abandoned: ${why}`);
+  }
+};
+function createAskBridge() {
+  const pendingByThread = /* @__PURE__ */ new Map();
+  const pendingById = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Map();
+  const forget = /* @__PURE__ */ __name((threadId, id) => {
+    pendingByThread.delete(threadId);
+    pendingById.delete(id);
+  }, "forget");
+  return {
+    ask(threadId, question) {
+      if (pendingByThread.has(threadId)) {
+        return Promise.reject(new ConcurrentQuestionError(threadId));
+      }
+      const listener = listeners.get(threadId);
+      if (listener === void 0) {
+        return Promise.reject(new QuestionAbandonedError(threadId, "no surface is listening on this thread"));
+      }
+      const id = crypto.randomUUID();
+      const promise = new Promise((resolve, reject) => {
+        const entry = {
+          id,
+          settle: /* @__PURE__ */ __name((answer) => {
+            forget(threadId, id);
+            resolve(answer);
+          }, "settle"),
+          fail: /* @__PURE__ */ __name((error) => {
+            forget(threadId, id);
+            reject(error);
+          }, "fail")
+        };
+        pendingByThread.set(threadId, entry);
+        pendingById.set(id, {
+          ...entry,
+          threadId
+        });
+      });
+      listener.notify({
+        id,
+        threadId,
+        question
+      });
+      return promise;
+    },
+    answer(id, answer) {
+      const entry = pendingById.get(id);
+      if (entry === void 0) return false;
+      entry.settle(answer);
+      return true;
+    },
+    abandon(threadId) {
+      const entry = pendingByThread.get(threadId);
+      if (entry === void 0) return false;
+      entry.fail(new QuestionAbandonedError(threadId, "the run was cancelled or the surface detached"));
+      listeners.get(threadId)?.onAbandon?.(threadId);
+      return true;
+    },
+    setListener(threadId, listener, options) {
+      if (listeners.has(threadId)) throw new ConcurrentListenerError(threadId);
+      const entry = {
+        notify: listener,
+        ...options?.onAbandon !== void 0 && {
+          onAbandon: options.onAbandon
+        }
+      };
+      listeners.set(threadId, entry);
+      return () => {
+        if (listeners.get(threadId) === entry) listeners.delete(threadId);
+      };
+    }
+  };
+}
+__name(createAskBridge, "createAskBridge");
+
+// src/ask/pending-ledger.ts
+function createPendingLedger() {
+  const open = /* @__PURE__ */ new Map();
+  const settled = /* @__PURE__ */ new Map();
+  return {
+    ingest(items) {
+      for (const item of items) {
+        if (settled.has(item.id) || open.has(item.id)) continue;
+        open.set(item.id, item);
+      }
+    },
+    settle(id) {
+      const item = open.get(id);
+      if (item === void 0) return false;
+      open.delete(id);
+      settled.set(id, item.messageIndex);
+      return true;
+    },
+    findNext() {
+      let oldest;
+      for (const item of open.values()) {
+        if (oldest === void 0 || item.messageIndex < oldest.messageIndex) oldest = item;
+      }
+      return oldest;
+    },
+    pruneBefore(messageIndex) {
+      let dropped = 0;
+      for (const [id, item] of open) {
+        if (item.messageIndex < messageIndex) {
+          open.delete(id);
+          dropped += 1;
+        }
+      }
+      for (const [id, at] of settled) {
+        if (at < messageIndex) settled.delete(id);
+      }
+      return dropped;
+    }
+  };
+}
+__name(createPendingLedger, "createPendingLedger");
+
+// src/ask/ask-user-via.ts
+function askUserVia(bridge) {
+  return (question, threadId) => {
+    if (threadId === void 0 || threadId === "") {
+      return Promise.reject(new QuestionAbandonedError("(none)", "the question tool was invoked without a thread id, and the ask channel routes by thread \u2014 there is no surface to reach. Pass the thread id through the run context."));
+    }
+    return bridge.ask(threadId, question);
+  };
+}
+__name(askUserVia, "askUserVia");
+export {
+  ConcurrentListenerError,
+  ConcurrentQuestionError,
+  QuestionAbandonedError,
+  askUserVia,
+  createAskBridge,
+  createPendingLedger
+};
+//# sourceMappingURL=ask.js.map

package/dist/ask.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ask/ask-bridge.ts","../src/ask/pending-ledger.ts","../src/ask/ask-user-via.ts"],"mappings":";;;;;AAAA,SAASA,yBAAyB;AAmC3B,IAAMC,0BAAN,cAAsCC,kBAAAA;EAnC7C,OAmC6CA;;;EACzBC,OAAO;EACzB,YAAYC,UAAkB;AAC5B,UACE,WAAWA,QAAAA,mLAEqB;EAEpC;AACF;AAGO,IAAMC,0BAAN,cAAsCH,kBAAAA;EA/C7C,OA+C6CA;;;EACzBC,OAAO;EACzB,YAAYC,UAAkB;AAC5B,UACE,WAAWA,QAAAA,0LAE4B;EAE3C;AACF;AAMO,IAAME,yBAAN,cAAqCJ,kBAAAA;EA9D5C,OA8D4CA;;;EACxBC,OAAO;EACzB,YAAYC,UAAkBG,KAAa;AACzC,UAAM,uBAAuBH,QAAAA,oBAA4BG,GAAAA,EAAK;EAChE;AACF;AAgEO,SAASC,kBAAAA;AACd,QAAMC,kBAAkB,oBAAIC,IAAAA;AAC5B,QAAMC,cAAc,oBAAID,IAAAA;AACxB,QAAME,YAAY,oBAAIF,IAAAA;AAEtB,QAAMG,SAAS,wBAACT,UAAkBU,OAAAA;AAChCL,oBAAgBM,OAAOX,QAAAA;AACvBO,gBAAYI,OAAOD,EAAAA;EACrB,GAHe;AAKf,SAAO;IACLE,IAAIZ,UAAUa,UAAQ;AACpB,UAAIR,gBAAgBS,IAAId,QAAAA,GAAW;AACjC,eAAOe,QAAQC,OAAO,IAAInB,wBAAwBG,QAAAA,CAAAA;MACpD;AACA,YAAMiB,WAAWT,UAAUU,IAAIlB,QAAAA;AAC/B,UAAIiB,aAAaE,QAAW;AAG1B,eAAOJ,QAAQC,OACb,IAAId,uBAAuBF,UAAU,wCAAA,CAAA;MAEzC;AAEA,YAAMU,KAAKU,OAAOC,WAAU;AAC5B,YAAMC,UAAU,IAAIP,QAAgB,CAACQ,SAASP,WAAAA;AAC5C,cAAMQ,QAAiB;UACrBd;UACAe,QAAQ,wBAACC,WAAAA;AACPjB,mBAAOT,UAAUU,EAAAA;AACjBa,oBAAQG,MAAAA;UACV,GAHQ;UAIRC,MAAM,wBAACC,UAAAA;AACLnB,mBAAOT,UAAUU,EAAAA;AACjBM,mBAAOY,KAAAA;UACT,GAHM;QAIR;AACAvB,wBAAgBwB,IAAI7B,UAAUwB,KAAAA;AAC9BjB,oBAAYsB,IAAInB,IAAI;UAAE,GAAGc;UAAOxB;QAAS,CAAA;MAC3C,CAAA;AAEAiB,eAASa,OAAO;QAAEpB;QAAIV;QAAUa;MAAS,CAAA;AACzC,aAAOS;IACT;IAEAI,OAAOhB,IAAIgB,QAAM;AACf,YAAMF,QAAQjB,YAAYW,IAAIR,EAAAA;AAG9B,UAAIc,UAAUL,OAAW,QAAO;AAChCK,YAAMC,OAAOC,MAAAA;AACb,aAAO;IACT;IAEAK,QAAQ/B,UAAQ;AACd,YAAMwB,QAAQnB,gBAAgBa,IAAIlB,QAAAA;AAElC,UAAIwB,UAAUL,OAAW,QAAO;AAChCK,YAAMG,KACJ,IAAIzB,uBAAuBF,UAAU,+CAAA,CAAA;AAEvCQ,gBAAUU,IAAIlB,QAAAA,GAAWgC,YAAYhC,QAAAA;AACrC,aAAO;IACT;IAEAiC,YAAYjC,UAAUiB,UAAUiB,SAAO;AACrC,UAAI1B,UAAUM,IAAId,QAAAA,EAAW,OAAM,IAAIC,wBAAwBD,QAAAA;AAC/D,YAAMwB,QAAkB;QACtBM,QAAQb;QACR,GAAIiB,SAASF,cAAcb,UAAa;UAAEa,WAAWE,QAAQF;QAAU;MACzE;AACAxB,gBAAUqB,IAAI7B,UAAUwB,KAAAA;AACxB,aAAO,MAAA;AAGL,YAAIhB,UAAUU,IAAIlB,QAAAA,MAAcwB,MAAOhB,WAAUG,OAAOX,QAAAA;MAC1D;IACF;EACF;AACF;AA/EgBI;;;ACpET,SAAS+B,sBAAAA;AACd,QAAMC,OAAO,oBAAIC,IAAAA;AAGjB,QAAMC,UAAU,oBAAID,IAAAA;AAEpB,SAAO;IACLE,OAAOC,OAAK;AACV,iBAAWC,QAAQD,OAAO;AACxB,YAAIF,QAAQI,IAAID,KAAKE,EAAE,KAAKP,KAAKM,IAAID,KAAKE,EAAE,EAAG;AAC/CP,aAAKQ,IAAIH,KAAKE,IAAIF,IAAAA;MACpB;IACF;IAEAI,OAAOF,IAAE;AACP,YAAMF,OAAOL,KAAKU,IAAIH,EAAAA;AACtB,UAAIF,SAASM,OAAW,QAAO;AAC/BX,WAAKY,OAAOL,EAAAA;AACZL,cAAQM,IAAID,IAAIF,KAAKQ,YAAY;AACjC,aAAO;IACT;IAEAC,WAAAA;AACE,UAAIC;AACJ,iBAAWV,QAAQL,KAAKgB,OAAM,GAAI;AAGhC,YAAID,WAAWJ,UAAaN,KAAKQ,eAAeE,OAAOF,aAAcE,UAASV;MAChF;AACA,aAAOU;IACT;IAEAE,YAAYJ,cAAY;AACtB,UAAIK,UAAU;AACd,iBAAW,CAACX,IAAIF,IAAAA,KAASL,MAAM;AAC7B,YAAIK,KAAKQ,eAAeA,cAAc;AACpCb,eAAKY,OAAOL,EAAAA;AACZW,qBAAW;QACb;MACF;AAKA,iBAAW,CAACX,IAAIY,EAAAA,KAAOjB,SAAS;AAC9B,YAAIiB,KAAKN,aAAcX,SAAQU,OAAOL,EAAAA;MACxC;AACA,aAAOW;IACT;EACF;AACF;AAlDgBnB;;;AC/BT,SAASqB,WACdC,QAAiB;AAEjB,SAAO,CAACC,UAAUC,aAAAA;AAChB,QAAIA,aAAaC,UAAaD,aAAa,IAAI;AAC7C,aAAOE,QAAQC,OACb,IAAIC,uBACF,UACA,0KACE,CAAA;IAGR;AACA,WAAON,OAAOO,IAAIL,UAAUD,QAAAA;EAC9B;AACF;AAfgBF;","names":["TheokitAgentError","ConcurrentQuestionError","TheokitAgentError","name","threadId","ConcurrentListenerError","QuestionAbandonedError","why","createAskBridge","pendingByThread","Map","pendingById","listeners","forget","id","delete","ask","question","has","Promise","reject","listener","get","undefined","crypto","randomUUID","promise","resolve","entry","settle","answer","fail","error","set","notify","abandon","onAbandon","setListener","options","createPendingLedger","open","Map","settled","ingest","items","item","has","id","set","settle","get","undefined","delete","messageIndex","findNext","oldest","values","pruneBefore","dropped","at","askUserVia","bridge","question","threadId","undefined","Promise","reject","QuestionAbandonedError","ask"]}

package/dist/auth.d.ts

@@ -1,5 +1,6 @@
 import { OAuthProviderConfig, CredentialStoreConfig, ResolvedCredential, ensureFreshCredential, OpenAIDeviceConfig, openaiDeviceLogin, OAuthTokens, DeviceDeps } from '@theokit/sdk/auth';
-export { CredentialError, CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolveCredentialOptions, ResolvedCredential, authFilePath, credentialHome, deviceLogin, ensureFreshCredential, extractAccountId, openaiDeviceLogin, persistOAuthTokens, pollDeviceToken, readAuthFile, readStoredOAuth, refreshOAuthTokens, requestDeviceCode, writeCredential } from '@theokit/sdk/auth';
+export { CredentialError, CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolveCredentialOptions, ResolvedCredential, assertSecureModes, authFilePath, credentialHome, deviceLogin, ensureFreshCredential, extractAccountId, openaiDeviceLogin, persistOAuthTokens, pollDeviceToken, readAuthFile, readStoredOAuth, refreshOAuthTokens, requestDeviceCode, writeCredential } from '@theokit/sdk/auth';
+import { TheokitAgentError } from '@theokit/sdk/errors';
 
 /**
  * M60 — `AuthProvider`, the OO contract that unifies the SDK's free OAuth-lifecycle functions
@@ -168,4 +169,97 @@ declare function loginWithDevice(provider: DeviceAuthProvider, method: AuthMetho
     accountId?: string;
 }>;
 
-export { type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type DeviceAuthProvider, type PromptHooks, loginWithDevice };
+/**
+ * M79 — "given an env, a home and a model, WHICH credential do I use, and WHERE did it come from?"
+ *
+ * ## The gap this closes
+ *
+ * The genuinely hard half was already supplied: RFC 8628 device flow, refresh under a cross-process
+ * lock, persistence, account-id extraction. The half every consumer meets FIRST was answered twice
+ * inside the framework and exposed neither time — `resolveProvider()` locked behind
+ * `internal-api.ts`, and `resolveCredential` deliberately withheld from `@theokit/agents/auth`.
+ *
+ * The "app policy" framing defends **which** providers exist. It does not defend the precedence
+ * chain, the prefix↔provider consistency check, or the provenance record: those are mechanism. A
+ * consumer forced to rewrite mechanism wrote a 70-line dotenv parser for the single question "shell
+ * or `.env`?".
+ *
+ * ## Why the descriptors are a PARAMETER, and why this name is safe here
+ *
+ * Two functions already share the name `resolveCredential` with divergent semantics — sync vs async,
+ * throws vs `undefined`, reads env vs does not, infers the provider vs refuses — which is exactly
+ * why `auth-entry.ts` withholds the SDK's. A third under the same name in the same scope would
+ * invite importing the wrong one.
+ *
+ * Taking the descriptor list as an ARGUMENT is what makes this one distinguishable at the call site
+ * rather than by luck: it is the only one whose signature says which providers it is talking about.
+ * The SDK's symbol stays unexported from this subpath, so only one is reachable.
+ */
+/** Where a credential came from — data, so provenance is formatting rather than parsing. */
+type SourceOrigin = {
+    readonly kind: 'env';
+    readonly varName: string;
+} | {
+    readonly kind: 'file';
+    readonly path: string;
+} | {
+    readonly kind: 'oauth';
+    readonly provider: string;
+};
+/** One provider the app is willing to use. WHICH providers exist stays app policy. */
+interface ProviderDescriptor {
+    /** Name used in provenance, telemetry and messages. */
+    readonly name: string;
+    /** Environment variable carrying the API key. */
+    readonly envKey: string;
+    /** Lower wins. Declared, so the caller's array order is not a hidden second policy. */
+    readonly priority: number;
+    /** Model-id prefix this provider claims (`openai/`). Absent ⇒ it claims none. */
+    readonly modelPrefix?: string;
+}
+/**
+ * The answer, with its provenance attached.
+ *
+ * NOT called `ResolvedCredential`: the SDK already publishes a type under that name from this same
+ * subpath, and the collision surfaced the moment this shipped. Two shapes sharing one name in one
+ * scope is the failure this whole milestone is about — so the name says what it is, a resolution.
+ */
+interface CredentialResolution {
+    readonly kind: 'api-key' | 'oauth';
+    readonly provider: string;
+    readonly apiKey: string;
+    readonly source: SourceOrigin;
+    /**
+     * Whether the resolver PICKED the provider rather than the caller naming it.
+     *
+     * Without this, "why is it calling Anthropic?" has no answer in the data — the caller cannot tell
+     * a user's explicit choice from a precedence fallback.
+     */
+    readonly inferred: boolean;
+}
+/** Raised when the model's prefix names a provider that has no credential. */
+declare class ProviderPrefixMismatchError extends TheokitAgentError {
+    readonly name = "ProviderPrefixMismatchError";
+    constructor(provider: string, envKey: string, model: string);
+}
+interface ResolveCredentialInput {
+    /** The environment as the process sees it — already loaded, already interpolated. */
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** Directory whose `.env` is consulted for PROVENANCE only. Omitted ⇒ everything reads as shell. */
+    readonly home?: string;
+    /** The providers this app accepts. App policy, hence a parameter. */
+    readonly providers: readonly ProviderDescriptor[];
+    /** Model id, when known. Its prefix is checked against the resolved provider. */
+    readonly model?: string;
+}
+/**
+ * Resolve which credential to use, and record where it came from.
+ *
+ * Returns `undefined` when nothing is configured: a missing key is the ordinary first-run state, and
+ * the caller's next move is to print "run `theokit auth login`" — which a thrown error makes harder,
+ * not easier. A prefix that names a provider with no credential DOES throw, because that is a
+ * contradiction rather than an absence.
+ */
+declare function resolveCredential(input: ResolveCredentialInput): CredentialResolution | undefined;
+
+export { type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type DeviceAuthProvider, type PromptHooks, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, loginWithDevice, resolveCredential };

package/dist/auth.js

@@ -123,7 +123,7 @@ var AuthProvider = class _AuthProvider {
 };
 
 // src/auth-entry.ts
-import { authFilePath as authFilePath2, CredentialError, credentialHome, readAuthFile, readStoredOAuth as readStoredOAuth2, writeCredential } from "@theokit/sdk/auth";
+import { assertSecureModes, authFilePath as authFilePath2, CredentialError, credentialHome, readAuthFile, readStoredOAuth as readStoredOAuth2, writeCredential } from "@theokit/sdk/auth";
 import { deviceLogin, openaiDeviceLogin as openaiDeviceLogin3, pollDeviceToken, requestDeviceCode } from "@theokit/sdk/auth";
 import { ensureFreshCredential as ensureFreshCredential2, extractAccountId, persistOAuthTokens as persistOAuthTokens2, refreshOAuthTokens } from "@theokit/sdk/auth";
 
@@ -196,11 +196,94 @@ async function loginWithDevice(provider, method, store, hooks, opts = {}) {
   };
 }
 __name(loginWithDevice, "loginWithDevice");
+
+// src/auth/resolve-credential.ts
+import { readFileSync } from "fs";
+import { join } from "path";
+import { TheokitAgentError } from "@theokit/sdk/errors";
+var ProviderPrefixMismatchError = class extends TheokitAgentError {
+  static {
+    __name(this, "ProviderPrefixMismatchError");
+  }
+  name = "ProviderPrefixMismatchError";
+  constructor(provider, envKey, model) {
+    super(`model "${model}" names provider "${provider}", but no credential for it was found. Set ${envKey}, or drop the prefix to let the resolver pick by precedence. Falling back to another provider would send the request to a model you did not ask for \u2014 and bill you for it.`);
+  }
+};
+function declaredNames(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const withoutExport = trimmed.startsWith("export ") ? trimmed.slice("export ".length) : trimmed;
+    const eq = withoutExport.indexOf("=");
+    if (eq <= 0) continue;
+    names.add(withoutExport.slice(0, eq).trim());
+  }
+  return names;
+}
+__name(declaredNames, "declaredNames");
+function resolveCredential(input) {
+  const byPriority = [
+    ...input.providers
+  ].sort((a, b) => a.priority - b.priority);
+  const available = byPriority.flatMap((descriptor) => {
+    const apiKey = input.env[descriptor.envKey];
+    return apiKey === void 0 || apiKey === "" ? [] : [
+      {
+        descriptor,
+        apiKey
+      }
+    ];
+  });
+  const claimed = claimedProvider(input.model, byPriority);
+  const found = claimed === void 0 ? available[0] : available.find((candidate) => candidate.descriptor === claimed);
+  if (claimed !== void 0 && found === void 0) {
+    throw new ProviderPrefixMismatchError(claimed.name, claimed.envKey, input.model ?? "");
+  }
+  if (found === void 0) return void 0;
+  return {
+    kind: "api-key",
+    provider: found.descriptor.name,
+    apiKey: found.apiKey,
+    source: originOf(found.descriptor.envKey, input.home),
+    inferred: claimed === void 0
+  };
+}
+__name(resolveCredential, "resolveCredential");
+function claimedProvider(model, providers) {
+  if (model === void 0) return void 0;
+  return providers.find((p) => p.modelPrefix !== void 0 && model.startsWith(p.modelPrefix));
+}
+__name(claimedProvider, "claimedProvider");
+function originOf(varName, home) {
+  if (home === void 0) return {
+    kind: "env",
+    varName
+  };
+  const dotenv = join(home, ".env");
+  return declaredNames(dotenv).has(varName) ? {
+    kind: "file",
+    path: dotenv
+  } : {
+    kind: "env",
+    varName
+  };
+}
+__name(originOf, "originOf");
 export {
   AuthProvider,
   CODEX_CLIENT_ID_ENV_VAR,
   CODEX_PROVIDER,
   CredentialError,
+  ProviderPrefixMismatchError,
+  assertSecureModes,
   authFilePath2 as authFilePath,
   credentialHome,
   deviceLogin,
@@ -214,6 +297,7 @@ export {
   readStoredOAuth2 as readStoredOAuth,
   refreshOAuthTokens,
   requestDeviceCode,
+  resolveCredential,
   writeCredential
 };
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts"],"mappings":";;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACzLA,SACEmC,gBAAAA,eACAC,iBACAC,gBACAC,cACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;;;ACjFP,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts"],"mappings":";;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,cACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;;;ACtFP,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAErB,SAASC,yBAAyB;AAqE3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EAxEjD,OAwEiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAqBA,SAASE,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAkCF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,aAAa;OAAID,MAAME;IAAWC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,WAAWD,EAAEC,QAAQ;AAS9E,QAAMC,YAAYN,WAAWO,QAAQ,CAACC,eAAAA;AACpC,UAAMC,SAASV,MAAMW,IAAIF,WAAW7B,MAAM;AAC1C,WAAO8B,WAAWE,UAAaF,WAAW,KAAK,CAAA,IAAK;MAAC;QAAED;QAAYC;MAAO;;EAC5E,CAAA;AAEA,QAAMG,UAAUC,gBAAgBd,MAAMnB,OAAOoB,UAAAA;AAC7C,QAAMc,QACJF,YAAYD,SACRL,UAAU,CAAA,IACVA,UAAUS,KAAK,CAACC,cAAcA,UAAUR,eAAeI,OAAAA;AAE7D,MAAIA,YAAYD,UAAaG,UAAUH,QAAW;AAChD,UAAM,IAAIpC,4BAA4BqC,QAAQnC,MAAMmC,QAAQjC,QAAQoB,MAAMnB,SAAS,EAAA;EACrF;AACA,MAAIkC,UAAUH,OAAW,QAAOA;AAEhC,SAAO;IACLM,MAAM;IACNvC,UAAUoC,MAAMN,WAAW/B;IAC3BgC,QAAQK,MAAML;IACdS,QAAQC,SAASL,MAAMN,WAAW7B,QAAQoB,MAAMqB,IAAI;IACpDC,UAAUT,YAAYD;EACxB;AACF;AAjCgBb;AA0ChB,SAASe,gBACPjC,OACAqB,WAAwC;AAExC,MAAIrB,UAAU+B,OAAW,QAAOA;AAChC,SAAOV,UAAUc,KAAK,CAACO,MAAMA,EAAEC,gBAAgBZ,UAAa/B,MAAMW,WAAW+B,EAAEC,WAAW,CAAA;AAC5F;AANSV;AAST,SAASM,SAASK,SAAiBJ,MAAwB;AACzD,MAAIA,SAAST,OAAW,QAAO;IAAEM,MAAM;IAAOO;EAAQ;AACtD,QAAMC,SAASC,KAAKN,MAAM,MAAA;AAC1B,SAAOvC,cAAc4C,MAAAA,EAAQE,IAAIH,OAAAA,IAC7B;IAAEP,MAAM;IAAQnC,MAAM2C;EAAO,IAC7B;IAAER,MAAM;IAAOO;EAAQ;AAC7B;AANSL;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","resolveCredential","input","byPriority","providers","sort","a","b","priority","available","flatMap","descriptor","apiKey","env","undefined","claimed","claimedProvider","found","find","candidate","kind","source","originOf","home","inferred","p","modelPrefix","varName","dotenv","join","has"]}