@theokit/agents 9.1.0 → 9.2.0

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @theokit/agents
 
+## 9.2.0
+
+### Minor Changes
+
+- bb01ce8: **`resolveAgentCredential` — a montagem de autenticacao, para um app novo nao reescrever nenhuma.**
+
+  O framework ja entregava as PECAS (store no 0600, device flow RFC 8628, refresh, `writeCredential`) e
+  nao entregava a MONTAGEM. Medido no consumidor mais proximo: ele importa seis simbolos nossos e
+  escreve ~250 linhas em cima, e nenhuma delas e sobre o dominio dele — sao a politica de resolucao que
+  todo app de agente de terminal precisa e nenhum consegue importar.
+
+  Adicionado:
+
+  - **`DEFAULT_PROVIDERS`** — openrouter, anthropic, openai com variavel de ambiente, prioridade e
+    prefixo de chave. O consumidor abre com TRES tabelas escritas a mao dizendo isto; agora um app novo
+    nao escreve nenhuma. Prioridades espacadas de 10 para caber um provider entre dois padroes sem
+    renumerar.
+  - **`resolveAgentCredential({ env })`** — a chamada unica. Aplica os padroes e mantem todos
+    sobrescreviveis: `providers` para estreitar (um produto que so fala com um provider) ou estender
+    (um gateway self-hosted).
+  - **O pin de provider** (`THEOKIT_PROVIDER` por padrao) que se RECUSA a cair para outro. Cair
+    mandaria a requisicao — e a conta, e os dados — para um provider que o operador nao escolheu. Um
+    typo no nome tambem e recusado: um erro de digitacao nao pode desligar o pin em silencio.
+  - **Coerencia chave↔provider** via `keyPrefix`. `ANTHROPIC_API_KEY=sk-proj-…` e uma colagem na
+    variavel errada, pega aqui de graca em vez de virar um 401 remoto cuja mensagem nao fala do
+    desencontro.
+  - **`requireCredential`** e `CredentialNotFoundError` carregando ONDE procurou. "Nenhuma credencial
+    encontrada" sem a lista e a frase menos util que um CLI pode imprimir, e e por isso que o consumidor
+    carregava a propria.
+
+  `resolveCredential` segue devolvendo `undefined` — a forma nao-lancante e o que o caminho de primeira
+  execucao quer, e `requireCredential` e o opt-in de quem nao pode continuar. Duas funcoes em vez de uma
+  flag: a intencao fica visivel no call site.
+
+  Os prefixos vivem aqui E no SDK (`providerFromApiKeyPrefix`), o que nao e ideal e esta guardado: um
+  teste falha quando as duas tabelas discordam. Uma tabela so seria melhor, mas o simbolo do SDK esta
+  exportado em runtime e AUSENTE do `auth/index.d.ts` (medido contra 4.52.0), entao um import tipado nao
+  resolve. Guardado por CI em vez de esperado.
+
+## 9.1.1
+
+### Patch Changes
+
+- **`readSecureJson` passa a recusar um store que outro usuario local pode ESCREVER.**
+
+  `ensureSecureDir` segurava o diretorio em owner-only e a leitura entao abria o arquivo sem olhar o
+  modo dele. Um `hook-approvals.json` deixado group- ou world-writable — por uma versao antiga, por um
+  umask ruim, por quem tivesse acesso de escrita — era lido como autoritativo. Esse arquivo decide
+  quais linhas de comando chegam ao `spawn(cmd, { shell: true })`.
+
+  Falha FECHADA e reporta, em vez de lancar: um store ilegivel ja significa "nada aprovado", o turno
+  do chamador nao deve terminar por causa disso, e `lastReadError` e como o operador descobre que as
+  aprovacoes dele pararam de valer. Silencio tornaria um store adulterado indistinguivel de um vazio.
+
+  Recusado em vez de reparado: apertar o modo em silencio esconderia que algo o mudou, que e o fato
+  que importa saber.
+
+  Achado por um teste do consumidor (B-019) falhando enquanto ele migrava para este helper.
+
 ## 9.1.0
 
 ### Minor Changes

package/dist/auth.d.ts

@@ -216,6 +216,15 @@ interface ProviderDescriptor {
     readonly priority: number;
     /** Model-id prefix this provider claims (`openai/`). Absent ⇒ it claims none. */
     readonly modelPrefix?: string;
+    /**
+     * Prefix this provider stamps on its API keys (`sk-ant-`, `sk-or-`, `sk-`).
+     *
+     * Enables the coherence check: a key sitting in `ANTHROPIC_API_KEY` that starts with `sk-proj-`
+     * is a paste into the wrong variable, caught here for free instead of as a 401 from the wrong
+     * endpoint whose message says nothing about the mismatch. Absent means "this provider stamps no
+     * recognisable prefix", and nothing is checked — never a silent pass disguised as a check.
+     */
+    readonly keyPrefix?: string;
 }
 /**
  * The answer, with its provenance attached.
@@ -242,6 +251,30 @@ declare class ProviderPrefixMismatchError extends TheokitAgentError {
     readonly name = "ProviderPrefixMismatchError";
     constructor(provider: string, envKey: string, model: string);
 }
+/** Raised when a key's prefix contradicts the provider it was declared for. */
+declare class ProviderKeyMismatchError extends TheokitAgentError {
+    readonly provider: string;
+    readonly where: string;
+    readonly expectedPrefix: string;
+    readonly name = "ProviderKeyMismatchError";
+    constructor(provider: string, where: string, expectedPrefix: string);
+}
+/** Raised when a pinned provider has no credential, or names one the app never declared. */
+declare class DeclaredProviderError extends TheokitAgentError {
+    readonly name = "DeclaredProviderError";
+    constructor(message: string);
+}
+/**
+ * Raised by {@link requireCredential} when nothing is configured, carrying WHERE it looked.
+ *
+ * The list is the point. "No credential found" without it is the least useful sentence available,
+ * and it is why the closest measured consumer carried its own `attempts` array.
+ */
+declare class CredentialNotFoundError extends TheokitAgentError {
+    readonly attempts: readonly string[];
+    readonly name = "CredentialNotFoundError";
+    constructor(attempts: readonly string[]);
+}
 interface ResolveCredentialInput {
     /** The environment as the process sees it — already loaded, already interpolated. */
     readonly env: Readonly<Record<string, string | undefined>>;
@@ -263,6 +296,17 @@ interface ResolveCredentialInput {
      * the precedence a consumer already implements (declared env → per-provider env → file).
      */
     readonly store?: CredentialStoreConfig;
+    /**
+     * Name of the variable that PINS a provider (`PROVIDER`, `THEOCODE_PROVIDER`, …).
+     *
+     * When set and present, the pinned provider is the only one considered: if it has no credential,
+     * resolution THROWS rather than falling back. Falling back would send the request — and the bill,
+     * and the data — to a provider the operator did not choose, which is the one outcome a pin exists
+     * to prevent.
+     *
+     * The variable NAME is the app's (products disagree on it); the semantics are not.
+     */
+    readonly declaredProviderEnvVar?: string;
 }
 /** What `credentialSources` needs — the same declarations the resolver consults. */
 interface CredentialSourcesInput {
@@ -287,15 +331,70 @@ interface CredentialSourcesInput {
  * precedence claim the resolver does not honour.
  */
 declare function credentialSources(input: CredentialSourcesInput): readonly string[];
+declare function resolveCredential(input: ResolveCredentialInput): CredentialResolution | undefined;
 /**
- * Resolve which credential to use, and record where it came from.
+ * Like {@link resolveCredential}, but THROWS when nothing is configured — carrying where it looked.
+ *
+ * Two functions rather than a flag: the non-throwing shape is what a first-run path wants ("no key
+ * yet" is the ordinary state, and the next move is `theokit auth login`), and the throwing shape is
+ * what a path that cannot continue wants. A boolean parameter would make the caller's intent
+ * invisible at the call site, and the two intents are genuinely different.
  *
- * Returns `undefined` when nothing is configured: a missing key is the ordinary first-run state, and
- * the caller's next move is to print "run `theokit auth login`" — which a thrown error makes harder,
- * not easier. A prefix that names a provider with no credential DOES throw, because that is a
- * contradiction rather than an absence.
+ * The attempts list is the reason this exists: "no credential found" without saying WHERE it looked
+ * is the least useful sentence a CLI can print, and it is why the closest measured consumer carried
+ * its own.
  */
-declare function resolveCredential(input: ResolveCredentialInput): CredentialResolution | undefined;
+declare function requireCredential(input: ResolveCredentialInput): CredentialResolution;
+/**
+ * The providers a TheoKit agent app starts with — so a new app writes no table at all.
+ *
+ * Measured against the closest real consumer: it opens with three hand-written tables (`PROVIDERS`,
+ * `PREFIXES`, `ENV_KEYS`) saying what every terminal agent app says. That is not its domain; it is
+ * the cost of shipping a resolver whose only input is the argument the app must build.
+ *
+ * ## Why the prefixes live here as well as in the SDK
+ *
+ * `providerFromApiKeyPrefix` owns the same knowledge, and one table would be better. It cannot be
+ * the only one today: the symbol is exported at runtime and absent from the SDK's `auth/index.d.ts`
+ * (measured against 4.52.0), so a typed import does not resolve. Rather than block, the table is
+ * here AND a drift-guard test fails when the two disagree — the same hand-maintained-table hazard
+ * that produced the longest-prefix bug is caught by CI instead of hoped away.
+ *
+ * ## Priorities, and why they are spaced
+ *
+ * Distinct and 10 apart: an app that wants to slot a provider between two defaults can, without
+ * renumbering. Order is `openrouter → anthropic → openai`, matching the consumer's measured chain.
+ */
+declare const DEFAULT_PROVIDERS: readonly ProviderDescriptor[];
+/** Everything {@link resolveAgentCredential} needs, and nothing an app has to invent. */
+interface AgentCredentialInput {
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly home?: string;
+    readonly model?: string;
+    readonly store?: CredentialStoreConfig;
+    /**
+     * Providers to accept. Defaults to {@link DEFAULT_PROVIDERS}.
+     *
+     * Present so an app can NARROW (a product that only talks to Anthropic) or EXTEND (a self-hosted
+     * gateway) — the two real reasons to disagree with the default. Which providers exist stays app
+     * policy; not having to state it to get started is the point.
+     */
+    readonly providers?: readonly ProviderDescriptor[];
+    /** Variable that pins a provider. Defaults to `THEOKIT_PROVIDER`. */
+    readonly declaredProviderEnvVar?: string;
+}
+/**
+ * The one call a new app makes: given the environment, which credential do I use?
+ *
+ * `resolveCredential` takes the full policy as arguments, which is right for an app that has
+ * opinions and wrong as a starting point — a new app should not have to state a provider table, a
+ * precedence order and a pin variable before it can read a key. This applies the defaults and keeps
+ * every one of them overridable.
+ *
+ * Throws when nothing is configured, carrying WHERE it looked: a new app's first run is exactly the
+ * case that needs the list, and printing the error is the whole handling it needs.
+ */
+declare function resolveAgentCredential(input: AgentCredentialInput): CredentialResolution;
 
 /** What a caller asks about: may THIS tool run THIS command in THIS place? */
 interface PermissionQuery {
@@ -344,4 +443,4 @@ declare class PermissionStore {
     expired(): readonly Grant[];
 }
 
-export { type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, type DeviceAuthProvider, type Grant, type GrantOptions, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, credentialSources, loginWithDevice, resolveCredential };
+export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Grant, type GrantOptions, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, credentialSources, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential };

package/dist/auth.js

@@ -1,7 +1,7 @@
 import {
   readSecureJson,
   writeSecureJson
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";
@@ -215,6 +215,47 @@ var ProviderPrefixMismatchError = class extends TheokitAgentError {
     super(`model "${model}" names provider "${provider}", but no credential for it was found. Set ${envKey}, or drop the prefix to let the resolver pick by precedence. Falling back to another provider would send the request to a model you did not ask for \u2014 and bill you for it.`);
   }
 };
+var ProviderKeyMismatchError = class extends TheokitAgentError {
+  static {
+    __name(this, "ProviderKeyMismatchError");
+  }
+  provider;
+  where;
+  expectedPrefix;
+  name = "ProviderKeyMismatchError";
+  constructor(provider, where, expectedPrefix) {
+    super(`${where}: the key declared for provider "${provider}" does not start with "${expectedPrefix}". Either the provider or the key is wrong, and sending it would fail mid-request against the wrong endpoint.`, {
+      code: "provider_key_mismatch",
+      isRetryable: false
+    }), this.provider = provider, this.where = where, this.expectedPrefix = expectedPrefix;
+  }
+};
+var DeclaredProviderError = class extends TheokitAgentError {
+  static {
+    __name(this, "DeclaredProviderError");
+  }
+  name = "DeclaredProviderError";
+  constructor(message) {
+    super(message, {
+      code: "declared_provider_unusable",
+      isRetryable: false
+    });
+  }
+};
+var CredentialNotFoundError = class extends TheokitAgentError {
+  static {
+    __name(this, "CredentialNotFoundError");
+  }
+  attempts;
+  name = "CredentialNotFoundError";
+  constructor(attempts) {
+    super(`no provider credential found. Tried, in order:
+` + attempts.map((a, i) => `  ${String(i + 1)}. ${a}`).join("\n"), {
+      code: "credential_not_found",
+      isRetryable: false
+    }), this.attempts = attempts;
+  }
+};
 function declaredNames(path) {
   let raw;
   try {
@@ -245,10 +286,42 @@ function credentialSources(input) {
   return sources;
 }
 __name(credentialSources, "credentialSources");
+function assertKeyMatchesProvider(descriptor, apiKey, where) {
+  if (descriptor.keyPrefix === void 0) return;
+  if (apiKey.startsWith(descriptor.keyPrefix)) return;
+  throw new ProviderKeyMismatchError(descriptor.name, where, descriptor.keyPrefix);
+}
+__name(assertKeyMatchesProvider, "assertKeyMatchesProvider");
+function pinnedProvider(input, byPriority) {
+  if (input.declaredProviderEnvVar === void 0) return void 0;
+  const declared = input.env[input.declaredProviderEnvVar]?.trim();
+  if (declared === void 0 || declared === "") return void 0;
+  const descriptor = byPriority.find((d) => d.name === declared);
+  if (descriptor === void 0) {
+    throw new DeclaredProviderError(`${input.declaredProviderEnvVar} is "${declared}" \u2014 expected one of ${byPriority.map((d) => d.name).join(", ")}.`);
+  }
+  return descriptor;
+}
+__name(pinnedProvider, "pinnedProvider");
 function resolveCredential(input) {
   const byPriority = [
     ...input.providers
   ].sort((a, b) => a.priority - b.priority);
+  const pinned = pinnedProvider(input, byPriority);
+  if (pinned !== void 0) {
+    const apiKey = input.env[pinned.envKey];
+    if (apiKey === void 0 || apiKey === "") {
+      throw new DeclaredProviderError(`provider "${pinned.name}" is pinned via ${String(input.declaredProviderEnvVar)} but no key for it was found (looked at ${pinned.envKey}). Refusing to fall back to a different provider's credential.`);
+    }
+    assertKeyMatchesProvider(pinned, apiKey, pinned.envKey);
+    return {
+      kind: "api-key",
+      provider: pinned.name,
+      apiKey,
+      source: originOf(pinned.envKey, input.home),
+      inferred: false
+    };
+  }
   const available = byPriority.flatMap((descriptor) => {
     const apiKey = input.env[descriptor.envKey];
     return apiKey === void 0 || apiKey === "" ? [] : [
@@ -264,6 +337,7 @@ function resolveCredential(input) {
     throw new ProviderPrefixMismatchError(claimed.name, claimed.envKey, input.model ?? "");
   }
   if (found === void 0) return storedOAuthResolution(input, byPriority);
+  assertKeyMatchesProvider(found.descriptor, found.apiKey, found.descriptor.envKey);
   return {
     kind: "api-key",
     provider: found.descriptor.name,
@@ -326,6 +400,56 @@ function originOf(varName, home) {
   };
 }
 __name(originOf, "originOf");
+function requireCredential(input) {
+  const resolved = resolveCredential(input);
+  if (resolved !== void 0) return resolved;
+  throw new CredentialNotFoundError(credentialSources({
+    providers: input.providers,
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- `CredentialStoreConfig` does not resolve (see the import note at the top of this file); the value is only forwarded, never inspected
+    ...input.store === void 0 ? {} : {
+      store: input.store
+    }
+  }));
+}
+__name(requireCredential, "requireCredential");
+var DEFAULT_PROVIDERS = [
+  {
+    name: "openrouter",
+    envKey: "OPENROUTER_API_KEY",
+    priority: 10,
+    keyPrefix: "sk-or-"
+  },
+  {
+    name: "anthropic",
+    envKey: "ANTHROPIC_API_KEY",
+    priority: 20,
+    keyPrefix: "sk-ant-"
+  },
+  {
+    name: "openai",
+    envKey: "OPENAI_API_KEY",
+    priority: 30,
+    keyPrefix: "sk-"
+  }
+];
+function resolveAgentCredential(input) {
+  return requireCredential({
+    env: input.env,
+    providers: input.providers ?? DEFAULT_PROVIDERS,
+    declaredProviderEnvVar: input.declaredProviderEnvVar ?? "THEOKIT_PROVIDER",
+    ...input.home === void 0 ? {} : {
+      home: input.home
+    },
+    ...input.model === void 0 ? {} : {
+      model: input.model
+    },
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- same unresolved `CredentialStoreConfig`; forwarded verbatim to the resolver
+    ...input.store === void 0 ? {} : {
+      store: input.store
+    }
+  });
+}
+__name(resolveAgentCredential, "resolveAgentCredential");
 
 // src/auth/permission-store.ts
 import { realpathSync } from "fs";
@@ -429,7 +553,11 @@ export {
   CODEX_CLIENT_ID_ENV_VAR,
   CODEX_PROVIDER,
   CredentialError,
+  CredentialNotFoundError,
+  DEFAULT_PROVIDERS,
+  DeclaredProviderError,
   PermissionStore,
+  ProviderKeyMismatchError,
   ProviderPrefixMismatchError,
   assertSecureModes,
   authFilePath2 as authFilePath,
@@ -446,6 +574,8 @@ export {
   readStoredOAuth3 as readStoredOAuth,
   refreshOAuthTokens,
   requestDeviceCode,
+  requireCredential,
+  resolveAgentCredential,
   resolveCredential,
   writeCredential
 };

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/permission-store.ts"],"mappings":";;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,cACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;;;ACtFP,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SAASC,mBAAAA,wBAAmD;AAC5D,SAASC,yBAAyB;AAqE3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EA9EjD,OA8EiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAiCA,SAASE,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,WAAWD,EAAEC,QAAQ,EACtCC,IAAI,CAACC,eAAeA,WAAW5B,MAAM;AAIxC,MAAIoB,MAAMS,UAAUC,QAAW;AAC7B,UAAMC,SAASX,MAAMS;AACrBR,YAAQW,KAAKC,KAAKF,OAAOG,WAAW,YAAYH,OAAOI,YAAY,WAAA,CAAA;EACrE;AACA,SAAOd;AACT;AAZgBF;AAsBT,SAASiB,kBAAkBhB,OAA6B;AAC7D,QAAMiB,aAAa;OAAIjB,MAAME;IAAWC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,WAAWD,EAAEC,QAAQ;AAS9E,QAAMY,YAAYD,WAAWE,QAAQ,CAACX,eAAAA;AACpC,UAAMY,SAASpB,MAAMqB,IAAIb,WAAW5B,MAAM;AAC1C,WAAOwC,WAAWV,UAAaU,WAAW,KAAK,CAAA,IAAK;MAAC;QAAEZ;QAAYY;MAAO;;EAC5E,CAAA;AAEA,QAAME,UAAUC,gBAAgBvB,MAAMnB,OAAOoC,UAAAA;AAC7C,QAAMO,QACJF,YAAYZ,SACRQ,UAAU,CAAA,IACVA,UAAUO,KAAK,CAACC,cAAcA,UAAUlB,eAAec,OAAAA;AAE7D,MAAIA,YAAYZ,UAAac,UAAUd,QAAW;AAChD,UAAM,IAAIlC,4BAA4B8C,QAAQ5C,MAAM4C,QAAQ1C,QAAQoB,MAAMnB,SAAS,EAAA;EACrF;AACA,MAAI2C,UAAUd,OAAW,QAAOiB,sBAAsB3B,OAAOiB,UAAAA;AAE7D,SAAO;IACLW,MAAM;IACNjD,UAAU6C,MAAMhB,WAAW9B;IAC3B0C,QAAQI,MAAMJ;IACdS,QAAQC,SAASN,MAAMhB,WAAW5B,QAAQoB,MAAM+B,IAAI;IACpDC,UAAUV,YAAYZ;EACxB;AACF;AAjCgBM;AA0ChB,SAASiB,SAASC,SAAe;AAC/BC,UAAQC,KAAK,qBAAqBF,OAAAA,EAAS;AAC7C;AAFSD;AAiCT,SAASN,sBACP3B,OACAE,WAAwC;AAExC,MAAIF,MAAMS,UAAUC,OAAW,QAAOA;AAEtC,MAAI2B;AACJ,MAAI;AAGFA,aAASC,iBAAgBtC,MAAMS,OAAOT,MAAMqB,GAAG;EACjD,SAASkB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAML,UAAUO,OAAOF,KAAAA,CAAAA,EAAQ;AAEtE,WAAO7B;EACT;AACA,MAAI2B,WAAW3B,OAAW,QAAOA;AAGjC,MAAI2B,OAAOK,SAAS,WAAW,OAAOL,OAAOM,WAAW,YAAYN,OAAOM,WAAW,IAAI;AACxF,WAAOjC;EACT;AACA,QAAMc,QAAQtB,UAAUuB,KAAK,CAACmB,MAAMA,EAAElE,SAAS2D,OAAO1D,QAAQ;AAC9D,MAAI6C,UAAUd,OAAW,QAAOA;AAEhC,SAAO;IACLkB,MAAM;IACNjD,UAAU6C,MAAM9C;;IAEhB0C,QAAQiB,OAAOM;IACfd,QAAQ;MAAED,MAAM;MAASjD,UAAU6C,MAAM9C;IAAK;;IAE9CsD,UAAU;EACZ;AACF;AAxCSL;AAiDT,SAASJ,gBACP1C,OACAqB,WAAwC;AAExC,MAAIrB,UAAU6B,OAAW,QAAOA;AAChC,SAAOR,UAAUuB,KAAK,CAACmB,MAAMA,EAAEC,gBAAgBnC,UAAa7B,MAAMW,WAAWoD,EAAEC,WAAW,CAAA;AAC5F;AANStB;AAST,SAASO,SAASgB,SAAiBf,MAAwB;AACzD,MAAIA,SAASrB,OAAW,QAAO;IAAEkB,MAAM;IAAOkB;EAAQ;AACtD,QAAMC,SAASlC,KAAKkB,MAAM,MAAA;AAC1B,SAAOjD,cAAciE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAElB,MAAM;IAAQ7C,MAAMgE;EAAO,IAC7B;IAAEnB,MAAM;IAAOkB;EAAQ;AAC7B;AANShB;;;ACjST,SAASmB,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA9Eb,OA8EaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","readStoredOAuth","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","a","b","priority","map","descriptor","store","undefined","config","push","join","dirName","fileName","resolveCredential","byPriority","available","flatMap","apiKey","env","claimed","claimedProvider","found","find","candidate","storedOAuthResolution","kind","source","originOf","home","inferred","diagnose","message","console","warn","stored","readStoredOAuth","cause","Error","String","type","access","p","modelPrefix","varName","dotenv","has","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/permission-store.ts"],"mappings":";;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,cACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;;;ACtFP,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SAASC,mBAAAA,wBAAmD;AAC5D,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EAvFjD,OAuFiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAnG9C,OAmG8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EArH3C,OAqH2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAnI7C,OAmI6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAEb,MAAIqC,WAAWS,cAAcP,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWS,SAAS,EAAG;AAC7C,QAAM,IAAI/C,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWS,SAAS;AACjF;AARSF;AAgBT,SAASG,eACPhB,OACAiB,YAAyC;AAEzC,MAAIjB,MAAMkB,2BAA2BV,OAAW,QAAOA;AACvD,QAAMW,WAAWnB,MAAMoB,IAAIpB,MAAMkB,sBAAsB,GAAG3B,KAAAA;AAC1D,MAAI4B,aAAaX,UAAaW,aAAa,GAAI,QAAOX;AAEtD,QAAMF,aAAaW,WAAWI,KAAK,CAACC,MAAMA,EAAE1D,SAASuD,QAAAA;AACrD,MAAIb,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMkB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAWxC,IAAI,CAAC6C,MAAMA,EAAE1D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSU;AAkBF,SAASO,kBAAkBvB,OAA6B;AAC7D,QAAMiB,aAAa;OAAIjB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMmB,SAASR,eAAehB,OAAOiB,UAAAA;AACrC,MAAIO,WAAWhB,QAAW;AACxB,UAAMM,SAASd,MAAMoB,IAAII,OAAO1D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAamD,OAAO5D,IAAI,mBAAmBgB,OAAOoB,MAAMkB,sBAAsB,CAAA,2CACzCM,OAAO1D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBW,QAAQV,QAAQU,OAAO1D,MAAM;AACtD,WAAO;MACL2D,MAAM;MACN5D,UAAU2D,OAAO5D;MACjBkD;MACAY,QAAQC,SAASH,OAAO1D,QAAQkC,MAAM4B,IAAI;MAC1CC,UAAU;IACZ;EACF;AASA,QAAMC,YAAYb,WAAWc,QAAQ,CAACzB,eAAAA;AACpC,UAAMQ,SAASd,MAAMoB,IAAId,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMkB,UAAUC,gBAAgBjC,MAAMjC,OAAOkD,UAAAA;AAC7C,QAAMiB,QACJF,YAAYxB,SACRsB,UAAU,CAAA,IACVA,UAAUT,KAAK,CAACc,cAAcA,UAAU7B,eAAe0B,OAAAA;AAE7D,MAAIA,YAAYxB,UAAa0B,UAAU1B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BsE,QAAQpE,MAAMoE,QAAQlE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAImE,UAAU1B,OAAW,QAAO4B,sBAAsBpC,OAAOiB,UAAAA;AAE7DJ,2BAAyBqB,MAAM5B,YAAY4B,MAAMpB,QAAQoB,MAAM5B,WAAWxC,MAAM;AAEhF,SAAO;IACL2D,MAAM;IACN5D,UAAUqE,MAAM5B,WAAW1C;IAC3BkD,QAAQoB,MAAMpB;IACdY,QAAQC,SAASO,MAAM5B,WAAWxC,QAAQkC,MAAM4B,IAAI;IACpDC,UAAUG,YAAYxB;EACxB;AACF;AA1DgBe;AAmEhB,SAASc,SAAS/D,SAAe;AAC/BgE,UAAQC,KAAK,qBAAqBjE,OAAAA,EAAS;AAC7C;AAFS+D;AAiCT,SAASD,sBACPpC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIgC;AACJ,MAAI;AAGFA,aAASC,iBAAgBzC,MAAMO,OAAOP,MAAMoB,GAAG;EACjD,SAASsB,OAAO;AAKdL,aACE,oFACYK,iBAAiBC,QAAQD,MAAMpE,UAAUM,OAAO8D,KAAAA,CAAAA,EAAQ;AAEtE,WAAOlC;EACT;AACA,MAAIgC,WAAWhC,OAAW,QAAOA;AAGjC,MAAIgC,OAAOI,SAAS,WAAW,OAAOJ,OAAOK,WAAW,YAAYL,OAAOK,WAAW,IAAI;AACxF,WAAOrC;EACT;AACA,QAAM0B,QAAQhC,UAAUmB,KAAK,CAACyB,MAAMA,EAAElF,SAAS4E,OAAO3E,QAAQ;AAC9D,MAAIqE,UAAU1B,OAAW,QAAOA;AAEhC,SAAO;IACLiB,MAAM;IACN5D,UAAUqE,MAAMtE;;IAEhBkD,QAAQ0B,OAAOK;IACfnB,QAAQ;MAAED,MAAM;MAAS5D,UAAUqE,MAAMtE;IAAK;;IAE9CiE,UAAU;EACZ;AACF;AAxCSO;AAiDT,SAASH,gBACPlE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUmB,KAAK,CAACyB,MAAMA,EAAEC,gBAAgBvC,UAAazC,MAAMyB,WAAWsD,EAAEC,WAAW,CAAA;AAC5F;AANSd;AAST,SAASN,SAASqB,SAAiBpB,MAAwB;AACzD,MAAIA,SAASpB,OAAW,QAAO;IAAEiB,MAAM;IAAOuB;EAAQ;AACtD,QAAMC,SAASpE,KAAK+C,MAAM,MAAA;AAC1B,SAAO9C,cAAcmE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAEvB,MAAM;IAAQ1C,MAAMkE;EAAO,IAC7B;IAAExB,MAAM;IAAOuB;EAAQ;AAC7B;AANSrB;AAoBF,SAASwB,kBAAkBnD,OAA6B;AAC7D,QAAMoD,WAAW7B,kBAAkBvB,KAAAA;AACnC,MAAIoD,aAAa5C,OAAW,QAAO4C;AACnC,QAAM,IAAI7E,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB4C;AAiCT,IAAME,oBAAmD;EAC9D;IAAEzF,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIU,WAAW;EAAS;EACtF;IAAEnD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIU,WAAW;EAAU;EACrF;IAAEnD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIU,WAAW;EAAM;;AAgCtE,SAASuC,uBAAuBtD,OAA2B;AAChE,SAAOmD,kBAAkB;IACvB/B,KAAKpB,MAAMoB;IACXlB,WAAWF,MAAME,aAAamD;IAC9BnC,wBAAwBlB,MAAMkB,0BAA0B;IACxD,GAAIlB,MAAM4B,SAASpB,SAAY,CAAC,IAAI;MAAEoB,MAAM5B,MAAM4B;IAAK;IACvD,GAAI5B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgB+C;;;AC3fhB,SAASC,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA9Eb,OA8EaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","readStoredOAuth","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","inferred","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","stored","readStoredOAuth","cause","Error","type","access","p","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify"]}

package/dist/{chunk-AJIQS3WB.js → chunk-QXGSF6WX.js}

@@ -34,6 +34,13 @@ function readSecureJson(filePath, parse, empty) {
       value: empty
     };
   }
+  const fileMode = statSync(filePath).mode & 511;
+  if ((fileMode & FORBIDDEN_WRITE_BITS) !== 0) {
+    return {
+      value: empty,
+      error: new Error(`${filePath} is mode ${fileMode.toString(8)} \u2014 group or world writable, so another local user can decide what it says. It is being treated as empty: every entry in it has stopped applying. Fix with \`chmod 600 ${filePath}\`.`)
+    };
+  }
   if (raw.trim().length === 0) return {
     value: empty
   };
@@ -70,4 +77,4 @@ export {
   readSecureJson,
   writeSecureJson
 };
-//# sourceMappingURL=chunk-AJIQS3WB.js.map
+//# sourceMappingURL=chunk-QXGSF6WX.js.map

package/dist/chunk-QXGSF6WX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hooks/secure-store.ts"],"mappings":";;;;;AAuBA,SAASA,kBAAkB;AAC3B,SAASC,WAAWC,WAAWC,cAAcC,YAAYC,UAAUC,qBAAqB;AACxF,SAASC,SAASC,YAAY;AAG9B,IAAMC,uBAAuB;AAG7B,IAAMC,WAAW;AACjB,IAAMC,YAAY;AAqBX,SAASC,gBAAgBC,UAAgB;AAC9C,QAAMC,MAAMC,QAAQF,QAAAA;AAEpBG,YAAUF,KAAK;IAAEG,WAAW;IAAMC,MAAMR;EAAS,CAAA;AAGjD,QAAMQ,OAAOC,SAASL,GAAAA,EAAKI,OAAO;AAClC,OAAKA,OAAOT,0BAA0B,GAAG;AAEvCW,cAAUN,KAAKJ,QAAAA;AAEf,UAAMW,WAAWF,SAASL,GAAAA,EAAKI,OAAO;AACtC,SAAKG,WAAWZ,0BAA0B,GAAG;AAC3C,YAAM,IAAIa,MACR,GAAGR,GAAAA,YAAeO,SAASE,SAAS,CAAA,CAAA,2LAEQT,GAAAA,KAAQ;IAExD;EACF;AACF;AApBgBF;AA2BT,SAASY,eACdX,UACAY,OACAC,OAAQ;AAER,MAAIC;AACJ,MAAI;AAEFA,UAAMC,aAAaf,UAAU,MAAA;EAC/B,QAAQ;AAEN,WAAO;MAAEgB,OAAOH;IAAM;EACxB;AAUA,QAAMI,WAAWX,SAASN,QAAAA,EAAUK,OAAO;AAC3C,OAAKY,WAAWrB,0BAA0B,GAAG;AAC3C,WAAO;MACLoB,OAAOH;MACPK,OAAO,IAAIT,MACT,GAAGT,QAAAA,YAAoBiB,SAASP,SAAS,CAAA,CAAA,8KAEGV,QAAAA,KAAa;IAE7D;EACF;AAGA,MAAIc,IAAIK,KAAI,EAAGC,WAAW,EAAG,QAAO;IAAEJ,OAAOH;EAAM;AAEnD,MAAI;AACF,WAAO;MAAEG,OAAOJ,MAAME,GAAAA;IAAK;EAC7B,SAASO,OAAO;AACd,WAAO;MACLL,OAAOH;MACPK,OAAO,IAAIT,MACT,GAAGT,QAAAA,kIACiDqB,iBAAiBZ,QAAQY,MAAMC,UAAUC,OAAOF,KAAAA,CAAAA,EAAQ;IAEhH;EACF;AACF;AAhDgBV;AAiET,SAASa,YAAYxB,UAAgB;AAC1C,SAAOyB,KAAKvB,QAAQF,QAAAA,GAAW,IAAI0B,WAAAA,CAAAA,MAAkB;AACvD;AAFgBF;AAKT,SAASG,gBAAgB3B,UAAkB4B,WAAuB;AACvE7B,kBAAgBC,QAAAA;AAChB,QAAM6B,MAAML,YAAYxB,QAAAA;AAExB8B,gBAAcD,KAAKD,UAAAA,GAAa;IAAEG,UAAU;IAAQ1B,MAAMP;EAAU,CAAA;AAEpEkC,aAAWH,KAAK7B,QAAAA;AAQhBO,YAAUP,UAAUF,SAAAA;AACtB;AAfgB6B;","names":["randomUUID","chmodSync","mkdirSync","readFileSync","renameSync","statSync","writeFileSync","dirname","join","FORBIDDEN_WRITE_BITS","DIR_MODE","FILE_MODE","ensureSecureDir","filePath","dir","dirname","mkdirSync","recursive","mode","statSync","chmodSync","repaired","Error","toString","readSecureJson","parse","empty","raw","readFileSync","value","fileMode","error","trim","length","cause","message","String","tempPathFor","join","randomUUID","writeSecureJson","serialize","tmp","writeFileSync","encoding","renameSync"]}

package/dist/config.js

@@ -1,6 +1,6 @@
 import {
   ensureSecureDir
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   __name
 } from "./chunk-Z4QWC7IK.js";

package/dist/hooks.js

@@ -1,7 +1,7 @@
 import {
   readSecureJson,
   writeSecureJson
-} from "./chunk-AJIQS3WB.js";
+} from "./chunk-QXGSF6WX.js";
 import {
   hooksPlugin,
   inheritHooks

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/agents",
-  "version": "9.1.0",
+  "version": "9.2.0",
   "description": "AI agents as first-class citizens of the TheoKit pipeline. The fluent agent()/tool() builders compile to SDK Agent.create() (M31 builder-only authoring API).",
   "license": "Apache-2.0",
   "type": "module",

package/dist/chunk-AJIQS3WB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/hooks/secure-store.ts"],"mappings":";;;;;AAuBA,SAASA,kBAAkB;AAC3B,SAASC,WAAWC,WAAWC,cAAcC,YAAYC,UAAUC,qBAAqB;AACxF,SAASC,SAASC,YAAY;AAG9B,IAAMC,uBAAuB;AAG7B,IAAMC,WAAW;AACjB,IAAMC,YAAY;AAqBX,SAASC,gBAAgBC,UAAgB;AAC9C,QAAMC,MAAMC,QAAQF,QAAAA;AAEpBG,YAAUF,KAAK;IAAEG,WAAW;IAAMC,MAAMR;EAAS,CAAA;AAGjD,QAAMQ,OAAOC,SAASL,GAAAA,EAAKI,OAAO;AAClC,OAAKA,OAAOT,0BAA0B,GAAG;AAEvCW,cAAUN,KAAKJ,QAAAA;AAEf,UAAMW,WAAWF,SAASL,GAAAA,EAAKI,OAAO;AACtC,SAAKG,WAAWZ,0BAA0B,GAAG;AAC3C,YAAM,IAAIa,MACR,GAAGR,GAAAA,YAAeO,SAASE,SAAS,CAAA,CAAA,2LAEQT,GAAAA,KAAQ;IAExD;EACF;AACF;AApBgBF;AA2BT,SAASY,eACdX,UACAY,OACAC,OAAQ;AAER,MAAIC;AACJ,MAAI;AAEFA,UAAMC,aAAaf,UAAU,MAAA;EAC/B,QAAQ;AAEN,WAAO;MAAEgB,OAAOH;IAAM;EACxB;AAGA,MAAIC,IAAIG,KAAI,EAAGC,WAAW,EAAG,QAAO;IAAEF,OAAOH;EAAM;AAEnD,MAAI;AACF,WAAO;MAAEG,OAAOJ,MAAME,GAAAA;IAAK;EAC7B,SAASK,OAAO;AACd,WAAO;MACLH,OAAOH;MACPO,OAAO,IAAIX,MACT,GAAGT,QAAAA,kIACiDmB,iBAAiBV,QAAQU,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAEhH;EACF;AACF;AA5BgBR;AA6CT,SAASY,YAAYvB,UAAgB;AAC1C,SAAOwB,KAAKtB,QAAQF,QAAAA,GAAW,IAAIyB,WAAAA,CAAAA,MAAkB;AACvD;AAFgBF;AAKT,SAASG,gBAAgB1B,UAAkB2B,WAAuB;AACvE5B,kBAAgBC,QAAAA;AAChB,QAAM4B,MAAML,YAAYvB,QAAAA;AAExB6B,gBAAcD,KAAKD,UAAAA,GAAa;IAAEG,UAAU;IAAQzB,MAAMP;EAAU,CAAA;AAEpEiC,aAAWH,KAAK5B,QAAAA;AAQhBO,YAAUP,UAAUF,SAAAA;AACtB;AAfgB4B;","names":["randomUUID","chmodSync","mkdirSync","readFileSync","renameSync","statSync","writeFileSync","dirname","join","FORBIDDEN_WRITE_BITS","DIR_MODE","FILE_MODE","ensureSecureDir","filePath","dir","dirname","mkdirSync","recursive","mode","statSync","chmodSync","repaired","Error","toString","readSecureJson","parse","empty","raw","readFileSync","value","trim","length","cause","error","message","String","tempPathFor","join","randomUUID","writeSecureJson","serialize","tmp","writeFileSync","encoding","renameSync"]}