@theokit/agents 9.1.1 → 9.2.1

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @theokit/agents
 
+## 9.2.1
+
+### Patch Changes
+
+- **O resolver passa a LER a credencial de chave de API que `writeCredential` escreve.**
+
+  `writeCredential` persiste `{ provider, api_key }` no store, e o resolver lia de volta apenas a
+  variante `oauth` — usava `readStoredOAuth`, que por construcao so responde uma delas. O framework
+  conseguia GRAVAR uma chave que nada nele conseguia depois usar, e e por isso que o consumidor medido
+  mantinha o proprio leitor de arquivo.
+
+  Escrever sem conseguir ler e a mesma classe de defeito de uma capacidade que existe e nao se alcanca.
+
+  A proveniencia diz `{ kind: 'file', path }` — "por que esta chamando a Anthropic?" precisa ser
+  respondivel pelos dados, e "veio do store" e uma resposta diferente de "veio do ambiente". A
+  coerencia chave↔provider e aplicada tambem aqui, e um provider que o app nunca declarou continua
+  ignorado nas DUAS variantes.
+
+  Achado ao tentar a migracao do consumidor, nao ao revisar o desenho.
+
+## 9.2.0
+
+### Minor Changes
+
+- bb01ce8: **`resolveAgentCredential` — a montagem de autenticacao, para um app novo nao reescrever nenhuma.**
+
+  O framework ja entregava as PECAS (store no 0600, device flow RFC 8628, refresh, `writeCredential`) e
+  nao entregava a MONTAGEM. Medido no consumidor mais proximo: ele importa seis simbolos nossos e
+  escreve ~250 linhas em cima, e nenhuma delas e sobre o dominio dele — sao a politica de resolucao que
+  todo app de agente de terminal precisa e nenhum consegue importar.
+
+  Adicionado:
+
+  - **`DEFAULT_PROVIDERS`** — openrouter, anthropic, openai com variavel de ambiente, prioridade e
+    prefixo de chave. O consumidor abre com TRES tabelas escritas a mao dizendo isto; agora um app novo
+    nao escreve nenhuma. Prioridades espacadas de 10 para caber um provider entre dois padroes sem
+    renumerar.
+  - **`resolveAgentCredential({ env })`** — a chamada unica. Aplica os padroes e mantem todos
+    sobrescreviveis: `providers` para estreitar (um produto que so fala com um provider) ou estender
+    (um gateway self-hosted).
+  - **O pin de provider** (`THEOKIT_PROVIDER` por padrao) que se RECUSA a cair para outro. Cair
+    mandaria a requisicao — e a conta, e os dados — para um provider que o operador nao escolheu. Um
+    typo no nome tambem e recusado: um erro de digitacao nao pode desligar o pin em silencio.
+  - **Coerencia chave↔provider** via `keyPrefix`. `ANTHROPIC_API_KEY=sk-proj-…` e uma colagem na
+    variavel errada, pega aqui de graca em vez de virar um 401 remoto cuja mensagem nao fala do
+    desencontro.
+  - **`requireCredential`** e `CredentialNotFoundError` carregando ONDE procurou. "Nenhuma credencial
+    encontrada" sem a lista e a frase menos util que um CLI pode imprimir, e e por isso que o consumidor
+    carregava a propria.
+
+  `resolveCredential` segue devolvendo `undefined` — a forma nao-lancante e o que o caminho de primeira
+  execucao quer, e `requireCredential` e o opt-in de quem nao pode continuar. Duas funcoes em vez de uma
+  flag: a intencao fica visivel no call site.
+
+  Os prefixos vivem aqui E no SDK (`providerFromApiKeyPrefix`), o que nao e ideal e esta guardado: um
+  teste falha quando as duas tabelas discordam. Uma tabela so seria melhor, mas o simbolo do SDK esta
+  exportado em runtime e AUSENTE do `auth/index.d.ts` (medido contra 4.52.0), entao um import tipado nao
+  resolve. Guardado por CI em vez de esperado.
+
 ## 9.1.1
 
 ### Patch Changes

package/dist/auth.d.ts

@@ -216,6 +216,15 @@ interface ProviderDescriptor {
     readonly priority: number;
     /** Model-id prefix this provider claims (`openai/`). Absent ⇒ it claims none. */
     readonly modelPrefix?: string;
+    /**
+     * Prefix this provider stamps on its API keys (`sk-ant-`, `sk-or-`, `sk-`).
+     *
+     * Enables the coherence check: a key sitting in `ANTHROPIC_API_KEY` that starts with `sk-proj-`
+     * is a paste into the wrong variable, caught here for free instead of as a 401 from the wrong
+     * endpoint whose message says nothing about the mismatch. Absent means "this provider stamps no
+     * recognisable prefix", and nothing is checked — never a silent pass disguised as a check.
+     */
+    readonly keyPrefix?: string;
 }
 /**
  * The answer, with its provenance attached.
@@ -242,6 +251,30 @@ declare class ProviderPrefixMismatchError extends TheokitAgentError {
     readonly name = "ProviderPrefixMismatchError";
     constructor(provider: string, envKey: string, model: string);
 }
+/** Raised when a key's prefix contradicts the provider it was declared for. */
+declare class ProviderKeyMismatchError extends TheokitAgentError {
+    readonly provider: string;
+    readonly where: string;
+    readonly expectedPrefix: string;
+    readonly name = "ProviderKeyMismatchError";
+    constructor(provider: string, where: string, expectedPrefix: string);
+}
+/** Raised when a pinned provider has no credential, or names one the app never declared. */
+declare class DeclaredProviderError extends TheokitAgentError {
+    readonly name = "DeclaredProviderError";
+    constructor(message: string);
+}
+/**
+ * Raised by {@link requireCredential} when nothing is configured, carrying WHERE it looked.
+ *
+ * The list is the point. "No credential found" without it is the least useful sentence available,
+ * and it is why the closest measured consumer carried its own `attempts` array.
+ */
+declare class CredentialNotFoundError extends TheokitAgentError {
+    readonly attempts: readonly string[];
+    readonly name = "CredentialNotFoundError";
+    constructor(attempts: readonly string[]);
+}
 interface ResolveCredentialInput {
     /** The environment as the process sees it — already loaded, already interpolated. */
     readonly env: Readonly<Record<string, string | undefined>>;
@@ -263,6 +296,17 @@ interface ResolveCredentialInput {
      * the precedence a consumer already implements (declared env → per-provider env → file).
      */
     readonly store?: CredentialStoreConfig;
+    /**
+     * Name of the variable that PINS a provider (`PROVIDER`, `THEOCODE_PROVIDER`, …).
+     *
+     * When set and present, the pinned provider is the only one considered: if it has no credential,
+     * resolution THROWS rather than falling back. Falling back would send the request — and the bill,
+     * and the data — to a provider the operator did not choose, which is the one outcome a pin exists
+     * to prevent.
+     *
+     * The variable NAME is the app's (products disagree on it); the semantics are not.
+     */
+    readonly declaredProviderEnvVar?: string;
 }
 /** What `credentialSources` needs — the same declarations the resolver consults. */
 interface CredentialSourcesInput {
@@ -287,15 +331,70 @@ interface CredentialSourcesInput {
  * precedence claim the resolver does not honour.
  */
 declare function credentialSources(input: CredentialSourcesInput): readonly string[];
+declare function resolveCredential(input: ResolveCredentialInput): CredentialResolution | undefined;
 /**
- * Resolve which credential to use, and record where it came from.
+ * Like {@link resolveCredential}, but THROWS when nothing is configured — carrying where it looked.
+ *
+ * Two functions rather than a flag: the non-throwing shape is what a first-run path wants ("no key
+ * yet" is the ordinary state, and the next move is `theokit auth login`), and the throwing shape is
+ * what a path that cannot continue wants. A boolean parameter would make the caller's intent
+ * invisible at the call site, and the two intents are genuinely different.
  *
- * Returns `undefined` when nothing is configured: a missing key is the ordinary first-run state, and
- * the caller's next move is to print "run `theokit auth login`" — which a thrown error makes harder,
- * not easier. A prefix that names a provider with no credential DOES throw, because that is a
- * contradiction rather than an absence.
+ * The attempts list is the reason this exists: "no credential found" without saying WHERE it looked
+ * is the least useful sentence a CLI can print, and it is why the closest measured consumer carried
+ * its own.
  */
-declare function resolveCredential(input: ResolveCredentialInput): CredentialResolution | undefined;
+declare function requireCredential(input: ResolveCredentialInput): CredentialResolution;
+/**
+ * The providers a TheoKit agent app starts with — so a new app writes no table at all.
+ *
+ * Measured against the closest real consumer: it opens with three hand-written tables (`PROVIDERS`,
+ * `PREFIXES`, `ENV_KEYS`) saying what every terminal agent app says. That is not its domain; it is
+ * the cost of shipping a resolver whose only input is the argument the app must build.
+ *
+ * ## Why the prefixes live here as well as in the SDK
+ *
+ * `providerFromApiKeyPrefix` owns the same knowledge, and one table would be better. It cannot be
+ * the only one today: the symbol is exported at runtime and absent from the SDK's `auth/index.d.ts`
+ * (measured against 4.52.0), so a typed import does not resolve. Rather than block, the table is
+ * here AND a drift-guard test fails when the two disagree — the same hand-maintained-table hazard
+ * that produced the longest-prefix bug is caught by CI instead of hoped away.
+ *
+ * ## Priorities, and why they are spaced
+ *
+ * Distinct and 10 apart: an app that wants to slot a provider between two defaults can, without
+ * renumbering. Order is `openrouter → anthropic → openai`, matching the consumer's measured chain.
+ */
+declare const DEFAULT_PROVIDERS: readonly ProviderDescriptor[];
+/** Everything {@link resolveAgentCredential} needs, and nothing an app has to invent. */
+interface AgentCredentialInput {
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly home?: string;
+    readonly model?: string;
+    readonly store?: CredentialStoreConfig;
+    /**
+     * Providers to accept. Defaults to {@link DEFAULT_PROVIDERS}.
+     *
+     * Present so an app can NARROW (a product that only talks to Anthropic) or EXTEND (a self-hosted
+     * gateway) — the two real reasons to disagree with the default. Which providers exist stays app
+     * policy; not having to state it to get started is the point.
+     */
+    readonly providers?: readonly ProviderDescriptor[];
+    /** Variable that pins a provider. Defaults to `THEOKIT_PROVIDER`. */
+    readonly declaredProviderEnvVar?: string;
+}
+/**
+ * The one call a new app makes: given the environment, which credential do I use?
+ *
+ * `resolveCredential` takes the full policy as arguments, which is right for an app that has
+ * opinions and wrong as a starting point — a new app should not have to state a provider table, a
+ * precedence order and a pin variable before it can read a key. This applies the defaults and keeps
+ * every one of them overridable.
+ *
+ * Throws when nothing is configured, carrying WHERE it looked: a new app's first run is exactly the
+ * case that needs the list, and printing the error is the whole handling it needs.
+ */
+declare function resolveAgentCredential(input: AgentCredentialInput): CredentialResolution;
 
 /** What a caller asks about: may THIS tool run THIS command in THIS place? */
 interface PermissionQuery {
@@ -344,4 +443,4 @@ declare class PermissionStore {
     expired(): readonly Grant[];
 }
 
-export { type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, type DeviceAuthProvider, type Grant, type GrantOptions, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, credentialSources, loginWithDevice, resolveCredential };
+export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Grant, type GrantOptions, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type SourceOrigin, credentialSources, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential };

package/dist/auth.js

@@ -127,7 +127,7 @@ var AuthProvider = class _AuthProvider {
 };
 
 // src/auth-entry.ts
-import { assertSecureModes, authFilePath as authFilePath2, CredentialError, credentialHome, readAuthFile, readStoredOAuth as readStoredOAuth3, writeCredential } from "@theokit/sdk/auth";
+import { assertSecureModes, authFilePath as authFilePath2, CredentialError, credentialHome, readAuthFile as readAuthFile2, readStoredOAuth as readStoredOAuth2, writeCredential } from "@theokit/sdk/auth";
 import { deviceLogin, openaiDeviceLogin as openaiDeviceLogin3, pollDeviceToken, requestDeviceCode } from "@theokit/sdk/auth";
 import { ensureFreshCredential as ensureFreshCredential2, extractAccountId, persistOAuthTokens as persistOAuthTokens2, refreshOAuthTokens } from "@theokit/sdk/auth";
 
@@ -204,7 +204,7 @@ __name(loginWithDevice, "loginWithDevice");
 // src/auth/resolve-credential.ts
 import { readFileSync } from "fs";
 import { join } from "path";
-import { readStoredOAuth as readStoredOAuth2 } from "@theokit/sdk/auth";
+import { readAuthFile } from "@theokit/sdk/auth";
 import { TheokitAgentError } from "@theokit/sdk/errors";
 var ProviderPrefixMismatchError = class extends TheokitAgentError {
   static {
@@ -215,6 +215,47 @@ var ProviderPrefixMismatchError = class extends TheokitAgentError {
     super(`model "${model}" names provider "${provider}", but no credential for it was found. Set ${envKey}, or drop the prefix to let the resolver pick by precedence. Falling back to another provider would send the request to a model you did not ask for \u2014 and bill you for it.`);
   }
 };
+var ProviderKeyMismatchError = class extends TheokitAgentError {
+  static {
+    __name(this, "ProviderKeyMismatchError");
+  }
+  provider;
+  where;
+  expectedPrefix;
+  name = "ProviderKeyMismatchError";
+  constructor(provider, where, expectedPrefix) {
+    super(`${where}: the key declared for provider "${provider}" does not start with "${expectedPrefix}". Either the provider or the key is wrong, and sending it would fail mid-request against the wrong endpoint.`, {
+      code: "provider_key_mismatch",
+      isRetryable: false
+    }), this.provider = provider, this.where = where, this.expectedPrefix = expectedPrefix;
+  }
+};
+var DeclaredProviderError = class extends TheokitAgentError {
+  static {
+    __name(this, "DeclaredProviderError");
+  }
+  name = "DeclaredProviderError";
+  constructor(message) {
+    super(message, {
+      code: "declared_provider_unusable",
+      isRetryable: false
+    });
+  }
+};
+var CredentialNotFoundError = class extends TheokitAgentError {
+  static {
+    __name(this, "CredentialNotFoundError");
+  }
+  attempts;
+  name = "CredentialNotFoundError";
+  constructor(attempts) {
+    super(`no provider credential found. Tried, in order:
+` + attempts.map((a, i) => `  ${String(i + 1)}. ${a}`).join("\n"), {
+      code: "credential_not_found",
+      isRetryable: false
+    }), this.attempts = attempts;
+  }
+};
 function declaredNames(path) {
   let raw;
   try {
@@ -245,10 +286,42 @@ function credentialSources(input) {
   return sources;
 }
 __name(credentialSources, "credentialSources");
+function assertKeyMatchesProvider(descriptor, apiKey, where) {
+  if (descriptor.keyPrefix === void 0) return;
+  if (apiKey.startsWith(descriptor.keyPrefix)) return;
+  throw new ProviderKeyMismatchError(descriptor.name, where, descriptor.keyPrefix);
+}
+__name(assertKeyMatchesProvider, "assertKeyMatchesProvider");
+function pinnedProvider(input, byPriority) {
+  if (input.declaredProviderEnvVar === void 0) return void 0;
+  const declared = input.env[input.declaredProviderEnvVar]?.trim();
+  if (declared === void 0 || declared === "") return void 0;
+  const descriptor = byPriority.find((d) => d.name === declared);
+  if (descriptor === void 0) {
+    throw new DeclaredProviderError(`${input.declaredProviderEnvVar} is "${declared}" \u2014 expected one of ${byPriority.map((d) => d.name).join(", ")}.`);
+  }
+  return descriptor;
+}
+__name(pinnedProvider, "pinnedProvider");
 function resolveCredential(input) {
   const byPriority = [
     ...input.providers
   ].sort((a, b) => a.priority - b.priority);
+  const pinned = pinnedProvider(input, byPriority);
+  if (pinned !== void 0) {
+    const apiKey = input.env[pinned.envKey];
+    if (apiKey === void 0 || apiKey === "") {
+      throw new DeclaredProviderError(`provider "${pinned.name}" is pinned via ${String(input.declaredProviderEnvVar)} but no key for it was found (looked at ${pinned.envKey}). Refusing to fall back to a different provider's credential.`);
+    }
+    assertKeyMatchesProvider(pinned, apiKey, pinned.envKey);
+    return {
+      kind: "api-key",
+      provider: pinned.name,
+      apiKey,
+      source: originOf(pinned.envKey, input.home),
+      inferred: false
+    };
+  }
   const available = byPriority.flatMap((descriptor) => {
     const apiKey = input.env[descriptor.envKey];
     return apiKey === void 0 || apiKey === "" ? [] : [
@@ -264,6 +337,7 @@ function resolveCredential(input) {
     throw new ProviderPrefixMismatchError(claimed.name, claimed.envKey, input.model ?? "");
   }
   if (found === void 0) return storedOAuthResolution(input, byPriority);
+  assertKeyMatchesProvider(found.descriptor, found.apiKey, found.descriptor.envKey);
   return {
     kind: "api-key",
     provider: found.descriptor.name,
@@ -277,21 +351,40 @@ function diagnose(message) {
   console.warn(`[@theokit/agents] ${message}`);
 }
 __name(diagnose, "diagnose");
+function filePathOf(input) {
+  const config = input.store;
+  return join(config.dirName ?? ".theokit", config.fileName ?? "auth.json");
+}
+__name(filePathOf, "filePathOf");
 function storedOAuthResolution(input, providers) {
   if (input.store === void 0) return void 0;
   let stored;
   try {
-    stored = readStoredOAuth2(input.store, input.env);
+    stored = readAuthFile(input.store, input.env);
   } catch (cause) {
     diagnose(`the configured credential store could not be read; treating it as absent. Cause: ${cause instanceof Error ? cause.message : String(cause)}`);
     return void 0;
   }
   if (stored === void 0) return void 0;
-  if (stored.type !== "oauth" || typeof stored.access !== "string" || stored.access === "") {
-    return void 0;
-  }
   const found = providers.find((p) => p.name === stored.provider);
   if (found === void 0) return void 0;
+  if (stored.type !== "oauth") {
+    const apiKey = stored.api_key;
+    if (typeof apiKey !== "string" || apiKey === "") return void 0;
+    assertKeyMatchesProvider(found, apiKey, filePathOf(input));
+    return {
+      kind: "api-key",
+      provider: found.name,
+      apiKey,
+      source: {
+        kind: "file",
+        path: filePathOf(input)
+      },
+      // The store names the provider explicitly, so nothing was inferred.
+      inferred: false
+    };
+  }
+  if (typeof stored.access !== "string" || stored.access === "") return void 0;
   return {
     kind: "oauth",
     provider: found.name,
@@ -326,6 +419,56 @@ function originOf(varName, home) {
   };
 }
 __name(originOf, "originOf");
+function requireCredential(input) {
+  const resolved = resolveCredential(input);
+  if (resolved !== void 0) return resolved;
+  throw new CredentialNotFoundError(credentialSources({
+    providers: input.providers,
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- `CredentialStoreConfig` does not resolve (see the import note at the top of this file); the value is only forwarded, never inspected
+    ...input.store === void 0 ? {} : {
+      store: input.store
+    }
+  }));
+}
+__name(requireCredential, "requireCredential");
+var DEFAULT_PROVIDERS = [
+  {
+    name: "openrouter",
+    envKey: "OPENROUTER_API_KEY",
+    priority: 10,
+    keyPrefix: "sk-or-"
+  },
+  {
+    name: "anthropic",
+    envKey: "ANTHROPIC_API_KEY",
+    priority: 20,
+    keyPrefix: "sk-ant-"
+  },
+  {
+    name: "openai",
+    envKey: "OPENAI_API_KEY",
+    priority: 30,
+    keyPrefix: "sk-"
+  }
+];
+function resolveAgentCredential(input) {
+  return requireCredential({
+    env: input.env,
+    providers: input.providers ?? DEFAULT_PROVIDERS,
+    declaredProviderEnvVar: input.declaredProviderEnvVar ?? "THEOKIT_PROVIDER",
+    ...input.home === void 0 ? {} : {
+      home: input.home
+    },
+    ...input.model === void 0 ? {} : {
+      model: input.model
+    },
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- same unresolved `CredentialStoreConfig`; forwarded verbatim to the resolver
+    ...input.store === void 0 ? {} : {
+      store: input.store
+    }
+  });
+}
+__name(resolveAgentCredential, "resolveAgentCredential");
 
 // src/auth/permission-store.ts
 import { realpathSync } from "fs";
@@ -429,7 +572,11 @@ export {
   CODEX_CLIENT_ID_ENV_VAR,
   CODEX_PROVIDER,
   CredentialError,
+  CredentialNotFoundError,
+  DEFAULT_PROVIDERS,
+  DeclaredProviderError,
   PermissionStore,
+  ProviderKeyMismatchError,
   ProviderPrefixMismatchError,
   assertSecureModes,
   authFilePath2 as authFilePath,
@@ -442,10 +589,12 @@ export {
   openaiDeviceLogin3 as openaiDeviceLogin,
   persistOAuthTokens2 as persistOAuthTokens,
   pollDeviceToken,
-  readAuthFile,
-  readStoredOAuth3 as readStoredOAuth,
+  readAuthFile2 as readAuthFile,
+  readStoredOAuth2 as readStoredOAuth,
   refreshOAuthTokens,
   requestDeviceCode,
+  requireCredential,
+  resolveAgentCredential,
   resolveCredential,
   writeCredential
 };

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/permission-store.ts"],"mappings":";;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,cACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;;;ACtFP,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SAASC,mBAAAA,wBAAmD;AAC5D,SAASC,yBAAyB;AAqE3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EA9EjD,OA8EiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAiCA,SAASE,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,WAAWD,EAAEC,QAAQ,EACtCC,IAAI,CAACC,eAAeA,WAAW5B,MAAM;AAIxC,MAAIoB,MAAMS,UAAUC,QAAW;AAC7B,UAAMC,SAASX,MAAMS;AACrBR,YAAQW,KAAKC,KAAKF,OAAOG,WAAW,YAAYH,OAAOI,YAAY,WAAA,CAAA;EACrE;AACA,SAAOd;AACT;AAZgBF;AAsBT,SAASiB,kBAAkBhB,OAA6B;AAC7D,QAAMiB,aAAa;OAAIjB,MAAME;IAAWC,KAAK,CAACC,GAAGC,MAAMD,EAAEE,WAAWD,EAAEC,QAAQ;AAS9E,QAAMY,YAAYD,WAAWE,QAAQ,CAACX,eAAAA;AACpC,UAAMY,SAASpB,MAAMqB,IAAIb,WAAW5B,MAAM;AAC1C,WAAOwC,WAAWV,UAAaU,WAAW,KAAK,CAAA,IAAK;MAAC;QAAEZ;QAAYY;MAAO;;EAC5E,CAAA;AAEA,QAAME,UAAUC,gBAAgBvB,MAAMnB,OAAOoC,UAAAA;AAC7C,QAAMO,QACJF,YAAYZ,SACRQ,UAAU,CAAA,IACVA,UAAUO,KAAK,CAACC,cAAcA,UAAUlB,eAAec,OAAAA;AAE7D,MAAIA,YAAYZ,UAAac,UAAUd,QAAW;AAChD,UAAM,IAAIlC,4BAA4B8C,QAAQ5C,MAAM4C,QAAQ1C,QAAQoB,MAAMnB,SAAS,EAAA;EACrF;AACA,MAAI2C,UAAUd,OAAW,QAAOiB,sBAAsB3B,OAAOiB,UAAAA;AAE7D,SAAO;IACLW,MAAM;IACNjD,UAAU6C,MAAMhB,WAAW9B;IAC3B0C,QAAQI,MAAMJ;IACdS,QAAQC,SAASN,MAAMhB,WAAW5B,QAAQoB,MAAM+B,IAAI;IACpDC,UAAUV,YAAYZ;EACxB;AACF;AAjCgBM;AA0ChB,SAASiB,SAASC,SAAe;AAC/BC,UAAQC,KAAK,qBAAqBF,OAAAA,EAAS;AAC7C;AAFSD;AAiCT,SAASN,sBACP3B,OACAE,WAAwC;AAExC,MAAIF,MAAMS,UAAUC,OAAW,QAAOA;AAEtC,MAAI2B;AACJ,MAAI;AAGFA,aAASC,iBAAgBtC,MAAMS,OAAOT,MAAMqB,GAAG;EACjD,SAASkB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAML,UAAUO,OAAOF,KAAAA,CAAAA,EAAQ;AAEtE,WAAO7B;EACT;AACA,MAAI2B,WAAW3B,OAAW,QAAOA;AAGjC,MAAI2B,OAAOK,SAAS,WAAW,OAAOL,OAAOM,WAAW,YAAYN,OAAOM,WAAW,IAAI;AACxF,WAAOjC;EACT;AACA,QAAMc,QAAQtB,UAAUuB,KAAK,CAACmB,MAAMA,EAAElE,SAAS2D,OAAO1D,QAAQ;AAC9D,MAAI6C,UAAUd,OAAW,QAAOA;AAEhC,SAAO;IACLkB,MAAM;IACNjD,UAAU6C,MAAM9C;;IAEhB0C,QAAQiB,OAAOM;IACfd,QAAQ;MAAED,MAAM;MAASjD,UAAU6C,MAAM9C;IAAK;;IAE9CsD,UAAU;EACZ;AACF;AAxCSL;AAiDT,SAASJ,gBACP1C,OACAqB,WAAwC;AAExC,MAAIrB,UAAU6B,OAAW,QAAOA;AAChC,SAAOR,UAAUuB,KAAK,CAACmB,MAAMA,EAAEC,gBAAgBnC,UAAa7B,MAAMW,WAAWoD,EAAEC,WAAW,CAAA;AAC5F;AANStB;AAST,SAASO,SAASgB,SAAiBf,MAAwB;AACzD,MAAIA,SAASrB,OAAW,QAAO;IAAEkB,MAAM;IAAOkB;EAAQ;AACtD,QAAMC,SAASlC,KAAKkB,MAAM,MAAA;AAC1B,SAAOjD,cAAciE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAElB,MAAM;IAAQ7C,MAAMgE;EAAO,IAC7B;IAAEnB,MAAM;IAAOkB;EAAQ;AAC7B;AANShB;;;ACjST,SAASmB,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA9Eb,OA8EaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","readStoredOAuth","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","a","b","priority","map","descriptor","store","undefined","config","push","join","dirName","fileName","resolveCredential","byPriority","available","flatMap","apiKey","env","claimed","claimedProvider","found","find","candidate","storedOAuthResolution","kind","source","originOf","home","inferred","diagnose","message","console","warn","stored","readStoredOAuth","cause","Error","String","type","access","p","modelPrefix","varName","dotenv","has","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/permission-store.ts"],"mappings":";;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAE7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EAEF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACrLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;;;ACtFP,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAOrB,SAASC,oBAAgD;AACzD,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EAvFjD,OAuFiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAnG9C,OAmG8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EArH3C,OAqH2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAnI7C,OAmI6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAEb,MAAIqC,WAAWS,cAAcP,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWS,SAAS,EAAG;AAC7C,QAAM,IAAI/C,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWS,SAAS;AACjF;AARSF;AAgBT,SAASG,eACPhB,OACAiB,YAAyC;AAEzC,MAAIjB,MAAMkB,2BAA2BV,OAAW,QAAOA;AACvD,QAAMW,WAAWnB,MAAMoB,IAAIpB,MAAMkB,sBAAsB,GAAG3B,KAAAA;AAC1D,MAAI4B,aAAaX,UAAaW,aAAa,GAAI,QAAOX;AAEtD,QAAMF,aAAaW,WAAWI,KAAK,CAACC,MAAMA,EAAE1D,SAASuD,QAAAA;AACrD,MAAIb,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMkB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAWxC,IAAI,CAAC6C,MAAMA,EAAE1D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSU;AAkBF,SAASO,kBAAkBvB,OAA6B;AAC7D,QAAMiB,aAAa;OAAIjB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMmB,SAASR,eAAehB,OAAOiB,UAAAA;AACrC,MAAIO,WAAWhB,QAAW;AACxB,UAAMM,SAASd,MAAMoB,IAAII,OAAO1D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAamD,OAAO5D,IAAI,mBAAmBgB,OAAOoB,MAAMkB,sBAAsB,CAAA,2CACzCM,OAAO1D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBW,QAAQV,QAAQU,OAAO1D,MAAM;AACtD,WAAO;MACL2D,MAAM;MACN5D,UAAU2D,OAAO5D;MACjBkD;MACAY,QAAQC,SAASH,OAAO1D,QAAQkC,MAAM4B,IAAI;MAC1CC,UAAU;IACZ;EACF;AASA,QAAMC,YAAYb,WAAWc,QAAQ,CAACzB,eAAAA;AACpC,UAAMQ,SAASd,MAAMoB,IAAId,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMkB,UAAUC,gBAAgBjC,MAAMjC,OAAOkD,UAAAA;AAC7C,QAAMiB,QACJF,YAAYxB,SACRsB,UAAU,CAAA,IACVA,UAAUT,KAAK,CAACc,cAAcA,UAAU7B,eAAe0B,OAAAA;AAE7D,MAAIA,YAAYxB,UAAa0B,UAAU1B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BsE,QAAQpE,MAAMoE,QAAQlE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAImE,UAAU1B,OAAW,QAAO4B,sBAAsBpC,OAAOiB,UAAAA;AAE7DJ,2BAAyBqB,MAAM5B,YAAY4B,MAAMpB,QAAQoB,MAAM5B,WAAWxC,MAAM;AAEhF,SAAO;IACL2D,MAAM;IACN5D,UAAUqE,MAAM5B,WAAW1C;IAC3BkD,QAAQoB,MAAMpB;IACdY,QAAQC,SAASO,MAAM5B,WAAWxC,QAAQkC,MAAM4B,IAAI;IACpDC,UAAUG,YAAYxB;EACxB;AACF;AA1DgBe;AAmEhB,SAASc,SAAS/D,SAAe;AAC/BgE,UAAQC,KAAK,qBAAqBjE,OAAAA,EAAS;AAC7C;AAFS+D;AAkCT,SAASG,WAAWxC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS4B;AAKT,SAASJ,sBACPpC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIiC;AACJ,MAAI;AAKFA,aAASC,aAAa1C,MAAMO,OAAOP,MAAMoB,GAAG;EAC9C,SAASuB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMrE,UAAUM,OAAO+D,KAAAA,CAAAA,EAAQ;AAEtE,WAAOnC;EACT;AACA,MAAIiC,WAAWjC,OAAW,QAAOA;AACjC,QAAM0B,QAAQhC,UAAUmB,KAAK,CAACwB,MAAMA,EAAEjF,SAAS6E,OAAO5E,QAAQ;AAG9D,MAAIqE,UAAU1B,OAAW,QAAOA;AAMhC,MAAIiC,OAAOK,SAAS,SAAS;AAC3B,UAAMhC,SAAU2B,OAA4CM;AAC5D,QAAI,OAAOjC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBqB,OAAOpB,QAAQ0B,WAAWxC,KAAAA,CAAAA;AACnD,WAAO;MACLyB,MAAM;MACN5D,UAAUqE,MAAMtE;MAChBkD;MACAY,QAAQ;QAAED,MAAM;QAAQ1C,MAAMyD,WAAWxC,KAAAA;MAAO;;MAEhD6B,UAAU;IACZ;EACF;AAIA,MAAI,OAAOY,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOxC;AAEtE,SAAO;IACLiB,MAAM;IACN5D,UAAUqE,MAAMtE;;IAEhBkD,QAAQ2B,OAAOO;IACftB,QAAQ;MAAED,MAAM;MAAS5D,UAAUqE,MAAMtE;IAAK;;IAE9CiE,UAAU;EACZ;AACF;AA7DSO;AAsET,SAASH,gBACPlE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUmB,KAAK,CAACwB,MAAMA,EAAEI,gBAAgBzC,UAAazC,MAAMyB,WAAWqD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASN,SAASuB,SAAiBtB,MAAwB;AACzD,MAAIA,SAASpB,OAAW,QAAO;IAAEiB,MAAM;IAAOyB;EAAQ;AACtD,QAAMC,SAAStE,KAAK+C,MAAM,MAAA;AAC1B,SAAO9C,cAAcqE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAEzB,MAAM;IAAQ1C,MAAMoE;EAAO,IAC7B;IAAE1B,MAAM;IAAOyB;EAAQ;AAC7B;AANSvB;AAoBF,SAAS0B,kBAAkBrD,OAA6B;AAC7D,QAAMsD,WAAW/B,kBAAkBvB,KAAAA;AACnC,MAAIsD,aAAa9C,OAAW,QAAO8C;AACnC,QAAM,IAAI/E,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB8C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE3F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIU,WAAW;EAAS;EACtF;IAAEnD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIU,WAAW;EAAU;EACrF;IAAEnD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIU,WAAW;EAAM;;AAgCtE,SAASyC,uBAAuBxD,OAA2B;AAChE,SAAOqD,kBAAkB;IACvBjC,KAAKpB,MAAMoB;IACXlB,WAAWF,MAAME,aAAaqD;IAC9BrC,wBAAwBlB,MAAMkB,0BAA0B;IACxD,GAAIlB,MAAM4B,SAASpB,SAAY,CAAC,IAAI;MAAEoB,MAAM5B,MAAM4B;IAAK;IACvD,GAAI5B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBiD;;;ACthBhB,SAASC,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA9Eb,OA8EaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","inferred","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/agents",
-  "version": "9.1.1",
+  "version": "9.2.1",
   "description": "AI agents as first-class citizens of the TheoKit pipeline. The fluent agent()/tool() builders compile to SDK Agent.create() (M31 builder-only authoring API).",
   "license": "Apache-2.0",
   "type": "module",