@theokit/sdk 0.0.0-compat-580-20260905204608

package/dist/chunk-EPSICJLZ.js

@@ -0,0 +1,79 @@
+// src/internal/runtime/lifecycle/run-to-completion.ts
+var DEFAULT_MAX_ROUNDS = 5;
+var DEFAULT_CONTINUATION_PROMPT = "Continue from where you left off and finish the task. If it is already complete, give the final answer.";
+function isEmptyRound(result) {
+  return (result.result ?? "").trim() === "";
+}
+function classifyRound(result, round, maxRounds, emptyStreak) {
+  if (result.stoppedByDoomLoop === true) return "no_progress";
+  if (result.stoppedAtIterationLimit !== true) return "done";
+  if (isEmptyRound(result) && emptyStreak >= 1) return "no_progress";
+  if (round >= maxRounds) return "step_limit";
+  return "continue";
+}
+function addUsage(acc, u) {
+  if (u === void 0) return acc;
+  const inputTokens = (acc?.inputTokens ?? 0) + u.inputTokens;
+  const outputTokens = (acc?.outputTokens ?? 0) + u.outputTokens;
+  const sumOpt = (a, b) => a === void 0 && b === void 0 ? void 0 : (a ?? 0) + (b ?? 0);
+  return {
+    inputTokens,
+    outputTokens,
+    totalTokens: inputTokens + outputTokens,
+    cacheReadTokens: sumOpt(acc?.cacheReadTokens, u.cacheReadTokens),
+    cacheWriteTokens: sumOpt(acc?.cacheWriteTokens, u.cacheWriteTokens),
+    reasoningTokens: sumOpt(acc?.reasoningTokens, u.reasoningTokens)
+  };
+}
+function buildResult(terminal, rounds, lastResult, usage) {
+  return { terminal, rounds, lastResult, ...usage !== void 0 ? { usage } : {} };
+}
+async function continuationTail(round, lastResult, usage, onTruncated, signal) {
+  await onTruncated?.({ round });
+  return signal?.aborted === true ? buildResult("step_limit", round, lastResult, usage) : void 0;
+}
+function resolveContinuation(options) {
+  return {
+    maxRounds: options?.maxRounds ?? DEFAULT_MAX_ROUNDS,
+    continuationPrompt: options?.continuationPrompt ?? DEFAULT_CONTINUATION_PROMPT,
+    onTruncated: options?.onTruncated,
+    signal: options?.signal,
+    sendOptions: options?.sendOptions,
+    state: { usage: void 0, emptyStreak: 0 }
+  };
+}
+function promptForRound(round, message, continuationPrompt) {
+  return round === 0 ? message : continuationPrompt;
+}
+async function stepRound(agent, prompt, sendOptions, round, maxRounds, state) {
+  const roundOptions = round === 0 ? sendOptions : { ...sendOptions ?? {}, origin: { kind: "auto-continuation" } };
+  const run = await agent.send(prompt, roundOptions);
+  const result = await run.wait();
+  const usage = addUsage(state.usage, result.usage);
+  const decision = classifyRound(result, round, maxRounds, state.emptyStreak);
+  if (decision !== "continue") return { terminal: buildResult(decision, round, result, usage) };
+  const emptyStreak = isEmptyRound(result) ? state.emptyStreak + 1 : 0;
+  return { next: { usage, emptyStreak }, lastResult: result };
+}
+async function runToCompletionImpl(agent, message, options) {
+  const cfg = resolveContinuation(options);
+  let state = cfg.state;
+  for (let round = 0; ; round += 1) {
+    const prompt = promptForRound(round, message, cfg.continuationPrompt);
+    const outcome = await stepRound(agent, prompt, cfg.sendOptions, round, cfg.maxRounds, state);
+    if ("terminal" in outcome) return outcome.terminal;
+    state = outcome.next;
+    const aborted = await continuationTail(
+      round,
+      outcome.lastResult,
+      state.usage,
+      cfg.onTruncated,
+      cfg.signal
+    );
+    if (aborted !== void 0) return aborted;
+  }
+}
+
+export { DEFAULT_CONTINUATION_PROMPT, DEFAULT_MAX_ROUNDS, addUsage, buildResult, classifyRound, continuationTail, isEmptyRound, promptForRound, resolveContinuation, runToCompletionImpl };
+//# sourceMappingURL=chunk-EPSICJLZ.js.map
+//# sourceMappingURL=chunk-EPSICJLZ.js.map

package/dist/chunk-EPSICJLZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/lifecycle/run-to-completion.ts"],"names":[],"mappings":";AA+BO,IAAM,kBAAA,GAAqB;AAE3B,IAAM,2BAAA,GACX;AAQK,SAAS,aAAa,MAAA,EAA4B;AACvD,EAAA,OAAA,CAAQ,MAAA,CAAO,MAAA,IAAU,EAAA,EAAI,IAAA,EAAK,KAAM,EAAA;AAC1C;AASO,SAAS,aAAA,CACd,MAAA,EACA,KAAA,EACA,SAAA,EACA,WAAA,EACe;AAIf,EAAA,IAAI,MAAA,CAAO,iBAAA,KAAsB,IAAA,EAAM,OAAO,aAAA;AAC9C,EAAA,IAAI,MAAA,CAAO,uBAAA,KAA4B,IAAA,EAAM,OAAO,MAAA;AAEpD,EAAA,IAAI,YAAA,CAAa,MAAM,CAAA,IAAK,WAAA,IAAe,GAAG,OAAO,aAAA;AACrD,EAAA,IAAI,KAAA,IAAS,WAAW,OAAO,YAAA;AAC/B,EAAA,OAAO,UAAA;AACT;AAWO,SAAS,QAAA,CACd,KACA,CAAA,EACwB;AACxB,EAAA,IAAI,CAAA,KAAM,QAAW,OAAO,GAAA;AAC5B,EAAA,MAAM,WAAA,GAAA,CAAe,GAAA,EAAK,WAAA,IAAe,CAAA,IAAK,CAAA,CAAE,WAAA;AAChD,EAAA,MAAM,YAAA,GAAA,CAAgB,GAAA,EAAK,YAAA,IAAgB,CAAA,IAAK,CAAA,CAAE,YAAA;AAClD,EAAA,MAAM,MAAA,GAAS,CAAC,CAAA,EAAuB,CAAA,KACrC,CAAA,KAAM,MAAA,IAAa,CAAA,KAAM,MAAA,GAAY,MAAA,GAAA,CAAa,CAAA,IAAK,CAAA,KAAM,CAAA,IAAK,CAAA,CAAA;AACpE,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,YAAA;AAAA,IACA,aAAa,WAAA,GAAc,YAAA;AAAA,IAC3B,eAAA,EAAiB,MAAA,CAAO,GAAA,EAAK,eAAA,EAAiB,EAAE,eAAe,CAAA;AAAA,IAC/D,gBAAA,EAAkB,MAAA,CAAO,GAAA,EAAK,gBAAA,EAAkB,EAAE,gBAAgB,CAAA;AAAA,IAClE,eAAA,EAAiB,MAAA,CAAO,GAAA,EAAK,eAAA,EAAiB,EAAE,eAAe;AAAA,GACjE;AACF;AAMO,SAAS,WAAA,CACd,QAAA,EACA,MAAA,EACA,UAAA,EACA,KAAA,EACuB;AACvB,EAAA,OAAO,EAAE,QAAA,EAAU,MAAA,EAAQ,UAAA,EAAY,GAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAM,GAAI,EAAC,EAAG;AACnF;AASA,eAAsB,gBAAA,CACpB,KAAA,EACA,UAAA,EACA,KAAA,EACA,aACA,MAAA,EAC4C;AAC5C,EAAA,MAAM,WAAA,GAAc,EAAE,KAAA,EAAO,CAAA;AAC7B,EAAA,OAAO,MAAA,EAAQ,YAAY,IAAA,GAAO,WAAA,CAAY,cAAc,KAAA,EAAO,UAAA,EAAY,KAAK,CAAA,GAAI,MAAA;AAC1F;AAsBO,SAAS,oBAAoB,OAAA,EAAwD;AAC1F,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,SAAS,SAAA,IAAa,kBAAA;AAAA,IACjC,kBAAA,EAAoB,SAAS,kBAAA,IAAsB,2BAAA;AAAA,IACnD,aAAa,OAAA,EAAS,WAAA;AAAA,IACtB,QAAQ,OAAA,EAAS,MAAA;AAAA,IACjB,aAAa,OAAA,EAAS,WAAA;AAAA,IACtB,KAAA,EAAO,EAAE,KAAA,EAAO,MAAA,EAAW,aAAa,CAAA;AAAE,GAC5C;AACF;AAGO,SAAS,cAAA,CAAe,KAAA,EAAe,OAAA,EAAiB,kBAAA,EAAoC;AACjG,EAAA,OAAO,KAAA,KAAU,IAAI,OAAA,GAAU,kBAAA;AACjC;AAQA,eAAe,UACb,KAAA,EACA,MAAA,EACA,WAAA,EACA,KAAA,EACA,WACA,KAAA,EACuB;AAGvB,EAAA,MAAM,YAAA,GACJ,KAAA,KAAU,CAAA,GAAI,WAAA,GAAc,EAAE,GAAI,WAAA,IAAe,EAAC,EAAI,MAAA,EAAQ,EAAE,IAAA,EAAM,qBAAoB,EAAE;AAC9F,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,QAAQ,YAAY,CAAA;AACjD,EAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,KAAA,EAAO,OAAO,KAAK,CAAA;AAChD,EAAA,MAAM,WAAW,aAAA,CAAc,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW,MAAM,WAAW,CAAA;AAC1E,EAAA,IAAI,QAAA,KAAa,UAAA,EAAY,OAAO,EAAE,QAAA,EAAU,YAAY,QAAA,EAAU,KAAA,EAAO,MAAA,EAAQ,KAAK,CAAA,EAAE;AAC5F,EAAA,MAAM,cAAc,YAAA,CAAa,MAAM,CAAA,GAAI,KAAA,CAAM,cAAc,CAAA,GAAI,CAAA;AACnE,EAAA,OAAO,EAAE,IAAA,EAAM,EAAE,OAAO,WAAA,EAAY,EAAG,YAAY,MAAA,EAAO;AAC5D;AAOA,eAAsB,mBAAA,CACpB,KAAA,EACA,OAAA,EACA,OAAA,EACgC;AAChC,EAAA,MAAM,GAAA,GAAM,oBAAoB,OAAO,CAAA;AACvC,EAAA,IAAI,QAAQ,GAAA,CAAI,KAAA;AAEhB,EAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,IAAK,KAAA,IAAS,CAAA,EAAG;AAChC,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,KAAA,EAAO,OAAA,EAAS,IAAI,kBAAkB,CAAA;AACpE,IAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,KAAA,EAAO,MAAA,EAAQ,IAAI,WAAA,EAAa,KAAA,EAAO,GAAA,CAAI,SAAA,EAAW,KAAK,CAAA;AAC3F,IAAA,IAAI,UAAA,IAAc,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAA;AAG1C,IAAA,KAAA,GAAQ,OAAA,CAAQ,IAAA;AAChB,IAAA,MAAM,UAAU,MAAM,gBAAA;AAAA,MACpB,KAAA;AAAA,MACA,OAAA,CAAQ,UAAA;AAAA,MACR,KAAA,CAAM,KAAA;AAAA,MACN,GAAA,CAAI,WAAA;AAAA,MACJ,GAAA,CAAI;AAAA,KACN;AACA,IAAA,IAAI,OAAA,KAAY,QAAW,OAAO,OAAA;AAAA,EACpC;AACF","file":"chunk-EPSICJLZ.js","sourcesContent":["/**\n * `runToCompletion` continuation driver (M1 Phase 3 — plan m1-run-to-completion).\n *\n * Drives repeated `send()`s on a STATEFUL agent until a genuine terminal,\n * consuming the `RunResult.stoppedAtIterationLimit` signal shipped in 2.2.0.\n * The agent's session preserves conversation history across sends, so after a\n * truncated round the driver only re-sends a short continuation prompt (it does\n * NOT reconstruct history). Mirrors the injectable shape of `run-until.ts` and\n * absorbs the outer-loop policy hand-rolled in `theocode/server/lib/agent-loop.ts`.\n *\n * The core is decision-pure + injectable (`agent` is only the `.send` port) so\n * every terminal is unit-testable with a fake send — fixture mode never sets\n * `stoppedAtIterationLimit`, so injection is the only deterministic path.\n *\n * @internal\n */\n\nimport type {\n  RunResult,\n  RunToCompletionOptions,\n  RunToCompletionResult,\n  SendOptions,\n} from \"../../../types/run.js\";\nimport type { TokenUsage } from \"../../../types/usage.js\";\n\n/** Minimal agent port the driver needs — the instance `.send()` surface. */\nexport interface RunToCompletionAgent {\n  send(message: string, options?: SendOptions): Promise<{ wait(): Promise<RunResult> }>;\n}\n\n/** @internal — shared with the streaming twin (`stream-to-completion.ts`, V3-4). */\nexport const DEFAULT_MAX_ROUNDS = 5;\n/** @internal — shared with the streaming twin (`stream-to-completion.ts`, V3-4). */\nexport const DEFAULT_CONTINUATION_PROMPT =\n  \"Continue from where you left off and finish the task. If it is already complete, give the final answer.\";\n\ntype RoundDecision = \"done\" | \"continue\" | \"step_limit\" | \"no_progress\";\n\n/**\n * True when a round produced no observable output text.\n * @internal — shared with the streaming twin (`stream-to-completion.ts`, V3-4).\n */\nexport function isEmptyRound(result: RunResult): boolean {\n  return (result.result ?? \"\").trim() === \"\";\n}\n\n/**\n * Pure decision: given a round's result + position + the running empty streak,\n * decide whether to finish (`done`), keep going (`continue`), or bail\n * (`step_limit` / `no_progress`).\n *\n * @internal\n */\nexport function classifyRound(\n  result: RunResult,\n  round: number,\n  maxRounds: number,\n  emptyStreak: number,\n): RoundDecision {\n  // Doom-loop stop is a genuine terminal (the model repeated identical tool calls) — classify it as\n  // `no_progress` FIRST, before the iteration-limit check, so it is never mistaken for a truncation\n  // to re-send (which would re-trigger the loop). Complements the empty-round `no_progress` below.\n  if (result.stoppedByDoomLoop === true) return \"no_progress\";\n  if (result.stoppedAtIterationLimit !== true) return \"done\";\n  // Truncated at the iteration ceiling.\n  if (isEmptyRound(result) && emptyStreak >= 1) return \"no_progress\";\n  if (round >= maxRounds) return \"step_limit\";\n  return \"continue\";\n}\n\n/**\n * Sum a round's usage into the running aggregate. `requests` is intentionally\n * dropped (concatenating per-run request breakdowns across continuation rounds\n * would falsely imply a single multi-call run). `totalTokens` is DERIVED\n * (`inputTokens + outputTokens`), never summed independently, to preserve the\n * EC-10 invariant (`usage.ts`) at this aggregation boundary even if a provider\n * folded extra buckets into a round's own `totalTokens`.\n * @internal — shared with the streaming twin (`stream-to-completion.ts`, V3-4).\n */\nexport function addUsage(\n  acc: TokenUsage | undefined,\n  u: TokenUsage | undefined,\n): TokenUsage | undefined {\n  if (u === undefined) return acc;\n  const inputTokens = (acc?.inputTokens ?? 0) + u.inputTokens;\n  const outputTokens = (acc?.outputTokens ?? 0) + u.outputTokens;\n  const sumOpt = (a: number | undefined, b: number | undefined): number | undefined =>\n    a === undefined && b === undefined ? undefined : (a ?? 0) + (b ?? 0);\n  return {\n    inputTokens,\n    outputTokens,\n    totalTokens: inputTokens + outputTokens,\n    cacheReadTokens: sumOpt(acc?.cacheReadTokens, u.cacheReadTokens),\n    cacheWriteTokens: sumOpt(acc?.cacheWriteTokens, u.cacheWriteTokens),\n    reasoningTokens: sumOpt(acc?.reasoningTokens, u.reasoningTokens),\n  };\n}\n\n/**\n * Assemble the result object, omitting `usage` when no round reported any.\n * @internal — shared with the streaming twin (`stream-to-completion.ts`, V3-4).\n */\nexport function buildResult(\n  terminal: RunToCompletionResult[\"terminal\"],\n  rounds: number,\n  lastResult: RunResult,\n  usage: TokenUsage | undefined,\n): RunToCompletionResult {\n  return { terminal, rounds, lastResult, ...(usage !== undefined ? { usage } : {}) };\n}\n\n/**\n * The shared between-rounds tail: fire `onTruncated`, then — re-reading `aborted`\n * (a getter that can flip between rounds) — return a `step_limit` result if the\n * signal aborted, else `undefined` to continue. Used by BOTH the stateful driver\n * and its streaming twin (V3-4), so the continuation-end policy has one home.\n * @internal\n */\nexport async function continuationTail(\n  round: number,\n  lastResult: RunResult,\n  usage: TokenUsage | undefined,\n  onTruncated: ((event: { round: number }) => void | Promise<void>) | undefined,\n  signal: AbortSignal | undefined,\n): Promise<RunToCompletionResult | undefined> {\n  await onTruncated?.({ round });\n  return signal?.aborted === true ? buildResult(\"step_limit\", round, lastResult, usage) : undefined;\n}\n\n/**\n * Carried state between continuation rounds.\n * @internal — shared with the streaming twin (`stream-to-completion.ts`, V3-4).\n */\nexport interface RoundState {\n  usage: TokenUsage | undefined;\n  emptyStreak: number;\n}\n\n/** Resolved continuation config + fresh initial state — shared by both drivers. @internal */\nexport interface ResolvedContinuation {\n  maxRounds: number;\n  continuationPrompt: string;\n  onTruncated: ((event: { round: number }) => void | Promise<void>) | undefined;\n  signal: AbortSignal | undefined;\n  sendOptions: SendOptions | undefined;\n  state: RoundState;\n}\n\n/** Resolve options to the continuation config + a fresh state. One home for the defaults. @internal */\nexport function resolveContinuation(options?: RunToCompletionOptions): ResolvedContinuation {\n  return {\n    maxRounds: options?.maxRounds ?? DEFAULT_MAX_ROUNDS,\n    continuationPrompt: options?.continuationPrompt ?? DEFAULT_CONTINUATION_PROMPT,\n    onTruncated: options?.onTruncated,\n    signal: options?.signal,\n    sendOptions: options?.sendOptions,\n    state: { usage: undefined, emptyStreak: 0 },\n  };\n}\n\n/** The round's prompt: the task on round 0, the continuation prompt after. @internal */\nexport function promptForRound(round: number, message: string, continuationPrompt: string): string {\n  return round === 0 ? message : continuationPrompt;\n}\n\n/** A round either reaches a terminal, or yields the state to carry into the next round. */\ntype RoundOutcome =\n  | { terminal: RunToCompletionResult }\n  | { next: RoundState; lastResult: RunResult };\n\n/** Send one round, fold usage, classify. Splits the loop body out to cap complexity. */\nasync function stepRound(\n  agent: RunToCompletionAgent,\n  prompt: string,\n  sendOptions: SendOptions | undefined,\n  round: number,\n  maxRounds: number,\n  state: RoundState,\n): Promise<RoundOutcome> {\n  // SE3 — a continuation round (round > 0) is a driver-initiated turn; stamp its\n  // provenance so a consumer can tell it apart from the caller's first send.\n  const roundOptions: SendOptions | undefined =\n    round === 0 ? sendOptions : { ...(sendOptions ?? {}), origin: { kind: \"auto-continuation\" } };\n  const run = await agent.send(prompt, roundOptions);\n  const result = await run.wait();\n  const usage = addUsage(state.usage, result.usage);\n  const decision = classifyRound(result, round, maxRounds, state.emptyStreak);\n  if (decision !== \"continue\") return { terminal: buildResult(decision, round, result, usage) };\n  const emptyStreak = isEmptyRound(result) ? state.emptyStreak + 1 : 0;\n  return { next: { usage, emptyStreak }, lastResult: result };\n}\n\n/**\n * Drive `agent.send()` until a terminal. See {@link RunToCompletionOptions}.\n *\n * @internal\n */\nexport async function runToCompletionImpl(\n  agent: RunToCompletionAgent,\n  message: string,\n  options?: RunToCompletionOptions,\n): Promise<RunToCompletionResult> {\n  const cfg = resolveContinuation(options);\n  let state = cfg.state;\n\n  for (let round = 0; ; round += 1) {\n    const prompt = promptForRound(round, message, cfg.continuationPrompt);\n    const outcome = await stepRound(agent, prompt, cfg.sendOptions, round, cfg.maxRounds, state);\n    if (\"terminal\" in outcome) return outcome.terminal;\n\n    // Truncated and below the round budget — re-send next iteration.\n    state = outcome.next;\n    const aborted = await continuationTail(\n      round,\n      outcome.lastResult,\n      state.usage,\n      cfg.onTruncated,\n      cfg.signal,\n    );\n    if (aborted !== undefined) return aborted;\n  }\n}\n"]}

package/dist/chunk-EXTRW7GW.cjs

@@ -0,0 +1,155 @@
+'use strict';
+
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var crypto = require('crypto');
+var fs = require('fs');
+var path = require('path');
+var zod = require('zod');
+
+function credentialHome(config, env = {}) {
+  const override = config.homeEnvVar !== void 0 ? env[config.homeEnvVar]?.trim() : void 0;
+  return override !== void 0 && override.length > 0 ? override : path.join(config.home, config.dirName);
+}
+function authFilePath(config, env = {}) {
+  return path.join(credentialHome(config, env), config.fileName);
+}
+var CredentialError = class extends chunkJ7J7J2GN_cjs.AuthenticationError {
+  // Field, not an assignment in the constructor: `AuthenticationError.name` is `override readonly`
+  // (`errors.ts:174`), so `this.name = …` does not compile. Caught by `tsc`, not by vitest — the
+  // suite was green with the broken assignment because the transpiler strips the type.
+  name = "CredentialError";
+};
+var apiFileSchema = zod.z.object({
+  type: zod.z.literal("api").optional(),
+  provider: zod.z.string().min(1).optional(),
+  api_key: zod.z.string()
+}).strict();
+var oauthFileSchema = zod.z.object({
+  type: zod.z.literal("oauth"),
+  provider: zod.z.string().min(1),
+  access: zod.z.string().min(1),
+  refresh: zod.z.string().min(1),
+  expires: zod.z.number(),
+  account_id: zod.z.string().optional()
+}).strict();
+var fileSchema = zod.z.union([oauthFileSchema, apiFileSchema]);
+function assertSecureModes(dirPath, path) {
+  if (process.platform === "win32") return;
+  const dirMode = fs.statSync(dirPath).mode & 511;
+  if ((dirMode & 18) !== 0) {
+    throw new CredentialError(
+      `${dirPath} is writable by other users (mode ${dirMode.toString(8)}), so the credential file inside it can be replaced. Fix it with:  chmod 700 ${dirPath}`
+    );
+  }
+  const mode = fs.statSync(path).mode & 511;
+  if ((mode & 63) !== 0) {
+    throw new CredentialError(
+      `${path} is readable by other users (mode ${mode.toString(8)}). A credential file must not be. Fix it with:  chmod 600 ${path}`
+    );
+  }
+}
+function describeUnionError(parsed, err, path) {
+  const looksOAuth = typeof parsed === "object" && parsed !== null && parsed.type === "oauth";
+  const specific = looksOAuth ? oauthFileSchema.safeParse(parsed) : apiFileSchema.safeParse(parsed);
+  let issue;
+  if (!specific.success) {
+    issue = specific.error.issues[0];
+  } else if (err instanceof zod.z.ZodError) {
+    issue = err.issues[0];
+  }
+  return new CredentialError(
+    `${path}: ${issue?.message ?? String(err)} [${issue?.path.join(".") || "root"}]`
+  );
+}
+function parseStoredFile(raw, path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new CredentialError(
+      `${path} is not valid JSON. Expected:  {"provider": "<name>", "api_key": "..."}`
+    );
+  }
+  try {
+    return fileSchema.parse(parsed);
+  } catch (err) {
+    throw describeUnionError(parsed, err, path);
+  }
+}
+function readAuthFile(config, env = {}) {
+  const path = authFilePath(config, env);
+  let raw;
+  try {
+    raw = fs.readFileSync(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new CredentialError(`cannot read ${path}: ${err.message}`);
+  }
+  assertSecureModes(credentialHome(config, env), path);
+  return parseStoredFile(raw, path);
+}
+function readStoredOAuth(config, env = {}) {
+  const stored = readAuthFile(config, env);
+  return stored !== void 0 && stored.type === "oauth" ? stored : void 0;
+}
+function isOAuthWrite(c) {
+  return "type" in c && c.type === "oauth";
+}
+function buildStorePayload(cred) {
+  if (isOAuthWrite(cred)) {
+    if (cred.access.length === 0 || cred.refresh.length === 0) {
+      throw new CredentialError(
+        "refusing to write an oauth credential with an empty access/refresh token"
+      );
+    }
+    return {
+      type: "oauth",
+      provider: cred.provider,
+      access: cred.access,
+      refresh: cred.refresh,
+      expires: cred.expires,
+      ...cred.account_id !== void 0 ? { account_id: cred.account_id } : {}
+    };
+  }
+  if (typeof cred.apiKey !== "string" || cred.apiKey.length === 0) {
+    throw new CredentialError("refusing to write an empty API key");
+  }
+  return { provider: cred.provider, api_key: cred.apiKey };
+}
+function writeCredential(cred, config, env = {}) {
+  const payload = buildStorePayload(cred);
+  const dir = credentialHome(config, env);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+  const path = authFilePath(config, env);
+  const tmp = `${path}.tmp-${crypto.randomBytes(8).toString("hex")}`;
+  try {
+    const fd = fs.openSync(tmp, "wx", 384);
+    try {
+      fs.writeFileSync(fd, `${JSON.stringify(payload, null, 2)}
+`);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.chmodSync(tmp, 384);
+    fs.renameSync(tmp, path);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+    }
+    throw new CredentialError(`cannot write ${path}: ${err.message}`);
+  }
+  return path;
+}
+
+exports.CredentialError = CredentialError;
+exports.assertSecureModes = assertSecureModes;
+exports.authFilePath = authFilePath;
+exports.credentialHome = credentialHome;
+exports.readAuthFile = readAuthFile;
+exports.readStoredOAuth = readStoredOAuth;
+exports.writeCredential = writeCredential;
+//# sourceMappingURL=chunk-EXTRW7GW.cjs.map
+//# sourceMappingURL=chunk-EXTRW7GW.cjs.map

package/dist/chunk-EXTRW7GW.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/auth/credential-store.ts"],"names":["join","AuthenticationError","z","statSync","readFileSync","mkdirSync","chmodSync","randomBytes","openSync","writeFileSync","fsyncSync","closeSync","renameSync","unlinkSync"],"mappings":";;;;;;;;AA0CO,SAAS,cAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,MAAM,QAAA,GAAW,OAAO,UAAA,KAAe,MAAA,GAAY,IAAI,MAAA,CAAO,UAAU,CAAA,EAAG,IAAA,EAAK,GAAI,MAAA;AACpF,EAAA,OAAO,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,GAC/C,WACAA,SAAA,CAAK,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AACtC;AAGO,SAAS,YAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,OAAOA,UAAK,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA,EAAG,OAAO,QAAQ,CAAA;AAC1D;AAmBO,IAAM,eAAA,GAAN,cAA8BC,qCAAA,CAAoB;AAAA;AAAA;AAAA;AAAA,EAIrC,IAAA,GAAe,iBAAA;AACnC;AAOA,IAAM,aAAA,GAAgBC,MACnB,MAAA,CAAO;AAAA,EACN,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,KAAK,EAAE,QAAA,EAAS;AAAA,EAChC,UAAUA,KAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,OAAA,EAASA,MAAE,MAAA;AACb,CAAC,EACA,MAAA,EAAO;AAEV,IAAM,eAAA,GAAkBA,MACrB,MAAA,CAAO;AAAA,EACN,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,EACvB,QAAA,EAAUA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACxB,OAAA,EAASA,KAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,OAAA,EAASA,MAAE,MAAA,EAAO;AAAA,EAClB,UAAA,EAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACzB,CAAC,EACA,MAAA,EAAO;AAGV,IAAM,aAAaA,KAAA,CAAE,KAAA,CAAM,CAAC,eAAA,EAAiB,aAAa,CAAC,CAAA;AAQpD,SAAS,iBAAA,CAAkB,SAAiB,IAAA,EAAoB;AAMrE,EAAA,IAAI,OAAA,CAAQ,aAAa,OAAA,EAAS;AAElC,EAAA,MAAM,OAAA,GAAUC,WAAA,CAAS,OAAO,CAAA,CAAE,IAAA,GAAO,GAAA;AACzC,EAAA,IAAA,CAAK,OAAA,GAAU,QAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,EAAG,OAAO,CAAA,kCAAA,EAAqC,OAAA,CAAQ,SAAS,CAAC,CAAC,gFACV,OAAO,CAAA;AAAA,KACjE;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAOA,WAAA,CAAS,IAAI,CAAA,CAAE,IAAA,GAAO,GAAA;AACnC,EAAA,IAAA,CAAK,IAAA,GAAO,QAAW,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,EAAG,IAAI,CAAA,kCAAA,EAAqC,IAAA,CAAK,SAAS,CAAC,CAAC,6DACA,IAAI,CAAA;AAAA,KAClE;AAAA,EACF;AACF;AAMA,SAAS,kBAAA,CAAmB,MAAA,EAAiB,GAAA,EAAc,IAAA,EAA+B;AACxF,EAAA,MAAM,aACJ,OAAO,MAAA,KAAW,YAClB,MAAA,KAAW,IAAA,IACV,OAA8B,IAAA,KAAS,OAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,aAAa,eAAA,CAAgB,SAAA,CAAU,MAAM,CAAA,GAAI,aAAA,CAAc,UAAU,MAAM,CAAA;AAChG,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,CAAC,SAAS,OAAA,EAAS;AACrB,IAAA,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AAAA,EACjC,CAAA,MAAA,IAAW,GAAA,YAAeD,KAAA,CAAE,QAAA,EAAU;AACpC,IAAA,KAAA,GAAQ,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACtB;AACA,EAAA,OAAO,IAAI,eAAA;AAAA,IACT,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAA,EAAO,WAAW,MAAA,CAAO,GAAG,CAAC,CAAA,EAAA,EAAK,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,GAAG,KAAK,MAAM,CAAA,CAAA;AAAA,GAC/E;AACF;AAGA,SAAS,eAAA,CAAgB,KAAa,IAAA,EAAgC;AACpE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AAGN,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,GAAG,IAAI,CAAA,uEAAA;AAAA,KACT;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,UAAA,CAAW,MAAM,MAAM,CAAA;AAAA,EAChC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,kBAAA,CAAmB,MAAA,EAAQ,GAAA,EAAK,IAAI,CAAA;AAAA,EAC5C;AACF;AAQO,SAAS,YAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACb;AAC9B,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AAErC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAME,eAAA,CAAa,MAAM,MAAM,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,MAAA;AAC7D,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,YAAA,EAAe,IAAI,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,iBAAA,CAAkB,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA,EAAG,IAAI,CAAA;AACnD,EAAA,OAAO,eAAA,CAAgB,KAAK,IAAI,CAAA;AAClC;AAOO,SAAS,eAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACR;AACnC,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AACvC,EAAA,OAAO,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,IAAA,KAAS,UAAU,MAAA,GAAS,MAAA;AACpE;AAGA,SAAS,aACP,CAAA,EAC4B;AAC5B,EAAA,OAAO,MAAA,IAAU,CAAA,IAAK,CAAA,CAAE,IAAA,KAAS,OAAA;AACnC;AAGA,SAAS,kBACP,IAAA,EACyB;AACzB,EAAA,IAAI,YAAA,CAAa,IAAI,CAAA,EAAG;AACtB,IAAA,IAAI,KAAK,MAAA,CAAO,MAAA,KAAW,KAAK,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AACzD,MAAA,MAAM,IAAI,eAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,OAAA;AAAA,MACN,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI;AAAC,KACzE;AAAA,EACF;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,MAAA,KAAW,YAAY,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,gBAAgB,oCAAoC,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,OAAA,EAAS,KAAK,MAAA,EAAO;AACzD;AASO,SAAS,eAAA,CACd,IAAA,EACA,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AAEtC,EAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA;AACtC,EAAAC,YAAA,CAAU,KAAK,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAC/C,EAAAC,YAAA,CAAU,KAAK,GAAK,CAAA;AAEpB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AAIrC,EAAA,MAAM,GAAA,GAAM,GAAG,IAAI,CAAA,KAAA,EAAQC,mBAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAKC,WAAA,CAAS,GAAA,EAAK,IAAA,EAAM,GAAK,CAAA;AACpC,IAAA,IAAI;AACF,MAAAC,gBAAA,CAAc,IAAI,CAAA,EAAG,IAAA,CAAK,UAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC;AAAA,CAAI,CAAA;AACzD,MAAAC,YAAA,CAAU,EAAE,CAAA;AAAA,IACd,CAAA,SAAE;AACA,MAAAC,YAAA,CAAU,EAAE,CAAA;AAAA,IACd;AACA,IAAAL,YAAA,CAAU,KAAK,GAAK,CAAA;AACpB,IAAAM,aAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAAC,aAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,aAAA,EAAgB,IAAI,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-EXTRW7GW.cjs","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport {\n  chmodSync,\n  closeSync,\n  fsyncSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { z } from \"zod\";\n\nimport { AuthenticationError } from \"../../errors.js\";\n\n/**\n * M42 — the SDK credential store. Promoted DOWN from agent-builder's hardened `agents/lib/credentials.ts`\n * (M37), generalized from a closed `openrouter|anthropic|openai` union to an open `provider: string` and\n * driven by a caller-supplied {@link CredentialStoreConfig} (no hardcoded `.agent-builder`/`auth.json` /\n * `AGENT_BUILDER_HOME`). The security-critical file mechanics are ported VERBATIM (ADR D3 of the M42 plan):\n * atomic O_EXCL + rename + fsync write, 0700/0600 mode gates, `env` is always a PARAMETER (never an ambient\n * `process.env` read).\n *\n * The env-precedence + key-prefix-inference + declared-provider rungs of the agent-builder resolver are\n * APP POLICY and deliberately stay UP in the consumer; this module owns only the on-disk store + the\n * `api|oauth` discriminated union. See {@link resolveCredential} (SDK) for the store-read + refresh path.\n *\n * Re-exported from `@theokit/sdk/auth`, and therefore PUBLIC, under semver.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\nimport type { CredentialStoreConfig, StoredCredential, StoredOAuthCredential } from \"./types.js\";\n\n/** The store directory, honoring an optional `homeEnvVar` override. */\nexport function credentialHome(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  const override = config.homeEnvVar !== undefined ? env[config.homeEnvVar]?.trim() : undefined;\n  return override !== undefined && override.length > 0\n    ? override\n    : join(config.home, config.dirName);\n}\n\n/** The credential file path inside the (possibly overridden) store directory. */\nexport function authFilePath(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  return join(credentialHome(config, env), config.fileName);\n}\n\n/**\n * A credential problem the caller can act on. Never carries the key value.\n *\n * M78 — this used to extend bare `Error`, which quietly disabled classification for the entire auth\n * path: `isTransientError` is `err instanceof TheokitAgentError && err.isRetryable === true`\n * (`errors.ts:443`), so a credential failure could never be judged transient OR permanent. The\n * predicate was not \"forgotten\" downstream — it was unusable there by construction.\n *\n * Extending `AuthenticationError` is ADDITIVE: the class still exists, still reports\n * `name: \"CredentialError\"`, and every existing `instanceof CredentialError` stays true. It only\n * gains ancestors. `AuthenticationError` pins `isRetryable: false`, so gaining the ability to be\n * classified does NOT turn a revoked credential into a retry loop.\n *\n * The single reference does the same thing with one root type: Codex routes every domain failure\n * through `CodexErr` with `is_retryable()` as a method (`protocol/src/error.rs:176`), rather than\n * parallel classes extending the language's `Error`.\n */\nexport class CredentialError extends AuthenticationError {\n  // Field, not an assignment in the constructor: `AuthenticationError.name` is `override readonly`\n  // (`errors.ts:174`), so `this.name = …` does not compile. Caught by `tsc`, not by vitest — the\n  // suite was green with the broken assignment because the transpiler strips the type.\n  override readonly name: string = \"CredentialError\";\n}\n\n/**\n * The on-disk store — a discriminated union on `type`. A legacy file with NO\n * `type` (or `type: 'api'`) is the API-key variant — read unchanged, no migration. The `oauth` variant\n * carries the token pair + expiry.\n */\nconst apiFileSchema = z\n  .object({\n    type: z.literal(\"api\").optional(),\n    provider: z.string().min(1).optional(),\n    api_key: z.string(),\n  })\n  .strict();\n\nconst oauthFileSchema = z\n  .object({\n    type: z.literal(\"oauth\"),\n    provider: z.string().min(1),\n    access: z.string().min(1),\n    refresh: z.string().min(1),\n    expires: z.number(),\n    account_id: z.string().optional(),\n  })\n  .strict();\n\n// oauth first (it requires `type: 'oauth'`); a legacy `{provider?, api_key}` falls through to api.\nconst fileSchema = z.union([oauthFileSchema, apiFileSchema]);\n\n/**\n * The 0700-dir / 0600-file mode gates (ported verbatim). The DIRECTORY matters as much as the file:\n * `mkdirSync(mode)` applies only at creation, so a pre-existing store dir keeps whatever mode it had, and a\n * writable dir lets an attacker replace the credential file with a symlink to their own 0600 file — the\n * agent then runs on THEIR account.\n */\nexport function assertSecureModes(dirPath: string, path: string): void {\n  // Windows has no POSIX mode bits. `statSync().mode` there is SYNTHETIC — 0666 for any writable\n  // entry, whatever the ACLs actually say — so `mode & 0o022` was non-zero for every valid store and\n  // this gate refused all of them, which made the credential path unreadable on that platform\n  // rather than protected. A check that cannot observe the real permission system must not report a\n  // verdict about it; ACL enforcement is a separate mechanism and not one this function can fake.\n  if (process.platform === \"win32\") return;\n\n  const dirMode = statSync(dirPath).mode & 0o777;\n  if ((dirMode & 0o022) !== 0) {\n    throw new CredentialError(\n      `${dirPath} is writable by other users (mode ${dirMode.toString(8)}), so the credential file ` +\n        `inside it can be replaced. Fix it with:  chmod 700 ${dirPath}`,\n    );\n  }\n  const mode = statSync(path).mode & 0o777;\n  if ((mode & 0o077) !== 0) {\n    throw new CredentialError(\n      `${path} is readable by other users (mode ${mode.toString(8)}). ` +\n        `A credential file must not be. Fix it with:  chmod 600 ${path}`,\n    );\n  }\n}\n\n/**\n * A `z.union` reports a generic \"Invalid input\" at the root, hiding WHAT is wrong. Pick the sub-schema the\n * file was CLEARLY aiming at (by its `type` discriminant) and surface that schema's specific issue.\n */\nfunction describeUnionError(parsed: unknown, err: unknown, path: string): CredentialError {\n  const looksOAuth =\n    typeof parsed === \"object\" &&\n    parsed !== null &&\n    (parsed as { type?: unknown }).type === \"oauth\";\n  const specific = looksOAuth ? oauthFileSchema.safeParse(parsed) : apiFileSchema.safeParse(parsed);\n  let issue: z.ZodIssue | undefined;\n  if (!specific.success) {\n    issue = specific.error.issues[0];\n  } else if (err instanceof z.ZodError) {\n    issue = err.issues[0];\n  }\n  return new CredentialError(\n    `${path}: ${issue?.message ?? String(err)} [${issue?.path.join(\".\") || \"root\"}]`,\n  );\n}\n\n/** Parse the raw file into the store union, surfacing the SPECIFIC sub-schema issue (not a generic union error). */\nfunction parseStoredFile(raw: string, path: string): StoredCredential {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    // The parser's message embeds a snippet of the INPUT — up to the raw key when a user pastes the bare\n    // key instead of JSON. The position is not actionable anyway, so the expected shape is more useful.\n    throw new CredentialError(\n      `${path} is not valid JSON. Expected:  {\"provider\": \"<name>\", \"api_key\": \"...\"}`,\n    );\n  }\n  try {\n    return fileSchema.parse(parsed);\n  } catch (err) {\n    throw describeUnionError(parsed, err, path);\n  }\n}\n\n/**\n * Read the credential file. Absent ⇒ `undefined` (the normal case). Present-but-wrong is a typed error\n * naming the file: a malformed credential store must not surface as a raw parse crash. Enforces the\n * 0700 dir / 0600 file mode gates (ported verbatim — a writable dir lets an attacker swap the file for a\n * symlink to their own account).\n */\nexport function readAuthFile(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): StoredCredential | undefined {\n  const path = authFilePath(config, env);\n\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw new CredentialError(`cannot read ${path}: ${(err as Error).message}`);\n  }\n\n  assertSecureModes(credentialHome(config, env), path);\n  return parseStoredFile(raw, path);\n}\n\n/**\n * Read the stored OAuth credential (with its refresh token), or `undefined` when the store is absent or\n * holds an api credential. The oauth engine needs the refresh token, which the resolved bearer does not\n * carry. Enforces the same 0600/0700 gates as every other read.\n */\nexport function readStoredOAuth(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): StoredOAuthCredential | undefined {\n  const stored = readAuthFile(config, env);\n  return stored !== undefined && stored.type === \"oauth\" ? stored : undefined;\n}\n\n/** Narrows a writable credential to the oauth variant. */\nfunction isOAuthWrite(\n  c: { provider: string; apiKey: string } | StoredOAuthCredential,\n): c is StoredOAuthCredential {\n  return \"type\" in c && c.type === \"oauth\";\n}\n\n/** Build the on-disk JSON payload for the credential variant, validating non-empty tokens. */\nfunction buildStorePayload(\n  cred: { provider: string; apiKey: string } | StoredOAuthCredential,\n): Record<string, unknown> {\n  if (isOAuthWrite(cred)) {\n    if (cred.access.length === 0 || cred.refresh.length === 0) {\n      throw new CredentialError(\n        \"refusing to write an oauth credential with an empty access/refresh token\",\n      );\n    }\n    return {\n      type: \"oauth\",\n      provider: cred.provider,\n      access: cred.access,\n      refresh: cred.refresh,\n      expires: cred.expires,\n      ...(cred.account_id !== undefined ? { account_id: cred.account_id } : {}),\n    };\n  }\n  if (typeof cred.apiKey !== \"string\" || cred.apiKey.length === 0) {\n    throw new CredentialError(\"refusing to write an empty API key\");\n  }\n  return { provider: cred.provider, api_key: cred.apiKey };\n}\n\n/**\n * Persist a credential atomically at mode `0600`. Ported VERBATIM (ADR D3): write to a random-named temp\n * file in the same directory with `wx` (O_EXCL), fsync, close, chmod, then `rename` (atomic on POSIX) —\n * so a crash mid-write leaves whatever was there untouched, and a pre-planted symlink cannot capture the\n * key. The api variant persists the unchanged `{provider, api_key}` (back-compat, no `type` key); the\n * oauth variant persists `{type:'oauth', provider, access, refresh, expires, account_id?}`.\n */\nexport function writeCredential(\n  cred: { provider: string; apiKey: string } | StoredOAuthCredential,\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  const payload = buildStorePayload(cred);\n\n  const dir = credentialHome(config, env);\n  mkdirSync(dir, { recursive: true, mode: 0o700 });\n  chmodSync(dir, 0o700); // unconditional: mkdirSync's mode applies only at creation\n\n  const path = authFilePath(config, env);\n  // RANDOM name + `wx` (O_EXCL): a predictable temp name with a plain write follows a pre-planted SYMLINK,\n  // landing the key in an attacker's file while reporting success. O_EXCL refuses any pre-existing file or\n  // link; the random suffix also removes the pid collision two containers sharing a bind-mounted home make.\n  const tmp = `${path}.tmp-${randomBytes(8).toString(\"hex\")}`;\n  try {\n    const fd = openSync(tmp, \"wx\", 0o600);\n    try {\n      writeFileSync(fd, `${JSON.stringify(payload, null, 2)}\\n`);\n      fsyncSync(fd);\n    } finally {\n      closeSync(fd);\n    }\n    chmodSync(tmp, 0o600); // explicit: the mode argument is subject to umask\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // the temp file may not exist; its absence is not a failure of the write\n    }\n    throw new CredentialError(`cannot write ${path}: ${(err as Error).message}`);\n  }\n  return path;\n}\n"]}

package/dist/chunk-FD2UT76F.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-FD2UT76F.js.map
+//# sourceMappingURL=chunk-FD2UT76F.js.map

package/dist/chunk-FD2UT76F.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-FD2UT76F.js"}

package/dist/chunk-FJWQP6EE.js

@@ -0,0 +1,122 @@
+import { createRequire } from 'module';
+
+// src/sanitize/coerce.ts
+var cachedJsonrepair;
+function loadJsonrepair() {
+  if (cachedJsonrepair === void 0) {
+    const req = createRequire(import.meta.url);
+    cachedJsonrepair = req("jsonrepair").jsonrepair;
+  }
+  return cachedJsonrepair;
+}
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function toFiniteNumber(raw) {
+  if (raw === "") return void 0;
+  const n = Number(raw);
+  return Number.isFinite(n) && String(n) === raw ? n : void 0;
+}
+function tryJson(raw, repair) {
+  const t = raw.trimStart();
+  if (!(t.startsWith("{") || t.startsWith("["))) return void 0;
+  try {
+    return JSON.parse(repair ? loadJsonrepair()(t) : t);
+  } catch {
+    return void 0;
+  }
+}
+function heuristicCoerce(raw, repairJson) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  if (raw === "null") return null;
+  const n = toFiniteNumber(raw);
+  if (n !== void 0) return n;
+  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : void 0);
+  return json === void 0 ? raw : json;
+}
+function coerceCandidates(raw, repairJson) {
+  const out = [];
+  if (raw === "true") out.push(true);
+  else if (raw === "false") out.push(false);
+  else if (raw === "null") out.push(null);
+  const n = toFiniteNumber(raw);
+  if (n !== void 0) out.push(n);
+  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : void 0);
+  if (json !== void 0) out.push(json);
+  out.push(raw);
+  return out;
+}
+function objectShape(schema) {
+  const shape = schema?.shape;
+  return shape !== null && typeof shape === "object" ? shape : void 0;
+}
+
+// src/sanitize/sanitize-tool-input.ts
+function applyTrim(key, value, ctx) {
+  const trimmed = value.trim();
+  if (trimmed !== value) ctx.notes.push(`trimmed "${key}"`);
+  return trimmed;
+}
+function applyCoerce(key, raw, ctx) {
+  const field = ctx.shape?.[key];
+  let coerced = raw;
+  if (field) {
+    for (const candidate of coerceCandidates(raw, ctx.repairJson)) {
+      if (field.safeParse(candidate).success) {
+        coerced = candidate;
+        break;
+      }
+    }
+  } else {
+    coerced = heuristicCoerce(raw, ctx.repairJson);
+  }
+  if (coerced !== raw) ctx.notes.push(`coerced "${key}"`);
+  return coerced;
+}
+function applyRepair(key, value, ctx) {
+  const repaired = tryJson(value, true);
+  if (repaired === void 0) return value;
+  ctx.notes.push(`repaired json "${key}"`);
+  return repaired;
+}
+function sanitizeString(key, value, ctx) {
+  let out = ctx.trim ? applyTrim(key, value, ctx) : value;
+  if (ctx.coerce && typeof out === "string") out = applyCoerce(key, out, ctx);
+  if (ctx.repairJson && !ctx.coerce && typeof out === "string") out = applyRepair(key, out, ctx);
+  return out;
+}
+function walkValue(key, value, ctx, depth) {
+  if (typeof value === "string") return sanitizeString(key, value, ctx);
+  if (Array.isArray(value)) {
+    if (depth >= ctx.maxDepth) return value;
+    return value.map((element) => walkValue(key, element, ctx, depth + 1));
+  }
+  if (ctx.deep && depth < ctx.maxDepth && isPlainObject(value)) return walk(value, ctx, depth + 1);
+  return value;
+}
+function walk(input, ctx, depth) {
+  const out = {};
+  for (const [key, value] of Object.entries(input)) {
+    out[key] = walkValue(key, value, ctx, depth);
+  }
+  return out;
+}
+function sanitizeToolInput(input, options) {
+  if (!isPlainObject(input)) return { value: input, changed: false, notes: [] };
+  const ctx = {
+    trim: options?.trim ?? true,
+    coerce: options?.coerce ?? false,
+    repairJson: options?.repairJson ?? false,
+    deep: options?.deep ?? false,
+    maxDepth: options?.maxDepth ?? 8,
+    shape: objectShape(options?.schema),
+    notes: []
+  };
+  const value = walk(input, ctx, 0);
+  return { value, changed: ctx.notes.length > 0, notes: ctx.notes };
+}
+
+export { isPlainObject, sanitizeToolInput, tryJson };
+//# sourceMappingURL=chunk-FJWQP6EE.js.map
+//# sourceMappingURL=chunk-FJWQP6EE.js.map

package/dist/chunk-FJWQP6EE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sanitize/coerce.ts","../src/sanitize/sanitize-tool-input.ts"],"names":[],"mappings":";;;AAQA,IAAI,gBAAA;AACJ,SAAS,cAAA,GAA2C;AAClD,EAAA,IAAI,qBAAqB,MAAA,EAAW;AAClC,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,IAAA,gBAAA,GAAoB,GAAA,CAAI,YAAY,CAAA,CAA4C,UAAA;AAAA,EAClF;AACA,EAAA,OAAO,gBAAA;AACT;AAGO,SAAS,cAAc,CAAA,EAA0C;AACtE,EAAA,OAAO,CAAA,KAAM,QAAQ,OAAO,CAAA,KAAM,YAAY,CAAC,KAAA,CAAM,QAAQ,CAAC,CAAA;AAChE;AAIA,SAAS,eAAe,GAAA,EAAiC;AACvD,EAAA,IAAI,GAAA,KAAQ,IAAI,OAAO,MAAA;AACvB,EAAA,MAAM,CAAA,GAAI,OAAO,GAAG,CAAA;AACpB,EAAA,OAAO,MAAA,CAAO,SAAS,CAAC,CAAA,IAAK,OAAO,CAAC,CAAA,KAAM,MAAM,CAAA,GAAI,MAAA;AACvD;AAMO,SAAS,OAAA,CAAQ,KAAa,MAAA,EAA0B;AAC7D,EAAA,MAAM,CAAA,GAAI,IAAI,SAAA,EAAU;AACxB,EAAA,IAAI,EAAE,EAAE,UAAA,CAAW,GAAG,KAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,CAAA,EAAI,OAAO,MAAA;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,GAAS,gBAAe,CAAE,CAAC,IAAI,CAAC,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAKO,SAAS,eAAA,CAAgB,KAAa,UAAA,EAA8B;AACzE,EAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,IAAA;AAC3B,EAAA,IAAI,GAAA,KAAQ,SAAS,OAAO,KAAA;AAC5B,EAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,IAAA;AAC3B,EAAA,MAAM,CAAA,GAAI,eAAe,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,QAAW,OAAO,CAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,EAAK,KAAK,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA,GAAI,MAAA,CAAA;AACvE,EAAA,OAAO,IAAA,KAAS,SAAY,GAAA,GAAM,IAAA;AACpC;AAKO,SAAS,gBAAA,CAAiB,KAAa,UAAA,EAAgC;AAC5E,EAAA,MAAM,MAAiB,EAAC;AACxB,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,OAAA,IACxB,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,KAAK,CAAA;AAAA,OAAA,IAC/B,GAAA,KAAQ,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACtC,EAAA,MAAM,CAAA,GAAI,eAAe,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,EAAK,KAAK,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA,GAAI,MAAA,CAAA;AACvE,EAAA,IAAI,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACrC,EAAA,GAAA,CAAI,KAAK,GAAG,CAAA;AACZ,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,YAAY,MAAA,EAAkE;AAC5F,EAAA,MAAM,QAAS,MAAA,EAAuD,KAAA;AACtE,EAAA,OAAO,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,WACrC,KAAA,GACD,MAAA;AACN;;;AC5DA,SAAS,SAAA,CAAU,GAAA,EAAa,KAAA,EAAe,GAAA,EAAkB;AAC/D,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,YAAY,KAAA,EAAO,GAAA,CAAI,MAAM,IAAA,CAAK,CAAA,SAAA,EAAY,GAAG,CAAA,CAAA,CAAG,CAAA;AACxD,EAAA,OAAO,OAAA;AACT;AAIA,SAAS,WAAA,CAAY,GAAA,EAAa,GAAA,EAAa,GAAA,EAAmB;AAChE,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,GAAQ,GAAG,CAAA;AAC7B,EAAA,IAAI,OAAA,GAAmB,GAAA;AACvB,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,KAAA,MAAW,SAAA,IAAa,gBAAA,CAAiB,GAAA,EAAK,GAAA,CAAI,UAAU,CAAA,EAAG;AAC7D,MAAA,IAAI,KAAA,CAAM,SAAA,CAAU,SAAS,CAAA,CAAE,OAAA,EAAS;AACtC,QAAA,OAAA,GAAU,SAAA;AACV,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,GAAU,eAAA,CAAgB,GAAA,EAAK,GAAA,CAAI,UAAU,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,YAAY,GAAA,EAAK,GAAA,CAAI,MAAM,IAAA,CAAK,CAAA,SAAA,EAAY,GAAG,CAAA,CAAA,CAAG,CAAA;AACtD,EAAA,OAAO,OAAA;AACT;AAGA,SAAS,WAAA,CAAY,GAAA,EAAa,KAAA,EAAe,GAAA,EAAmB;AAClE,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AACpC,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,KAAA;AACnC,EAAA,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,CAAA,CAAG,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,cAAA,CAAe,GAAA,EAAa,KAAA,EAAe,GAAA,EAAmB;AACrE,EAAA,IAAI,MAAe,GAAA,CAAI,IAAA,GAAO,UAAU,GAAA,EAAK,KAAA,EAAO,GAAG,CAAA,GAAI,KAAA;AAC3D,EAAA,IAAI,GAAA,CAAI,UAAU,OAAO,GAAA,KAAQ,UAAU,GAAA,GAAM,WAAA,CAAY,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAI1E,EAAA,IAAI,GAAA,CAAI,UAAA,IAAc,CAAC,GAAA,CAAI,MAAA,IAAU,OAAO,GAAA,KAAQ,QAAA,EAAU,GAAA,GAAM,WAAA,CAAY,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;AAeA,SAAS,SAAA,CAAU,GAAA,EAAa,KAAA,EAAgB,GAAA,EAAU,KAAA,EAAwB;AAChF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,SAAiB,cAAA,CAAe,GAAA,EAAK,OAAO,GAAG,CAAA;AACpE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,IAAS,GAAA,CAAI,QAAA,EAAU,OAAO,KAAA;AAClC,IAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,OAAA,KAAY,SAAA,CAAU,KAAK,OAAA,EAAS,GAAA,EAAK,KAAA,GAAQ,CAAC,CAAC,CAAA;AAAA,EACvE;AACA,EAAA,IAAI,GAAA,CAAI,IAAA,IAAQ,KAAA,GAAQ,GAAA,CAAI,QAAA,IAAY,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,QAAQ,CAAC,CAAA;AAC/F,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,IAAA,CAAK,KAAA,EAAgC,GAAA,EAAU,KAAA,EAAwC;AAC9F,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,KAAK,KAAK,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,iBAAA,CACd,OACA,OAAA,EACgB;AAEhB,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,EAAC,EAAE;AAC5E,EAAA,MAAM,GAAA,GAAW;AAAA,IACf,IAAA,EAAM,SAAS,IAAA,IAAQ,IAAA;AAAA,IACvB,MAAA,EAAQ,SAAS,MAAA,IAAU,KAAA;AAAA,IAC3B,UAAA,EAAY,SAAS,UAAA,IAAc,KAAA;AAAA,IACnC,IAAA,EAAM,SAAS,IAAA,IAAQ,KAAA;AAAA,IACvB,QAAA,EAAU,SAAS,QAAA,IAAY,CAAA;AAAA,IAC/B,KAAA,EAAO,WAAA,CAAY,OAAA,EAAS,MAAM,CAAA;AAAA,IAClC,OAAO;AAAC,GACV;AACA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,CAAC,CAAA;AAChC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAS,GAAA,CAAI,MAAM,MAAA,GAAS,CAAA,EAAG,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM;AAClE","file":"chunk-FJWQP6EE.js","sourcesContent":["import { createRequire } from \"node:module\";\n\nimport type { ZodType } from \"zod\";\n\n// `jsonrepair` is loaded lazily — consumers who never set `repairJson: true` never pay its\n// module-parse cost. Unlike `zod` (an optional peer dep), `jsonrepair` is a direct dependency and\n// is always installed; the lazy load is a startup-cost optimization, not an optional-install story.\n// Cached after the first repair.\nlet cachedJsonrepair: ((text: string) => string) | undefined;\nfunction loadJsonrepair(): (text: string) => string {\n  if (cachedJsonrepair === undefined) {\n    const req = createRequire(import.meta.url);\n    cachedJsonrepair = (req(\"jsonrepair\") as { jsonrepair: (t: string) => string }).jsonrepair;\n  }\n  return cachedJsonrepair;\n}\n\n/** @internal */\nexport function isPlainObject(v: unknown): v is Record<string, unknown> {\n  return v !== null && typeof v === \"object\" && !Array.isArray(v);\n}\n\n/** Number coercion with a round-trip + finite guard: rejects big-ints, leading-zeros, `NaN`,\n *  `Infinity`, and non-canonical forms (`\"1e3\"`), preventing silent ID/precision corruption (EC-2). */\nfunction toFiniteNumber(raw: string): number | undefined {\n  if (raw === \"\") return undefined;\n  const n = Number(raw);\n  return Number.isFinite(n) && String(n) === raw ? n : undefined;\n}\n\n/** Parse a value ONLY when it looks like a JSON object/array (EC-3 guard; leading whitespace\n *  ignored so `trim:false` inputs are still gated correctly). `repair` routes it through\n *  `jsonrepair` first. Returns `undefined` when not JSON-looking or on parse failure.\n *  @internal */\nexport function tryJson(raw: string, repair: boolean): unknown {\n  const t = raw.trimStart();\n  if (!(t.startsWith(\"{\") || t.startsWith(\"[\"))) return undefined;\n  try {\n    return JSON.parse(repair ? loadJsonrepair()(t) : t);\n  } catch {\n    return undefined;\n  }\n}\n\n/** Heuristic scalar/JSON coercion (agentfw `coerceParameter` shape) used when there is no\n *  per-field schema. Returns the coerced value, or the raw string when nothing applies.\n *  @internal */\nexport function heuristicCoerce(raw: string, repairJson: boolean): unknown {\n  if (raw === \"true\") return true;\n  if (raw === \"false\") return false;\n  if (raw === \"null\") return null;\n  const n = toFiniteNumber(raw);\n  if (n !== undefined) return n;\n  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : undefined);\n  return json === undefined ? raw : json;\n}\n\n/** Candidates a raw string could coerce to, most-specific first. Used for schema-aware coercion:\n *  the field schema selects the first candidate it accepts (so a string field keeps `\"5\"`).\n *  @internal */\nexport function coerceCandidates(raw: string, repairJson: boolean): unknown[] {\n  const out: unknown[] = [];\n  if (raw === \"true\") out.push(true);\n  else if (raw === \"false\") out.push(false);\n  else if (raw === \"null\") out.push(null);\n  const n = toFiniteNumber(raw);\n  if (n !== undefined) out.push(n);\n  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : undefined);\n  if (json !== undefined) out.push(json);\n  out.push(raw); // raw string is always the last-resort candidate\n  return out;\n}\n\n/** True for a Zod schema that exposes a per-key `.shape` (a `z.object`, incl. Zod-v4\n *  `.refine()`/`.default()` which keep `.shape`); non-object schemas (union/record) return\n *  `undefined` so callers fall back to heuristic coercion (EC-4).\n *  @internal */\nexport function objectShape(schema: ZodType | undefined): Record<string, ZodType> | undefined {\n  const shape = (schema as unknown as { shape?: unknown } | undefined)?.shape;\n  return shape !== null && typeof shape === \"object\"\n    ? (shape as Record<string, ZodType>)\n    : undefined;\n}\n","import type { ZodType } from \"zod\";\n\nimport {\n  coerceCandidates,\n  heuristicCoerce,\n  isPlainObject,\n  objectShape,\n  tryJson,\n} from \"./coerce.js\";\nimport type { SanitizeOptions, SanitizeResult } from \"./types.js\";\n\ninterface Ctx {\n  trim: boolean;\n  coerce: boolean;\n  repairJson: boolean;\n  deep: boolean;\n  maxDepth: number;\n  shape: Record<string, ZodType> | undefined;\n  notes: string[];\n}\n\n/** Trim rung — returns the trimmed string, noting the change. */\nfunction applyTrim(key: string, value: string, ctx: Ctx): string {\n  const trimmed = value.trim();\n  if (trimmed !== value) ctx.notes.push(`trimmed \"${key}\"`);\n  return trimmed;\n}\n\n/** Coerce rung — schema-aware when a field schema exists (pick the first accepted candidate),\n *  else heuristic. Returns the coerced value (or the raw string), noting the change. */\nfunction applyCoerce(key: string, raw: string, ctx: Ctx): unknown {\n  const field = ctx.shape?.[key];\n  let coerced: unknown = raw;\n  if (field) {\n    for (const candidate of coerceCandidates(raw, ctx.repairJson)) {\n      if (field.safeParse(candidate).success) {\n        coerced = candidate;\n        break;\n      }\n    }\n  } else {\n    coerced = heuristicCoerce(raw, ctx.repairJson);\n  }\n  if (coerced !== raw) ctx.notes.push(`coerced \"${key}\"`);\n  return coerced;\n}\n\n/** Repair rung — repair-then-parse a JSON-looking string, noting the change. */\nfunction applyRepair(key: string, value: string, ctx: Ctx): unknown {\n  const repaired = tryJson(value, true);\n  if (repaired === undefined) return value;\n  ctx.notes.push(`repaired json \"${key}\"`);\n  return repaired;\n}\n\n/** Sanitize one string value through the enabled rungs (trim → coerce → repair). */\nfunction sanitizeString(key: string, value: string, ctx: Ctx): unknown {\n  let out: unknown = ctx.trim ? applyTrim(key, value, ctx) : value;\n  if (ctx.coerce && typeof out === \"string\") out = applyCoerce(key, out, ctx);\n  // Standalone repair runs ONLY when coerce is off. When coerce is on it already embedded the\n  // repair candidate (via coerceCandidates / heuristicCoerce), and a schema-confirmed raw string\n  // (e.g. a JSON string a `z.string()` field accepted) must not be clobbered back into an object.\n  if (ctx.repairJson && !ctx.coerce && typeof out === \"string\") out = applyRepair(key, out, ctx);\n  return out;\n}\n\n/**\n * Sanitize one value, whatever shape it has.\n *\n * Arrays used to fall through to \"assign as-is\", so `{ tags: [\"  a  \" ] }` came back untouched while\n * `{ tag: \"  a  \" }` was trimmed — even though trim is on by default and the `@public` docblock on\n * `deep` promised recursion into \"objects/arrays\". Nothing in the type distinguished the two cases.\n *\n * The element rules are the SAME rules, deliberately: a string element is sanitized like a string\n * field, and an object element is descended only under `deep`, so a caller does not have to learn a\n * second set of semantics for values that happen to sit in a list. `map` rather than the object\n * walker, because reusing that would return `{ \"0\": … }` and a handler doing `Array.isArray` would\n * reject it.\n */\nfunction walkValue(key: string, value: unknown, ctx: Ctx, depth: number): unknown {\n  if (typeof value === \"string\") return sanitizeString(key, value, ctx);\n  if (Array.isArray(value)) {\n    if (depth >= ctx.maxDepth) return value;\n    return value.map((element) => walkValue(key, element, ctx, depth + 1));\n  }\n  if (ctx.deep && depth < ctx.maxDepth && isPlainObject(value)) return walk(value, ctx, depth + 1);\n  return value;\n}\n\nfunction walk(input: Record<string, unknown>, ctx: Ctx, depth: number): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input)) {\n    out[key] = walkValue(key, value, ctx, depth);\n  }\n  return out;\n}\n\n/**\n * Sanitize the raw arguments a model emitted for a tool call — trim (default), optionally coerce\n * string values toward their expected type, optionally repair malformed JSON. Pure, synchronous,\n * and TOTAL: it never throws (non-object input is returned unchanged) and never changes a value's\n * meaning — only its hygiene/representation. Reused internally by the leaked-dialect recovery so\n * the public primitive and the internal path never diverge.\n *\n * @public\n */\nexport function sanitizeToolInput(\n  input: Record<string, unknown>,\n  options?: SanitizeOptions,\n): SanitizeResult {\n  // EC-1 — total contract: a non-object (null / array / primitive) is returned as-is, never thrown on.\n  if (!isPlainObject(input)) return { value: input, changed: false, notes: [] };\n  const ctx: Ctx = {\n    trim: options?.trim ?? true,\n    coerce: options?.coerce ?? false,\n    repairJson: options?.repairJson ?? false,\n    deep: options?.deep ?? false,\n    maxDepth: options?.maxDepth ?? 8,\n    shape: objectShape(options?.schema),\n    notes: [],\n  };\n  const value = walk(input, ctx, 0);\n  return { value, changed: ctx.notes.length > 0, notes: ctx.notes };\n}\n"]}

package/dist/chunk-FRITRLZQ.cjs

@@ -0,0 +1,24 @@
+'use strict';
+
+// src/internal/auth/api-key-prefix.ts
+var PREFIXES = {
+  "sk-or-": "openrouter",
+  "sk-ant-": "anthropic",
+  "sk-": "openai"
+};
+var BY_LENGTH = Object.entries(PREFIXES).sort(
+  (a, b) => b[0].length - a[0].length
+);
+function providerFromApiKeyPrefix(apiKey) {
+  if (apiKey === void 0) return void 0;
+  const key = apiKey.trim();
+  if (key.length === 0) return void 0;
+  for (const [prefix, provider] of BY_LENGTH) {
+    if (key.startsWith(prefix)) return provider;
+  }
+  return void 0;
+}
+
+exports.providerFromApiKeyPrefix = providerFromApiKeyPrefix;
+//# sourceMappingURL=chunk-FRITRLZQ.cjs.map
+//# sourceMappingURL=chunk-FRITRLZQ.cjs.map

package/dist/chunk-FRITRLZQ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/auth/api-key-prefix.ts"],"names":[],"mappings":";;;AAiBA,IAAM,QAAA,GAA6C;AAAA,EACjD,QAAA,EAAU,YAAA;AAAA,EACV,SAAA,EAAW,WAAA;AAAA,EACX,KAAA,EAAO;AACT,CAAA;AAYA,IAAM,SAAA,GAAsD,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,CAAE,IAAA;AAAA,EACnF,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA,GAAS,CAAA,CAAE,CAAC,CAAA,CAAE;AAC/B,CAAA;AASO,SAAS,yBAAyB,MAAA,EAAgD;AACvF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,MAAM,GAAA,GAAM,OAAO,IAAA,EAAK;AACxB,EAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC7B,EAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,QAAQ,CAAA,IAAK,SAAA,EAAW;AAC1C,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,QAAA;AAAA,EACrC;AACA,EAAA,OAAO,MAAA;AACT","file":"chunk-FRITRLZQ.cjs","sourcesContent":["/**\n * \"Which provider issued this key?\" — the pure prefix answer.\n *\n * Lives in `auth/` and not beside the local-run helper that used to own it, because the question is\n * an auth question. The local-run path additionally refuses a provider it has no profile for; that\n * is its policy, not part of this answer, so it stays there and composes with this.\n *\n * Lives under `internal/` by FOLDER, and is PUBLIC by contract — re-exported from\n * `@theokit/sdk/auth`.\n *\n * Deliberately NOT tagged `@internal`: `tsconfig.base.json` sets `stripInternal: true`, so that tag\n * deletes the declaration from every emitted `.d.ts`. The symbol then exists at runtime and cannot\n * be imported with types — which is the exact defect this module was published to fix, reintroduced\n * one layer down by a docblock. Measured: usetheodev/theokit-sdk#283.\n */\n\n/** Prefix → provider. Order here is irrelevant: the lookup sorts. */\nconst PREFIXES: Readonly<Record<string, string>> = {\n  \"sk-or-\": \"openrouter\",\n  \"sk-ant-\": \"anthropic\",\n  \"sk-\": \"openai\",\n};\n\n/**\n * Longest first, computed once.\n *\n * The ordering IS the correctness property, so it is derived rather than written down: every\n * OpenRouter and Anthropic key also starts with `sk-`, and a shortest-match-first scan resolves\n * them to OpenAI. That failure is invisible locally — it surfaces as a remote 401 from the wrong\n * endpoint, with a message that says nothing about prefixes. The previous implementation was\n * correct only because the entries happened to be written in a workable order; appending a longer\n * prefix, or sorting the table for readability, would have broken it silently.\n */\nconst BY_LENGTH: ReadonlyArray<readonly [string, string]> = Object.entries(PREFIXES).sort(\n  (a, b) => b[0].length - a[0].length,\n);\n\n/**\n * The provider whose key prefix matches, or `undefined` when none does.\n *\n * `undefined` means \"cannot tell\" and never a guess: a wrong guess here routes a real credential to\n * the wrong endpoint. Whitespace-only and empty inputs are \"cannot tell\" too — they are what an\n * empty prompt submits, not a key.\n */\nexport function providerFromApiKeyPrefix(apiKey: string | undefined): string | undefined {\n  if (apiKey === undefined) return undefined;\n  const key = apiKey.trim();\n  if (key.length === 0) return undefined;\n  for (const [prefix, provider] of BY_LENGTH) {\n    if (key.startsWith(prefix)) return provider;\n  }\n  return undefined;\n}\n"]}