@theokit/sdk 0.0.0-compat-580-20260905204608

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":[],"mappings":";;;;;;;;;AA0BA,IAAM,wBAAA,GAA2B,GAAA;AAejC,eAAe,eAAA,CAAgB,GAAA,EAAe,IAAA,EAAc,IAAA,EAAgC;AAC1F,EAAA,MAAM,OAAO,MAAM,GAAA,CAAI,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAC5C,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,iBAAA,CAAkB,IAAA,EAAM,CAAA,EAAG,IAAI,CAAA,2BAAA,EAA8B,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,EAC7F;AACF;AAIA,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAQA,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAKA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAQ,MAAM,eAAA;AAAA,IAClB,GAAA;AAAA,IACA,mCAAA;AAAA,IACA;AAAA,GACF;AAKA,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,eAAA,CAAgB,GAAA,EAAK,+BAA+B,aAAa,CAAA;AAIrF,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAM,YAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * Implements two device flows against their published specs: the RFC 8628 device-grant poll loop\n * (device_code → authorization_pending / slow_down) and OpenAI's two-step headless flow, including the\n * JWT-claim / account-id extraction used to attribute an account.\n * Design choices: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./types.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early. */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/**\n * Parse a JSON body, or fail with this module's typed error instead of a raw `SyntaxError`.\n *\n * Every failure in this file is supposed to reach the caller as an `AuthCallbackError` carrying a code\n * the CLI can branch on. `res.json()` breaks that contract: a device endpoint that answers with HTML —\n * a captive portal, a corporate proxy's sign-in page, a load balancer's error page — makes it reject\n * with a `SyntaxError` that no `catch` here handles, so it escapes untyped past a caller prepared only\n * for `AuthCallbackError`.\n *\n * The body is quoted, truncated, because \"not JSON\" and \"not JSON, and it looks like a proxy login\n * page\" are different diagnoses for whoever is holding the terminal — and routing them to the provider\n * when the fault is their network is the expensive kind of wrong.\n */\nasync function parseJsonOrFail(res: Response, code: string, what: string): Promise<unknown> {\n  const text = await res.text().catch(() => \"\");\n  try {\n    return JSON.parse(text);\n  } catch {\n    throw new AuthCallbackError(code, `${what} returned a non-JSON body: ${text.slice(0, 120)}`);\n  }\n}\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"device endpoint\",\n  )) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step) ───\n\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await parseJsonOrFail(\n    res,\n    \"oauth_device_authorization_failed\",\n    \"usercode endpoint\",\n  )) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await parseJsonOrFail(res, \"oauth_token_exchange_failed\", \"device poll\")) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}

package/dist/batch-I6T6MXZO.cjs

@@ -0,0 +1,263 @@
+'use strict';
+
+var chunkKVSAY6NZ_cjs = require('./chunk-KVSAY6NZ.cjs');
+require('./chunk-BUUUWQMB.cjs');
+var chunkFUSDYC2B_cjs = require('./chunk-FUSDYC2B.cjs');
+require('./chunk-QOGNZMHD.cjs');
+var chunkKTTHHYEW_cjs = require('./chunk-KTTHHYEW.cjs');
+require('./chunk-ZF2LDKQQ.cjs');
+require('./chunk-HCT4HPCL.cjs');
+require('./chunk-JLRLCBJ4.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
+var crypto = require('crypto');
+
+function validateBatchInput(prompts, options) {
+  const { concurrency } = options;
+  if (concurrency !== void 0 && (!Number.isInteger(concurrency) || concurrency < 1)) {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
+      `Agent.batch concurrency must be a positive integer, got ${concurrency}`,
+      { code: "invalid_concurrency" }
+    );
+  }
+  for (let i = 0; i < prompts.length; i++) {
+    const item = prompts[i];
+    const prompt = typeof item === "string" ? item : item?.prompt;
+    if (typeof prompt !== "string" || prompt.length === 0) {
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(`Agent.batch prompt at index ${i} must be a non-empty string`, {
+        code: "invalid_batch_item"
+      });
+    }
+  }
+}
+async function batchImpl(prompts, options, deps) {
+  if (prompts.length === 0) return [];
+  validateBatchInput(prompts, options);
+  const sharedPools = buildPoolsFromApiKeys(
+    options.providers?.apiKeys,
+    options.providers?.credentialPoolStrategy
+  );
+  const exec = () => runBatch(prompts, options, deps);
+  const withPool = () => sharedPools.size > 0 ? chunkFUSDYC2B_cjs.withCredentialPool(sharedPools, exec) : exec();
+  if (options.task !== void 0) {
+    return wrapBatchAsTask(prompts.length, options.task, withPool);
+  }
+  return withPool();
+}
+function throwIfTerminalFailure(id, event) {
+  if (event.type === "errored") {
+    const error = event.error;
+    throw new chunkJ7J7J2GN_cjs.TheokitAgentError(`Batch task ${id} failed: ${error.message}`, {
+      code: "batch_task_failed",
+      protoErrorCode: error.code
+    });
+  }
+  if (event.type === "cancelled") {
+    const reason = event.reason;
+    throw new chunkJ7J7J2GN_cjs.TheokitAgentError(
+      `Batch task ${id} was cancelled${reason === void 0 ? "" : `: ${reason}`}`,
+      { code: "batch_task_cancelled" }
+    );
+  }
+}
+async function wrapBatchAsTask(total, taskOpt, exec) {
+  const opts = taskOpt === true ? {} : taskOpt;
+  const id = opts.id ?? `b-${crypto.randomUUID()}`;
+  const meta = {
+    total,
+    ...opts.meta ?? {}
+  };
+  let results = [];
+  await chunkKVSAY6NZ_cjs.submit({
+    kind: "batch",
+    work: async (ctx) => {
+      results = await exec();
+      const succeeded = results.filter((r) => r.ok).length;
+      const failed = results.length - succeeded;
+      ctx.emit({ total: results.length, succeeded, failed });
+      return { total: results.length, succeeded, failed };
+    },
+    id,
+    meta,
+    allowReservedPrefix: true
+  });
+  for await (const event of chunkKVSAY6NZ_cjs.subscribe(id)) {
+    if (event.type === "finished") return results;
+    throwIfTerminalFailure(id, event);
+  }
+  throw new chunkJ7J7J2GN_cjs.TheokitAgentError(`Batch task ${id} ended without a terminal event`, {
+    code: "batch_task_no_terminal_event"
+  });
+}
+async function runBatch(prompts, options, deps) {
+  const requested = options.concurrency ?? 4;
+  const effective = Math.min(requested, prompts.length);
+  const semaphore = chunkKTTHHYEW_cjs.createSemaphore(effective);
+  const items = prompts.map(normalizeItem);
+  const results = new Array(items.length);
+  const counters = { completed: 0, failed: 0 };
+  let aborted = false;
+  const onAbort = () => {
+    aborted = true;
+  };
+  options.signal?.addEventListener("abort", onAbort);
+  if (options.signal?.aborted === true) aborted = true;
+  try {
+    await Promise.all(
+      items.map(async (item, index) => {
+        const release = await semaphore.acquire();
+        try {
+          if (aborted) {
+            results[index] = abortResult(item, index, options.signal);
+          } else {
+            results[index] = await runOne(item, index, options, deps);
+          }
+          if (results[index].ok) counters.completed += 1;
+          else counters.failed += 1;
+          await safeCallResult(options.onResult, results[index]);
+        } finally {
+          release();
+        }
+        safeCallProgress(options.onProgress, {
+          total: items.length,
+          completed: counters.completed,
+          failed: counters.failed,
+          inFlight: semaphore.inFlight(),
+          pending: Math.max(0, semaphore.pending() - semaphore.inFlight())
+        });
+      })
+    );
+  } finally {
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+  return options.filter ? results.filter(options.filter) : results;
+}
+async function runOne(item, index, options, deps) {
+  const t0 = Date.now();
+  const agentOpts = buildAgentOptions(item, options);
+  try {
+    const agent = await deps.create(agentOpts);
+    try {
+      const run = await agent.send(item.prompt);
+      const result = await run.wait();
+      return {
+        ok: true,
+        index,
+        prompt: item.prompt,
+        result,
+        ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+        durationMs: Date.now() - t0
+      };
+    } finally {
+      try {
+        await agent.dispose();
+      } catch (disposeErr) {
+        chunk6LHQPOMI_cjs.diag(
+          `[theokit-sdk] batch: agent.dispose failed for prompt ${index}: ${disposeErr instanceof Error ? disposeErr.message : String(disposeErr)}
+`
+        );
+      }
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      index,
+      prompt: item.prompt,
+      error: toTheokitError(err),
+      ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+      durationMs: Date.now() - t0
+    };
+  }
+}
+var BATCH_ONLY_KEYS = [
+  "concurrency",
+  "filter",
+  "onResult",
+  "onProgress",
+  "signal",
+  "task"
+];
+function buildAgentOptions(item, options) {
+  const rest = { ...options };
+  for (const key of BATCH_ONLY_KEYS) delete rest[key];
+  const agentOpts = rest;
+  if (item.systemPrompt !== void 0) {
+    return { ...agentOpts, systemPrompt: item.systemPrompt };
+  }
+  return agentOpts;
+}
+function normalizeItem(promptOrItem) {
+  return typeof promptOrItem === "string" ? { prompt: promptOrItem } : promptOrItem;
+}
+function abortResult(item, index, signal) {
+  let error;
+  if (signal?.reason instanceof chunkJ7J7J2GN_cjs.TheokitAgentError) {
+    error = signal.reason;
+  } else if (signal?.reason instanceof Error) {
+    error = new chunkJ7J7J2GN_cjs.TheokitAgentError(signal.reason.message, {
+      code: "aborted",
+      cause: signal.reason
+    });
+  } else {
+    error = new chunkJ7J7J2GN_cjs.TheokitAgentError("Batch aborted via AbortSignal", { code: "aborted" });
+  }
+  return {
+    ok: false,
+    index,
+    prompt: item.prompt,
+    error,
+    ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+    durationMs: 0
+  };
+}
+function toTheokitError(err) {
+  if (err instanceof chunkJ7J7J2GN_cjs.TheokitAgentError) return err;
+  if (err instanceof Error) {
+    return new chunkJ7J7J2GN_cjs.TheokitAgentError(err.message, { code: "unknown", cause: err });
+  }
+  return new chunkJ7J7J2GN_cjs.TheokitAgentError(String(err), { code: "unknown" });
+}
+async function safeCallResult(cb, result) {
+  if (cb === void 0) return;
+  try {
+    await cb(result);
+  } catch (err) {
+    chunk6LHQPOMI_cjs.diag(
+      `[theokit-sdk] batch: onResult callback threw: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function safeCallProgress(cb, progress) {
+  if (cb === void 0) return;
+  try {
+    cb(progress);
+  } catch (err) {
+    chunk6LHQPOMI_cjs.diag(
+      `[theokit-sdk] batch: onProgress callback threw: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function buildPoolsFromApiKeys(apiKeys, strategy) {
+  const pools = /* @__PURE__ */ new Map();
+  if (apiKeys === void 0) return pools;
+  for (const [provider, keys] of Object.entries(apiKeys)) {
+    if (!Array.isArray(keys)) continue;
+    const filtered = keys.filter((k) => typeof k === "string" && k.length > 0);
+    if (filtered.length < 2) continue;
+    const entries = filtered.map(
+      (token, i) => chunkFUSDYC2B_cjs.newPooledCredential({ provider, accessToken: token, priority: i, source: "manual" })
+    );
+    pools.set(
+      provider,
+      new chunkFUSDYC2B_cjs.CredentialPool(provider, entries, strategy?.[provider] ?? "fill_first")
+    );
+  }
+  return pools;
+}
+
+exports.batchImpl = batchImpl;
+exports.validateBatchInput = validateBatchInput;
+//# sourceMappingURL=batch-I6T6MXZO.cjs.map
+//# sourceMappingURL=batch-I6T6MXZO.cjs.map

package/dist/batch-I6T6MXZO.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/agent/batch.ts"],"names":["ConfigurationError","withCredentialPool","TheokitAgentError","randomUUID","submit","subscribe","createSemaphore","diag","newPooledCredential","CredentialPool"],"mappings":";;;;;;;;;;;;;;AAmDO,SAAS,kBAAA,CACd,SACA,OAAA,EACM;AACN,EAAA,MAAM,EAAE,aAAY,GAAI,OAAA;AACxB,EAAA,IAAI,WAAA,KAAgB,WAAc,CAAC,MAAA,CAAO,UAAU,WAAW,CAAA,IAAK,cAAc,CAAA,CAAA,EAAI;AACpF,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,2DAA2D,WAAW,CAAA,CAAA;AAAA,MACtE,EAAE,MAAM,qBAAA;AAAsB,KAChC;AAAA,EACF;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,MAAM,IAAA,GAAO,QAAQ,CAAC,CAAA;AACtB,IAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAA,EAAM,MAAA;AACvD,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,WAAW,CAAA,EAAG;AACrD,MAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,4BAAA,EAA+B,CAAC,CAAA,2BAAA,CAAA,EAA+B;AAAA,QAC1F,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AAAA,EACF;AACF;AAOA,eAAsB,SAAA,CACpB,OAAA,EACA,OAAA,EACA,IAAA,EACwB;AAExB,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAKlC,EAAA,kBAAA,CAAmB,SAAS,OAAO,CAAA;AAKnC,EAAA,MAAM,WAAA,GAAc,qBAAA;AAAA,IAClB,QAAQ,SAAA,EAAW,OAAA;AAAA,IACnB,QAAQ,SAAA,EAAW;AAAA,GACrB;AACA,EAAA,MAAM,IAAA,GAAO,MAA8B,QAAA,CAAS,OAAA,EAAS,SAAS,IAAI,CAAA;AAC1E,EAAA,MAAM,QAAA,GAAW,MACf,WAAA,CAAY,IAAA,GAAO,IAAIC,oCAAA,CAAmB,WAAA,EAAa,IAAI,CAAA,GAAI,IAAA,EAAK;AAGtE,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAW;AAC9B,IAAA,OAAO,eAAA,CAAgB,OAAA,CAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,QAAA,EAAS;AAClB;AASA,SAAS,sBAAA,CACP,IACA,KAAA,EACM;AACN,EAAA,IAAI,KAAA,CAAM,SAAS,SAAA,EAAW;AAC5B,IAAA,MAAM,QAAQ,KAAA,CAAM,KAAA;AACpB,IAAA,MAAM,IAAIC,mCAAA,CAAkB,CAAA,WAAA,EAAc,EAAE,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,CAAA,EAAI;AAAA,MACvE,IAAA,EAAM,mBAAA;AAAA,MACN,gBAAgB,KAAA,CAAM;AAAA,KACvB,CAAA;AAAA,EACH;AACA,EAAA,IAAI,KAAA,CAAM,SAAS,WAAA,EAAa;AAC9B,IAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AACrB,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,CAAA,WAAA,EAAc,EAAE,CAAA,cAAA,EAAiB,MAAA,KAAW,SAAY,EAAA,GAAK,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,CAAA,CAAA;AAAA,MAC1E,EAAE,MAAM,sBAAA;AAAuB,KACjC;AAAA,EACF;AACF;AAEA,eAAe,eAAA,CACb,KAAA,EACA,OAAA,EACA,IAAA,EACwB;AACxB,EAAA,MAAM,IAAA,GAAO,OAAA,KAAY,IAAA,GAAO,EAAC,GAAI,OAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,EAAA,IAAM,CAAA,EAAA,EAAKC,mBAAY,CAAA,CAAA;AACvC,EAAA,MAAM,IAAA,GAAgC;AAAA,IACpC,KAAA;AAAA,IACA,GAAI,IAAA,CAAK,IAAA,IAAQ;AAAC,GACpB;AACA,EAAA,IAAI,UAAyB,EAAC;AAC9B,EAAA,MAAMC,wBAAA,CAAmB;AAAA,IACvB,IAAA,EAAM,OAAA;AAAA,IACN,IAAA,EAAM,OAAO,GAAA,KAAQ;AACnB,MAAA,OAAA,GAAU,MAAM,IAAA,EAAK;AACrB,MAAA,MAAM,YAAY,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,EAAE,CAAA,CAAE,MAAA;AAC9C,MAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,GAAS,SAAA;AAChC,MAAA,GAAA,CAAI,KAAK,EAAE,KAAA,EAAO,QAAQ,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA;AACrD,MAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,MAAA,EAAQ,WAAW,MAAA,EAAO;AAAA,IACpD,CAAA;AAAA,IACA,EAAA;AAAA,IACA,IAAA;AAAA,IACA,mBAAA,EAAqB;AAAA,GACtB,CAAA;AAiBD,EAAA,WAAA,MAAiB,KAAA,IAASC,2BAAA,CAAsB,EAAE,CAAA,EAAG;AACnD,IAAA,IAAI,KAAA,CAAM,IAAA,KAAS,UAAA,EAAY,OAAO,OAAA;AACtC,IAAA,sBAAA,CAAuB,IAAI,KAAK,CAAA;AAAA,EAClC;AAIA,EAAA,MAAM,IAAIH,mCAAA,CAAkB,CAAA,WAAA,EAAc,EAAE,CAAA,+BAAA,CAAA,EAAmC;AAAA,IAC7E,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEA,eAAe,QAAA,CACb,OAAA,EACA,OAAA,EACA,IAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GAAY,QAAQ,WAAA,IAAe,CAAA;AAGzC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,SAAA,EAAW,QAAQ,MAAM,CAAA;AACpD,EAAA,MAAM,SAAA,GAAYI,kCAAgB,SAAS,CAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACvC,EAAA,MAAM,OAAA,GAAyB,IAAI,KAAA,CAAM,KAAA,CAAM,MAAM,CAAA;AACrD,EAAA,MAAM,QAAA,GAAW,EAAE,SAAA,EAAW,CAAA,EAAG,QAAQ,CAAA,EAAE;AAC3C,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,UAAU,MAAY;AAC1B,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ,CAAA;AACA,EAAA,OAAA,CAAQ,MAAA,EAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAEjD,EAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,KAAY,IAAA,EAAM,OAAA,GAAU,IAAA;AAEhD,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,MACZ,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,EAAM,KAAA,KAAU;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,OAAA,EAAQ;AACxC,QAAA,IAAI;AACF,UAAA,IAAI,OAAA,EAAS;AACX,YAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,WAAA,CAAY,IAAA,EAAM,KAAA,EAAO,QAAQ,MAAM,CAAA;AAAA,UAC1D,CAAA,MAAO;AACL,YAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,MAAM,OAAO,IAAA,EAAM,KAAA,EAAO,SAAS,IAAI,CAAA;AAAA,UAC1D;AACA,UAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,CAAE,EAAA,WAAa,SAAA,IAAa,CAAA;AAAA,wBAC/B,MAAA,IAAU,CAAA;AAMxB,UAAA,MAAM,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QACvD,CAAA,SAAE;AACA,UAAA,OAAA,EAAQ;AAAA,QACV;AACA,QAAA,gBAAA,CAAiB,QAAQ,UAAA,EAAY;AAAA,UACnC,OAAO,KAAA,CAAM,MAAA;AAAA,UACb,WAAW,QAAA,CAAS,SAAA;AAAA,UACpB,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,QAAA,EAAU,UAAU,QAAA,EAAS;AAAA,UAC7B,OAAA,EAAS,KAAK,GAAA,CAAI,CAAA,EAAG,UAAU,OAAA,EAAQ,GAAI,SAAA,CAAU,QAAA,EAAU;AAAA,SAChE,CAAA;AAAA,MACH,CAAC;AAAA,KACH;AAAA,EACF,CAAA,SAAE;AACA,IAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,EACtD;AAEA,EAAA,OAAO,QAAQ,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,GAAI,OAAA;AAC3D;AAEA,eAAe,MAAA,CACb,IAAA,EACA,KAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,EAAA,GAAK,KAAK,GAAA,EAAI;AACpB,EAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,IAAA,EAAM,OAAO,CAAA;AAEjD,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,SAAS,CAAA;AACzC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,KAAK,MAAM,CAAA;AACxC,MAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,KAAA;AAAA,QACA,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,MAAA;AAAA,QACA,GAAI,KAAK,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,GAAI,EAAC;AAAA,QACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OAC3B;AAAA,IACF,CAAA,SAAE;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,OAAA,EAAQ;AAAA,MACtB,SAAS,UAAA,EAAY;AAEnB,QAAAC,sBAAA;AAAA,UACE,CAAA,qDAAA,EAAwD,KAAK,CAAA,EAAA,EAC3D,UAAA,YAAsB,QAAQ,UAAA,CAAW,OAAA,GAAU,MAAA,CAAO,UAAU,CACtE;AAAA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,KAAA,EAAO,eAAe,GAAG,CAAA;AAAA,MACzB,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,GAAI,EAAC;AAAA,MACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC3B;AAAA,EACF;AACF;AAuBA,IAAM,eAAA,GAAkB;AAAA,EACtB,aAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAcA,SAAS,iBAAA,CAAkB,MAAiB,OAAA,EAAqC;AAC/E,EAAA,MAAM,IAAA,GAAgC,EAAE,GAAG,OAAA,EAAQ;AACnD,EAAA,KAAA,MAAW,GAAA,IAAO,eAAA,EAAiB,OAAO,IAAA,CAAK,GAAG,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,IAAA;AAClB,EAAA,IAAI,IAAA,CAAK,iBAAiB,MAAA,EAAW;AACnC,IAAA,OAAO,EAAE,GAAG,SAAA,EAAW,YAAA,EAAc,KAAK,YAAA,EAAa;AAAA,EACzD;AACA,EAAA,OAAO,SAAA;AACT;AAEA,SAAS,cAAc,YAAA,EAA6C;AAClE,EAAA,OAAO,OAAO,YAAA,KAAiB,QAAA,GAAW,EAAE,MAAA,EAAQ,cAAa,GAAI,YAAA;AACvE;AAEA,SAAS,WAAA,CAAY,IAAA,EAAiB,KAAA,EAAe,MAAA,EAAmC;AAEtF,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,MAAA,EAAQ,kBAAkBL,mCAAA,EAAmB;AAC/C,IAAA,KAAA,GAAQ,MAAA,CAAO,MAAA;AAAA,EACjB,CAAA,MAAA,IAAW,MAAA,EAAQ,MAAA,YAAkB,KAAA,EAAO;AAC1C,IAAA,KAAA,GAAQ,IAAIA,mCAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS;AAAA,MACnD,IAAA,EAAM,SAAA;AAAA,MACN,OAAO,MAAA,CAAO;AAAA,KACf,CAAA;AAAA,EACH,CAAA,MAAO;AACL,IAAA,KAAA,GAAQ,IAAIA,mCAAA,CAAkB,+BAAA,EAAiC,EAAE,IAAA,EAAM,WAAW,CAAA;AAAA,EACpF;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA;AAAA,IACA,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,KAAA;AAAA,IACA,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,GAAI,EAAC;AAAA,IACjE,UAAA,EAAY;AAAA,GACd;AACF;AAEA,SAAS,eAAe,GAAA,EAAiC;AACvD,EAAA,IAAI,GAAA,YAAeA,qCAAmB,OAAO,GAAA;AAC7C,EAAA,IAAI,eAAe,KAAA,EAAO;AACxB,IAAA,OAAO,IAAIA,oCAAkB,GAAA,CAAI,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,IAAIA,oCAAkB,MAAA,CAAO,GAAG,GAAG,EAAE,IAAA,EAAM,WAAW,CAAA;AAC/D;AAEA,eAAe,cAAA,CAAe,IAA8B,MAAA,EAAoC;AAC9F,EAAA,IAAI,OAAO,MAAA,EAAW;AACtB,EAAA,IAAI;AACF,IAAA,MAAM,GAAG,MAAM,CAAA;AAAA,EACjB,SAAS,GAAA,EAAK;AACZ,IAAAK,sBAAA;AAAA,MACE,iDACE,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD;AAAA;AAAA,KACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAA,CAAiB,IAAgC,QAAA,EAA+B;AACvF,EAAA,IAAI,OAAO,MAAA,EAAW;AACtB,EAAA,IAAI;AACF,IAAA,EAAA,CAAG,QAAQ,CAAA;AAAA,EACb,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA;AAAA,MACE,mDACE,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD;AAAA;AAAA,KACF;AAAA,EACF;AACF;AAOA,SAAS,qBAAA,CACP,SACA,QAAA,EAC6B;AAC7B,EAAA,MAAM,KAAA,uBAAY,GAAA,EAA4B;AAC9C,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,KAAA;AAClC,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AACtD,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC1B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AACtF,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACzB,IAAA,MAAM,UAAU,QAAA,CAAS,GAAA;AAAA,MAAI,CAAC,KAAA,EAAO,CAAA,KACnCC,qCAAA,CAAoB,EAAE,QAAA,EAAU,WAAA,EAAa,KAAA,EAAO,QAAA,EAAU,CAAA,EAAG,MAAA,EAAQ,QAAA,EAAU;AAAA,KACrF;AACA,IAAA,KAAA,CAAM,GAAA;AAAA,MACJ,QAAA;AAAA,MACA,IAAIC,gCAAA,CAAe,QAAA,EAAU,SAAS,QAAA,GAAW,QAAQ,KAAK,YAAY;AAAA,KAC5E;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT","file":"batch-I6T6MXZO.cjs","sourcesContent":["/**\n * `Agent.batch(prompts, options)` core (ADRs D134-D140).\n *\n * Fans out N prompts via bounded concurrency, isolates failures per-prompt,\n * preserves input order in the result array, supports streaming callbacks\n * + AbortSignal. The credential pool (D131) is shared across all\n * in-flight agents via `withCredentialPool` ALS scope (EC-A fix).\n *\n * @internal\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { ConfigurationError, TheokitAgentError } from \"../../errors.js\";\nimport { diag } from \"../../internal/diagnostics.js\";\nimport { CredentialPool, newPooledCredential } from \"../../internal/llm/credential-pool.js\";\nimport { withCredentialPool } from \"../../internal/llm/credential-pool-context.js\";\nimport type { CredentialPoolStrategy } from \"../../internal/llm/credential-pool-types.js\";\nimport {\n  submit as taskRegistrySubmit,\n  subscribe as taskRegistrySubscribe,\n} from \"../../internal/task/registry.js\";\nimport type { AgentOptions, SDKAgent } from \"../../types/agent.js\";\nimport type { BatchItem, BatchOptions, BatchProgress, BatchResult } from \"../../types/batch.js\";\nimport { createSemaphore } from \"../concurrency/async-semaphore.js\";\n\n/** DI contract — keeps batch.ts cycle-free from agent.ts. @internal */\ninterface BatchDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n}\n\n/**\n * Pre-flight boundary validation for `Agent.batch` (arch-review Gap 3).\n *\n * Mirrors the in-repo `validateAgentOptions` / `validateCronExpression`\n * pattern: throws `ConfigurationError` with a stable code on the first\n * violation, returns silently otherwise. Pure — no I/O.\n *\n * Rules:\n * - `concurrency`, when provided, must be a positive integer (rejects\n *   0/negative/non-integer/NaN/Infinity). Previously this was caught only\n *   incidentally deep inside `createSemaphore` with a leaky \"permits\"\n *   message, AND after task wrapping (dangling Task on invalid input).\n * - every prompt item must carry a non-empty string prompt. Previously\n *   `normalizeItem` passed `prompt: \"\"` / non-string straight to\n *   `agent.send`. (Whitespace-only strings are intentionally NOT rejected —\n *   an empty string is a structural error; judging content is not this\n *   validator's job, and the repo's property tests treat any length>=1\n *   string as a valid prompt.)\n *\n * @internal\n */\nexport function validateBatchInput(\n  prompts: ReadonlyArray<string | BatchItem>,\n  options: BatchOptions,\n): void {\n  const { concurrency } = options;\n  if (concurrency !== undefined && (!Number.isInteger(concurrency) || concurrency < 1)) {\n    throw new ConfigurationError(\n      `Agent.batch concurrency must be a positive integer, got ${concurrency}`,\n      { code: \"invalid_concurrency\" },\n    );\n  }\n  for (let i = 0; i < prompts.length; i++) {\n    const item = prompts[i];\n    const prompt = typeof item === \"string\" ? item : item?.prompt;\n    if (typeof prompt !== \"string\" || prompt.length === 0) {\n      throw new ConfigurationError(`Agent.batch prompt at index ${i} must be a non-empty string`, {\n        code: \"invalid_batch_item\",\n      });\n    }\n  }\n}\n\n/**\n * Run N prompts in parallel with bounded concurrency.\n *\n * @internal\n */\nexport async function batchImpl(\n  prompts: ReadonlyArray<string | BatchItem>,\n  options: BatchOptions,\n  deps: BatchDeps,\n): Promise<BatchResult[]> {\n  // EC-1: empty array → no work, no agents created.\n  if (prompts.length === 0) return [];\n\n  // Pre-flight boundary validation (arch-review Gap 3). MUST run before pool\n  // build AND before wrapBatchAsTask so invalid input never registers a\n  // dangling Task or builds a credential pool (fail-fast, Rule 8).\n  validateBatchInput(prompts, options);\n\n  // EC-A fix: build credential pools ONCE and share via AsyncLocalStorage.\n  // Without this each Agent.create() would build its own pool from identical\n  // apiKeys → 4× rate-limit wastage per concurrency window.\n  const sharedPools = buildPoolsFromApiKeys(\n    options.providers?.apiKeys,\n    options.providers?.credentialPoolStrategy,\n  );\n  const exec = (): Promise<BatchResult[]> => runBatch(prompts, options, deps);\n  const withPool = (): Promise<BatchResult[]> =>\n    sharedPools.size > 0 ? withCredentialPool(sharedPools, exec) : exec();\n  // T3.3: opt-in Task wrapping (ADRs D363, D374). Register the whole\n  // batch as a single Task (kind=\"batch\") with `b-` prefix (D368/EC-5).\n  if (options.task !== undefined) {\n    return wrapBatchAsTask(prompts.length, options.task, withPool);\n  }\n  return withPool();\n}\n\n/**\n * Raises the typed error for a terminal failure event, and returns for anything else.\n *\n * Split out of {@link wrapBatchAsTask} so the wait loop reads as \"finished -> results, terminal\n * failure -> throw\" rather than as three inlined branches; the failure vocabulary is one concern and\n * lives in one place.\n */\nfunction throwIfTerminalFailure(\n  id: string,\n  event: { type: string } & Record<string, unknown>,\n): void {\n  if (event.type === \"errored\") {\n    const error = event.error as { message: string; code?: string };\n    throw new TheokitAgentError(`Batch task ${id} failed: ${error.message}`, {\n      code: \"batch_task_failed\",\n      protoErrorCode: error.code,\n    });\n  }\n  if (event.type === \"cancelled\") {\n    const reason = event.reason as string | undefined;\n    throw new TheokitAgentError(\n      `Batch task ${id} was cancelled${reason === undefined ? \"\" : `: ${reason}`}`,\n      { code: \"batch_task_cancelled\" },\n    );\n  }\n}\n\nasync function wrapBatchAsTask(\n  total: number,\n  taskOpt: true | { id?: string; meta?: Record<string, unknown> },\n  exec: () => Promise<BatchResult[]>,\n): Promise<BatchResult[]> {\n  const opts = taskOpt === true ? {} : taskOpt;\n  const id = opts.id ?? `b-${randomUUID()}`;\n  const meta: Record<string, unknown> = {\n    total,\n    ...(opts.meta ?? {}),\n  };\n  let results: BatchResult[] = [];\n  await taskRegistrySubmit({\n    kind: \"batch\",\n    work: async (ctx) => {\n      results = await exec();\n      const succeeded = results.filter((r) => r.ok).length;\n      const failed = results.length - succeeded;\n      ctx.emit({ total: results.length, succeeded, failed });\n      return { total: results.length, succeeded, failed };\n    },\n    id,\n    meta,\n    allowReservedPrefix: true,\n  });\n  // `submit` returns immediately with a queued handle, so this waits for the task's own terminal\n  // EVENT rather than polling its state.\n  //\n  // What this replaced, and why the replacement is not just tidier: the wait was\n  // `for (let i = 0; i < 5000; i++) { ...get(id)...; await sleep(5) }` followed by an unconditional\n  // `return results`, and `results` is assigned only inside the `work` callback above. So THREE\n  // distinct failures produced one indistinguishable value — the work threw, the task was\n  // cancelled, or the budget elapsed — and each returned `[]` on a RESOLVED promise, which a caller\n  // cannot tell apart from `Agent.batch([])`. The registry had already recorded the failure as\n  // `{ code, message }` on the terminal event; the loop read only `handle.state` and dropped it.\n  //\n  // The budget was not a safety net either. 5000 iterations of a 5 ms sleep is ~25 s, and a batch\n  // legitimately longer than that would trip it and return `[]` — the bound generated the bug it\n  // appeared to guard against. A task's own lifecycle is the honest bound, and `subscribe` drains\n  // the buffered events first (`subscribe.ts:23`), so a task that finished before this line runs\n  // still delivers its terminal event rather than hanging.\n  for await (const event of taskRegistrySubscribe(id)) {\n    if (event.type === \"finished\") return results;\n    throwIfTerminalFailure(id, event);\n  }\n  // The registry's contract says the stream ends only after a terminal event, so this is\n  // unreachable. It throws rather than returning `results` because returning here would restore the\n  // exact silent-empty-array path this function was rewritten to remove.\n  throw new TheokitAgentError(`Batch task ${id} ended without a terminal event`, {\n    code: \"batch_task_no_terminal_event\",\n  });\n}\n\nasync function runBatch(\n  prompts: ReadonlyArray<string | BatchItem>,\n  options: BatchOptions,\n  deps: BatchDeps,\n): Promise<BatchResult[]> {\n  const requested = options.concurrency ?? 4;\n  // createSemaphore throws on invalid (EC-2).\n  // EC-3: cap to prompts.length to avoid idle workers.\n  const effective = Math.min(requested, prompts.length);\n  const semaphore = createSemaphore(effective);\n  const items = prompts.map(normalizeItem);\n  const results: BatchResult[] = new Array(items.length);\n  const counters = { completed: 0, failed: 0 };\n  let aborted = false;\n\n  const onAbort = (): void => {\n    aborted = true;\n  };\n  options.signal?.addEventListener(\"abort\", onAbort);\n  // EC-C: pre-aborted signal — treat as already-aborted before any work.\n  if (options.signal?.aborted === true) aborted = true;\n\n  try {\n    await Promise.all(\n      items.map(async (item, index) => {\n        const release = await semaphore.acquire();\n        try {\n          if (aborted) {\n            results[index] = abortResult(item, index, options.signal);\n          } else {\n            results[index] = await runOne(item, index, options, deps);\n          }\n          if (results[index].ok) counters.completed += 1;\n          else counters.failed += 1;\n          // B-110 (measured 2026-08-19): `onResult` used to run AFTER `release()`, so a caller who\n          // asked for `concurrency: 1` still got overlapping `onResult` invocations — the permit was\n          // already returned before the callback ran. `concurrency` is documented (`types/batch.ts`)\n          // to bound the whole per-item lifecycle, callback included, so the permit is now held\n          // until `onResult` finishes: this call moved inside the `try` the `finally` below wraps.\n          await safeCallResult(options.onResult, results[index]);\n        } finally {\n          release();\n        }\n        safeCallProgress(options.onProgress, {\n          total: items.length,\n          completed: counters.completed,\n          failed: counters.failed,\n          inFlight: semaphore.inFlight(),\n          pending: Math.max(0, semaphore.pending() - semaphore.inFlight()),\n        });\n      }),\n    );\n  } finally {\n    options.signal?.removeEventListener(\"abort\", onAbort);\n  }\n\n  return options.filter ? results.filter(options.filter) : results;\n}\n\nasync function runOne(\n  item: BatchItem,\n  index: number,\n  options: BatchOptions,\n  deps: BatchDeps,\n): Promise<BatchResult> {\n  const t0 = Date.now();\n  const agentOpts = buildAgentOptions(item, options);\n\n  try {\n    const agent = await deps.create(agentOpts);\n    try {\n      const run = await agent.send(item.prompt);\n      const result = await run.wait();\n      return {\n        ok: true,\n        index,\n        prompt: item.prompt,\n        result,\n        ...(item.metadata !== undefined ? { metadata: item.metadata } : {}),\n        durationMs: Date.now() - t0,\n      };\n    } finally {\n      // EC-8: dispose failure → stderr warn, don't fail the result.\n      try {\n        await agent.dispose();\n      } catch (disposeErr) {\n        // theokit#147 — the interceptable channel; a batch run must not write onto a TUI's frame.\n        diag(\n          `[theokit-sdk] batch: agent.dispose failed for prompt ${index}: ${\n            disposeErr instanceof Error ? disposeErr.message : String(disposeErr)\n          }\\n`,\n        );\n      }\n    }\n  } catch (err) {\n    return {\n      ok: false,\n      index,\n      prompt: item.prompt,\n      error: toTheokitError(err),\n      ...(item.metadata !== undefined ? { metadata: item.metadata } : {}),\n      durationMs: Date.now() - t0,\n    };\n  }\n}\n\n/** Every key `BatchOptions` adds on top of `AgentOptions`, derived rather than listed twice. */\ntype BatchOnlyKey = Exclude<keyof BatchOptions, keyof AgentOptions>;\n\n/**\n * The batch-only keys, as values — `buildAgentOptions` has to strip them at runtime and a type\n * cannot do that.\n *\n * Both halves of this declaration are load-bearing, in opposite directions:\n *\n *  - `satisfies readonly BatchOnlyKey[]` rejects a key here that is NOT batch-only, so a rename in\n *    the interface breaks this list instead of silently stripping a field that should be forwarded.\n *  - `NoUnlistedBatchOnlyKey` below rejects a batch-only key MISSING from here, which is the\n *    direction that actually bites: adding a seventh option to `BatchOptions` and forgetting this\n *    function forwards it into `AgentOptions`, where TypeScript's excess-property check does not\n *    fire on a spread and `validateAgentOptions` either rejects it or carries it into every agent\n *    the batch creates.\n *\n * The keys are NOT derived into the interface as a mapped type, which would collapse both\n * representations into one: each of the six carries several paragraphs of public API documentation,\n * and a mapped type cannot hold them.\n */\nconst BATCH_ONLY_KEYS = [\n  \"concurrency\",\n  \"filter\",\n  \"onResult\",\n  \"onProgress\",\n  \"signal\",\n  \"task\",\n] as const satisfies readonly BatchOnlyKey[];\n\n/** Compile-time only: resolves to `never` unless every batch-only key is listed above. */\ntype NoUnlistedBatchOnlyKey =\n  Exclude<BatchOnlyKey, (typeof BATCH_ONLY_KEYS)[number]> extends never\n    ? true\n    : [\n        \"batch-only key missing from BATCH_ONLY_KEYS\",\n        Exclude<BatchOnlyKey, (typeof BATCH_ONLY_KEYS)[number]>,\n      ];\n\nconst _batchKeysAreExhaustive: NoUnlistedBatchOnlyKey = true;\nvoid _batchKeysAreExhaustive;\n\nfunction buildAgentOptions(item: BatchItem, options: BatchOptions): AgentOptions {\n  const rest: Record<string, unknown> = { ...options };\n  for (const key of BATCH_ONLY_KEYS) delete rest[key];\n  const agentOpts = rest as AgentOptions;\n  if (item.systemPrompt !== undefined) {\n    return { ...agentOpts, systemPrompt: item.systemPrompt };\n  }\n  return agentOpts;\n}\n\nfunction normalizeItem(promptOrItem: string | BatchItem): BatchItem {\n  return typeof promptOrItem === \"string\" ? { prompt: promptOrItem } : promptOrItem;\n}\n\nfunction abortResult(item: BatchItem, index: number, signal?: AbortSignal): BatchResult {\n  // EC-D: propagate signal.reason when set (preserves caller's error).\n  let error: TheokitAgentError;\n  if (signal?.reason instanceof TheokitAgentError) {\n    error = signal.reason;\n  } else if (signal?.reason instanceof Error) {\n    error = new TheokitAgentError(signal.reason.message, {\n      code: \"aborted\",\n      cause: signal.reason,\n    });\n  } else {\n    error = new TheokitAgentError(\"Batch aborted via AbortSignal\", { code: \"aborted\" });\n  }\n  return {\n    ok: false,\n    index,\n    prompt: item.prompt,\n    error,\n    ...(item.metadata !== undefined ? { metadata: item.metadata } : {}),\n    durationMs: 0,\n  };\n}\n\nfunction toTheokitError(err: unknown): TheokitAgentError {\n  if (err instanceof TheokitAgentError) return err;\n  if (err instanceof Error) {\n    return new TheokitAgentError(err.message, { code: \"unknown\", cause: err });\n  }\n  return new TheokitAgentError(String(err), { code: \"unknown\" });\n}\n\nasync function safeCallResult(cb: BatchOptions[\"onResult\"], result: BatchResult): Promise<void> {\n  if (cb === undefined) return;\n  try {\n    await cb(result);\n  } catch (err) {\n    diag(\n      `[theokit-sdk] batch: onResult callback threw: ${\n        err instanceof Error ? err.message : String(err)\n      }\\n`,\n    );\n  }\n}\n\nfunction safeCallProgress(cb: BatchOptions[\"onProgress\"], progress: BatchProgress): void {\n  if (cb === undefined) return;\n  try {\n    cb(progress);\n  } catch (err) {\n    diag(\n      `[theokit-sdk] batch: onProgress callback threw: ${\n        err instanceof Error ? err.message : String(err)\n      }\\n`,\n    );\n  }\n}\n\n/**\n * EC-A: construct shared pools from options.apiKeys. Empty/invalid → empty Map.\n *\n * @internal\n */\nfunction buildPoolsFromApiKeys(\n  apiKeys: Record<string, string[]> | undefined,\n  strategy: Record<string, CredentialPoolStrategy> | undefined,\n): Map<string, CredentialPool> {\n  const pools = new Map<string, CredentialPool>();\n  if (apiKeys === undefined) return pools;\n  for (const [provider, keys] of Object.entries(apiKeys)) {\n    if (!Array.isArray(keys)) continue;\n    const filtered = keys.filter((k): k is string => typeof k === \"string\" && k.length > 0);\n    if (filtered.length < 2) continue; // 1-key pools aren't pools\n    const entries = filtered.map((token, i) =>\n      newPooledCredential({ provider, accessToken: token, priority: i, source: \"manual\" }),\n    );\n    pools.set(\n      provider,\n      new CredentialPool(provider, entries, strategy?.[provider] ?? \"fill_first\"),\n    );\n  }\n  return pools;\n}\n"]}

package/dist/batch-US4F6WPK.js

@@ -0,0 +1,260 @@
+import { submit, subscribe } from './chunk-K2VMFZQ5.js';
+import './chunk-K2BQQ445.js';
+import { newPooledCredential, CredentialPool, withCredentialPool } from './chunk-UBR5PWD7.js';
+import './chunk-24MGQDK3.js';
+import { createSemaphore } from './chunk-G7BLGBRN.js';
+import './chunk-Q5EWJPRY.js';
+import './chunk-EIQFAOFD.js';
+import './chunk-3JHIFQ4I.js';
+import { ConfigurationError, TheokitAgentError } from './chunk-ALUN2B4W.js';
+import { diag } from './chunk-CZJ6Q7CW.js';
+import { randomUUID } from 'crypto';
+
+function validateBatchInput(prompts, options) {
+  const { concurrency } = options;
+  if (concurrency !== void 0 && (!Number.isInteger(concurrency) || concurrency < 1)) {
+    throw new ConfigurationError(
+      `Agent.batch concurrency must be a positive integer, got ${concurrency}`,
+      { code: "invalid_concurrency" }
+    );
+  }
+  for (let i = 0; i < prompts.length; i++) {
+    const item = prompts[i];
+    const prompt = typeof item === "string" ? item : item?.prompt;
+    if (typeof prompt !== "string" || prompt.length === 0) {
+      throw new ConfigurationError(`Agent.batch prompt at index ${i} must be a non-empty string`, {
+        code: "invalid_batch_item"
+      });
+    }
+  }
+}
+async function batchImpl(prompts, options, deps) {
+  if (prompts.length === 0) return [];
+  validateBatchInput(prompts, options);
+  const sharedPools = buildPoolsFromApiKeys(
+    options.providers?.apiKeys,
+    options.providers?.credentialPoolStrategy
+  );
+  const exec = () => runBatch(prompts, options, deps);
+  const withPool = () => sharedPools.size > 0 ? withCredentialPool(sharedPools, exec) : exec();
+  if (options.task !== void 0) {
+    return wrapBatchAsTask(prompts.length, options.task, withPool);
+  }
+  return withPool();
+}
+function throwIfTerminalFailure(id, event) {
+  if (event.type === "errored") {
+    const error = event.error;
+    throw new TheokitAgentError(`Batch task ${id} failed: ${error.message}`, {
+      code: "batch_task_failed",
+      protoErrorCode: error.code
+    });
+  }
+  if (event.type === "cancelled") {
+    const reason = event.reason;
+    throw new TheokitAgentError(
+      `Batch task ${id} was cancelled${reason === void 0 ? "" : `: ${reason}`}`,
+      { code: "batch_task_cancelled" }
+    );
+  }
+}
+async function wrapBatchAsTask(total, taskOpt, exec) {
+  const opts = taskOpt === true ? {} : taskOpt;
+  const id = opts.id ?? `b-${randomUUID()}`;
+  const meta = {
+    total,
+    ...opts.meta ?? {}
+  };
+  let results = [];
+  await submit({
+    kind: "batch",
+    work: async (ctx) => {
+      results = await exec();
+      const succeeded = results.filter((r) => r.ok).length;
+      const failed = results.length - succeeded;
+      ctx.emit({ total: results.length, succeeded, failed });
+      return { total: results.length, succeeded, failed };
+    },
+    id,
+    meta,
+    allowReservedPrefix: true
+  });
+  for await (const event of subscribe(id)) {
+    if (event.type === "finished") return results;
+    throwIfTerminalFailure(id, event);
+  }
+  throw new TheokitAgentError(`Batch task ${id} ended without a terminal event`, {
+    code: "batch_task_no_terminal_event"
+  });
+}
+async function runBatch(prompts, options, deps) {
+  const requested = options.concurrency ?? 4;
+  const effective = Math.min(requested, prompts.length);
+  const semaphore = createSemaphore(effective);
+  const items = prompts.map(normalizeItem);
+  const results = new Array(items.length);
+  const counters = { completed: 0, failed: 0 };
+  let aborted = false;
+  const onAbort = () => {
+    aborted = true;
+  };
+  options.signal?.addEventListener("abort", onAbort);
+  if (options.signal?.aborted === true) aborted = true;
+  try {
+    await Promise.all(
+      items.map(async (item, index) => {
+        const release = await semaphore.acquire();
+        try {
+          if (aborted) {
+            results[index] = abortResult(item, index, options.signal);
+          } else {
+            results[index] = await runOne(item, index, options, deps);
+          }
+          if (results[index].ok) counters.completed += 1;
+          else counters.failed += 1;
+          await safeCallResult(options.onResult, results[index]);
+        } finally {
+          release();
+        }
+        safeCallProgress(options.onProgress, {
+          total: items.length,
+          completed: counters.completed,
+          failed: counters.failed,
+          inFlight: semaphore.inFlight(),
+          pending: Math.max(0, semaphore.pending() - semaphore.inFlight())
+        });
+      })
+    );
+  } finally {
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+  return options.filter ? results.filter(options.filter) : results;
+}
+async function runOne(item, index, options, deps) {
+  const t0 = Date.now();
+  const agentOpts = buildAgentOptions(item, options);
+  try {
+    const agent = await deps.create(agentOpts);
+    try {
+      const run = await agent.send(item.prompt);
+      const result = await run.wait();
+      return {
+        ok: true,
+        index,
+        prompt: item.prompt,
+        result,
+        ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+        durationMs: Date.now() - t0
+      };
+    } finally {
+      try {
+        await agent.dispose();
+      } catch (disposeErr) {
+        diag(
+          `[theokit-sdk] batch: agent.dispose failed for prompt ${index}: ${disposeErr instanceof Error ? disposeErr.message : String(disposeErr)}
+`
+        );
+      }
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      index,
+      prompt: item.prompt,
+      error: toTheokitError(err),
+      ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+      durationMs: Date.now() - t0
+    };
+  }
+}
+var BATCH_ONLY_KEYS = [
+  "concurrency",
+  "filter",
+  "onResult",
+  "onProgress",
+  "signal",
+  "task"
+];
+function buildAgentOptions(item, options) {
+  const rest = { ...options };
+  for (const key of BATCH_ONLY_KEYS) delete rest[key];
+  const agentOpts = rest;
+  if (item.systemPrompt !== void 0) {
+    return { ...agentOpts, systemPrompt: item.systemPrompt };
+  }
+  return agentOpts;
+}
+function normalizeItem(promptOrItem) {
+  return typeof promptOrItem === "string" ? { prompt: promptOrItem } : promptOrItem;
+}
+function abortResult(item, index, signal) {
+  let error;
+  if (signal?.reason instanceof TheokitAgentError) {
+    error = signal.reason;
+  } else if (signal?.reason instanceof Error) {
+    error = new TheokitAgentError(signal.reason.message, {
+      code: "aborted",
+      cause: signal.reason
+    });
+  } else {
+    error = new TheokitAgentError("Batch aborted via AbortSignal", { code: "aborted" });
+  }
+  return {
+    ok: false,
+    index,
+    prompt: item.prompt,
+    error,
+    ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+    durationMs: 0
+  };
+}
+function toTheokitError(err) {
+  if (err instanceof TheokitAgentError) return err;
+  if (err instanceof Error) {
+    return new TheokitAgentError(err.message, { code: "unknown", cause: err });
+  }
+  return new TheokitAgentError(String(err), { code: "unknown" });
+}
+async function safeCallResult(cb, result) {
+  if (cb === void 0) return;
+  try {
+    await cb(result);
+  } catch (err) {
+    diag(
+      `[theokit-sdk] batch: onResult callback threw: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function safeCallProgress(cb, progress) {
+  if (cb === void 0) return;
+  try {
+    cb(progress);
+  } catch (err) {
+    diag(
+      `[theokit-sdk] batch: onProgress callback threw: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function buildPoolsFromApiKeys(apiKeys, strategy) {
+  const pools = /* @__PURE__ */ new Map();
+  if (apiKeys === void 0) return pools;
+  for (const [provider, keys] of Object.entries(apiKeys)) {
+    if (!Array.isArray(keys)) continue;
+    const filtered = keys.filter((k) => typeof k === "string" && k.length > 0);
+    if (filtered.length < 2) continue;
+    const entries = filtered.map(
+      (token, i) => newPooledCredential({ provider, accessToken: token, priority: i, source: "manual" })
+    );
+    pools.set(
+      provider,
+      new CredentialPool(provider, entries, strategy?.[provider] ?? "fill_first")
+    );
+  }
+  return pools;
+}
+
+export { batchImpl, validateBatchInput };
+//# sourceMappingURL=batch-US4F6WPK.js.map
+//# sourceMappingURL=batch-US4F6WPK.js.map