@theokit/sdk 4.23.0 → 4.24.0

package/dist/internal/auth/credential-store.d.ts

@@ -1,10 +1,27 @@
+import { AuthenticationError } from "../../errors.js";
 /** The store directory, honoring an optional `homeEnvVar` override. */
 export declare function credentialHome(config: CredentialStoreConfig, env?: Record<string, string | undefined>): string;
 /** The credential file path inside the (possibly overridden) store directory. */
 export declare function authFilePath(config: CredentialStoreConfig, env?: Record<string, string | undefined>): string;
-/** A credential problem the caller can act on. Never carries the key value. */
-export declare class CredentialError extends Error {
-    constructor(message: string);
+/**
+ * A credential problem the caller can act on. Never carries the key value.
+ *
+ * M78 — this used to extend bare `Error`, which quietly disabled classification for the entire auth
+ * path: `isTransientError` is `err instanceof TheokitAgentError && err.isRetryable === true`
+ * (`errors.ts:443`), so a credential failure could never be judged transient OR permanent. The
+ * predicate was not "forgotten" downstream — it was unusable there by construction.
+ *
+ * Extending `AuthenticationError` is ADDITIVE: the class still exists, still reports
+ * `name: "CredentialError"`, and every existing `instanceof CredentialError` stays true. It only
+ * gains ancestors. `AuthenticationError` pins `isRetryable: false`, so gaining the ability to be
+ * classified does NOT turn a revoked credential into a retry loop.
+ *
+ * The single reference does the same thing with one root type: Codex routes every domain failure
+ * through `CodexErr` with `is_retryable()` as a method (`protocol/src/error.rs:176`), rather than
+ * parallel classes extending the language's `Error`.
+ */
+export declare class CredentialError extends AuthenticationError {
+    readonly name: string;
 }
 export declare function readAuthFile(config: CredentialStoreConfig, env?: Record<string, string | undefined>): StoredCredential | undefined;
 /**

package/dist/models.cjs

@@ -295,6 +295,12 @@ var TheokitAgentError = class extends Error {
     if (options.metadata !== void 0) this.metadata = options.metadata;
   }
 };
+var AuthenticationError = class extends TheokitAgentError {
+  name = "AuthenticationError";
+  constructor(message, options = {}) {
+    super(message, { ...options, isRetryable: false });
+  }
+};
 var ConfigurationError = class extends TheokitAgentError {
   name = "ConfigurationError";
   constructor(message, options = {}) {
@@ -535,11 +541,11 @@ function credentialHome(config, env = {}) {
 function authFilePath(config, env = {}) {
   return path.join(credentialHome(config, env), config.fileName);
 }
-var CredentialError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CredentialError";
-  }
+var CredentialError = class extends AuthenticationError {
+  // Field, not an assignment in the constructor: `AuthenticationError.name` is `override readonly`
+  // (`errors.ts:174`), so `this.name = …` does not compile. Caught by `tsc`, not by vitest — the
+  // suite was green with the broken assignment because the transpiler strips the type.
+  name = "CredentialError";
 };
 var apiFileSchema = zod.z.object({
   type: zod.z.literal("api").optional(),