@theokit/sdk 4.24.0 → 4.26.0

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/errors.ts","../../src/internal/auth/credential-store.ts","../../src/server/auth/errors.ts","../../src/internal/auth/oauth-engine.ts","../../src/internal/auth/oauth-device.ts","../../src/internal/auth/resolve-credential.ts"],"names":["fresh"],"mappings":";;;;;;;;AA8IO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAe,mBAAA;AAAA,EACxB,WAAA;AAAA,EACA,IAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EAET,WAAA,CACE,OAAA,EACA,OAAA,GAMI,EAAC,EACL;AACA,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,MAAS,CAAA;AACjF,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,KAAA;AAC1C,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,MAAA,EAAW,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpD,IAAA,IAAI,OAAA,CAAQ,cAAA,KAAmB,MAAA,EAAW,IAAA,CAAK,iBAAiB,OAAA,CAAQ,cAAA;AACxE,IAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AAAA,EAC9D;AACF,CAAA;AAOO,IAAM,mBAAA,GAAN,cAAkC,iBAAA,CAAkB;AAAA,EACvC,IAAA,GAAe,qBAAA;AAAA,EAEjC,WAAA,CACE,OAAA,EACA,OAAA,GAAwE,EAAC,EACzE;AACA,IAAA,KAAA,CAAM,SAAS,EAAE,GAAG,OAAA,EAAS,WAAA,EAAa,OAAO,CAAA;AAAA,EACnD;AACF,CAAA;;;AC7IO,SAAS,cAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,MAAM,QAAA,GAAW,OAAO,UAAA,KAAe,MAAA,GAAY,IAAI,MAAA,CAAO,UAAU,CAAA,EAAG,IAAA,EAAK,GAAI,MAAA;AACpF,EAAA,OAAO,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,GAC/C,WACA,IAAA,CAAK,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AACtC;AAGO,SAAS,YAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,OAAO,KAAK,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA,EAAG,OAAO,QAAQ,CAAA;AAC1D;AAmBO,IAAM,eAAA,GAAN,cAA8B,mBAAA,CAAoB;AAAA;AAAA;AAAA;AAAA,EAIrC,IAAA,GAAe,iBAAA;AACnC;AAOA,IAAM,aAAA,GAAgB,EACnB,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,KAAK,EAAE,QAAA,EAAS;AAAA,EAChC,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,OAAA,EAAS,EAAE,MAAA;AACb,CAAC,EACA,MAAA,EAAO;AAEV,IAAM,eAAA,GAAkB,EACrB,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,EACvB,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACxB,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,OAAA,EAAS,EAAE,MAAA,EAAO;AAAA,EAClB,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACzB,CAAC,EACA,MAAA,EAAO;AAGV,IAAM,aAAa,CAAA,CAAE,KAAA,CAAM,CAAC,eAAA,EAAiB,aAAa,CAAC,CAAA;AAc3D,SAAS,iBAAA,CAAkB,SAAiB,IAAA,EAAoB;AAC9D,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,OAAO,CAAA,CAAE,IAAA,GAAO,GAAA;AACzC,EAAA,IAAA,CAAK,OAAA,GAAU,QAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,EAAG,OAAO,CAAA,kCAAA,EAAqC,OAAA,CAAQ,SAAS,CAAC,CAAC,gFACV,OAAO,CAAA;AAAA,KACjE;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAI,CAAA,CAAE,IAAA,GAAO,GAAA;AACnC,EAAA,IAAA,CAAK,IAAA,GAAO,QAAW,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,EAAG,IAAI,CAAA,kCAAA,EAAqC,IAAA,CAAK,SAAS,CAAC,CAAC,6DACA,IAAI,CAAA;AAAA,KAClE;AAAA,EACF;AACF;AAMA,SAAS,kBAAA,CAAmB,MAAA,EAAiB,GAAA,EAAc,IAAA,EAA+B;AACxF,EAAA,MAAM,aACJ,OAAO,MAAA,KAAW,YAClB,MAAA,KAAW,IAAA,IACV,OAA8B,IAAA,KAAS,OAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,aAAa,eAAA,CAAgB,SAAA,CAAU,MAAM,CAAA,GAAI,aAAA,CAAc,UAAU,MAAM,CAAA;AAChG,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,CAAC,SAAS,OAAA,EAAS;AACrB,IAAA,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AAAA,EACjC,CAAA,MAAA,IAAW,GAAA,YAAe,CAAA,CAAE,QAAA,EAAU;AACpC,IAAA,KAAA,GAAQ,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACtB;AACA,EAAA,OAAO,IAAI,eAAA;AAAA,IACT,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAA,EAAO,WAAW,MAAA,CAAO,GAAG,CAAC,CAAA,EAAA,EAAK,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,GAAG,KAAK,MAAM,CAAA,CAAA;AAAA,GAC/E;AACF;AAGA,SAAS,eAAA,CAAgB,KAAa,IAAA,EAAgC;AACpE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AAGN,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,GAAG,IAAI,CAAA,uEAAA;AAAA,KACT;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,UAAA,CAAW,MAAM,MAAM,CAAA;AAAA,EAChC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,kBAAA,CAAmB,MAAA,EAAQ,GAAA,EAAK,IAAI,CAAA;AAAA,EAC5C;AACF;AAEO,SAAS,YAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACb;AAC9B,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AAErC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,MAAM,MAAM,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,MAAA;AAC7D,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,YAAA,EAAe,IAAI,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,iBAAA,CAAkB,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA,EAAG,IAAI,CAAA;AACnD,EAAA,OAAO,eAAA,CAAgB,KAAK,IAAI,CAAA;AAClC;AAOO,SAAS,eAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACR;AACnC,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AACvC,EAAA,OAAO,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,IAAA,KAAS,UAAU,MAAA,GAAS,MAAA;AACpE;AAGA,SAAS,aACP,CAAA,EAC4B;AAC5B,EAAA,OAAO,MAAA,IAAU,CAAA,IAAK,CAAA,CAAE,IAAA,KAAS,OAAA;AACnC;AAUA,SAAS,kBACP,IAAA,EACyB;AACzB,EAAA,IAAI,YAAA,CAAa,IAAI,CAAA,EAAG;AACtB,IAAA,IAAI,KAAK,MAAA,CAAO,MAAA,KAAW,KAAK,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AACzD,MAAA,MAAM,IAAI,eAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,OAAA;AAAA,MACN,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI;AAAC,KACzE;AAAA,EACF;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,MAAA,KAAW,YAAY,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,gBAAgB,oCAAoC,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,OAAA,EAAS,KAAK,MAAA,EAAO;AACzD;AAEO,SAAS,eAAA,CACd,IAAA,EACA,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AAEtC,EAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA;AACtC,EAAA,SAAA,CAAU,KAAK,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAC/C,EAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AAEpB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AAIrC,EAAA,MAAM,GAAA,GAAM,GAAG,IAAI,CAAA,KAAA,EAAQ,YAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAK,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,GAAK,CAAA;AACpC,IAAA,IAAI;AACF,MAAA,aAAA,CAAc,IAAI,CAAA,EAAG,IAAA,CAAK,UAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC;AAAA,CAAI,CAAA;AACzD,MAAA,SAAA,CAAU,EAAE,CAAA;AAAA,IACd,CAAA,SAAE;AACA,MAAA,SAAA,CAAU,EAAE,CAAA;AAAA,IACd;AACA,IAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACpB,IAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAA,UAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,aAAA,EAAgB,IAAI,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,IAAA;AACT;;;AC3OO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAe,mBAAA;AAAA,EACxB,IAAA;AAAA,EAET,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,KAAA,CAAM,OAAA,IAAW,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAE,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF,CAAA;;;AC1BA,IAAM,eAAA,GAAkB,GAAA;AAGxB,SAAS,kBAAA,CAAmB,MAAe,GAAA,EAA0B;AACnE,EAAA,MAAM,CAAA,GAAI,IAAA;AAMV,EAAA,IAAI,OAAO,CAAA,CAAE,YAAA,KAAiB,YAAY,CAAA,CAAE,YAAA,CAAa,WAAW,CAAA,EAAG;AACrE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,aAAA,KAAkB,YAAY,CAAA,CAAE,aAAA,CAAc,WAAW,CAAA,EAAG;AACvE,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAY,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,UAAA,GAAa,IAAA;AACpE,EAAA,OAAO;AAAA,IACL,QAAQ,CAAA,CAAE,YAAA;AAAA,IACV,SAAS,CAAA,CAAE,aAAA;AAAA,IACX,OAAA,EAAS,MAAM,SAAA,GAAY,GAAA;AAAA,IAC3B,GAAI,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW,GAAI;AAAC,GACxE;AACF;AAGA,eAAe,SAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACsB;AACtB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB,IAAI,EAAE,QAAA;AAAS,KAC1C,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,+BAAA,EAAmC,IAAc,OAAO,CAAA;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AAGX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,IAAI,MAAM,CAAA;AAAA,KAC5C;AAAA,EACF;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAI,IAAA,EAAK;AAAA,EACxB,CAAA,CAAA,MAAQ;AAGN,IAAA,MAAM,IAAI,iBAAA,CAAkB,6BAAA,EAA+B,mCAAmC,CAAA;AAAA,EAChG;AACA,EAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,CAAA;AAC5C;AAGO,SAAS,YAAA,CACd,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA;AAAA,MACE,UAAA,EAAY,oBAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,MAAA,CAAO,WAAA;AAAA,MACrB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,eAAe,KAAA,CAAM;AAAA,KACvB;AAAA,IACA;AAAA,GACF;AACF;AAGO,SAAS,kBAAA,CACd,MAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA,EAAE,UAAA,EAAY,eAAA,EAAiB,eAAe,OAAA,EAAS,SAAA,EAAW,OAAO,QAAA,EAAS;AAAA,IAClF;AAAA,GACF;AACF;AAGO,SAAS,mBACd,QAAA,EACA,MAAA,EACA,KAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,OAAO,eAAA;AAAA,IACL;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,QAAA;AAAA,MACA,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,GAAI,OAAO,SAAA,KAAc,MAAA,GAAY,EAAE,UAAA,EAAY,MAAA,CAAO,SAAA,EAAU,GAAI;AAAC,KAC3E;AAAA,IACA,KAAA;AAAA,IACA;AAAA,GACF;AACF;AAQA,IAAM,eAAA,uBAAsB,GAAA,EAAkC;AAQ9D,eAAsB,qBAAA,CACpB,QAAA,EACA,IAAA,EAKA,IAAA,EAC6B;AAC7B,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,OAAA,EAAS,OAAO,QAAA;AAEtC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,SAAS,SAAA,KAAc,MAAA,IAAa,QAAA,CAAS,SAAA,GAAY,MAAM,eAAA,EAAiB;AAClF,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACzC,EAAA,IAAI,OAAA,GAAU,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AACtC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,OAAA,GAAA,CAAW,YAAkC;AAC3C,MAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC9C,MAAA,IAAI,WAAW,MAAA,EAAW;AAExB,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAMA,SAAQ,MAAM,kBAAA,CAAmB,KAAK,MAAA,EAAQ,MAAA,CAAO,SAAS,IAAI,CAAA;AAKxE,MAAA,MAAM,MAAA,GAAsB;AAAA,QAC1B,GAAGA,MAAAA;AAAA,QACH,SAAA,EAAWA,MAAAA,CAAM,SAAA,IAAa,MAAA,CAAO;AAAA,OACvC;AACA,MAAA,kBAAA,CAAmB,QAAA,CAAS,QAAA,EAAU,MAAA,EAAQ,IAAA,CAAK,OAAO,GAAG,CAAA;AAC7D,MAAA,OAAO,MAAA;AAAA,IACT,CAAA,GAAG;AACH,IAAA,eAAA,CAAgB,GAAA,CAAI,MAAM,OAAO,CAAA;AACjC,IAAA,OAAA,CAAQ,OAAA,CAAQ,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,QAAQ,MAAM,OAAA;AACpB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;;;AC9LA,IAAM,wBAAA,GAA2B,GAAA;AAIjC,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAQ7B,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAMA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAK7B,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAI7B,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAM,YAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT;;;ACvTA,eAAe,YAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACA,GAAA,EACyC;AACzC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,MAAM,IAAA,GAA2B;AAAA,IAC/B,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,MAAA,CAAO;AAAA,GACpB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AACrC,EAAA,MAAM,IAAA,GAAiB;AAAA,IACrB,KAAA,EAAO,IAAA,CAAK,IAAA,EAAM,KAAA,IAAS,KAAA;AAAA,IAC3B,KAAK,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI;AAAA,GACzC;AACA,EAAA,OAAO,qBAAA,CAAsB,IAAA,EAAM,EAAE,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,GAAA,EAAI,EAAG,IAAI,CAAA;AACzF;AAEA,eAAsB,kBACpB,IAAA,EACyC;AACzC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC3C,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAEjC,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,SAAS,OAAA,EAAS;AAC3B,IAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,GAAG,CAAA;AAAA,EAC7C;AAOA,EAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACxC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,OAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF","file":"index.js","sourcesContent":["import { defaultRetriableForCode } from \"./internal/runtime/retry/default-retriable.js\";\nimport { redactSecrets } from \"./internal/security/redact.js\";\nimport type { RunOperation } from \"./types/run.js\";\n\n/**\n * Finite, machine-readable error codes for provider-originated errors\n * (ADR D66). Consumers can `switch (err.metadata?.code)` exhaustively\n * — adding a new variant is an explicit decision + test coverage.\n *\n * @public\n */\nexport type ErrorCode =\n  | \"rate_limit\"\n  | \"auth_failed\"\n  | \"invalid_request\"\n  | \"timeout\"\n  | \"server_error\"\n  | \"context_too_long\"\n  | \"content_filtered\"\n  | \"model_unavailable\"\n  | \"network\"\n  | \"quota_exceeded\"\n  | \"unknown\";\n\n/**\n * Codes used by {@link AgentRunError} (Production-Readiness #3, ADR D311).\n *\n * Superset of {@link ErrorCode} extended with codes that do NOT originate\n * from a provider HTTP response:\n *\n * - `quota_exceeded` — billing limit hit (provider 402 or signalled error)\n * - `tool_runtime_error` — custom tool handler threw inside dispatch\n * - `aborted` — caller's `AbortSignal` fired (Phase 4)\n * - `invalid_model` — model id rejected by provider (400 \"model not found\")\n * - `safety_blocked` — provider safety filter blocked req or resp\n * - `provider_unreachable` — DNS/TCP/timeout/5xx at transport boundary\n *\n * The `& {}` tail keeps the literal-union ergonomics (autocomplete) while\n * accepting any string for forward compatibility with constructor calls\n * that pass arbitrary code values (legacy callers).\n *\n * @public\n */\n/**\n * T1.1 — closed literal union for `AgentRunError.code`. The previous\n * `(string & {})` escape hatch let arbitrary strings slip into the type\n * surface and defeated exhaustive `switch (code)` discrimination. This is\n * the canonical closed form. `AgentRunErrorCode` is re-aliased below for\n * source-level back-compat.\n *\n * Adding a new code: append the literal here AND audit every `switch (err.code)`\n * in callers. Type-checker enforces the audit via the `default: assertNever(code)`\n * convention.\n *\n * @public\n */\nexport type KnownAgentRunErrorCode =\n  | ErrorCode\n  | \"quota_exceeded\"\n  | \"tool_runtime_error\"\n  | \"aborted\"\n  | \"invalid_model\"\n  | \"safety_blocked\"\n  | \"provider_unreachable\";\n\n/**\n * Back-compat alias of {@link KnownAgentRunErrorCode}. Pre-T1.1 callers that\n * imported `AgentRunErrorCode` keep working; new code SHOULD prefer\n * `KnownAgentRunErrorCode` to make the closed-union intent explicit.\n *\n * @public\n */\nexport type AgentRunErrorCode = KnownAgentRunErrorCode;\n\n/** Snapshot of every known code at runtime — used by the boundary coercer. */\nconst KNOWN_AGENT_RUN_ERROR_CODES = new Set<string>([\n  \"rate_limit\",\n  \"auth_failed\",\n  \"invalid_request\",\n  \"timeout\",\n  \"server_error\",\n  \"context_too_long\",\n  \"content_filtered\",\n  \"model_unavailable\",\n  \"network\",\n  \"unknown\",\n  \"quota_exceeded\",\n  \"tool_runtime_error\",\n  \"aborted\",\n  \"invalid_model\",\n  \"safety_blocked\",\n  \"provider_unreachable\",\n]);\n\n/**\n * T1.1 boundary helper — coerce an arbitrary string (typically arriving from\n * a downstream `RunErrorDetail.code` or a deserialized cloud response) into a\n * `KnownAgentRunErrorCode`. Unknown strings collapse to `\"unknown\"` so the\n * closed type contract holds without forcing every caller to switch.\n *\n * @internal\n */\nexport function coerceToKnownAgentRunErrorCode(code: string | undefined): KnownAgentRunErrorCode {\n  if (code !== undefined && KNOWN_AGENT_RUN_ERROR_CODES.has(code)) {\n    return code as KnownAgentRunErrorCode;\n  }\n  return \"unknown\";\n}\n\n/**\n * Structured context for errors that originated from a provider HTTP\n * call (ADR D65). Lets callers retry with the right backoff (`retryAfter`),\n * surface actionable diagnostics (`provider`, `endpoint`), and inspect the\n * raw response body when needed (`raw`, capped at ~2KB by the mapper).\n *\n * @public\n */\nexport interface ErrorMetadata {\n  /** Provider canonical name (e.g., `\"anthropic\"`, `\"openai\"`, `\"openrouter\"`, `\"gemini\"`). */\n  provider: string;\n  /** HTTP endpoint that failed (e.g., `\"/v1/messages\"`, `\"/v1/chat/completions\"`). */\n  endpoint: string;\n  /** Machine-readable error code (finite enum). */\n  code: ErrorCode;\n  /** HTTP status code if applicable. */\n  statusCode?: number;\n  /** Seconds to wait before retry, per provider's `retry-after` header (numeric form only). */\n  retryAfter?: number;\n  /** Raw response body for debugging (truncated to ~2KB by the mapper). */\n  raw?: unknown;\n}\n\n/**\n * Base class for all errors thrown by `@theokit/sdk`.\n *\n * Use `isRetryable` to drive retry/backoff logic. `code` and `protoErrorCode`\n * are populated for server-originated errors when available. `metadata`\n * (ADR D65) carries structured `{ provider, endpoint, code, ... }` when\n * the error originated from a provider HTTP call.\n *\n * @public\n */\nexport class TheokitAgentError extends Error {\n  override readonly name: string = \"TheokitAgentError\";\n  readonly isRetryable: boolean;\n  readonly code?: string;\n  readonly protoErrorCode?: string;\n  readonly metadata?: ErrorMetadata;\n\n  constructor(\n    message: string,\n    options: {\n      isRetryable?: boolean;\n      code?: string;\n      protoErrorCode?: string;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    } = {},\n  ) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined);\n    this.isRetryable = options.isRetryable ?? false;\n    if (options.code !== undefined) this.code = options.code;\n    if (options.protoErrorCode !== undefined) this.protoErrorCode = options.protoErrorCode;\n    if (options.metadata !== undefined) this.metadata = options.metadata;\n  }\n}\n\n/**\n * Invalid API key, not logged in, insufficient permissions.\n *\n * @public\n */\nexport class AuthenticationError extends TheokitAgentError {\n  override readonly name: string = \"AuthenticationError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: false });\n  }\n}\n\n/**\n * Too many requests or usage limits exceeded.\n *\n * @public\n */\nexport class RateLimitError extends TheokitAgentError {\n  override readonly name: string = \"RateLimitError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: true });\n  }\n}\n\n/**\n * Invalid model, bad request parameters, malformed options.\n *\n * @public\n */\nexport class ConfigurationError extends TheokitAgentError {\n  override readonly name: string = \"ConfigurationError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: false });\n  }\n}\n\n/**\n * Thrown when creating a cloud agent for a repo whose SCM provider is not\n * connected. Use `helpUrl` to point the user at the right reconnect flow.\n *\n * @public\n */\nexport class IntegrationNotConnectedError extends ConfigurationError {\n  override readonly name: string = \"IntegrationNotConnectedError\";\n  readonly provider: string;\n  readonly helpUrl: string;\n\n  constructor(\n    message: string,\n    options: {\n      provider: string;\n      helpUrl: string;\n      code?: string;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, options);\n    this.provider = options.provider;\n    this.helpUrl = options.helpUrl;\n  }\n}\n\n/**\n * Service unavailable, timeout, transport-level failure.\n *\n * @public\n */\nexport class NetworkError extends TheokitAgentError {\n  override readonly name: string = \"NetworkError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: true });\n  }\n}\n\n/**\n * Catch-all for unclassified server or runtime errors.\n *\n * @public\n */\nexport class UnknownAgentError extends TheokitAgentError {\n  override readonly name: string = \"UnknownAgentError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: false });\n  }\n}\n\n/**\n * Thrown by `Agent.prompt` (and helpers that go through `run.wait()`) when\n * the option `{ throwOnError: true }` is set and the run terminates with\n * `status: 'error'`. Carries the structured `RunResult.error` fields so\n * callers can `catch` once and branch on `code` / `provider` instead of\n * unwrapping the run.\n *\n * Extends {@link TheokitAgentError} per ADR D65 — no new hierarchy.\n *\n * @example\n *   try {\n *     await Agent.prompt(msg, { apiKey, model, throwOnError: true });\n *   } catch (err) {\n *     if (err instanceof AgentRunError && err.code === 'auth_failed') {\n *       // bad key\n *     }\n *   }\n *\n * @public\n */\nexport class AgentRunError extends TheokitAgentError {\n  override readonly name: string = \"AgentRunError\";\n  readonly provider?: string;\n  readonly raw?: string;\n  /** Provider's request id (`x-request-id` / `request-id` header). Useful for support tickets. */\n  readonly requestId?: string;\n  /** SDK conversation id this error was raised inside. */\n  readonly conversationId?: string;\n\n  constructor(\n    message: string,\n    options: {\n      code: AgentRunErrorCode;\n      provider?: string;\n      raw?: string;\n      requestId?: string;\n      conversationId?: string;\n      retriable?: boolean;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, {\n      code: options.code,\n      cause: options.cause,\n      metadata: options.metadata,\n      // D311: most AgentRunErrors are not retriable (auth, validation, abort).\n      // Provider mappers (D314) override per-status — explicit `retriable` wins\n      // over the implicit default when supplied.\n      isRetryable: options.retriable ?? defaultRetriableForCode(options.code),\n    });\n    if (options.provider !== undefined) this.provider = options.provider;\n    if (options.raw !== undefined) this.raw = options.raw;\n    if (options.requestId !== undefined) this.requestId = options.requestId;\n    if (options.conversationId !== undefined) this.conversationId = options.conversationId;\n  }\n\n  /**\n   * Production-Readiness #3 (ADR D311): alias for `isRetryable` exposed as\n   * `retriable` to match the handoff contract. Future v2 will deprecate\n   * `isRetryable` in favor of this.\n   */\n  get retriable(): boolean {\n    return this.isRetryable;\n  }\n\n  /**\n   * D312: provider's `Retry-After` header in **milliseconds**. Mappers store\n   * the header value (seconds) in `metadata.retryAfter`; this getter\n   * multiplies by 1000 so the result composes with `Date.now()`/`setTimeout`.\n   *\n   * Returns `undefined` when no hint was provided. `0` is a legitimate value\n   * — use `=== undefined` check rather than truthy check.\n   */\n  get retryAfterMs(): number | undefined {\n    if (this.metadata?.retryAfter === undefined) return undefined;\n    return this.metadata.retryAfter * 1000;\n  }\n\n  /**\n   * D313 + T1.5: alias for `metadata.raw`. Provider response body for\n   * debugging. T1.5 wraps the value in `redactSecrets` at the getter\n   * boundary so secret-shaped substrings (`sk-...`, Bearer JWTs, etc.) are\n   * stripped before reaching the caller. Available but NEVER serialized\n   * into `.message` (anti-leak invariant).\n   */\n  get providerError(): unknown {\n    const raw = this.metadata?.raw;\n    if (raw === undefined) return undefined;\n    if (typeof raw === \"string\") return redactSecrets(raw);\n    // Non-string raw (object/buffer) — stringify then redact.\n    try {\n      return redactSecrets(JSON.stringify(raw));\n    } catch {\n      return redactSecrets(String(raw));\n    }\n  }\n\n  /**\n   * T1.5 — sanitized JSON form. `metadata.raw` is OMITTED by default; opt\n   * in via `THEOKIT_DEBUG_RAW_ERRORS=1` to surface the (redacted) raw\n   * payload for diagnostics. Every other field stays accessible.\n   *\n   * The single env-var gate is read each call so operators can toggle at\n   * runtime without restarting the process.\n   */\n  toJSON(): Record<string, unknown> {\n    const json: Record<string, unknown> = {\n      name: this.name,\n      message: this.message,\n      isRetryable: this.isRetryable,\n    };\n    addOptionalFields(json, this);\n    const safeMeta = sanitizeMetadata(this.metadata);\n    if (safeMeta !== undefined) json.metadata = safeMeta;\n    return json;\n  }\n}\n\nfunction addOptionalFields(json: Record<string, unknown>, err: AgentRunError): void {\n  if (err.code !== undefined) json.code = err.code;\n  if (err.provider !== undefined) json.provider = err.provider;\n  if (err.requestId !== undefined) json.requestId = err.requestId;\n  if (err.conversationId !== undefined) json.conversationId = err.conversationId;\n  if (err.raw !== undefined) json.raw = redactSecrets(err.raw);\n}\n\nfunction sanitizeMetadata(meta: ErrorMetadata | undefined): ErrorMetadata | undefined {\n  if (meta === undefined) return undefined;\n  const { raw, ...rest } = meta;\n  const debugRaw = process.env.THEOKIT_DEBUG_RAW_ERRORS === \"1\";\n  if (debugRaw && raw !== undefined) {\n    const redactedRaw =\n      typeof raw === \"string\" ? redactSecrets(raw) : redactSecrets(safeStringify(raw));\n    return { ...rest, raw: redactedRaw } as ErrorMetadata;\n  }\n  return rest as ErrorMetadata;\n}\n\nfunction safeStringify(value: unknown): string {\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return String(value);\n  }\n}\n\n/**\n * Is this error transient (worth retrying)?\n *\n * Returns the SDK's own retryability verdict: every {@link TheokitAgentError}\n * subclass computes `isRetryable` at construction (rate-limit / network /\n * credential-pool-exhausted are retryable; auth / configuration / unsupported\n * are not), so this predicate is a single source of truth rather than a\n * re-derivation. Non-SDK errors return `false` conservatively — wrap a foreign\n * error in the appropriate SDK error first if you want it considered transient.\n * It never inspects `err.message`.\n *\n * @example\n *   try {\n *     await agent.send(message, { throwOnError: true });\n *   } catch (err) {\n *     if (isTransientError(err)) return retryWithBackoff();\n *     throw err;\n *   }\n *\n * @public\n */\nexport function isTransientError(err: unknown): boolean {\n  return err instanceof TheokitAgentError && err.isRetryable === true;\n}\n\n/**\n * Thrown when a {@link Run} or agent operation is not available on the current\n * runtime. Check first with `run.supports(operation)`.\n *\n * Extends {@link TheokitAgentError} (so error-catching code that branches on\n * `instanceof TheokitAgentError` continues to work) but is never retryable —\n * an unsupported operation will not become supported on retry.\n *\n * @public\n */\nexport class UnsupportedRunOperationError extends TheokitAgentError {\n  override readonly name: string = \"UnsupportedRunOperationError\";\n  readonly operation: RunOperation;\n\n  constructor(\n    message: string,\n    operation: RunOperation,\n    options: { code?: string; cause?: unknown } = {},\n  ) {\n    super(message, {\n      ...options,\n      isRetryable: false,\n      code: options.code ?? \"unsupported_run_operation\",\n    });\n    this.operation = operation;\n  }\n}\n\n/**\n * Thrown when every credential in a per-provider pool is in cooldown\n * and no healthy key is available (ADR D133). The caller's\n * {@link import(\"./internal/llm/fallback-client.js\").FallbackLlmClient}\n * catches this and tries the next provider in the fallback chain.\n *\n * `metadata.nextRetryAt` (epoch ms) tells callers when the soonest\n * pool entry resumes — useful for manual retry scheduling.\n *\n * @public\n */\nexport class CredentialPoolExhaustedError extends TheokitAgentError {\n  override readonly name: string = \"CredentialPoolExhaustedError\";\n  readonly provider: string;\n  readonly nextRetryAt: number | undefined;\n\n  constructor(\n    message: string,\n    options: {\n      provider: string;\n      nextRetryAt?: number;\n      code?: string;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, {\n      ...options,\n      isRetryable: true,\n      code: options.code ?? \"credential_pool_exhausted\",\n    });\n    this.provider = options.provider;\n    this.nextRetryAt = options.nextRetryAt;\n  }\n}\n\n/**\n * Finite error codes specific to memory adapter operations (ADR D141).\n *\n * @public\n */\nexport type MemoryAdapterErrorCode =\n  | \"auth_failed\"\n  | \"rate_limited\"\n  | \"not_found\"\n  | \"network\"\n  | \"invalid_input\"\n  | \"unknown\";\n\n/**\n * Error raised by `@theokit-memory-*` adapters. Carries `adapterId`\n * so callers can branch on which provider failed (ADR D141).\n *\n * @public\n */\nexport class MemoryAdapterError extends TheokitAgentError {\n  override readonly name: string = \"MemoryAdapterError\";\n  readonly adapterId: string;\n\n  constructor(\n    message: string,\n    options: {\n      adapterId: string;\n      code: MemoryAdapterErrorCode;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, {\n      isRetryable: options.code === \"rate_limited\" || options.code === \"network\",\n      code: options.code,\n      ...(options.cause !== undefined ? { cause: options.cause } : {}),\n      ...(options.metadata !== undefined ? { metadata: options.metadata } : {}),\n    });\n    this.adapterId = options.adapterId;\n  }\n}\n\n/**\n * Thrown when a user-supplied task ID violates the grammar\n * `^[a-z0-9][a-z0-9_-]*$` (D368) OR starts with a reserved adapter\n * prefix (`wf-` / `b-` / `cron-`, EC-5).\n *\n * @public\n */\nexport class InvalidTaskIdError extends TheokitAgentError {\n  override readonly name: string = \"InvalidTaskIdError\";\n  readonly taskId: string;\n\n  constructor(message: string, taskId: string, options: { cause?: unknown } = {}) {\n    super(message, {\n      ...options,\n      isRetryable: false,\n      code: \"invalid_task_id\",\n    });\n    this.taskId = taskId;\n  }\n}\n\n/**\n * Thrown when `Task.subscribe(id)` is called for a task that has been\n * evicted, never submitted, or evicted after retention (D373).\n *\n * @public\n */\nexport class TaskNotFoundError extends TheokitAgentError {\n  override readonly name: string = \"TaskNotFoundError\";\n  readonly taskId: string;\n\n  constructor(taskId: string, options: { cause?: unknown } = {}) {\n    super(`Task not found: ${taskId}`, {\n      ...options,\n      isRetryable: false,\n      code: \"task_not_found\",\n    });\n    this.taskId = taskId;\n  }\n}\n\n/**\n * Thrown when `CloudAgent` is asked to wrap a task (D370). Cloud\n * task observability is deferred until Theo PaaS GA.\n *\n * @public\n */\nexport class UnsupportedTaskOperationError extends TheokitAgentError {\n  override readonly name: string = \"UnsupportedTaskOperationError\";\n  readonly operation: string;\n\n  constructor(operation: string, options: { cause?: unknown } = {}) {\n    super(\n      `Task operation \"${operation}\" is not supported on CloudAgent (pre-release; see ADR D370)`,\n      {\n        ...options,\n        isRetryable: false,\n        code: \"task_op_unsupported\",\n      },\n    );\n    this.operation = operation;\n  }\n}\n\n/**\n * Thrown by `Budget` enforcement (ADR D386) when a `mode: \"block\"`\n * budget would be exceeded by the upcoming LLM call. Caller pega\n * tipado para retry-after-window-reset or surface to the user.\n *\n * @public\n */\nexport class BudgetExceededError extends TheokitAgentError {\n  override readonly name: string = \"BudgetExceededError\";\n  readonly budgetName: string;\n  readonly window: import(\"./types/budget.js\").BudgetWindow;\n  readonly spentUsd: number;\n  readonly limitUsd: number;\n  readonly mode: import(\"./types/budget.js\").BudgetMode;\n\n  constructor(args: {\n    budgetName: string;\n    window: import(\"./types/budget.js\").BudgetWindow;\n    spentUsd: number;\n    limitUsd: number;\n    mode: import(\"./types/budget.js\").BudgetMode;\n    cause?: unknown;\n  }) {\n    super(\n      `Budget \"${args.budgetName}\" exceeded for window ${args.window}: spent $${args.spentUsd.toFixed(4)} > limit $${args.limitUsd.toFixed(4)}`,\n      {\n        ...(args.cause !== undefined ? { cause: args.cause } : {}),\n        isRetryable: false,\n        code: \"budget_exceeded\",\n      },\n    );\n    this.budgetName = args.budgetName;\n    this.window = args.window;\n    this.spentUsd = args.spentUsd;\n    this.limitUsd = args.limitUsd;\n    this.mode = args.mode;\n  }\n}\n\n/**\n * Thrown when `CloudAgent.send({ budget })` is invoked (D388). Cloud\n * budget surface waits for Theo PaaS GA.\n *\n * @public\n */\n/**\n * T1.6 — Thrown when a consumer calls `agent.send()` or any method\n * on an agent that has already been `dispose()`d. Pre-T1.6 this was\n * a generic `new Error(\"Agent has been disposed\")` — consumers\n * couldn't catch it without string-matching the message.\n *\n * @public\n */\nexport class AgentDisposedError extends TheokitAgentError {\n  override readonly name: string = \"AgentDisposedError\";\n  readonly agentId: string;\n\n  constructor(agentId: string) {\n    super(`Agent \"${agentId}\" has been disposed. Create a new agent or use Agent.resume().`, {\n      isRetryable: false,\n      code: \"agent_disposed\",\n    });\n    this.agentId = agentId;\n  }\n}\n\nexport class UnsupportedBudgetOperationError extends TheokitAgentError {\n  override readonly name: string = \"UnsupportedBudgetOperationError\";\n  readonly operation: string;\n\n  constructor(operation: string, options: { cause?: unknown } = {}) {\n    super(\n      `Budget operation \"${operation}\" is not supported on CloudAgent (pre-release; see ADR D388)`,\n      {\n        ...options,\n        isRetryable: false,\n        code: \"budget_op_unsupported\",\n      },\n    );\n    this.operation = operation;\n  }\n}\n","import { randomBytes } from \"node:crypto\";\nimport {\n  chmodSync,\n  closeSync,\n  fsyncSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { z } from \"zod\";\n\nimport { AuthenticationError } from \"../../errors.js\";\n\n/**\n * M42 — the SDK credential store. Promoted DOWN from agent-builder's hardened `agents/lib/credentials.ts`\n * (M37), generalized from a closed `openrouter|anthropic|openai` union to an open `provider: string` and\n * driven by a caller-supplied {@link CredentialStoreConfig} (no hardcoded `.agent-builder`/`auth.json` /\n * `AGENT_BUILDER_HOME`). The security-critical file mechanics are ported VERBATIM (ADR D3 of the M42 plan):\n * atomic O_EXCL + rename + fsync write, 0700/0600 mode gates, `env` is always a PARAMETER (never an ambient\n * `process.env` read). Contract SHAPE adapted from OpenCode's provider `auth.loader` (MIT © 2025 opencode).\n *\n * The env-precedence + key-prefix-inference + declared-provider rungs of the agent-builder resolver are\n * APP POLICY and deliberately stay UP in the consumer; this module owns only the on-disk store + the\n * `api|oauth` discriminated union. See {@link resolveCredential} (SDK) for the store-read + refresh path.\n *\n * @internal\n */\nimport type {\n  CredentialStoreConfig,\n  StoredCredential,\n  StoredOAuthCredential,\n} from \"./auth-types.js\";\n\n/** The store directory, honoring an optional `homeEnvVar` override. */\nexport function credentialHome(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  const override = config.homeEnvVar !== undefined ? env[config.homeEnvVar]?.trim() : undefined;\n  return override !== undefined && override.length > 0\n    ? override\n    : join(config.home, config.dirName);\n}\n\n/** The credential file path inside the (possibly overridden) store directory. */\nexport function authFilePath(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  return join(credentialHome(config, env), config.fileName);\n}\n\n/**\n * A credential problem the caller can act on. Never carries the key value.\n *\n * M78 — this used to extend bare `Error`, which quietly disabled classification for the entire auth\n * path: `isTransientError` is `err instanceof TheokitAgentError && err.isRetryable === true`\n * (`errors.ts:443`), so a credential failure could never be judged transient OR permanent. The\n * predicate was not \"forgotten\" downstream — it was unusable there by construction.\n *\n * Extending `AuthenticationError` is ADDITIVE: the class still exists, still reports\n * `name: \"CredentialError\"`, and every existing `instanceof CredentialError` stays true. It only\n * gains ancestors. `AuthenticationError` pins `isRetryable: false`, so gaining the ability to be\n * classified does NOT turn a revoked credential into a retry loop.\n *\n * The single reference does the same thing with one root type: Codex routes every domain failure\n * through `CodexErr` with `is_retryable()` as a method (`protocol/src/error.rs:176`), rather than\n * parallel classes extending the language's `Error`.\n */\nexport class CredentialError extends AuthenticationError {\n  // Field, not an assignment in the constructor: `AuthenticationError.name` is `override readonly`\n  // (`errors.ts:174`), so `this.name = …` does not compile. Caught by `tsc`, not by vitest — the\n  // suite was green with the broken assignment because the transpiler strips the type.\n  override readonly name: string = \"CredentialError\";\n}\n\n/**\n * The on-disk store — a discriminated union on `type` (OpenCode `Info` shape). A legacy file with NO\n * `type` (or `type: 'api'`) is the API-key variant — read unchanged, no migration. The `oauth` variant\n * carries the token pair + expiry.\n */\nconst apiFileSchema = z\n  .object({\n    type: z.literal(\"api\").optional(),\n    provider: z.string().min(1).optional(),\n    api_key: z.string(),\n  })\n  .strict();\n\nconst oauthFileSchema = z\n  .object({\n    type: z.literal(\"oauth\"),\n    provider: z.string().min(1),\n    access: z.string().min(1),\n    refresh: z.string().min(1),\n    expires: z.number(),\n    account_id: z.string().optional(),\n  })\n  .strict();\n\n// oauth first (it requires `type: 'oauth'`); a legacy `{provider?, api_key}` falls through to api.\nconst fileSchema = z.union([oauthFileSchema, apiFileSchema]);\n\n/**\n * Read the credential file. Absent ⇒ `undefined` (the normal case). Present-but-wrong is a typed error\n * naming the file: a malformed credential store must not surface as a raw parse crash. Enforces the\n * 0700 dir / 0600 file mode gates (ported verbatim — a writable dir lets an attacker swap the file for a\n * symlink to their own account).\n */\n/**\n * The 0700-dir / 0600-file mode gates (ported verbatim). The DIRECTORY matters as much as the file:\n * `mkdirSync(mode)` applies only at creation, so a pre-existing store dir keeps whatever mode it had, and a\n * writable dir lets an attacker replace the credential file with a symlink to their own 0600 file — the\n * agent then runs on THEIR account.\n */\nfunction assertSecureModes(dirPath: string, path: string): void {\n  const dirMode = statSync(dirPath).mode & 0o777;\n  if ((dirMode & 0o022) !== 0) {\n    throw new CredentialError(\n      `${dirPath} is writable by other users (mode ${dirMode.toString(8)}), so the credential file ` +\n        `inside it can be replaced. Fix it with:  chmod 700 ${dirPath}`,\n    );\n  }\n  const mode = statSync(path).mode & 0o777;\n  if ((mode & 0o077) !== 0) {\n    throw new CredentialError(\n      `${path} is readable by other users (mode ${mode.toString(8)}). ` +\n        `A credential file must not be. Fix it with:  chmod 600 ${path}`,\n    );\n  }\n}\n\n/**\n * A `z.union` reports a generic \"Invalid input\" at the root, hiding WHAT is wrong. Pick the sub-schema the\n * file was CLEARLY aiming at (by its `type` discriminant) and surface that schema's specific issue.\n */\nfunction describeUnionError(parsed: unknown, err: unknown, path: string): CredentialError {\n  const looksOAuth =\n    typeof parsed === \"object\" &&\n    parsed !== null &&\n    (parsed as { type?: unknown }).type === \"oauth\";\n  const specific = looksOAuth ? oauthFileSchema.safeParse(parsed) : apiFileSchema.safeParse(parsed);\n  let issue: z.ZodIssue | undefined;\n  if (!specific.success) {\n    issue = specific.error.issues[0];\n  } else if (err instanceof z.ZodError) {\n    issue = err.issues[0];\n  }\n  return new CredentialError(\n    `${path}: ${issue?.message ?? String(err)} [${issue?.path.join(\".\") || \"root\"}]`,\n  );\n}\n\n/** Parse the raw file into the store union, surfacing the SPECIFIC sub-schema issue (not a generic union error). */\nfunction parseStoredFile(raw: string, path: string): StoredCredential {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    // The parser's message embeds a snippet of the INPUT — up to the raw key when a user pastes the bare\n    // key instead of JSON. The position is not actionable anyway, so the expected shape is more useful.\n    throw new CredentialError(\n      `${path} is not valid JSON. Expected:  {\"provider\": \"<name>\", \"api_key\": \"...\"}`,\n    );\n  }\n  try {\n    return fileSchema.parse(parsed);\n  } catch (err) {\n    throw describeUnionError(parsed, err, path);\n  }\n}\n\nexport function readAuthFile(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): StoredCredential | undefined {\n  const path = authFilePath(config, env);\n\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw new CredentialError(`cannot read ${path}: ${(err as Error).message}`);\n  }\n\n  assertSecureModes(credentialHome(config, env), path);\n  return parseStoredFile(raw, path);\n}\n\n/**\n * Read the stored OAuth credential (with its refresh token), or `undefined` when the store is absent or\n * holds an api credential. The oauth engine needs the refresh token, which the resolved bearer does not\n * carry. Enforces the same 0600/0700 gates as every other read.\n */\nexport function readStoredOAuth(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): StoredOAuthCredential | undefined {\n  const stored = readAuthFile(config, env);\n  return stored !== undefined && stored.type === \"oauth\" ? stored : undefined;\n}\n\n/** Narrows a writable credential to the oauth variant. */\nfunction isOAuthWrite(\n  c: { provider: string; apiKey: string } | StoredOAuthCredential,\n): c is StoredOAuthCredential {\n  return \"type\" in c && c.type === \"oauth\";\n}\n\n/**\n * Persist a credential atomically at mode `0600`. Ported VERBATIM (ADR D3): write to a random-named temp\n * file in the same directory with `wx` (O_EXCL), fsync, close, chmod, then `rename` (atomic on POSIX) —\n * so a crash mid-write leaves whatever was there untouched, and a pre-planted symlink cannot capture the\n * key. The api variant persists the unchanged `{provider, api_key}` (back-compat, no `type` key); the\n * oauth variant persists `{type:'oauth', provider, access, refresh, expires, account_id?}`.\n */\n/** Build the on-disk JSON payload for the credential variant, validating non-empty tokens. */\nfunction buildStorePayload(\n  cred: { provider: string; apiKey: string } | StoredOAuthCredential,\n): Record<string, unknown> {\n  if (isOAuthWrite(cred)) {\n    if (cred.access.length === 0 || cred.refresh.length === 0) {\n      throw new CredentialError(\n        \"refusing to write an oauth credential with an empty access/refresh token\",\n      );\n    }\n    return {\n      type: \"oauth\",\n      provider: cred.provider,\n      access: cred.access,\n      refresh: cred.refresh,\n      expires: cred.expires,\n      ...(cred.account_id !== undefined ? { account_id: cred.account_id } : {}),\n    };\n  }\n  if (typeof cred.apiKey !== \"string\" || cred.apiKey.length === 0) {\n    throw new CredentialError(\"refusing to write an empty API key\");\n  }\n  return { provider: cred.provider, api_key: cred.apiKey };\n}\n\nexport function writeCredential(\n  cred: { provider: string; apiKey: string } | StoredOAuthCredential,\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  const payload = buildStorePayload(cred);\n\n  const dir = credentialHome(config, env);\n  mkdirSync(dir, { recursive: true, mode: 0o700 });\n  chmodSync(dir, 0o700); // unconditional: mkdirSync's mode applies only at creation\n\n  const path = authFilePath(config, env);\n  // RANDOM name + `wx` (O_EXCL): a predictable temp name with a plain write follows a pre-planted SYMLINK,\n  // landing the key in an attacker's file while reporting success. O_EXCL refuses any pre-existing file or\n  // link; the random suffix also removes the pid collision two containers sharing a bind-mounted home make.\n  const tmp = `${path}.tmp-${randomBytes(8).toString(\"hex\")}`;\n  try {\n    const fd = openSync(tmp, \"wx\", 0o600);\n    try {\n      writeFileSync(fd, `${JSON.stringify(payload, null, 2)}\\n`);\n      fsyncSync(fd);\n    } finally {\n      closeSync(fd);\n    }\n    chmodSync(tmp, 0o600); // explicit: the mode argument is subject to umask\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // the temp file may not exist; its absence is not a failure of the write\n    }\n    throw new CredentialError(`cannot write ${path}: ${(err as Error).message}`);\n  }\n  return path;\n}\n","/**\n * @theokit/sdk/server/auth — typed error classes\n *\n * Plan T1.2 + v1.1 EC-1 (AuthCancelledError for OAuth provider error response RFC 6749 §4.1.2.1).\n */\n\n/**\n * Thrown at `defineAuth()` time when configuration is invalid\n * (e.g., duplicate provider name, invalid email shape per EC-V1-12).\n */\nexport class AuthConfigError extends Error {\n  override readonly name = \"AuthConfigError\";\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(`[${code}] ${message}`);\n    this.code = code;\n  }\n}\n\n/**\n * Thrown at `startSignIn(providerName, ...)` or `finishSignIn(providerName, ...)`\n * when the named provider is not registered in `providers[]`.\n */\nexport class AuthProviderNotFoundError extends Error {\n  override readonly name = \"AuthProviderNotFoundError\";\n  readonly providerName: string;\n\n  constructor(providerName: string) {\n    super(\n      `Auth provider not found: '${providerName}'. Register it in defineAuth({ providers: [...] }).`,\n    );\n    this.providerName = providerName;\n  }\n}\n\n/**\n * Thrown during OAuth callback handling for state mismatches, expired\n * transactions, missing query params, or provider 4xx/5xx errors.\n *\n * Typed `code` field lets consumers branch on cause:\n *   - 'oauth_transaction_expired' — cookie tx > 10min old (per ADR D5)\n *   - 'oauth_state_mismatch' — query state ≠ cookie state (CSRF defense per RFC 6749 §10.12)\n *   - 'oauth_provider_error' — non-access_denied error in callback URL\n *   - 'oauth_token_exchange_failed' — provider rejected code-for-tokens swap\n *   - 'oauth_userinfo_failed' — userinfo endpoint returned error\n *   - 'oauth_missing_code_or_state' — required query params absent\n */\nexport class AuthCallbackError extends Error {\n  override readonly name: string = \"AuthCallbackError\";\n  readonly code: string;\n\n  constructor(code: string, message?: string) {\n    super(message ?? `OAuth callback error: ${code}`);\n    this.code = code;\n  }\n}\n\n/**\n * Per v1.1 EC-1 MUST FIX — typed subclass of AuthCallbackError for the\n * specific case where user declined consent at provider screen.\n *\n * OAuth 2.0 RFC 6749 §4.1.2.1: provider redirects with `?error=access_denied`.\n * Apps can catch this distinctly from network/server errors to render\n * \"Login cancelled — try again\" UX instead of opaque \"callback failed\".\n */\nexport class AuthCancelledError extends AuthCallbackError {\n  override readonly name: string = \"AuthCancelledError\";\n  readonly errorDescription?: string;\n\n  constructor(errorDescription?: string) {\n    super(\"user_declined_consent\", errorDescription ?? \"User declined consent at provider\");\n    this.errorDescription = errorDescription;\n  }\n}\n","/**\n * M42 — the SDK OAuth engine. Promoted DOWN from agent-builder's hardened `agents/lib/oauth.ts` +\n * `oauth-device.ts` (M37), generalized to `provider: string` + a caller-supplied {@link CredentialStoreConfig}\n * (no hardcoded client IDs — the caller declares its provider's endpoints). Ported VERBATIM (ADR D3): the\n * refresh coalescing lock, the no-token-in-error discipline, and the RFC 8628 device grant.\n *\n * Reuses the SDK's typed error taxonomy (`AuthCallbackError` from `server/auth`) for exchange/refresh\n * failures. All network I/O + clock + sleep are INJECTED so the flow is deterministic.\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  OAuthTokens,\n  ResolvedCredential,\n} from \"./auth-types.js\";\nimport { authFilePath, readStoredOAuth, writeCredential } from \"./credential-store.js\";\n\n/** Refresh a token this many ms BEFORE it actually expires (avoid a last-second, mid-request expiry). */\nconst REFRESH_SKEW_MS = 60_000;\n\n/** Parse an OAuth token endpoint response into our token triple. Throws a typed error on a bad shape. */\nfunction parseTokenResponse(body: unknown, now: number): OAuthTokens {\n  const b = body as {\n    access_token?: unknown;\n    refresh_token?: unknown;\n    expires_in?: unknown;\n    account_id?: unknown;\n  };\n  if (typeof b.access_token !== \"string\" || b.access_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no access_token\",\n    );\n  }\n  if (typeof b.refresh_token !== \"string\" || b.refresh_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no refresh_token\",\n    );\n  }\n  const expiresIn = typeof b.expires_in === \"number\" ? b.expires_in : 3600;\n  return {\n    access: b.access_token,\n    refresh: b.refresh_token,\n    expires: now + expiresIn * 1000,\n    ...(typeof b.account_id === \"string\" ? { accountId: b.account_id } : {}),\n  };\n}\n\n/** POST a form-encoded grant to the token endpoint; return the parsed JSON or throw a typed error. */\nasync function postGrant(\n  config: OAuthProviderConfig,\n  form: Record<string, string>,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams(form).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    // The body may carry an OAuth `error` code, but never echo it verbatim — it can contain a token in\n    // some providers' error payloads. Report the status only.\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint returned HTTP ${res.status}`,\n    );\n  }\n  let json: unknown;\n  try {\n    json = await res.json();\n  } catch {\n    // Do NOT echo the parser message — on a 200 non-JSON body it embeds a snippet of the response, which\n    // in a token context can contain access/refresh material.\n    throw new AuthCallbackError(\"oauth_token_exchange_failed\", \"token response was not valid JSON\");\n  }\n  return parseTokenResponse(json, deps.now());\n}\n\n/** Exchange an authorization `code` (+ PKCE verifier) for the token pair. */\nexport function exchangeCode(\n  config: OAuthProviderConfig,\n  input: { code: string; verifier: string },\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    {\n      grant_type: \"authorization_code\",\n      code: input.code,\n      redirect_uri: config.redirectUri,\n      client_id: config.clientId,\n      code_verifier: input.verifier,\n    },\n    deps,\n  );\n}\n\n/** Swap a refresh token for a fresh access (and possibly rotated refresh) token. */\nexport function refreshOAuthTokens(\n  config: OAuthProviderConfig,\n  refresh: string,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    { grant_type: \"refresh_token\", refresh_token: refresh, client_id: config.clientId },\n    deps,\n  );\n}\n\n/** Persist a token triple to the store's oauth variant through the hardened 0600 writer. */\nexport function persistOAuthTokens(\n  provider: string,\n  tokens: OAuthTokens,\n  store: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  return writeCredential(\n    {\n      type: \"oauth\",\n      provider,\n      access: tokens.access,\n      refresh: tokens.refresh,\n      expires: tokens.expires,\n      ...(tokens.accountId !== undefined ? { account_id: tokens.accountId } : {}),\n    },\n    store,\n    env,\n  );\n}\n\n/**\n * In-flight refreshes, keyed by the auth-file path. Refresh tokens ROTATE (single-use) on many providers,\n * so two concurrent turns must NOT both POST the same refresh token — the second would present an\n * already-consumed token and fail. This coalesces concurrent refreshes of the same store onto one promise.\n * Process-local — the single-credential store is per-user; a cross-process lock would be over-engineering.\n */\nconst inFlightRefresh = new Map<string, Promise<OAuthTokens>>();\n\n/**\n * Return a credential guaranteed fresh enough to use. An `api` credential passes through untouched. An\n * `oauth` credential still valid (beyond the skew window) passes through; an expired one is refreshed,\n * re-persisted 0600, and returned with the new access token. Concurrent refreshes of the same store are\n * coalesced (single-use refresh tokens); the rejected promise is evicted so a failure is not cached-poison.\n */\nexport async function ensureFreshCredential(\n  resolved: ResolvedCredential,\n  opts: {\n    config: OAuthProviderConfig;\n    store: CredentialStoreConfig;\n    env?: Record<string, string | undefined>;\n  },\n  deps: HttpDeps,\n): Promise<ResolvedCredential> {\n  if (resolved.kind !== \"oauth\") return resolved;\n\n  const now = deps.now();\n  if (resolved.expiresAt !== undefined && resolved.expiresAt > now + REFRESH_SKEW_MS) {\n    return resolved; // still valid — no network, no rewrite\n  }\n\n  const env = opts.env ?? {};\n  const path = authFilePath(opts.store, env);\n  let refresh = inFlightRefresh.get(path);\n  if (refresh === undefined) {\n    refresh = (async (): Promise<OAuthTokens> => {\n      const stored = readStoredOAuth(opts.store, env);\n      if (stored === undefined) {\n        // The resolved credential said oauth but the store no longer holds it — do not fabricate; surface it.\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"no stored oauth credential to refresh\",\n        );\n      }\n      const fresh = await refreshOAuthTokens(opts.config, stored.refresh, deps);\n      // M43 D4 fix #1 — the OAuth refresh response returns JWTs, not a top-level `account_id`, so\n      // `parseTokenResponse` leaves `fresh.accountId` undefined. Prefer a freshly-derived id, else PRESERVE\n      // the stored one (account_id is stable) — otherwise the Codex `ChatGPT-Account-Id` header empties after\n      // the first refresh and the backend 401/403s.\n      const merged: OAuthTokens = {\n        ...fresh,\n        accountId: fresh.accountId ?? stored.account_id,\n      };\n      persistOAuthTokens(resolved.provider, merged, opts.store, env);\n      return merged;\n    })();\n    inFlightRefresh.set(path, refresh);\n    refresh.finally(() => inFlightRefresh.delete(path)).catch(() => {});\n  }\n\n  const fresh = await refresh;\n  return {\n    kind: \"oauth\",\n    provider: resolved.provider,\n    apiKey: fresh.access,\n    source: resolved.source,\n    inferred: false,\n    expiresAt: fresh.expires,\n  };\n}\n","/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n * Adaptations: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop (upstream loops unbounded).\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./auth-types.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early (from OpenCode). */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle, mirroring OpenCode's copilot flow.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step; ADAPTED FROM OpenCode codex.ts, MIT © 2025) ───\n\n/** The OpenAI two-step device config: usercode + poll endpoints return an authorization_code (not tokens). */\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await res.json()) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. Adapted from OpenCode's codex plugin. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). Adapted from OpenCode. */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n","/**\n * M42 — `resolveCredential`: the public composition entrypoint over the credential store + oauth engine.\n * Given a provider name + a {@link CredentialStoreConfig} (and, for oauth, an {@link OAuthProviderConfig}),\n * read the store and return a FRESH `ResolvedCredential` — an api credential passes through by identity; an\n * oauth credential is transparently refreshed when its access token is within the skew window. Returns\n * `undefined` when the store holds no credential for `provider` (the caller then falls back to env / apiKeys).\n *\n * Mirrors agent-builder's `resolveFreshCredential` composition (store read → oauth → ensureFreshCredential),\n * defaulting `fetch`/`now` to globals. This is the async surface an oauth provider's M41 `transform.fetch`\n * calls at stream time, so a mid-turn token expiry refreshes without rebuilding the agent.\n *\n * @internal (re-exported from the package barrel as public)\n */\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  ResolvedCredential,\n} from \"./auth-types.js\";\nimport { authFilePath, readAuthFile } from \"./credential-store.js\";\nimport { ensureFreshCredential } from \"./oauth-engine.js\";\n\nexport interface ResolveCredentialOptions {\n  /** The provider whose stored credential to resolve. */\n  provider: string;\n  /** Where the credential store lives. */\n  store: CredentialStoreConfig;\n  /** Env for the store's optional `homeEnvVar` override. Never an ambient read. */\n  env?: Record<string, string | undefined>;\n  /** Required to refresh an oauth credential; omit for an api-only store. */\n  oauth?: OAuthProviderConfig;\n  /** Injected HTTP + clock for deterministic tests; default globals. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/**\n * Resolve a fresh credential for `provider` from the store, or `undefined` if the store holds none for it.\n * oauth credentials are auto-refreshed when `opts.oauth` is supplied; api credentials pass through.\n */\n/** Resolve (and, when a config is supplied, refresh) the oauth variant for the requested provider. */\nasync function resolveOAuth(\n  stored: { provider: string; access: string; expires: number },\n  path: string,\n  opts: ResolveCredentialOptions,\n  env: Record<string, string | undefined>,\n): Promise<ResolvedCredential | undefined> {\n  if (stored.provider !== opts.provider) return undefined;\n  const base: ResolvedCredential = {\n    kind: \"oauth\",\n    provider: opts.provider,\n    apiKey: stored.access,\n    source: path,\n    inferred: false,\n    expiresAt: stored.expires,\n  };\n  if (opts.oauth === undefined) return base; // no config to refresh with — return the stored access token\n  const deps: HttpDeps = {\n    fetch: opts.deps?.fetch ?? fetch,\n    now: opts.deps?.now ?? (() => Date.now()),\n  };\n  return ensureFreshCredential(base, { config: opts.oauth, store: opts.store, env }, deps);\n}\n\nexport async function resolveCredential(\n  opts: ResolveCredentialOptions,\n): Promise<ResolvedCredential | undefined> {\n  const env = opts.env ?? {};\n  const stored = readAuthFile(opts.store, env);\n  if (stored === undefined) return undefined;\n\n  const path = authFilePath(opts.store, env);\n\n  if (stored.type === \"oauth\") {\n    return resolveOAuth(stored, path, opts, env);\n  }\n\n  // api variant: require the stored `provider` to MATCH the requested provider (M42 review MEDIUM-2).\n  // The generic SDK cannot infer a provider from a key prefix (that was agent-builder app policy), so a\n  // provider-less or mismatched stored key is NOT attributed to the requested provider — otherwise a legacy\n  // `{api_key:\"sk-ant-…\"}` file could be POSTed to the wrong vendor's endpoint (cross-vendor key exposure).\n  // Fail-closed, mirroring OpenCode, whose credential resolution never attributes a key across providers.\n  if (stored.api_key.length === 0) return undefined;\n  if (stored.provider !== opts.provider) return undefined;\n  return {\n    kind: \"api\",\n    provider: opts.provider,\n    apiKey: stored.api_key,\n    source: path,\n    inferred: false,\n  };\n}\n"]}
+{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":[],"mappings":";;;;;;;AA8BA,IAAM,wBAAA,GAA2B,GAAA;AAIjC,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAQ7B,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAMA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAK7B,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAI7B,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAM,YAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n * Adaptations: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop (upstream loops unbounded).\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./auth-types.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early (from OpenCode). */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle, mirroring OpenCode's copilot flow.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step; ADAPTED FROM OpenCode codex.ts, MIT © 2025) ───\n\n/** The OpenAI two-step device config: usercode + poll endpoints return an authorization_code (not tokens). */\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await res.json()) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. Adapted from OpenCode's codex plugin. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). Adapted from OpenCode. */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}

package/dist/batch-2FSD2UNL.cjs

@@ -0,0 +1,244 @@
+'use strict';
+
+var chunkMZ5ZRORA_cjs = require('./chunk-MZ5ZRORA.cjs');
+require('./chunk-BUUUWQMB.cjs');
+var chunkLUSXDZPV_cjs = require('./chunk-LUSXDZPV.cjs');
+var chunk7S7KKUO6_cjs = require('./chunk-7S7KKUO6.cjs');
+require('./chunk-YLQQX5W2.cjs');
+require('./chunk-ANIZEWTU.cjs');
+require('./chunk-TIZ4TS5V.cjs');
+var chunkA44COQJJ_cjs = require('./chunk-A44COQJJ.cjs');
+require('./chunk-BEURCLDV.cjs');
+var crypto = require('crypto');
+
+function validateBatchInput(prompts, options) {
+  const { concurrency } = options;
+  if (concurrency !== void 0 && (!Number.isInteger(concurrency) || concurrency < 1)) {
+    throw new chunkA44COQJJ_cjs.ConfigurationError(
+      `Agent.batch concurrency must be a positive integer, got ${concurrency}`,
+      { code: "invalid_concurrency" }
+    );
+  }
+  for (let i = 0; i < prompts.length; i++) {
+    const item = prompts[i];
+    const prompt = typeof item === "string" ? item : item?.prompt;
+    if (typeof prompt !== "string" || prompt.length === 0) {
+      throw new chunkA44COQJJ_cjs.ConfigurationError(`Agent.batch prompt at index ${i} must be a non-empty string`, {
+        code: "invalid_batch_item"
+      });
+    }
+  }
+}
+async function batchImpl(prompts, options, deps) {
+  if (prompts.length === 0) return [];
+  validateBatchInput(prompts, options);
+  const sharedPools = buildPoolsFromApiKeys(
+    options.providers?.apiKeys,
+    options.providers?.credentialPoolStrategy
+  );
+  const exec = () => runBatch(prompts, options, deps);
+  const withPool = () => sharedPools.size > 0 ? chunkLUSXDZPV_cjs.withCredentialPool(sharedPools, exec) : exec();
+  if (options.task !== void 0) {
+    return wrapBatchAsTask(prompts.length, options.task, withPool);
+  }
+  return withPool();
+}
+async function wrapBatchAsTask(total, taskOpt, exec) {
+  const opts = taskOpt === true ? {} : taskOpt;
+  const id = opts.id ?? `b-${crypto.randomUUID()}`;
+  const meta = {
+    total,
+    ...opts.meta ?? {}
+  };
+  let results = [];
+  await chunkMZ5ZRORA_cjs.submit({
+    kind: "batch",
+    work: async (ctx) => {
+      results = await exec();
+      const succeeded = results.filter((r) => r.ok).length;
+      const failed = results.length - succeeded;
+      ctx.emit({ total: results.length, succeeded, failed });
+      return { total: results.length, succeeded, failed };
+    },
+    id,
+    meta,
+    allowReservedPrefix: true
+  });
+  for (let i = 0; i < 5e3; i++) {
+    const h = await chunkMZ5ZRORA_cjs.get(id);
+    if (h?.state === "finished" || h?.state === "error" || h?.state === "cancelled") break;
+    await new Promise((r) => setTimeout(r, 5));
+  }
+  return results;
+}
+async function runBatch(prompts, options, deps) {
+  const requested = options.concurrency ?? 4;
+  const effective = Math.min(requested, prompts.length);
+  const semaphore = chunk7S7KKUO6_cjs.createSemaphore(effective);
+  const items = prompts.map(normalizeItem);
+  const results = new Array(items.length);
+  const counters = { completed: 0, failed: 0 };
+  let aborted = false;
+  const onAbort = () => {
+    aborted = true;
+  };
+  options.signal?.addEventListener("abort", onAbort);
+  if (options.signal?.aborted === true) aborted = true;
+  try {
+    await Promise.all(
+      items.map(async (item, index) => {
+        const release = await semaphore.acquire();
+        try {
+          if (aborted) {
+            results[index] = abortResult(item, index, options.signal);
+          } else {
+            results[index] = await runOne(item, index, options, deps);
+          }
+        } finally {
+          release();
+        }
+        if (results[index].ok) counters.completed += 1;
+        else counters.failed += 1;
+        await safeCallResult(options.onResult, results[index]);
+        safeCallProgress(options.onProgress, {
+          total: items.length,
+          completed: counters.completed,
+          failed: counters.failed,
+          inFlight: semaphore.inFlight(),
+          pending: Math.max(0, semaphore.pending() - semaphore.inFlight())
+        });
+      })
+    );
+  } finally {
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+  return options.filter ? results.filter(options.filter) : results;
+}
+async function runOne(item, index, options, deps) {
+  const t0 = Date.now();
+  const agentOpts = buildAgentOptions(item, options);
+  try {
+    const agent = await deps.create(agentOpts);
+    try {
+      const run = await agent.send(item.prompt);
+      const result = await run.wait();
+      return {
+        ok: true,
+        index,
+        prompt: item.prompt,
+        result,
+        ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+        durationMs: Date.now() - t0
+      };
+    } finally {
+      try {
+        await agent.dispose();
+      } catch (disposeErr) {
+        process.stderr.write(
+          `[theokit-sdk] batch: agent.dispose failed for prompt ${index}: ${disposeErr instanceof Error ? disposeErr.message : String(disposeErr)}
+`
+        );
+      }
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      index,
+      prompt: item.prompt,
+      error: toTheokitError(err),
+      ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+      durationMs: Date.now() - t0
+    };
+  }
+}
+function buildAgentOptions(item, options) {
+  const {
+    concurrency: _c,
+    filter: _f,
+    onResult: _or,
+    onProgress: _op,
+    signal: _s,
+    task: _t,
+    ...rest
+  } = options;
+  const agentOpts = rest;
+  if (item.systemPrompt !== void 0) {
+    return { ...agentOpts, systemPrompt: item.systemPrompt };
+  }
+  return agentOpts;
+}
+function normalizeItem(promptOrItem) {
+  return typeof promptOrItem === "string" ? { prompt: promptOrItem } : promptOrItem;
+}
+function abortResult(item, index, signal) {
+  let error;
+  if (signal?.reason instanceof chunkA44COQJJ_cjs.TheokitAgentError) {
+    error = signal.reason;
+  } else if (signal?.reason instanceof Error) {
+    error = new chunkA44COQJJ_cjs.TheokitAgentError(signal.reason.message, {
+      code: "aborted",
+      cause: signal.reason
+    });
+  } else {
+    error = new chunkA44COQJJ_cjs.TheokitAgentError("Batch aborted via AbortSignal", { code: "aborted" });
+  }
+  return {
+    ok: false,
+    index,
+    prompt: item.prompt,
+    error,
+    ...item.metadata !== void 0 ? { metadata: item.metadata } : {},
+    durationMs: 0
+  };
+}
+function toTheokitError(err) {
+  if (err instanceof chunkA44COQJJ_cjs.TheokitAgentError) return err;
+  if (err instanceof Error) {
+    return new chunkA44COQJJ_cjs.TheokitAgentError(err.message, { code: "unknown", cause: err });
+  }
+  return new chunkA44COQJJ_cjs.TheokitAgentError(String(err), { code: "unknown" });
+}
+async function safeCallResult(cb, result) {
+  if (cb === void 0) return;
+  try {
+    await cb(result);
+  } catch (err) {
+    process.stderr.write(
+      `[theokit-sdk] batch: onResult callback threw: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function safeCallProgress(cb, progress) {
+  if (cb === void 0) return;
+  try {
+    cb(progress);
+  } catch (err) {
+    process.stderr.write(
+      `[theokit-sdk] batch: onProgress callback threw: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+}
+function buildPoolsFromApiKeys(apiKeys, strategy) {
+  const pools = /* @__PURE__ */ new Map();
+  if (apiKeys === void 0) return pools;
+  for (const [provider, keys] of Object.entries(apiKeys)) {
+    if (!Array.isArray(keys)) continue;
+    const filtered = keys.filter((k) => typeof k === "string" && k.length > 0);
+    if (filtered.length < 2) continue;
+    const entries = filtered.map(
+      (token, i) => chunkLUSXDZPV_cjs.newPooledCredential({ provider, accessToken: token, priority: i, source: "manual" })
+    );
+    pools.set(
+      provider,
+      new chunkLUSXDZPV_cjs.CredentialPool(provider, entries, strategy?.[provider] ?? "fill_first")
+    );
+  }
+  return pools;
+}
+
+exports.batchImpl = batchImpl;
+exports.validateBatchInput = validateBatchInput;
+//# sourceMappingURL=batch-2FSD2UNL.cjs.map
+//# sourceMappingURL=batch-2FSD2UNL.cjs.map

package/dist/batch-2FSD2UNL.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/batch.ts"],"names":["ConfigurationError","withCredentialPool","randomUUID","submit","get","createSemaphore","TheokitAgentError","newPooledCredential","CredentialPool"],"mappings":";;;;;;;;;;;;;AA+CO,SAAS,kBAAA,CACd,SACA,OAAA,EACM;AACN,EAAA,MAAM,EAAE,aAAY,GAAI,OAAA;AACxB,EAAA,IAAI,WAAA,KAAgB,WAAc,CAAC,MAAA,CAAO,UAAU,WAAW,CAAA,IAAK,cAAc,CAAA,CAAA,EAAI;AACpF,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,2DAA2D,WAAW,CAAA,CAAA;AAAA,MACtE,EAAE,MAAM,qBAAA;AAAsB,KAChC;AAAA,EACF;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,QAAQ,CAAA,EAAA,EAAK;AACvC,IAAA,MAAM,IAAA,GAAO,QAAQ,CAAC,CAAA;AACtB,IAAA,MAAM,MAAA,GAAS,OAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAA,EAAM,MAAA;AACvD,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,WAAW,CAAA,EAAG;AACrD,MAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,4BAAA,EAA+B,CAAC,CAAA,2BAAA,CAAA,EAA+B;AAAA,QAC1F,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AAAA,EACF;AACF;AAOA,eAAsB,SAAA,CACpB,OAAA,EACA,OAAA,EACA,IAAA,EACwB;AAExB,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAKlC,EAAA,kBAAA,CAAmB,SAAS,OAAO,CAAA;AAKnC,EAAA,MAAM,WAAA,GAAc,qBAAA;AAAA,IAClB,QAAQ,SAAA,EAAW,OAAA;AAAA,IACnB,QAAQ,SAAA,EAAW;AAAA,GACrB;AACA,EAAA,MAAM,IAAA,GAAO,MAA8B,QAAA,CAAS,OAAA,EAAS,SAAS,IAAI,CAAA;AAC1E,EAAA,MAAM,QAAA,GAAW,MACf,WAAA,CAAY,IAAA,GAAO,IAAIC,oCAAA,CAAmB,WAAA,EAAa,IAAI,CAAA,GAAI,IAAA,EAAK;AAGtE,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAW;AAC9B,IAAA,OAAO,eAAA,CAAgB,OAAA,CAAQ,MAAA,EAAQ,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAAA,EAC/D;AACA,EAAA,OAAO,QAAA,EAAS;AAClB;AAEA,eAAe,eAAA,CACb,KAAA,EACA,OAAA,EACA,IAAA,EACwB;AACxB,EAAA,MAAM,IAAA,GAAO,OAAA,KAAY,IAAA,GAAO,EAAC,GAAI,OAAA;AACrC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,EAAA,IAAM,CAAA,EAAA,EAAKC,mBAAY,CAAA,CAAA;AACvC,EAAA,MAAM,IAAA,GAAgC;AAAA,IACpC,KAAA;AAAA,IACA,GAAI,IAAA,CAAK,IAAA,IAAQ;AAAC,GACpB;AACA,EAAA,IAAI,UAAyB,EAAC;AAC9B,EAAA,MAAMC,wBAAA,CAAmB;AAAA,IACvB,IAAA,EAAM,OAAA;AAAA,IACN,IAAA,EAAM,OAAO,GAAA,KAAQ;AACnB,MAAA,OAAA,GAAU,MAAM,IAAA,EAAK;AACrB,MAAA,MAAM,YAAY,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,EAAE,CAAA,CAAE,MAAA;AAC9C,MAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,GAAS,SAAA;AAChC,MAAA,GAAA,CAAI,KAAK,EAAE,KAAA,EAAO,QAAQ,MAAA,EAAQ,SAAA,EAAW,QAAQ,CAAA;AACrD,MAAA,OAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,MAAA,EAAQ,WAAW,MAAA,EAAO;AAAA,IACpD,CAAA;AAAA,IACA,EAAA;AAAA,IACA,IAAA;AAAA,IACA,mBAAA,EAAqB;AAAA,GACtB,CAAA;AAED,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAM,CAAA,EAAA,EAAK;AAC7B,IAAA,MAAM,CAAA,GAAI,MAAMC,qBAAA,CAAgB,EAAE,CAAA;AAClC,IAAA,IAAI,CAAA,EAAG,UAAU,UAAA,IAAc,CAAA,EAAG,UAAU,OAAA,IAAW,CAAA,EAAG,UAAU,WAAA,EAAa;AACjF,IAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,EAC3C;AACA,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,QAAA,CACb,OAAA,EACA,OAAA,EACA,IAAA,EACwB;AACxB,EAAA,MAAM,SAAA,GAAY,QAAQ,WAAA,IAAe,CAAA;AAGzC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,SAAA,EAAW,QAAQ,MAAM,CAAA;AACpD,EAAA,MAAM,SAAA,GAAYC,kCAAgB,SAAS,CAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACvC,EAAA,MAAM,OAAA,GAAyB,IAAI,KAAA,CAAM,KAAA,CAAM,MAAM,CAAA;AACrD,EAAA,MAAM,QAAA,GAAW,EAAE,SAAA,EAAW,CAAA,EAAG,QAAQ,CAAA,EAAE;AAC3C,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,UAAU,MAAY;AAC1B,IAAA,OAAA,GAAU,IAAA;AAAA,EACZ,CAAA;AACA,EAAA,OAAA,CAAQ,MAAA,EAAQ,gBAAA,CAAiB,OAAA,EAAS,OAAO,CAAA;AAEjD,EAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,OAAA,KAAY,IAAA,EAAM,OAAA,GAAU,IAAA;AAEhD,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,MACZ,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,EAAM,KAAA,KAAU;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,OAAA,EAAQ;AACxC,QAAA,IAAI;AACF,UAAA,IAAI,OAAA,EAAS;AACX,YAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,WAAA,CAAY,IAAA,EAAM,KAAA,EAAO,QAAQ,MAAM,CAAA;AAAA,UAC1D,CAAA,MAAO;AACL,YAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,MAAM,OAAO,IAAA,EAAM,KAAA,EAAO,SAAS,IAAI,CAAA;AAAA,UAC1D;AAAA,QACF,CAAA,SAAE;AACA,UAAA,OAAA,EAAQ;AAAA,QACV;AACA,QAAA,IAAI,OAAA,CAAQ,KAAK,CAAA,CAAE,EAAA,WAAa,SAAA,IAAa,CAAA;AAAA,sBAC/B,MAAA,IAAU,CAAA;AACxB,QAAA,MAAM,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,KAAK,CAAC,CAAA;AACrD,QAAA,gBAAA,CAAiB,QAAQ,UAAA,EAAY;AAAA,UACnC,OAAO,KAAA,CAAM,MAAA;AAAA,UACb,WAAW,QAAA,CAAS,SAAA;AAAA,UACpB,QAAQ,QAAA,CAAS,MAAA;AAAA,UACjB,QAAA,EAAU,UAAU,QAAA,EAAS;AAAA,UAC7B,OAAA,EAAS,KAAK,GAAA,CAAI,CAAA,EAAG,UAAU,OAAA,EAAQ,GAAI,SAAA,CAAU,QAAA,EAAU;AAAA,SAChE,CAAA;AAAA,MACH,CAAC;AAAA,KACH;AAAA,EACF,CAAA,SAAE;AACA,IAAA,OAAA,CAAQ,MAAA,EAAQ,mBAAA,CAAoB,OAAA,EAAS,OAAO,CAAA;AAAA,EACtD;AAEA,EAAA,OAAO,QAAQ,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,GAAI,OAAA;AAC3D;AAEA,eAAe,MAAA,CACb,IAAA,EACA,KAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,EAAA,GAAK,KAAK,GAAA,EAAI;AACpB,EAAA,MAAM,SAAA,GAAY,iBAAA,CAAkB,IAAA,EAAM,OAAO,CAAA;AAEjD,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,SAAS,CAAA;AACzC,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,KAAK,MAAM,CAAA;AACxC,MAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,IAAA;AAAA,QACJ,KAAA;AAAA,QACA,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,MAAA;AAAA,QACA,GAAI,KAAK,QAAA,KAAa,KAAA,CAAA,GAAY,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,GAAI,EAAC;AAAA,QACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OAC3B;AAAA,IACF,CAAA,SAAE;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,MAAM,OAAA,EAAQ;AAAA,MACtB,SAAS,UAAA,EAAY;AACnB,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,UACb,CAAA,qDAAA,EAAwD,KAAK,CAAA,EAAA,EAC3D,UAAA,YAAsB,QAAQ,UAAA,CAAW,OAAA,GAAU,MAAA,CAAO,UAAU,CACtE;AAAA;AAAA,SACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,KAAA,EAAO,eAAe,GAAG,CAAA;AAAA,MACzB,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,GAAI,EAAC;AAAA,MACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC3B;AAAA,EACF;AACF;AAEA,SAAS,iBAAA,CAAkB,MAAiB,OAAA,EAAqC;AAC/E,EAAA,MAAM;AAAA,IACJ,WAAA,EAAa,EAAA;AAAA,IACb,MAAA,EAAQ,EAAA;AAAA,IACR,QAAA,EAAU,GAAA;AAAA,IACV,UAAA,EAAY,GAAA;AAAA,IACZ,MAAA,EAAQ,EAAA;AAAA,IACR,IAAA,EAAM,EAAA;AAAA,IACN,GAAG;AAAA,GACL,GAAI,OAAA;AAOJ,EAAA,MAAM,SAAA,GAAY,IAAA;AAClB,EAAA,IAAI,IAAA,CAAK,iBAAiB,MAAA,EAAW;AACnC,IAAA,OAAO,EAAE,GAAG,SAAA,EAAW,YAAA,EAAc,KAAK,YAAA,EAAa;AAAA,EACzD;AACA,EAAA,OAAO,SAAA;AACT;AAEA,SAAS,cAAc,YAAA,EAA6C;AAClE,EAAA,OAAO,OAAO,YAAA,KAAiB,QAAA,GAAW,EAAE,MAAA,EAAQ,cAAa,GAAI,YAAA;AACvE;AAEA,SAAS,WAAA,CAAY,IAAA,EAAiB,KAAA,EAAe,MAAA,EAAmC;AAEtF,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,MAAA,EAAQ,kBAAkBC,mCAAA,EAAmB;AAC/C,IAAA,KAAA,GAAQ,MAAA,CAAO,MAAA;AAAA,EACjB,CAAA,MAAA,IAAW,MAAA,EAAQ,MAAA,YAAkB,KAAA,EAAO;AAC1C,IAAA,KAAA,GAAQ,IAAIA,mCAAA,CAAkB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS;AAAA,MACnD,IAAA,EAAM,SAAA;AAAA,MACN,OAAO,MAAA,CAAO;AAAA,KACf,CAAA;AAAA,EACH,CAAA,MAAO;AACL,IAAA,KAAA,GAAQ,IAAIA,mCAAA,CAAkB,+BAAA,EAAiC,EAAE,IAAA,EAAM,WAAW,CAAA;AAAA,EACpF;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA;AAAA,IACA,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,KAAA;AAAA,IACA,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,GAAI,EAAC;AAAA,IACjE,UAAA,EAAY;AAAA,GACd;AACF;AAEA,SAAS,eAAe,GAAA,EAAiC;AACvD,EAAA,IAAI,GAAA,YAAeA,qCAAmB,OAAO,GAAA;AAC7C,EAAA,IAAI,eAAe,KAAA,EAAO;AACxB,IAAA,OAAO,IAAIA,oCAAkB,GAAA,CAAI,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,GAAA,EAAK,CAAA;AAAA,EAC3E;AACA,EAAA,OAAO,IAAIA,oCAAkB,MAAA,CAAO,GAAG,GAAG,EAAE,IAAA,EAAM,WAAW,CAAA;AAC/D;AAEA,eAAe,cAAA,CAAe,IAA8B,MAAA,EAAoC;AAC9F,EAAA,IAAI,OAAO,MAAA,EAAW;AACtB,EAAA,IAAI;AACF,IAAA,MAAM,GAAG,MAAM,CAAA;AAAA,EACjB,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,iDACE,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD;AAAA;AAAA,KACF;AAAA,EACF;AACF;AAEA,SAAS,gBAAA,CAAiB,IAAgC,QAAA,EAA+B;AACvF,EAAA,IAAI,OAAO,MAAA,EAAW;AACtB,EAAA,IAAI;AACF,IAAA,EAAA,CAAG,QAAQ,CAAA;AAAA,EACb,SAAS,GAAA,EAAK;AACZ,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,MACb,mDACE,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD;AAAA;AAAA,KACF;AAAA,EACF;AACF;AAOA,SAAS,qBAAA,CACP,SACA,QAAA,EAC6B;AAC7B,EAAA,MAAM,KAAA,uBAAY,GAAA,EAA4B;AAC9C,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,KAAA;AAClC,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AACtD,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC1B,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AACtF,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACzB,IAAA,MAAM,UAAU,QAAA,CAAS,GAAA;AAAA,MAAI,CAAC,KAAA,EAAO,CAAA,KACnCC,qCAAA,CAAoB,EAAE,QAAA,EAAU,WAAA,EAAa,KAAA,EAAO,QAAA,EAAU,CAAA,EAAG,MAAA,EAAQ,QAAA,EAAU;AAAA,KACrF;AACA,IAAA,KAAA,CAAM,GAAA;AAAA,MACJ,QAAA;AAAA,MACA,IAAIC,gCAAA,CAAe,QAAA,EAAU,SAAS,QAAA,GAAW,QAAQ,KAAK,YAAY;AAAA,KAC5E;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT","file":"batch-2FSD2UNL.cjs","sourcesContent":["/**\n * `Agent.batch(prompts, options)` core (ADRs D134-D140).\n *\n * Fans out N prompts via bounded concurrency, isolates failures per-prompt,\n * preserves input order in the result array, supports streaming callbacks\n * + AbortSignal. The credential pool (D131) is shared across all\n * in-flight agents via `withCredentialPool` ALS scope (EC-A fix).\n *\n * @internal\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { ConfigurationError, TheokitAgentError } from \"./errors.js\";\nimport { CredentialPool, newPooledCredential } from \"./internal/llm/credential-pool.js\";\nimport { withCredentialPool } from \"./internal/llm/credential-pool-context.js\";\nimport type { CredentialPoolStrategy } from \"./internal/llm/credential-pool-types.js\";\nimport { createSemaphore } from \"./internal/runtime/concurrency/async-semaphore.js\";\nimport { get as taskRegistryGet, submit as taskRegistrySubmit } from \"./internal/task/registry.js\";\nimport type { AgentOptions, SDKAgent } from \"./types/agent.js\";\nimport type { BatchItem, BatchOptions, BatchProgress, BatchResult } from \"./types/batch.js\";\n\n/** DI contract — keeps batch.ts cycle-free from agent.ts. @internal */\ninterface BatchDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n}\n\n/**\n * Pre-flight boundary validation for `Agent.batch` (arch-review Gap 3).\n *\n * Mirrors the in-repo `validateAgentOptions` / `validateCronExpression`\n * pattern: throws `ConfigurationError` with a stable code on the first\n * violation, returns silently otherwise. Pure — no I/O.\n *\n * Rules:\n * - `concurrency`, when provided, must be a positive integer (rejects\n *   0/negative/non-integer/NaN/Infinity). Previously this was caught only\n *   incidentally deep inside `createSemaphore` with a leaky \"permits\"\n *   message, AND after task wrapping (dangling Task on invalid input).\n * - every prompt item must carry a non-empty string prompt. Previously\n *   `normalizeItem` passed `prompt: \"\"` / non-string straight to\n *   `agent.send`. (Whitespace-only strings are intentionally NOT rejected —\n *   an empty string is a structural error; judging content is not this\n *   validator's job, and the repo's property tests treat any length>=1\n *   string as a valid prompt.)\n *\n * @internal\n */\nexport function validateBatchInput(\n  prompts: ReadonlyArray<string | BatchItem>,\n  options: BatchOptions,\n): void {\n  const { concurrency } = options;\n  if (concurrency !== undefined && (!Number.isInteger(concurrency) || concurrency < 1)) {\n    throw new ConfigurationError(\n      `Agent.batch concurrency must be a positive integer, got ${concurrency}`,\n      { code: \"invalid_concurrency\" },\n    );\n  }\n  for (let i = 0; i < prompts.length; i++) {\n    const item = prompts[i];\n    const prompt = typeof item === \"string\" ? item : item?.prompt;\n    if (typeof prompt !== \"string\" || prompt.length === 0) {\n      throw new ConfigurationError(`Agent.batch prompt at index ${i} must be a non-empty string`, {\n        code: \"invalid_batch_item\",\n      });\n    }\n  }\n}\n\n/**\n * Run N prompts in parallel with bounded concurrency.\n *\n * @internal\n */\nexport async function batchImpl(\n  prompts: ReadonlyArray<string | BatchItem>,\n  options: BatchOptions,\n  deps: BatchDeps,\n): Promise<BatchResult[]> {\n  // EC-1: empty array → no work, no agents created.\n  if (prompts.length === 0) return [];\n\n  // Pre-flight boundary validation (arch-review Gap 3). MUST run before pool\n  // build AND before wrapBatchAsTask so invalid input never registers a\n  // dangling Task or builds a credential pool (fail-fast, Rule 8).\n  validateBatchInput(prompts, options);\n\n  // EC-A fix: build credential pools ONCE and share via AsyncLocalStorage.\n  // Without this each Agent.create() would build its own pool from identical\n  // apiKeys → 4× rate-limit wastage per concurrency window.\n  const sharedPools = buildPoolsFromApiKeys(\n    options.providers?.apiKeys,\n    options.providers?.credentialPoolStrategy,\n  );\n  const exec = (): Promise<BatchResult[]> => runBatch(prompts, options, deps);\n  const withPool = (): Promise<BatchResult[]> =>\n    sharedPools.size > 0 ? withCredentialPool(sharedPools, exec) : exec();\n  // T3.3: opt-in Task wrapping (ADRs D363, D374). Register the whole\n  // batch as a single Task (kind=\"batch\") with `b-` prefix (D368/EC-5).\n  if (options.task !== undefined) {\n    return wrapBatchAsTask(prompts.length, options.task, withPool);\n  }\n  return withPool();\n}\n\nasync function wrapBatchAsTask(\n  total: number,\n  taskOpt: true | { id?: string; meta?: Record<string, unknown> },\n  exec: () => Promise<BatchResult[]>,\n): Promise<BatchResult[]> {\n  const opts = taskOpt === true ? {} : taskOpt;\n  const id = opts.id ?? `b-${randomUUID()}`;\n  const meta: Record<string, unknown> = {\n    total,\n    ...(opts.meta ?? {}),\n  };\n  let results: BatchResult[] = [];\n  await taskRegistrySubmit({\n    kind: \"batch\",\n    work: async (ctx) => {\n      results = await exec();\n      const succeeded = results.filter((r) => r.ok).length;\n      const failed = results.length - succeeded;\n      ctx.emit({ total: results.length, succeeded, failed });\n      return { total: results.length, succeeded, failed };\n    },\n    id,\n    meta,\n    allowReservedPrefix: true,\n  });\n  // submit returns immediately with a queued handle. Wait for terminal.\n  for (let i = 0; i < 5000; i++) {\n    const h = await taskRegistryGet(id);\n    if (h?.state === \"finished\" || h?.state === \"error\" || h?.state === \"cancelled\") break;\n    await new Promise((r) => setTimeout(r, 5));\n  }\n  return results;\n}\n\nasync function runBatch(\n  prompts: ReadonlyArray<string | BatchItem>,\n  options: BatchOptions,\n  deps: BatchDeps,\n): Promise<BatchResult[]> {\n  const requested = options.concurrency ?? 4;\n  // createSemaphore throws on invalid (EC-2).\n  // EC-3: cap to prompts.length to avoid idle workers.\n  const effective = Math.min(requested, prompts.length);\n  const semaphore = createSemaphore(effective);\n  const items = prompts.map(normalizeItem);\n  const results: BatchResult[] = new Array(items.length);\n  const counters = { completed: 0, failed: 0 };\n  let aborted = false;\n\n  const onAbort = (): void => {\n    aborted = true;\n  };\n  options.signal?.addEventListener(\"abort\", onAbort);\n  // EC-C: pre-aborted signal — treat as already-aborted before any work.\n  if (options.signal?.aborted === true) aborted = true;\n\n  try {\n    await Promise.all(\n      items.map(async (item, index) => {\n        const release = await semaphore.acquire();\n        try {\n          if (aborted) {\n            results[index] = abortResult(item, index, options.signal);\n          } else {\n            results[index] = await runOne(item, index, options, deps);\n          }\n        } finally {\n          release();\n        }\n        if (results[index].ok) counters.completed += 1;\n        else counters.failed += 1;\n        await safeCallResult(options.onResult, results[index]);\n        safeCallProgress(options.onProgress, {\n          total: items.length,\n          completed: counters.completed,\n          failed: counters.failed,\n          inFlight: semaphore.inFlight(),\n          pending: Math.max(0, semaphore.pending() - semaphore.inFlight()),\n        });\n      }),\n    );\n  } finally {\n    options.signal?.removeEventListener(\"abort\", onAbort);\n  }\n\n  return options.filter ? results.filter(options.filter) : results;\n}\n\nasync function runOne(\n  item: BatchItem,\n  index: number,\n  options: BatchOptions,\n  deps: BatchDeps,\n): Promise<BatchResult> {\n  const t0 = Date.now();\n  const agentOpts = buildAgentOptions(item, options);\n\n  try {\n    const agent = await deps.create(agentOpts);\n    try {\n      const run = await agent.send(item.prompt);\n      const result = await run.wait();\n      return {\n        ok: true,\n        index,\n        prompt: item.prompt,\n        result,\n        ...(item.metadata !== undefined ? { metadata: item.metadata } : {}),\n        durationMs: Date.now() - t0,\n      };\n    } finally {\n      // EC-8: dispose failure → stderr warn, don't fail the result.\n      try {\n        await agent.dispose();\n      } catch (disposeErr) {\n        process.stderr.write(\n          `[theokit-sdk] batch: agent.dispose failed for prompt ${index}: ${\n            disposeErr instanceof Error ? disposeErr.message : String(disposeErr)\n          }\\n`,\n        );\n      }\n    }\n  } catch (err) {\n    return {\n      ok: false,\n      index,\n      prompt: item.prompt,\n      error: toTheokitError(err),\n      ...(item.metadata !== undefined ? { metadata: item.metadata } : {}),\n      durationMs: Date.now() - t0,\n    };\n  }\n}\n\nfunction buildAgentOptions(item: BatchItem, options: BatchOptions): AgentOptions {\n  const {\n    concurrency: _c,\n    filter: _f,\n    onResult: _or,\n    onProgress: _op,\n    signal: _s,\n    task: _t,\n    ...rest\n  } = options;\n  void _c;\n  void _f;\n  void _or;\n  void _op;\n  void _s;\n  void _t;\n  const agentOpts = rest as AgentOptions;\n  if (item.systemPrompt !== undefined) {\n    return { ...agentOpts, systemPrompt: item.systemPrompt };\n  }\n  return agentOpts;\n}\n\nfunction normalizeItem(promptOrItem: string | BatchItem): BatchItem {\n  return typeof promptOrItem === \"string\" ? { prompt: promptOrItem } : promptOrItem;\n}\n\nfunction abortResult(item: BatchItem, index: number, signal?: AbortSignal): BatchResult {\n  // EC-D: propagate signal.reason when set (preserves caller's error).\n  let error: TheokitAgentError;\n  if (signal?.reason instanceof TheokitAgentError) {\n    error = signal.reason;\n  } else if (signal?.reason instanceof Error) {\n    error = new TheokitAgentError(signal.reason.message, {\n      code: \"aborted\",\n      cause: signal.reason,\n    });\n  } else {\n    error = new TheokitAgentError(\"Batch aborted via AbortSignal\", { code: \"aborted\" });\n  }\n  return {\n    ok: false,\n    index,\n    prompt: item.prompt,\n    error,\n    ...(item.metadata !== undefined ? { metadata: item.metadata } : {}),\n    durationMs: 0,\n  };\n}\n\nfunction toTheokitError(err: unknown): TheokitAgentError {\n  if (err instanceof TheokitAgentError) return err;\n  if (err instanceof Error) {\n    return new TheokitAgentError(err.message, { code: \"unknown\", cause: err });\n  }\n  return new TheokitAgentError(String(err), { code: \"unknown\" });\n}\n\nasync function safeCallResult(cb: BatchOptions[\"onResult\"], result: BatchResult): Promise<void> {\n  if (cb === undefined) return;\n  try {\n    await cb(result);\n  } catch (err) {\n    process.stderr.write(\n      `[theokit-sdk] batch: onResult callback threw: ${\n        err instanceof Error ? err.message : String(err)\n      }\\n`,\n    );\n  }\n}\n\nfunction safeCallProgress(cb: BatchOptions[\"onProgress\"], progress: BatchProgress): void {\n  if (cb === undefined) return;\n  try {\n    cb(progress);\n  } catch (err) {\n    process.stderr.write(\n      `[theokit-sdk] batch: onProgress callback threw: ${\n        err instanceof Error ? err.message : String(err)\n      }\\n`,\n    );\n  }\n}\n\n/**\n * EC-A: construct shared pools from options.apiKeys. Empty/invalid → empty Map.\n *\n * @internal\n */\nfunction buildPoolsFromApiKeys(\n  apiKeys: Record<string, string[]> | undefined,\n  strategy: Record<string, CredentialPoolStrategy> | undefined,\n): Map<string, CredentialPool> {\n  const pools = new Map<string, CredentialPool>();\n  if (apiKeys === undefined) return pools;\n  for (const [provider, keys] of Object.entries(apiKeys)) {\n    if (!Array.isArray(keys)) continue;\n    const filtered = keys.filter((k): k is string => typeof k === \"string\" && k.length > 0);\n    if (filtered.length < 2) continue; // 1-key pools aren't pools\n    const entries = filtered.map((token, i) =>\n      newPooledCredential({ provider, accessToken: token, priority: i, source: \"manual\" }),\n    );\n    pools.set(\n      provider,\n      new CredentialPool(provider, entries, strategy?.[provider] ?? \"fill_first\"),\n    );\n  }\n  return pools;\n}\n"]}