@theokit/sdk 4.24.0 → 4.26.0

package/dist/chunk-5PZMMF4H.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/concurrency/async-semaphore.ts"],"names":[],"mappings":";;;AA2BO,SAAS,gBAAgB,OAAA,EAAiC;AAC/D,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,UAAU,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,4DAA4D,OAAO,CAAA,CAAA;AAAA,MACnE,EAAE,MAAM,qBAAA;AAAsB,KAChC;AAAA,EACF;AACA,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,MAAM,QAA2B,EAAC;AAElC,EAAA,SAAS,QAAA,GAAiB;AACxB,IAAA,IAAI,MAAA,GAAS,OAAA,IAAW,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AACxC,MAAA,MAAM,OAAA,GAAU,MAAM,KAAA,EAAM;AAC5B,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAA,IAAU,CAAA;AACV,QAAA,OAAA,EAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,UAAU,MAAM,MAAA;AAAA,IAChB,OAAA,EAAS,MAAM,KAAA,CAAM,MAAA,GAAS,MAAA;AAAA,IAC9B,MAAM,OAAA,GAAU;AACd,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACnC,QAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,QAAA,QAAA,EAAS;AAAA,MACX,CAAC,CAAA;AACD,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,OAAO,MAAM;AACX,QAAA,IAAI,QAAA,EAAU;AACd,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,MAAA,IAAU,CAAA;AACV,QAAA,QAAA,EAAS;AAAA,MACX,CAAA;AAAA,IACF;AAAA,GACF;AACF","file":"chunk-5PZMMF4H.js","sourcesContent":["/**\n * Async-aware counting semaphore (ADR D135).\n *\n * N-permit gate for cooperative concurrency control inside a single\n * Node process. Used by `Agent.batch` to bound parallel agent count\n * without pulling in `p-limit` or `p-queue` (~30 LoC in-house).\n *\n * Contract: `acquire()` returns a release function. Caller MUST call\n * release exactly once when done — typically in a `finally` block.\n * Release is idempotent (multiple calls are no-ops after the first)\n * for defense against caller bugs, but leaking the release function\n * permanently consumes one permit (EC-G — caller responsibility).\n *\n * @internal\n */\n\nimport { ConfigurationError } from \"../../../errors.js\";\n\nexport interface AsyncSemaphore {\n  /** Acquire a permit. Returns the release function (call once). */\n  acquire(): Promise<() => void>;\n  /** Permits currently held in flight. */\n  inFlight(): number;\n  /** Total: in-flight + queued waiters. */\n  pending(): number;\n}\n\nexport function createSemaphore(permits: number): AsyncSemaphore {\n  if (!Number.isInteger(permits) || permits < 1) {\n    throw new ConfigurationError(\n      `async-semaphore: permits must be a positive integer, got ${permits}`,\n      { code: \"invalid_concurrency\" },\n    );\n  }\n  let active = 0;\n  const queue: Array<() => void> = [];\n\n  function tryGrant(): void {\n    if (active < permits && queue.length > 0) {\n      const resolve = queue.shift();\n      if (resolve !== undefined) {\n        active += 1;\n        resolve();\n      }\n    }\n  }\n\n  return {\n    inFlight: () => active,\n    pending: () => queue.length + active,\n    async acquire() {\n      await new Promise<void>((resolve) => {\n        queue.push(resolve);\n        tryGrant();\n      });\n      let released = false;\n      return () => {\n        if (released) return;\n        released = true;\n        active -= 1;\n        tryGrant();\n      };\n    },\n  };\n}\n"]}

package/dist/chunk-6CLRANZA.js

@@ -0,0 +1,289 @@
+import { withCwdMutex } from './chunk-2XLKLVVR.js';
+import { ConfigurationError } from './chunk-WLKFWQSJ.js';
+import { AsyncLocalStorage } from 'async_hooks';
+
+// src/internal/llm/credential-pool-types.ts
+var COOLDOWN_MS = {
+  401: 5 * 60 * 1e3,
+  // 5 minutes — OAuth refresh can recover quickly
+  402: 60 * 60 * 1e3,
+  // 1 hour — billing quota typically hourly+
+  429: 60 * 60 * 1e3
+  // 1 hour — daily-rate-limit windows
+};
+var DEFAULT_COOLDOWN_MS = 60 * 60 * 1e3;
+
+// src/internal/llm/retry.ts
+var DEFAULT_BASE_MS = 500;
+var DEFAULT_CAP_MS = 32e3;
+function computeBackoffMs(opts) {
+  const base = opts.baseMs ?? DEFAULT_BASE_MS;
+  const cap = opts.capMs ?? DEFAULT_CAP_MS;
+  const rng = opts.rng ?? Math.random;
+  if (opts.retryAfterMs !== void 0 && opts.retryAfterMs >= 0) {
+    return Math.max(base, Math.min(cap, opts.retryAfterMs));
+  }
+  const ceiling = Math.min(cap, base * 2 ** opts.attempt);
+  return Math.floor(rng() * ceiling);
+}
+function sleepWithAbort(ms, signal) {
+  if (ms <= 0 || signal.aborted) return Promise.resolve();
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// src/internal/llm/credential-pool.ts
+function newPooledCredential(args) {
+  return {
+    id: globalThis.crypto.randomUUID(),
+    label: args.label ?? labelFromSource(args.source, args.accessToken),
+    provider: args.provider,
+    priority: args.priority,
+    source: args.source,
+    accessToken: args.accessToken,
+    lastStatus: "ok",
+    lastStatusAt: void 0,
+    lastErrorCode: void 0,
+    lastErrorResetAt: void 0,
+    requestCount: 0
+  };
+}
+function labelFromSource(source, accessToken) {
+  if (source.startsWith("env:")) return source.slice(4);
+  const masked = accessToken.length > 8 ? `${accessToken.slice(0, 4)}\u2026${accessToken.slice(-4)}` : "***";
+  return `${source}:${masked}`;
+}
+var CredentialPool = class _CredentialPool {
+  provider;
+  strategy;
+  entries;
+  constructor(provider, entries, strategy = "fill_first") {
+    if (entries.length === 0) {
+      throw new ConfigurationError(
+        `credential-pool: cannot construct empty pool for provider "${provider}"`,
+        { code: "credential_pool_empty" }
+      );
+    }
+    this.provider = provider;
+    this.strategy = strategy;
+    this.entries = dedupeByToken(entries).sort((a, b) => a.priority - b.priority);
+  }
+  /** True if the pool was seeded with at least one entry. */
+  hasCredentials() {
+    return this.entries.length > 0;
+  }
+  /** True iff at least one entry is healthy (auto-healed if cooldown expired). */
+  hasAvailable() {
+    return this.availableEntries().length > 0;
+  }
+  /**
+   * Earliest `lastErrorResetAt` across all entries, or `undefined` if no
+   * entry is in cooldown. Used by `waitForAvailable` to compute the
+   * upper bound of each jittered sleep window.
+   *
+   * @internal
+   */
+  earliestResetAt() {
+    let earliest;
+    for (const entry of this.entries) {
+      if (entry.lastStatus === "ok") continue;
+      if (entry.lastErrorResetAt === void 0) continue;
+      if (earliest === void 0 || entry.lastErrorResetAt < earliest) {
+        earliest = entry.lastErrorResetAt;
+      }
+    }
+    return earliest;
+  }
+  /**
+   * Wait until at least one entry becomes healthy OR `maxWaitMs` elapses
+   * OR `signal` aborts. Returns `true` if a healthy entry is available
+   * when the call returns, `false` otherwise.
+   *
+   * T3.9 — Reconnect storm prevention. Concurrent callers each sleep a
+   * random fraction of the window to the earliest cooldown reset (full
+   * jitter — AWS Brooker 2015) so they do not all wake at the exact
+   * instant cooldown expires and hammer the upstream simultaneously.
+   *
+   * The `sleeper` parameter is a dependency-injection seam for tests:
+   * callers in production omit it and the default `setTimeout`-based
+   * sleeper is used. The seam avoids the `vi.useFakeTimers()` mismatch
+   * that blocked T3.4's wiring.
+   *
+   * @internal
+   */
+  async waitForAvailable(signal, opts) {
+    if (signal.aborted) return false;
+    if (this.hasAvailable()) return true;
+    const sleeper = opts.sleeper ?? sleepWithAbort;
+    const deadline = Date.now() + opts.maxWaitMs;
+    while (Date.now() < deadline) {
+      if (signal.aborted) return false;
+      const jittered = this.computeJitteredSleepMs(deadline);
+      await sleeper(jittered, signal);
+      if (signal.aborted) return false;
+      if (this.hasAvailable()) return true;
+    }
+    return this.hasAvailable();
+  }
+  /**
+   * Compute the next jittered sleep window (ms) for `waitForAvailable`.
+   * Full-jitter cap: at most (a) time until the earliest reset (plus a
+   * 50 ms grace so the entry actually heals before re-probe), or (b) the
+   * remaining wait window, whichever is smaller. When no entry has a
+   * known reset (rare — only if `markExhaustedAndRotate` was called
+   * without `resetAtMs`), fall back to a 250 ms ceiling so we stay
+   * responsive without hot-looping.
+   */
+  computeJitteredSleepMs(deadline) {
+    const resetAt = this.earliestResetAt();
+    const remaining = deadline - Date.now();
+    const ceiling = resetAt === void 0 ? Math.min(remaining, 250) : Math.min(remaining, Math.max(0, resetAt - Date.now()) + 50);
+    return Math.max(0, Math.floor(Math.random() * ceiling));
+  }
+  /** Live (frozen) view of all entries. */
+  list() {
+    return this.entries;
+  }
+  /**
+   * Pick a healthy entry according to the configured strategy.
+   * Mutates `requestCount` and (for round_robin) entry order.
+   * Returns null if every entry is in cooldown.
+   *
+   * @internal
+   */
+  async select() {
+    return withCwdMutex(`credential-pool:${this.provider}`, async () => this.selectLocked());
+  }
+  /**
+   * Mark the entry whose id matches `entryId` as exhausted with the
+   * appropriate cooldown, then return the next healthy entry (or null).
+   * If `entryId` is undefined, marks all currently-active entries (rare —
+   * only used by admin reset scenarios).
+   *
+   * @internal
+   */
+  async markExhaustedAndRotate(args) {
+    return withCwdMutex(`credential-pool:${this.provider}`, async () => {
+      const entry = this.entries.find((e) => e.id === args.entryId);
+      if (entry !== void 0) {
+        const now = Date.now();
+        const cooldown = COOLDOWN_MS[args.statusCode] ?? DEFAULT_COOLDOWN_MS;
+        entry.lastStatus = "exhausted";
+        entry.lastStatusAt = now;
+        entry.lastErrorCode = args.statusCode;
+        entry.lastErrorResetAt = args.resetAtMs !== void 0 && args.resetAtMs > now ? args.resetAtMs : now + cooldown;
+      }
+      return this.selectLocked();
+    });
+  }
+  /** Admin escape hatch: clear all cooldowns. */
+  async resetAll() {
+    await withCwdMutex(`credential-pool:${this.provider}`, async () => {
+      for (const e of this.entries) {
+        e.lastStatus = "ok";
+        e.lastStatusAt = void 0;
+        e.lastErrorCode = void 0;
+        e.lastErrorResetAt = void 0;
+      }
+    });
+  }
+  /** Materialize for persistence. */
+  toSnapshot() {
+    return {
+      provider: this.provider,
+      strategy: this.strategy,
+      entries: this.entries.map((e) => ({ ...e }))
+    };
+  }
+  /** Hydrate from a previously-saved snapshot. */
+  static fromSnapshot(snapshot) {
+    return new _CredentialPool(snapshot.provider, snapshot.entries, snapshot.strategy);
+  }
+  // ─── Internal helpers (always called inside the mutex) ───
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: strategy dispatch must branch on 4 enum values (random/least_used/round_robin/fill_first) with 1-entry short-circuits per strategy. Each branch is 5-10 lines of focused logic; extracting per-strategy methods fragments the linear narrative.
+  selectLocked() {
+    const available = this.availableEntries();
+    if (available.length === 0) return null;
+    if (this.strategy === "random") {
+      const idx = Math.floor(Math.random() * available.length);
+      const picked2 = available[idx];
+      if (picked2 === void 0) return null;
+      picked2.requestCount += 1;
+      return picked2;
+    }
+    if (this.strategy === "least_used" && available.length > 1) {
+      const picked2 = [...available].sort(
+        (a, b) => a.requestCount - b.requestCount || a.priority - b.priority
+      )[0];
+      if (picked2 === void 0) return null;
+      picked2.requestCount += 1;
+      return picked2;
+    }
+    if (this.strategy === "round_robin" && available.length > 1) {
+      const picked2 = available[0];
+      if (picked2 === void 0) return null;
+      picked2.requestCount += 1;
+      const rest = this.entries.filter((e) => e.id !== picked2.id);
+      const maxPriority = this.entries.length - 1;
+      rest.forEach((e, i) => {
+        e.priority = i;
+      });
+      picked2.priority = maxPriority;
+      this.entries = [...rest, picked2];
+      return picked2;
+    }
+    const picked = available[0];
+    if (picked === void 0) return null;
+    picked.requestCount += 1;
+    return picked;
+  }
+  availableEntries() {
+    const now = Date.now();
+    const out = [];
+    for (const entry of this.entries) {
+      if (entry.lastStatus === "ok") {
+        out.push(entry);
+        continue;
+      }
+      const resetAt = entry.lastErrorResetAt;
+      if (resetAt !== void 0 && now >= resetAt) {
+        entry.lastStatus = "ok";
+        entry.lastStatusAt = void 0;
+        entry.lastErrorCode = void 0;
+        entry.lastErrorResetAt = void 0;
+        out.push(entry);
+      }
+    }
+    return out;
+  }
+};
+function dedupeByToken(entries) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const e of entries) {
+    if (seen.has(e.accessToken)) continue;
+    seen.add(e.accessToken);
+    out.push(e);
+  }
+  return out;
+}
+var credentialPoolStore = new AsyncLocalStorage();
+async function withCredentialPool(pools, fn) {
+  return credentialPoolStore.run(pools, fn);
+}
+function currentCredentialPool(provider) {
+  return credentialPoolStore.getStore()?.get(provider);
+}
+
+export { CredentialPool, computeBackoffMs, currentCredentialPool, newPooledCredential, sleepWithAbort, withCredentialPool };
+//# sourceMappingURL=chunk-6CLRANZA.js.map
+//# sourceMappingURL=chunk-6CLRANZA.js.map

package/dist/chunk-6CLRANZA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/llm/credential-pool-types.ts","../src/internal/llm/retry.ts","../src/internal/llm/credential-pool.ts","../src/internal/llm/credential-pool-context.ts"],"names":["picked"],"mappings":";;;;;AAyFO,IAAM,WAAA,GAAgD;AAAA,EAC3D,GAAA,EAAK,IAAI,EAAA,GAAK,GAAA;AAAA;AAAA,EACd,GAAA,EAAK,KAAK,EAAA,GAAK,GAAA;AAAA;AAAA,EACf,GAAA,EAAK,KAAK,EAAA,GAAK;AAAA;AACjB,CAAA;AAGO,IAAM,mBAAA,GAAsB,KAAK,EAAA,GAAK,GAAA;;;AC7D7C,IAAM,eAAA,GAAkB,GAAA;AACxB,IAAM,cAAA,GAAiB,IAAA;AAchB,SAAS,iBAAiB,IAAA,EAA8B;AAC7D,EAAA,MAAM,IAAA,GAAO,KAAK,MAAA,IAAU,eAAA;AAC5B,EAAA,MAAM,GAAA,GAAM,KAAK,KAAA,IAAS,cAAA;AAC1B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,MAAA;AAC7B,EAAA,IAAI,IAAA,CAAK,YAAA,KAAiB,MAAA,IAAa,IAAA,CAAK,gBAAgB,CAAA,EAAG;AAC7D,IAAA,OAAO,IAAA,CAAK,IAAI,IAAA,EAAM,IAAA,CAAK,IAAI,GAAA,EAAK,IAAA,CAAK,YAAY,CAAC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,GAAO,CAAA,IAAK,KAAK,OAAO,CAAA;AACtD,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAI,GAAI,OAAO,CAAA;AACnC;AASO,SAAS,cAAA,CAAe,IAAY,MAAA,EAAoC;AAC7E,EAAA,IAAI,MAAM,CAAA,IAAK,MAAA,CAAO,OAAA,EAAS,OAAO,QAAQ,OAAA,EAAQ;AACtD,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACpC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC3C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,OAAA,EAAQ;AAAA,IACV,CAAA;AACA,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC1D,CAAC,CAAA;AACH;;;AC/CO,SAAS,oBAAoB,IAAA,EAMf;AACnB,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,UAAA,CAAW,MAAA,CAAO,UAAA,EAAW;AAAA,IACjC,OAAO,IAAA,CAAK,KAAA,IAAS,gBAAgB,IAAA,CAAK,MAAA,EAAQ,KAAK,WAAW,CAAA;AAAA,IAClE,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,UAAA,EAAY,IAAA;AAAA,IACZ,YAAA,EAAc,MAAA;AAAA,IACd,aAAA,EAAe,MAAA;AAAA,IACf,gBAAA,EAAkB,MAAA;AAAA,IAClB,YAAA,EAAc;AAAA,GAChB;AACF;AAQA,SAAS,eAAA,CAAgB,QAAgB,WAAA,EAA6B;AACpE,EAAA,IAAI,OAAO,UAAA,CAAW,MAAM,GAAG,OAAO,MAAA,CAAO,MAAM,CAAC,CAAA;AACpD,EAAA,MAAM,MAAA,GACJ,WAAA,CAAY,MAAA,GAAS,CAAA,GAAI,GAAG,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,MAAA,EAAI,WAAA,CAAY,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA,GAAK,KAAA;AACnF,EAAA,OAAO,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC5B;AAYO,IAAM,cAAA,GAAN,MAAM,eAAA,CAAe;AAAA,EACjB,QAAA;AAAA,EACQ,QAAA;AAAA,EACT,OAAA;AAAA,EAER,WAAA,CACE,QAAA,EACA,OAAA,EACA,QAAA,GAAmC,YAAA,EACnC;AACA,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,8DAA8D,QAAQ,CAAA,CAAA,CAAA;AAAA,QACtE,EAAE,MAAM,uBAAA;AAAwB,OAClC;AAAA,IACF;AACA,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAEhB,IAAA,IAAA,CAAK,OAAA,GAAU,aAAA,CAAc,OAAO,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,QAAA,GAAW,CAAA,CAAE,QAAQ,CAAA;AAAA,EAC9E;AAAA;AAAA,EAGA,cAAA,GAA0B;AACxB,IAAA,OAAO,IAAA,CAAK,QAAQ,MAAA,GAAS,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,YAAA,GAAwB;AACtB,IAAA,OAAO,IAAA,CAAK,gBAAA,EAAiB,CAAE,MAAA,GAAS,CAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,eAAA,GAAsC;AACpC,IAAA,IAAI,QAAA;AACJ,IAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AAChC,MAAA,IAAI,KAAA,CAAM,eAAe,IAAA,EAAM;AAC/B,MAAA,IAAI,KAAA,CAAM,qBAAqB,MAAA,EAAW;AAC1C,MAAA,IAAI,QAAA,KAAa,MAAA,IAAa,KAAA,CAAM,gBAAA,GAAmB,QAAA,EAAU;AAC/D,QAAA,QAAA,GAAW,KAAA,CAAM,gBAAA;AAAA,MACnB;AAAA,IACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,gBAAA,CACJ,MAAA,EACA,IAAA,EAIkB;AAClB,IAAA,IAAI,MAAA,CAAO,SAAS,OAAO,KAAA;AAC3B,IAAA,IAAI,IAAA,CAAK,YAAA,EAAa,EAAG,OAAO,IAAA;AAChC,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,IAAW,cAAA;AAChC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA;AACnC,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,MAAA,IAAI,MAAA,CAAO,SAAS,OAAO,KAAA;AAC3B,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,sBAAA,CAAuB,QAAQ,CAAA;AACrD,MAAA,MAAM,OAAA,CAAQ,UAAU,MAAM,CAAA;AAC9B,MAAA,IAAI,MAAA,CAAO,SAAS,OAAO,KAAA;AAC3B,MAAA,IAAI,IAAA,CAAK,YAAA,EAAa,EAAG,OAAO,IAAA;AAAA,IAClC;AACA,IAAA,OAAO,KAAK,YAAA,EAAa;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,uBAAuB,QAAA,EAA0B;AACvD,IAAA,MAAM,OAAA,GAAU,KAAK,eAAA,EAAgB;AACrC,IAAA,MAAM,SAAA,GAAY,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI;AACtC,IAAA,MAAM,UACJ,OAAA,KAAY,MAAA,GACR,KAAK,GAAA,CAAI,SAAA,EAAW,GAAG,CAAA,GACvB,IAAA,CAAK,IAAI,SAAA,EAAW,IAAA,CAAK,IAAI,CAAA,EAAG,OAAA,GAAU,KAAK,GAAA,EAAK,IAAI,EAAE,CAAA;AAChE,IAAA,OAAO,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,CAAK,MAAM,IAAA,CAAK,MAAA,EAAO,GAAI,OAAO,CAAC,CAAA;AAAA,EACxD;AAAA;AAAA,EAGA,IAAA,GAAoC;AAClC,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,MAAA,GAA2C;AAC/C,IAAA,OAAO,YAAA,CAAa,mBAAmB,IAAA,CAAK,QAAQ,IAAI,YAAY,IAAA,CAAK,cAAc,CAAA;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,uBAAuB,IAAA,EAIQ;AACnC,IAAA,OAAO,YAAA,CAAa,CAAA,gBAAA,EAAmB,IAAA,CAAK,QAAQ,IAAI,YAAY;AAClE,MAAA,MAAM,KAAA,GAAQ,KAAK,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,IAAA,CAAK,OAAO,CAAA;AAC5D,MAAA,IAAI,UAAU,MAAA,EAAW;AACvB,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,IAAA,CAAK,UAAU,CAAA,IAAK,mBAAA;AACjD,QAAA,KAAA,CAAM,UAAA,GAAa,WAAA;AACnB,QAAA,KAAA,CAAM,YAAA,GAAe,GAAA;AACrB,QAAA,KAAA,CAAM,gBAAgB,IAAA,CAAK,UAAA;AAE3B,QAAA,KAAA,CAAM,gBAAA,GACJ,KAAK,SAAA,KAAc,MAAA,IAAa,KAAK,SAAA,GAAY,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,GAAA,GAAM,QAAA;AAAA,MAClF;AACA,MAAA,OAAO,KAAK,YAAA,EAAa;AAAA,IAC3B,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,QAAA,GAA0B;AAC9B,IAAA,MAAM,YAAA,CAAa,CAAA,gBAAA,EAAmB,IAAA,CAAK,QAAQ,IAAI,YAAY;AACjE,MAAA,KAAA,MAAW,CAAA,IAAK,KAAK,OAAA,EAAS;AAC5B,QAAA,CAAA,CAAE,UAAA,GAAa,IAAA;AACf,QAAA,CAAA,CAAE,YAAA,GAAe,MAAA;AACjB,QAAA,CAAA,CAAE,aAAA,GAAgB,MAAA;AAClB,QAAA,CAAA,CAAE,gBAAA,GAAmB,MAAA;AAAA,MACvB;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,UAAA,GAAqC;AACnC,IAAA,OAAO;AAAA,MACL,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAA,EAAS,KAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,GAAG,CAAA,EAAE,CAAE;AAAA,KAC7C;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,aAAa,QAAA,EAAkD;AACpE,IAAA,OAAO,IAAI,eAAA,CAAe,QAAA,CAAS,UAAU,QAAA,CAAS,OAAA,EAAS,SAAS,QAAQ,CAAA;AAAA,EAClF;AAAA;AAAA;AAAA,EAKQ,YAAA,GAAwC;AAC9C,IAAA,MAAM,SAAA,GAAY,KAAK,gBAAA,EAAiB;AACxC,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAEnC,IAAA,IAAI,IAAA,CAAK,aAAa,QAAA,EAAU;AAC9B,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,KAAK,MAAA,EAAO,GAAI,UAAU,MAAM,CAAA;AACvD,MAAA,MAAMA,OAAAA,GAAS,UAAU,GAAG,CAAA;AAC5B,MAAA,IAAIA,OAAAA,KAAW,QAAW,OAAO,IAAA;AACjC,MAAAA,QAAO,YAAA,IAAgB,CAAA;AACvB,MAAA,OAAOA,OAAAA;AAAA,IACT;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,YAAA,IAAgB,SAAA,CAAU,SAAS,CAAA,EAAG;AAE1D,MAAA,MAAMA,OAAAA,GAAS,CAAC,GAAG,SAAS,CAAA,CAAE,IAAA;AAAA,QAC5B,CAAC,GAAG,CAAA,KAAM,CAAA,CAAE,eAAe,CAAA,CAAE,YAAA,IAAgB,CAAA,CAAE,QAAA,GAAW,CAAA,CAAE;AAAA,QAC5D,CAAC,CAAA;AACH,MAAA,IAAIA,OAAAA,KAAW,QAAW,OAAO,IAAA;AACjC,MAAAA,QAAO,YAAA,IAAgB,CAAA;AACvB,MAAA,OAAOA,OAAAA;AAAA,IACT;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,KAAa,aAAA,IAAiB,SAAA,CAAU,SAAS,CAAA,EAAG;AAE3D,MAAA,MAAMA,OAAAA,GAAS,UAAU,CAAC,CAAA;AAC1B,MAAA,IAAIA,OAAAA,KAAW,QAAW,OAAO,IAAA;AACjC,MAAAA,QAAO,YAAA,IAAgB,CAAA;AACvB,MAAA,MAAM,IAAA,GAAO,KAAK,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAOA,OAAAA,CAAO,EAAE,CAAA;AAI1D,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,MAAA,GAAS,CAAA;AAC1C,MAAA,IAAA,CAAK,OAAA,CAAQ,CAAC,CAAA,EAAG,CAAA,KAAM;AACrB,QAAA,CAAA,CAAE,QAAA,GAAW,CAAA;AAAA,MACf,CAAC,CAAA;AACD,MAAAA,QAAO,QAAA,GAAW,WAAA;AAClB,MAAA,IAAA,CAAK,OAAA,GAAU,CAAC,GAAG,IAAA,EAAMA,OAAM,CAAA;AAC/B,MAAA,OAAOA,OAAAA;AAAA,IACT;AAGA,IAAA,MAAM,MAAA,GAAS,UAAU,CAAC,CAAA;AAC1B,IAAA,IAAI,MAAA,KAAW,QAAW,OAAO,IAAA;AACjC,IAAA,MAAA,CAAO,YAAA,IAAgB,CAAA;AACvB,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,gBAAA,GAAuC;AAC7C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,MAAM,MAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AAChC,MAAA,IAAI,KAAA,CAAM,eAAe,IAAA,EAAM;AAC7B,QAAA,GAAA,CAAI,KAAK,KAAK,CAAA;AACd,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,UAAU,KAAA,CAAM,gBAAA;AACtB,MAAA,IAAI,OAAA,KAAY,MAAA,IAAa,GAAA,IAAO,OAAA,EAAS;AAC3C,QAAA,KAAA,CAAM,UAAA,GAAa,IAAA;AACnB,QAAA,KAAA,CAAM,YAAA,GAAe,MAAA;AACrB,QAAA,KAAA,CAAM,aAAA,GAAgB,MAAA;AACtB,QAAA,KAAA,CAAM,gBAAA,GAAmB,MAAA;AACzB,QAAA,GAAA,CAAI,KAAK,KAAK,CAAA;AAAA,MAChB;AAAA,IACF;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACF;AAMA,SAAS,cAAc,OAAA,EAAiD;AACtE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,MAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,WAAW,CAAA,EAAG;AAC7B,IAAA,IAAA,CAAK,GAAA,CAAI,EAAE,WAAW,CAAA;AACtB,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT;ACvUA,IAAM,mBAAA,GAAsB,IAAI,iBAAA,EAA+C;AAS/E,eAAsB,kBAAA,CACpB,OACA,EAAA,EACY;AACZ,EAAA,OAAO,mBAAA,CAAoB,GAAA,CAAI,KAAA,EAAO,EAAE,CAAA;AAC1C;AAQO,SAAS,sBAAsB,QAAA,EAA8C;AAClF,EAAA,OAAO,mBAAA,CAAoB,QAAA,EAAS,EAAG,GAAA,CAAI,QAAQ,CAAA;AACrD","file":"chunk-6CLRANZA.js","sourcesContent":["/**\n * Types for the credential pool subsystem (ADRs D123-D133).\n *\n * Pool a developer's multiple API keys for the SAME provider so the SDK\n * can rotate transparently on HTTP 429/402/401 instead of jumping\n * straight to a different provider via `FallbackLlmClient`.\n *\n * @internal\n */\n\n/**\n * Rotation strategy when picking the next credential from a pool.\n *\n * - `fill_first` (default): use entries[0] until exhausted, then [1]…\n * - `round_robin`: rotate after each `select()`\n * - `least_used`: pick the entry with the lowest `requestCount`\n * - `random`: random pick among healthy entries\n *\n * Closed enum per ADR D124 — adding a strategy is an explicit semver\n * minor that updates `selectByStrategy` exhaustively.\n *\n * @internal\n */\nexport type CredentialPoolStrategy = \"fill_first\" | \"round_robin\" | \"least_used\" | \"random\";\n\n/** Health flag tracked per credential. */\nexport type CredentialStatus = \"ok\" | \"exhausted\";\n\n/**\n * Provenance of a credential — where it came from when seeded.\n * Free-form string; conventional prefixes:\n *\n * - `env:<VAR_NAME>` — auto-discovered from environment variable\n * - `manual` — added via explicit `apiKeys` config\n * - `explicit-apikey` — wrapped from `AgentOptions.apiKey` single-key path (D132)\n */\nexport type CredentialSource = string;\n\n/**\n * Single credential entry inside a {@link CredentialPool}.\n *\n * `accessToken` is the sensitive field — must never be logged unredacted.\n * The lint gate `tests/lint/no-unredacted-pool-token.test.ts` enforces this.\n *\n * @internal\n */\nexport interface PooledCredential {\n  /** Stable identifier (uuid v4) for log lines + telemetry. */\n  id: string;\n  /** Human-readable label for `Theokit.credentialPool.list()`. */\n  label: string;\n  /** Provider name (matches `ProviderProfile.name`). */\n  provider: string;\n  /** Sort key; lower = earlier in fill_first. Unique within a pool. */\n  priority: number;\n  /** Provenance string. */\n  source: CredentialSource;\n  /** Sensitive API key. NEVER LOG UNREDACTED. */\n  accessToken: string;\n  /** Current health. */\n  lastStatus: CredentialStatus;\n  /** Epoch ms of the last status change. */\n  lastStatusAt: number | undefined;\n  /** HTTP code that caused exhaustion (401/402/429). */\n  lastErrorCode: number | undefined;\n  /** Provider-supplied \"retry after this epoch ms\" hint. Overrides cooldown defaults. */\n  lastErrorResetAt: number | undefined;\n  /** Bumped per successful `select()` for `least_used` strategy. Lazy-persisted. */\n  requestCount: number;\n}\n\n/**\n * Serializable snapshot of a single provider's pool. Used by the\n * persistence layer (T2.1) to read/write `~/.theokit/credential-pool.json`.\n *\n * @internal\n */\nexport interface CredentialPoolSnapshot {\n  provider: string;\n  strategy: CredentialPoolStrategy;\n  entries: PooledCredential[];\n}\n\n/**\n * Cooldown ladder by HTTP error code (ADR D125). Provider-supplied\n * `lastErrorResetAt` overrides these defaults when present.\n *\n * @internal\n */\nexport const COOLDOWN_MS: Readonly<Record<number, number>> = {\n  401: 5 * 60 * 1000, // 5 minutes — OAuth refresh can recover quickly\n  402: 60 * 60 * 1000, // 1 hour — billing quota typically hourly+\n  429: 60 * 60 * 1000, // 1 hour — daily-rate-limit windows\n};\n\n/** Default cooldown when no specific code matches. */\nexport const DEFAULT_COOLDOWN_MS = 60 * 60 * 1000;\n","/**\n * T3.4 — exponential backoff with full jitter for credential-pool retry.\n *\n * Why we need this: pre-T3.4 `pool-aware-client.ts:79-83` retried the\n * SAME credential immediately on the first 429 without any wait. When\n * every credential in the pool returned 429 (thundering herd against a\n * shared quota), the client burned through all 5 retry attempts in <1ms,\n * tripped `CredentialPoolExhaustedError`, and surfaced to the agent loop\n * as a hard failure. The user-visible symptom was \"all my keys are\n * exhausted!\" when in reality a 1-2s wait would have cleared the rate\n * limit.\n *\n * AWS Architecture Blog \"Exponential Backoff And Jitter\" (Marc Brooker,\n * 2015) demonstrates full jitter as the canonical pattern: `sleep =\n * random_between(0, base * 2^attempt)`. We extend it with a hard cap\n * (so a 32s sleep never blocks an interactive agent) and honor the\n * provider's `Retry-After` hint when present — the hint always wins over\n * the computed value when it falls within `[base, cap]`.\n *\n * @internal\n */\n\nexport interface BackoffOptions {\n  /** 0-indexed retry attempt number. */\n  attempt: number;\n  /** Base delay in ms (multiplier for 2^attempt). Default 500. */\n  baseMs?: number;\n  /** Hard cap in ms — backoff never sleeps longer than this. Default 32_000. */\n  capMs?: number;\n  /** Provider's Retry-After hint in ms (from header). Takes precedence when in-range. */\n  retryAfterMs?: number;\n  /** Random source — pass a deterministic mock from tests. Default `Math.random`. */\n  rng?: () => number;\n}\n\nconst DEFAULT_BASE_MS = 500;\nconst DEFAULT_CAP_MS = 32_000;\n\n/**\n * Compute the next sleep duration (ms) before retrying a failed request.\n *\n * Algorithm:\n * 1. If `retryAfterMs` is set, prefer it — clamped to `[baseMs, capMs]`.\n *    The provider's hint is the most accurate available signal.\n * 2. Otherwise: `sleep = random(0, min(cap, base * 2^attempt))` — full\n *    jitter per Brooker 2015 ensures coordinated clients (each with\n *    different RNG seeds) spread the retry storm.\n *\n * @internal\n */\nexport function computeBackoffMs(opts: BackoffOptions): number {\n  const base = opts.baseMs ?? DEFAULT_BASE_MS;\n  const cap = opts.capMs ?? DEFAULT_CAP_MS;\n  const rng = opts.rng ?? Math.random;\n  if (opts.retryAfterMs !== undefined && opts.retryAfterMs >= 0) {\n    return Math.max(base, Math.min(cap, opts.retryAfterMs));\n  }\n  const ceiling = Math.min(cap, base * 2 ** opts.attempt);\n  return Math.floor(rng() * ceiling);\n}\n\n/**\n * `setTimeout`-based sleep that resolves early when the abort signal fires.\n * Resolves cleanly (does not throw on abort) so callers decide how to\n * react to the abort downstream.\n *\n * @internal\n */\nexport function sleepWithAbort(ms: number, signal: AbortSignal): Promise<void> {\n  if (ms <= 0 || signal.aborted) return Promise.resolve();\n  return new Promise<void>((resolve) => {\n    const timer = setTimeout(() => {\n      signal.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, ms);\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      resolve();\n    };\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n","/**\n * In-memory credential pool with strategy-based rotation (ADRs D123-D133).\n *\n * Pure logic. No I/O — persistence lives in `internal/persistence/\n * credential-pool-store.ts`. The pool is the single source of truth for\n * rotation state within a process; if it diverges from disk (e.g.,\n * process killed mid-rotation per EC-I), the next save heals the\n * inconsistency — at the cost of one extra HTTP 429 per crash.\n *\n * Thread safety: the pool uses an in-process async-aware mutex\n * (`cwd-mutex` D9 keyed by `credential-pool:${provider}`). Cross-process\n * safety happens at the persistence layer via `withFileLock` (D61).\n * Two Node processes sharing the same file may double-pick momentarily\n * (worst case = 1 extra 429 per race) — acceptable per ADR D128.\n *\n * @internal\n */\n\nimport { ConfigurationError } from \"../../errors.js\";\nimport { withCwdMutex } from \"../persistence/cwd-mutex.js\";\nimport {\n  COOLDOWN_MS,\n  type CredentialPoolSnapshot,\n  type CredentialPoolStrategy,\n  DEFAULT_COOLDOWN_MS,\n  type PooledCredential,\n} from \"./credential-pool-types.js\";\nimport { sleepWithAbort } from \"./retry.js\";\n\n/**\n * Construct a `PooledCredential` with sane defaults.\n *\n * @internal\n */\nexport function newPooledCredential(args: {\n  provider: string;\n  accessToken: string;\n  priority: number;\n  source: string;\n  label?: string;\n}): PooledCredential {\n  return {\n    id: globalThis.crypto.randomUUID(),\n    label: args.label ?? labelFromSource(args.source, args.accessToken),\n    provider: args.provider,\n    priority: args.priority,\n    source: args.source,\n    accessToken: args.accessToken,\n    lastStatus: \"ok\",\n    lastStatusAt: undefined,\n    lastErrorCode: undefined,\n    lastErrorResetAt: undefined,\n    requestCount: 0,\n  };\n}\n\n/**\n * Build a human-readable label from the credential source. Used for\n * `Theokit.credentialPool.list()` UX. NEVER includes the raw token.\n *\n * @internal\n */\nfunction labelFromSource(source: string, accessToken: string): string {\n  if (source.startsWith(\"env:\")) return source.slice(4);\n  const masked =\n    accessToken.length > 8 ? `${accessToken.slice(0, 4)}…${accessToken.slice(-4)}` : \"***\";\n  return `${source}:${masked}`;\n}\n\n/**\n * Per-provider credential pool. Construct with one or more entries\n * sorted by priority. Throws `ConfigurationError` on empty input.\n *\n * EC-C: identical `accessToken`s are deduplicated during construction\n * (3 copies of \"k1\" → 1 entry). Otherwise an exhaustion event would\n * mark \"k1\" exhausted 3× wastefully.\n *\n * @internal\n */\nexport class CredentialPool {\n  readonly provider: string;\n  private readonly strategy: CredentialPoolStrategy;\n  private entries: PooledCredential[];\n\n  constructor(\n    provider: string,\n    entries: PooledCredential[],\n    strategy: CredentialPoolStrategy = \"fill_first\",\n  ) {\n    if (entries.length === 0) {\n      throw new ConfigurationError(\n        `credential-pool: cannot construct empty pool for provider \"${provider}\"`,\n        { code: \"credential_pool_empty\" },\n      );\n    }\n    this.provider = provider;\n    this.strategy = strategy;\n    // EC-C: dedupe by accessToken before sort.\n    this.entries = dedupeByToken(entries).sort((a, b) => a.priority - b.priority);\n  }\n\n  /** True if the pool was seeded with at least one entry. */\n  hasCredentials(): boolean {\n    return this.entries.length > 0;\n  }\n\n  /** True iff at least one entry is healthy (auto-healed if cooldown expired). */\n  hasAvailable(): boolean {\n    return this.availableEntries().length > 0;\n  }\n\n  /**\n   * Earliest `lastErrorResetAt` across all entries, or `undefined` if no\n   * entry is in cooldown. Used by `waitForAvailable` to compute the\n   * upper bound of each jittered sleep window.\n   *\n   * @internal\n   */\n  earliestResetAt(): number | undefined {\n    let earliest: number | undefined;\n    for (const entry of this.entries) {\n      if (entry.lastStatus === \"ok\") continue;\n      if (entry.lastErrorResetAt === undefined) continue;\n      if (earliest === undefined || entry.lastErrorResetAt < earliest) {\n        earliest = entry.lastErrorResetAt;\n      }\n    }\n    return earliest;\n  }\n\n  /**\n   * Wait until at least one entry becomes healthy OR `maxWaitMs` elapses\n   * OR `signal` aborts. Returns `true` if a healthy entry is available\n   * when the call returns, `false` otherwise.\n   *\n   * T3.9 — Reconnect storm prevention. Concurrent callers each sleep a\n   * random fraction of the window to the earliest cooldown reset (full\n   * jitter — AWS Brooker 2015) so they do not all wake at the exact\n   * instant cooldown expires and hammer the upstream simultaneously.\n   *\n   * The `sleeper` parameter is a dependency-injection seam for tests:\n   * callers in production omit it and the default `setTimeout`-based\n   * sleeper is used. The seam avoids the `vi.useFakeTimers()` mismatch\n   * that blocked T3.4's wiring.\n   *\n   * @internal\n   */\n  async waitForAvailable(\n    signal: AbortSignal,\n    opts: {\n      maxWaitMs: number;\n      sleeper?: (ms: number, signal: AbortSignal) => Promise<void>;\n    },\n  ): Promise<boolean> {\n    if (signal.aborted) return false;\n    if (this.hasAvailable()) return true;\n    const sleeper = opts.sleeper ?? sleepWithAbort;\n    const deadline = Date.now() + opts.maxWaitMs;\n    while (Date.now() < deadline) {\n      if (signal.aborted) return false;\n      const jittered = this.computeJitteredSleepMs(deadline);\n      await sleeper(jittered, signal);\n      if (signal.aborted) return false;\n      if (this.hasAvailable()) return true;\n    }\n    return this.hasAvailable();\n  }\n\n  /**\n   * Compute the next jittered sleep window (ms) for `waitForAvailable`.\n   * Full-jitter cap: at most (a) time until the earliest reset (plus a\n   * 50 ms grace so the entry actually heals before re-probe), or (b) the\n   * remaining wait window, whichever is smaller. When no entry has a\n   * known reset (rare — only if `markExhaustedAndRotate` was called\n   * without `resetAtMs`), fall back to a 250 ms ceiling so we stay\n   * responsive without hot-looping.\n   */\n  private computeJitteredSleepMs(deadline: number): number {\n    const resetAt = this.earliestResetAt();\n    const remaining = deadline - Date.now();\n    const ceiling =\n      resetAt === undefined\n        ? Math.min(remaining, 250)\n        : Math.min(remaining, Math.max(0, resetAt - Date.now()) + 50);\n    return Math.max(0, Math.floor(Math.random() * ceiling));\n  }\n\n  /** Live (frozen) view of all entries. */\n  list(): readonly PooledCredential[] {\n    return this.entries;\n  }\n\n  /**\n   * Pick a healthy entry according to the configured strategy.\n   * Mutates `requestCount` and (for round_robin) entry order.\n   * Returns null if every entry is in cooldown.\n   *\n   * @internal\n   */\n  async select(): Promise<PooledCredential | null> {\n    return withCwdMutex(`credential-pool:${this.provider}`, async () => this.selectLocked());\n  }\n\n  /**\n   * Mark the entry whose id matches `entryId` as exhausted with the\n   * appropriate cooldown, then return the next healthy entry (or null).\n   * If `entryId` is undefined, marks all currently-active entries (rare —\n   * only used by admin reset scenarios).\n   *\n   * @internal\n   */\n  async markExhaustedAndRotate(args: {\n    entryId: string;\n    statusCode: number;\n    resetAtMs?: number;\n  }): Promise<PooledCredential | null> {\n    return withCwdMutex(`credential-pool:${this.provider}`, async () => {\n      const entry = this.entries.find((e) => e.id === args.entryId);\n      if (entry !== undefined) {\n        const now = Date.now();\n        const cooldown = COOLDOWN_MS[args.statusCode] ?? DEFAULT_COOLDOWN_MS;\n        entry.lastStatus = \"exhausted\";\n        entry.lastStatusAt = now;\n        entry.lastErrorCode = args.statusCode;\n        // EC-5: negative or stale resetAt → ignore, fall through to default.\n        entry.lastErrorResetAt =\n          args.resetAtMs !== undefined && args.resetAtMs > now ? args.resetAtMs : now + cooldown;\n      }\n      return this.selectLocked();\n    });\n  }\n\n  /** Admin escape hatch: clear all cooldowns. */\n  async resetAll(): Promise<void> {\n    await withCwdMutex(`credential-pool:${this.provider}`, async () => {\n      for (const e of this.entries) {\n        e.lastStatus = \"ok\";\n        e.lastStatusAt = undefined;\n        e.lastErrorCode = undefined;\n        e.lastErrorResetAt = undefined;\n      }\n    });\n  }\n\n  /** Materialize for persistence. */\n  toSnapshot(): CredentialPoolSnapshot {\n    return {\n      provider: this.provider,\n      strategy: this.strategy,\n      entries: this.entries.map((e) => ({ ...e })),\n    };\n  }\n\n  /** Hydrate from a previously-saved snapshot. */\n  static fromSnapshot(snapshot: CredentialPoolSnapshot): CredentialPool {\n    return new CredentialPool(snapshot.provider, snapshot.entries, snapshot.strategy);\n  }\n\n  // ─── Internal helpers (always called inside the mutex) ───\n\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: strategy dispatch must branch on 4 enum values (random/least_used/round_robin/fill_first) with 1-entry short-circuits per strategy. Each branch is 5-10 lines of focused logic; extracting per-strategy methods fragments the linear narrative.\n  private selectLocked(): PooledCredential | null {\n    const available = this.availableEntries();\n    if (available.length === 0) return null;\n\n    if (this.strategy === \"random\") {\n      const idx = Math.floor(Math.random() * available.length);\n      const picked = available[idx];\n      if (picked === undefined) return null; // unreachable; satisfies strict\n      picked.requestCount += 1;\n      return picked;\n    }\n\n    if (this.strategy === \"least_used\" && available.length > 1) {\n      // EC-3: tie-break by priority ascending (first wins).\n      const picked = [...available].sort(\n        (a, b) => a.requestCount - b.requestCount || a.priority - b.priority,\n      )[0];\n      if (picked === undefined) return null;\n      picked.requestCount += 1;\n      return picked;\n    }\n\n    if (this.strategy === \"round_robin\" && available.length > 1) {\n      // Pick head; move it to the end of `entries` so next call picks the next.\n      const picked = available[0];\n      if (picked === undefined) return null;\n      picked.requestCount += 1;\n      const rest = this.entries.filter((e) => e.id !== picked.id);\n      // Re-assign priorities: rotated entry gets the highest priority value\n      // so it sorts last after `fromSnapshot` rehydration. This makes EC-F\n      // (round-robin state survives save/load) work without a separate field.\n      const maxPriority = this.entries.length - 1;\n      rest.forEach((e, i) => {\n        e.priority = i;\n      });\n      picked.priority = maxPriority;\n      this.entries = [...rest, picked];\n      return picked;\n    }\n\n    // fill_first (default) and 1-entry edge case for round_robin/least_used\n    const picked = available[0];\n    if (picked === undefined) return null;\n    picked.requestCount += 1;\n    return picked;\n  }\n\n  private availableEntries(): PooledCredential[] {\n    const now = Date.now();\n    const out: PooledCredential[] = [];\n    for (const entry of this.entries) {\n      if (entry.lastStatus === \"ok\") {\n        out.push(entry);\n        continue;\n      }\n      // EC-1: auto-heal expired cooldowns inline.\n      const resetAt = entry.lastErrorResetAt;\n      if (resetAt !== undefined && now >= resetAt) {\n        entry.lastStatus = \"ok\";\n        entry.lastStatusAt = undefined;\n        entry.lastErrorCode = undefined;\n        entry.lastErrorResetAt = undefined;\n        out.push(entry);\n      }\n    }\n    return out;\n  }\n}\n\n/**\n * Drop duplicates by `accessToken`. Keeps the first occurrence (lowest\n * priority wins after sort). EC-C from the edge-case review.\n */\nfunction dedupeByToken(entries: PooledCredential[]): PooledCredential[] {\n  const seen = new Set<string>();\n  const out: PooledCredential[] = [];\n  for (const e of entries) {\n    if (seen.has(e.accessToken)) continue;\n    seen.add(e.accessToken);\n    out.push(e);\n  }\n  return out;\n}\n","/**\n * Per-fork credential-pool inheritance via `AsyncLocalStorage` (ADR D131).\n *\n * Mirrors the whitelist context pattern from D111\n * (`runtime/async-local-storage.ts`). Forked sub-agents inherit the\n * parent's pool *by reference* so concurrent rotations all observe\n * the same cooldown state — the desired behavior per Hermes parity.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nimport type { CredentialPool } from \"./credential-pool.js\";\n\n/** ALS slot — keyed by provider name → pool. */\nconst credentialPoolStore = new AsyncLocalStorage<Map<string, CredentialPool>>();\n\n/**\n * Run `fn` with `pools` as the active credential-pool registry for the\n * current async context. Nested calls shadow the outer map (parent\n * pools are not visible to children when the child sets its own).\n *\n * @internal\n */\nexport async function withCredentialPool<T>(\n  pools: Map<string, CredentialPool>,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return credentialPoolStore.run(pools, fn);\n}\n\n/**\n * Pool registered for `provider` in the current async context, or\n * `undefined` when no `withCredentialPool(...)` scope is active.\n *\n * @internal\n */\nexport function currentCredentialPool(provider: string): CredentialPool | undefined {\n  return credentialPoolStore.getStore()?.get(provider);\n}\n"]}

package/dist/chunk-6JSIEDKL.cjs

@@ -0,0 +1,121 @@
+'use strict';
+
+var module$1 = require('module');
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+// src/sanitize/coerce.ts
+var cachedJsonrepair;
+function loadJsonrepair() {
+  if (cachedJsonrepair === void 0) {
+    const req = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-6JSIEDKL.cjs', document.baseURI).href)));
+    cachedJsonrepair = req("jsonrepair").jsonrepair;
+  }
+  return cachedJsonrepair;
+}
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function toFiniteNumber(raw) {
+  if (raw === "") return void 0;
+  const n = Number(raw);
+  return Number.isFinite(n) && String(n) === raw ? n : void 0;
+}
+function tryJson(raw, repair) {
+  const t = raw.trimStart();
+  if (!(t.startsWith("{") || t.startsWith("["))) return void 0;
+  try {
+    return JSON.parse(repair ? loadJsonrepair()(t) : t);
+  } catch {
+    return void 0;
+  }
+}
+function heuristicCoerce(raw, repairJson) {
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  if (raw === "null") return null;
+  const n = toFiniteNumber(raw);
+  if (n !== void 0) return n;
+  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : void 0);
+  return json === void 0 ? raw : json;
+}
+function coerceCandidates(raw, repairJson) {
+  const out = [];
+  if (raw === "true") out.push(true);
+  else if (raw === "false") out.push(false);
+  else if (raw === "null") out.push(null);
+  const n = toFiniteNumber(raw);
+  if (n !== void 0) out.push(n);
+  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : void 0);
+  if (json !== void 0) out.push(json);
+  out.push(raw);
+  return out;
+}
+function objectShape(schema) {
+  const shape = schema?.shape;
+  return shape !== null && typeof shape === "object" ? shape : void 0;
+}
+
+// src/sanitize/sanitize-tool-input.ts
+function applyTrim(key, value, ctx) {
+  const trimmed = value.trim();
+  if (trimmed !== value) ctx.notes.push(`trimmed "${key}"`);
+  return trimmed;
+}
+function applyCoerce(key, raw, ctx) {
+  const field = ctx.shape?.[key];
+  let coerced = raw;
+  if (field) {
+    for (const candidate of coerceCandidates(raw, ctx.repairJson)) {
+      if (field.safeParse(candidate).success) {
+        coerced = candidate;
+        break;
+      }
+    }
+  } else {
+    coerced = heuristicCoerce(raw, ctx.repairJson);
+  }
+  if (coerced !== raw) ctx.notes.push(`coerced "${key}"`);
+  return coerced;
+}
+function applyRepair(key, value, ctx) {
+  const repaired = tryJson(value, true);
+  if (repaired === void 0) return value;
+  ctx.notes.push(`repaired json "${key}"`);
+  return repaired;
+}
+function sanitizeString(key, value, ctx) {
+  let out = ctx.trim ? applyTrim(key, value, ctx) : value;
+  if (ctx.coerce && typeof out === "string") out = applyCoerce(key, out, ctx);
+  if (ctx.repairJson && !ctx.coerce && typeof out === "string") out = applyRepair(key, out, ctx);
+  return out;
+}
+function walk(input, ctx, depth) {
+  const out = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (typeof value === "string") out[key] = sanitizeString(key, value, ctx);
+    else if (ctx.deep && depth < ctx.maxDepth && isPlainObject(value))
+      out[key] = walk(value, ctx, depth + 1);
+    else out[key] = value;
+  }
+  return out;
+}
+function sanitizeToolInput(input, options) {
+  if (!isPlainObject(input)) return { value: input, changed: false, notes: [] };
+  const ctx = {
+    trim: options?.trim ?? true,
+    coerce: options?.coerce ?? false,
+    repairJson: options?.repairJson ?? false,
+    deep: options?.deep ?? false,
+    maxDepth: options?.maxDepth ?? 8,
+    shape: objectShape(options?.schema),
+    notes: []
+  };
+  const value = walk(input, ctx, 0);
+  return { value, changed: ctx.notes.length > 0, notes: ctx.notes };
+}
+
+exports.isPlainObject = isPlainObject;
+exports.sanitizeToolInput = sanitizeToolInput;
+exports.tryJson = tryJson;
+//# sourceMappingURL=chunk-6JSIEDKL.cjs.map
+//# sourceMappingURL=chunk-6JSIEDKL.cjs.map

package/dist/chunk-6JSIEDKL.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sanitize/coerce.ts","../src/sanitize/sanitize-tool-input.ts"],"names":["createRequire"],"mappings":";;;;;;AAQA,IAAI,gBAAA;AACJ,SAAS,cAAA,GAA2C;AAClD,EAAA,IAAI,qBAAqB,MAAA,EAAW;AAClC,IAAA,MAAM,GAAA,GAAMA,sBAAA,CAAc,oQAAe,CAAA;AACzC,IAAA,gBAAA,GAAoB,GAAA,CAAI,YAAY,CAAA,CAA4C,UAAA;AAAA,EAClF;AACA,EAAA,OAAO,gBAAA;AACT;AAGO,SAAS,cAAc,CAAA,EAA0C;AACtE,EAAA,OAAO,CAAA,KAAM,QAAQ,OAAO,CAAA,KAAM,YAAY,CAAC,KAAA,CAAM,QAAQ,CAAC,CAAA;AAChE;AAIA,SAAS,eAAe,GAAA,EAAiC;AACvD,EAAA,IAAI,GAAA,KAAQ,IAAI,OAAO,MAAA;AACvB,EAAA,MAAM,CAAA,GAAI,OAAO,GAAG,CAAA;AACpB,EAAA,OAAO,MAAA,CAAO,SAAS,CAAC,CAAA,IAAK,OAAO,CAAC,CAAA,KAAM,MAAM,CAAA,GAAI,MAAA;AACvD;AAMO,SAAS,OAAA,CAAQ,KAAa,MAAA,EAA0B;AAC7D,EAAA,MAAM,CAAA,GAAI,IAAI,SAAA,EAAU;AACxB,EAAA,IAAI,EAAE,EAAE,UAAA,CAAW,GAAG,KAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,CAAA,EAAI,OAAO,MAAA;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,GAAS,gBAAe,CAAE,CAAC,IAAI,CAAC,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAKO,SAAS,eAAA,CAAgB,KAAa,UAAA,EAA8B;AACzE,EAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,IAAA;AAC3B,EAAA,IAAI,GAAA,KAAQ,SAAS,OAAO,KAAA;AAC5B,EAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,IAAA;AAC3B,EAAA,MAAM,CAAA,GAAI,eAAe,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,QAAW,OAAO,CAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,EAAK,KAAK,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA,GAAI,MAAA,CAAA;AACvE,EAAA,OAAO,IAAA,KAAS,SAAY,GAAA,GAAM,IAAA;AACpC;AAKO,SAAS,gBAAA,CAAiB,KAAa,UAAA,EAAgC;AAC5E,EAAA,MAAM,MAAiB,EAAC;AACxB,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,OAAA,IACxB,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,KAAK,CAAA;AAAA,OAAA,IAC/B,GAAA,KAAQ,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACtC,EAAA,MAAM,CAAA,GAAI,eAAe,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,EAAK,KAAK,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA,GAAI,MAAA,CAAA;AACvE,EAAA,IAAI,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACrC,EAAA,GAAA,CAAI,KAAK,GAAG,CAAA;AACZ,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,YAAY,MAAA,EAAkE;AAC5F,EAAA,MAAM,QAAS,MAAA,EAAuD,KAAA;AACtE,EAAA,OAAO,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,WACrC,KAAA,GACD,MAAA;AACN;;;AC5DA,SAAS,SAAA,CAAU,GAAA,EAAa,KAAA,EAAe,GAAA,EAAkB;AAC/D,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,YAAY,KAAA,EAAO,GAAA,CAAI,MAAM,IAAA,CAAK,CAAA,SAAA,EAAY,GAAG,CAAA,CAAA,CAAG,CAAA;AACxD,EAAA,OAAO,OAAA;AACT;AAIA,SAAS,WAAA,CAAY,GAAA,EAAa,GAAA,EAAa,GAAA,EAAmB;AAChE,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,GAAQ,GAAG,CAAA;AAC7B,EAAA,IAAI,OAAA,GAAmB,GAAA;AACvB,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,KAAA,MAAW,SAAA,IAAa,gBAAA,CAAiB,GAAA,EAAK,GAAA,CAAI,UAAU,CAAA,EAAG;AAC7D,MAAA,IAAI,KAAA,CAAM,SAAA,CAAU,SAAS,CAAA,CAAE,OAAA,EAAS;AACtC,QAAA,OAAA,GAAU,SAAA;AACV,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,GAAU,eAAA,CAAgB,GAAA,EAAK,GAAA,CAAI,UAAU,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,YAAY,GAAA,EAAK,GAAA,CAAI,MAAM,IAAA,CAAK,CAAA,SAAA,EAAY,GAAG,CAAA,CAAA,CAAG,CAAA;AACtD,EAAA,OAAO,OAAA;AACT;AAGA,SAAS,WAAA,CAAY,GAAA,EAAa,KAAA,EAAe,GAAA,EAAmB;AAClE,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AACpC,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,KAAA;AACnC,EAAA,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,CAAA,CAAG,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,cAAA,CAAe,GAAA,EAAa,KAAA,EAAe,GAAA,EAAmB;AACrE,EAAA,IAAI,MAAe,GAAA,CAAI,IAAA,GAAO,UAAU,GAAA,EAAK,KAAA,EAAO,GAAG,CAAA,GAAI,KAAA;AAC3D,EAAA,IAAI,GAAA,CAAI,UAAU,OAAO,GAAA,KAAQ,UAAU,GAAA,GAAM,WAAA,CAAY,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAI1E,EAAA,IAAI,GAAA,CAAI,UAAA,IAAc,CAAC,GAAA,CAAI,MAAA,IAAU,OAAO,GAAA,KAAQ,QAAA,EAAU,GAAA,GAAM,WAAA,CAAY,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,IAAA,CAAK,KAAA,EAAgC,GAAA,EAAU,KAAA,EAAwC;AAC9F,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU,GAAA,CAAI,GAAG,CAAA,GAAI,cAAA,CAAe,GAAA,EAAK,KAAA,EAAO,GAAG,CAAA;AAAA,SAAA,IAC/D,IAAI,IAAA,IAAQ,KAAA,GAAQ,GAAA,CAAI,QAAA,IAAY,cAAc,KAAK,CAAA;AAC9D,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,QAAQ,CAAC,CAAA;AAAA,SAClC,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,EAClB;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,iBAAA,CACd,OACA,OAAA,EACgB;AAEhB,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,EAAC,EAAE;AAC5E,EAAA,MAAM,GAAA,GAAW;AAAA,IACf,IAAA,EAAM,SAAS,IAAA,IAAQ,IAAA;AAAA,IACvB,MAAA,EAAQ,SAAS,MAAA,IAAU,KAAA;AAAA,IAC3B,UAAA,EAAY,SAAS,UAAA,IAAc,KAAA;AAAA,IACnC,IAAA,EAAM,SAAS,IAAA,IAAQ,KAAA;AAAA,IACvB,QAAA,EAAU,SAAS,QAAA,IAAY,CAAA;AAAA,IAC/B,KAAA,EAAO,WAAA,CAAY,OAAA,EAAS,MAAM,CAAA;AAAA,IAClC,OAAO;AAAC,GACV;AACA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,CAAC,CAAA;AAChC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAS,GAAA,CAAI,MAAM,MAAA,GAAS,CAAA,EAAG,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM;AAClE","file":"chunk-6JSIEDKL.cjs","sourcesContent":["import { createRequire } from \"node:module\";\n\nimport type { ZodType } from \"zod\";\n\n// `jsonrepair` is loaded lazily — consumers who never set `repairJson: true` never pay its\n// module-parse cost. Unlike `zod` (an optional peer dep), `jsonrepair` is a direct dependency and\n// is always installed; the lazy load is a startup-cost optimization, not an optional-install story.\n// Cached after the first repair.\nlet cachedJsonrepair: ((text: string) => string) | undefined;\nfunction loadJsonrepair(): (text: string) => string {\n  if (cachedJsonrepair === undefined) {\n    const req = createRequire(import.meta.url);\n    cachedJsonrepair = (req(\"jsonrepair\") as { jsonrepair: (t: string) => string }).jsonrepair;\n  }\n  return cachedJsonrepair;\n}\n\n/** @internal */\nexport function isPlainObject(v: unknown): v is Record<string, unknown> {\n  return v !== null && typeof v === \"object\" && !Array.isArray(v);\n}\n\n/** Number coercion with a round-trip + finite guard: rejects big-ints, leading-zeros, `NaN`,\n *  `Infinity`, and non-canonical forms (`\"1e3\"`), preventing silent ID/precision corruption (EC-2). */\nfunction toFiniteNumber(raw: string): number | undefined {\n  if (raw === \"\") return undefined;\n  const n = Number(raw);\n  return Number.isFinite(n) && String(n) === raw ? n : undefined;\n}\n\n/** Parse a value ONLY when it looks like a JSON object/array (EC-3 guard; leading whitespace\n *  ignored so `trim:false` inputs are still gated correctly). `repair` routes it through\n *  `jsonrepair` first. Returns `undefined` when not JSON-looking or on parse failure.\n *  @internal */\nexport function tryJson(raw: string, repair: boolean): unknown {\n  const t = raw.trimStart();\n  if (!(t.startsWith(\"{\") || t.startsWith(\"[\"))) return undefined;\n  try {\n    return JSON.parse(repair ? loadJsonrepair()(t) : t);\n  } catch {\n    return undefined;\n  }\n}\n\n/** Heuristic scalar/JSON coercion (agentfw `coerceParameter` shape) used when there is no\n *  per-field schema. Returns the coerced value, or the raw string when nothing applies.\n *  @internal */\nexport function heuristicCoerce(raw: string, repairJson: boolean): unknown {\n  if (raw === \"true\") return true;\n  if (raw === \"false\") return false;\n  if (raw === \"null\") return null;\n  const n = toFiniteNumber(raw);\n  if (n !== undefined) return n;\n  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : undefined);\n  return json === undefined ? raw : json;\n}\n\n/** Candidates a raw string could coerce to, most-specific first. Used for schema-aware coercion:\n *  the field schema selects the first candidate it accepts (so a string field keeps `\"5\"`).\n *  @internal */\nexport function coerceCandidates(raw: string, repairJson: boolean): unknown[] {\n  const out: unknown[] = [];\n  if (raw === \"true\") out.push(true);\n  else if (raw === \"false\") out.push(false);\n  else if (raw === \"null\") out.push(null);\n  const n = toFiniteNumber(raw);\n  if (n !== undefined) out.push(n);\n  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : undefined);\n  if (json !== undefined) out.push(json);\n  out.push(raw); // raw string is always the last-resort candidate\n  return out;\n}\n\n/** True for a Zod schema that exposes a per-key `.shape` (a `z.object`, incl. Zod-v4\n *  `.refine()`/`.default()` which keep `.shape`); non-object schemas (union/record) return\n *  `undefined` so callers fall back to heuristic coercion (EC-4).\n *  @internal */\nexport function objectShape(schema: ZodType | undefined): Record<string, ZodType> | undefined {\n  const shape = (schema as unknown as { shape?: unknown } | undefined)?.shape;\n  return shape !== null && typeof shape === \"object\"\n    ? (shape as Record<string, ZodType>)\n    : undefined;\n}\n","import type { ZodType } from \"zod\";\n\nimport {\n  coerceCandidates,\n  heuristicCoerce,\n  isPlainObject,\n  objectShape,\n  tryJson,\n} from \"./coerce.js\";\nimport type { SanitizeOptions, SanitizeResult } from \"./types.js\";\n\ninterface Ctx {\n  trim: boolean;\n  coerce: boolean;\n  repairJson: boolean;\n  deep: boolean;\n  maxDepth: number;\n  shape: Record<string, ZodType> | undefined;\n  notes: string[];\n}\n\n/** Trim rung — returns the trimmed string, noting the change. */\nfunction applyTrim(key: string, value: string, ctx: Ctx): string {\n  const trimmed = value.trim();\n  if (trimmed !== value) ctx.notes.push(`trimmed \"${key}\"`);\n  return trimmed;\n}\n\n/** Coerce rung — schema-aware when a field schema exists (pick the first accepted candidate),\n *  else heuristic. Returns the coerced value (or the raw string), noting the change. */\nfunction applyCoerce(key: string, raw: string, ctx: Ctx): unknown {\n  const field = ctx.shape?.[key];\n  let coerced: unknown = raw;\n  if (field) {\n    for (const candidate of coerceCandidates(raw, ctx.repairJson)) {\n      if (field.safeParse(candidate).success) {\n        coerced = candidate;\n        break;\n      }\n    }\n  } else {\n    coerced = heuristicCoerce(raw, ctx.repairJson);\n  }\n  if (coerced !== raw) ctx.notes.push(`coerced \"${key}\"`);\n  return coerced;\n}\n\n/** Repair rung — repair-then-parse a JSON-looking string, noting the change. */\nfunction applyRepair(key: string, value: string, ctx: Ctx): unknown {\n  const repaired = tryJson(value, true);\n  if (repaired === undefined) return value;\n  ctx.notes.push(`repaired json \"${key}\"`);\n  return repaired;\n}\n\n/** Sanitize one string value through the enabled rungs (trim → coerce → repair). */\nfunction sanitizeString(key: string, value: string, ctx: Ctx): unknown {\n  let out: unknown = ctx.trim ? applyTrim(key, value, ctx) : value;\n  if (ctx.coerce && typeof out === \"string\") out = applyCoerce(key, out, ctx);\n  // Standalone repair runs ONLY when coerce is off. When coerce is on it already embedded the\n  // repair candidate (via coerceCandidates / heuristicCoerce), and a schema-confirmed raw string\n  // (e.g. a JSON string a `z.string()` field accepted) must not be clobbered back into an object.\n  if (ctx.repairJson && !ctx.coerce && typeof out === \"string\") out = applyRepair(key, out, ctx);\n  return out;\n}\n\nfunction walk(input: Record<string, unknown>, ctx: Ctx, depth: number): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input)) {\n    if (typeof value === \"string\") out[key] = sanitizeString(key, value, ctx);\n    else if (ctx.deep && depth < ctx.maxDepth && isPlainObject(value))\n      out[key] = walk(value, ctx, depth + 1);\n    else out[key] = value;\n  }\n  return out;\n}\n\n/**\n * Sanitize the raw arguments a model emitted for a tool call — trim (default), optionally coerce\n * string values toward their expected type, optionally repair malformed JSON. Pure, synchronous,\n * and TOTAL: it never throws (non-object input is returned unchanged) and never changes a value's\n * meaning — only its hygiene/representation. Reused internally by the leaked-dialect recovery so\n * the public primitive and the internal path never diverge.\n *\n * @public\n */\nexport function sanitizeToolInput(\n  input: Record<string, unknown>,\n  options?: SanitizeOptions,\n): SanitizeResult {\n  // EC-1 — total contract: a non-object (null / array / primitive) is returned as-is, never thrown on.\n  if (!isPlainObject(input)) return { value: input, changed: false, notes: [] };\n  const ctx: Ctx = {\n    trim: options?.trim ?? true,\n    coerce: options?.coerce ?? false,\n    repairJson: options?.repairJson ?? false,\n    deep: options?.deep ?? false,\n    maxDepth: options?.maxDepth ?? 8,\n    shape: objectShape(options?.schema),\n    notes: [],\n  };\n  const value = walk(input, ctx, 0);\n  return { value, changed: ctx.notes.length > 0, notes: ctx.notes };\n}\n"]}

package/dist/chunk-6M4ODB2V.cjs

@@ -0,0 +1,145 @@
+'use strict';
+
+var chunkEPYZOCOL_cjs = require('./chunk-EPYZOCOL.cjs');
+
+// src/generate-object.ts
+var GenerateObjectError = class extends Error {
+  name = "GenerateObjectError";
+  code;
+  cause;
+  constructor(code, message, cause) {
+    super(message);
+    this.code = code;
+    if (cause !== void 0) this.cause = cause;
+  }
+};
+function salvagePartial(schema, raw) {
+  if (typeof raw !== "object" || raw === null) return raw;
+  const shape = schema.shape;
+  if (shape === void 0 || typeof shape !== "object") return raw;
+  const rawObj = raw;
+  const out = {};
+  for (const [key, fieldSchema] of Object.entries(shape)) {
+    if (typeof fieldSchema?.safeParse !== "function") continue;
+    const parsed = fieldSchema.safeParse(rawObj[key]);
+    if (parsed.success) out[key] = parsed.data;
+  }
+  return out;
+}
+async function runReasoningPhase(options, deps) {
+  const reasoningOptions = {
+    model: options.model,
+    local: options.local,
+    ...options.systemPrompt !== void 0 ? { systemPrompt: options.systemPrompt } : {},
+    ...options.apiKey !== void 0 ? { apiKey: options.apiKey } : {},
+    ...options.providers !== void 0 ? { providers: options.providers } : {}
+  };
+  const reasoningAgent = await deps.create(reasoningOptions);
+  try {
+    const run = await reasoningAgent.send(options.prompt);
+    const result = await run.wait();
+    const text = result.result;
+    return typeof text === "string" ? text : options.prompt;
+  } finally {
+    await chunkEPYZOCOL_cjs.disposeAndDeleteTransient(reasoningAgent, deps.delete);
+  }
+}
+async function generateObjectImpl(options, deps) {
+  const { jsonSchema, maxRetries, initialUsage } = chunkEPYZOCOL_cjs.setupStructuredOutput(
+    options.schema,
+    options.maxRetries
+  );
+  let capturedRaw;
+  let lastUsage = initialUsage;
+  const sentinel = /* @__PURE__ */ Symbol("generate-object-sentinel");
+  class CaptureSentinel extends Error {
+    constructor(captured) {
+      super("generate-object-capture");
+      this.captured = captured;
+    }
+    captured;
+    [sentinel] = true;
+  }
+  const outputTool = chunkEPYZOCOL_cjs.makeOutputTool(jsonSchema, (input) => {
+    if (capturedRaw === void 0) {
+      capturedRaw = input;
+    }
+    throw new CaptureSentinel(input);
+  });
+  const reasoningText = options.structuringModel !== void 0 ? await runReasoningPhase(options, deps) : void 0;
+  const structuringModel = options.structuringModel ?? options.model;
+  const structuringPrompt = reasoningText ?? options.prompt;
+  const agentOptions = chunkEPYZOCOL_cjs.buildTransientAgentOptions({
+    model: structuringModel,
+    local: options.local,
+    outputTool,
+    ...options.systemPrompt !== void 0 ? { systemPrompt: options.systemPrompt } : {},
+    ...options.apiKey !== void 0 ? { apiKey: options.apiKey } : {},
+    ...options.providers !== void 0 ? { providers: options.providers } : {}
+  });
+  const agent = await deps.create(agentOptions);
+  try {
+    const userMessage = chunkEPYZOCOL_cjs.buildToolPrompt(structuringPrompt);
+    let lastParseError;
+    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+      capturedRaw = void 0;
+      const run = await agent.send(userMessage);
+      const result = await run.wait();
+      lastUsage = chunkEPYZOCOL_cjs.extractUsage(result);
+      if (capturedRaw === void 0) {
+        if (result.status === "error" && result.error !== void 0) {
+          throw new GenerateObjectError(
+            "no_tool_call",
+            `Agent run failed before the model could reply: ${result.error.message ?? "unknown error"} [${result.error.code ?? "?"}]`,
+            result.error
+          );
+        }
+        if (attempt === maxRetries) {
+          throw new GenerateObjectError(
+            "no_tool_call",
+            "The model returned text instead of calling the `output` tool."
+          );
+        }
+        continue;
+      }
+      const parsed = options.schema.safeParse(capturedRaw);
+      if (parsed.success) {
+        return {
+          object: parsed.data,
+          raw: capturedRaw,
+          usage: lastUsage,
+          finishReason: "tool_use"
+        };
+      }
+      lastParseError = parsed.error;
+    }
+    if (options.errorStrategy === "return-raw") {
+      return {
+        object: capturedRaw,
+        raw: capturedRaw,
+        usage: lastUsage,
+        finishReason: "tool_use"
+      };
+    }
+    if (options.errorStrategy === "return-partial") {
+      return {
+        object: salvagePartial(options.schema, capturedRaw),
+        raw: capturedRaw,
+        usage: lastUsage,
+        finishReason: "tool_use"
+      };
+    }
+    throw new GenerateObjectError(
+      "parse_failed",
+      "Schema parse failed after all retries.",
+      lastParseError
+    );
+  } finally {
+    await chunkEPYZOCOL_cjs.disposeAndDeleteTransient(agent, deps.delete);
+  }
+}
+
+exports.GenerateObjectError = GenerateObjectError;
+exports.generateObjectImpl = generateObjectImpl;
+//# sourceMappingURL=chunk-6M4ODB2V.cjs.map
+//# sourceMappingURL=chunk-6M4ODB2V.cjs.map