@theokit/sdk 4.42.0 → 4.43.0

package/dist/context/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunk22EMHGBO_cjs = require('../chunk-22EMHGBO.cjs');
-var chunkYPEPCZHF_cjs = require('../chunk-YPEPCZHF.cjs');
+var chunkUU7MAO2D_cjs = require('../chunk-UU7MAO2D.cjs');
+var chunkL5YO6PWL_cjs = require('../chunk-L5YO6PWL.cjs');
 
 // src/context/index.ts
 function resolveContextImports(content, basePath, options) {
@@ -11,24 +11,24 @@ function resolveContextImports(content, basePath, options) {
     maxBytesPerFile: options.maxBytesPerFile,
     projectRoot: options.projectRoot
   };
-  return chunk22EMHGBO_cjs.resolveImports(content, basePath, internalOptions);
+  return chunkUU7MAO2D_cjs.resolveImports(content, basePath, internalOptions);
 }
 
 Object.defineProperty(exports, "parseRules", {
   enumerable: true,
-  get: function () { return chunk22EMHGBO_cjs.parseRules; }
+  get: function () { return chunkUU7MAO2D_cjs.parseRules; }
 });
 Object.defineProperty(exports, "runDiscovery", {
   enumerable: true,
-  get: function () { return chunk22EMHGBO_cjs.runDiscovery; }
+  get: function () { return chunkUU7MAO2D_cjs.runDiscovery; }
 });
 Object.defineProperty(exports, "shouldActivateRule", {
   enumerable: true,
-  get: function () { return chunk22EMHGBO_cjs.shouldActivateRule; }
+  get: function () { return chunkUU7MAO2D_cjs.shouldActivateRule; }
 });
 Object.defineProperty(exports, "DEFAULT_DISCOVERY_SPECS", {
   enumerable: true,
-  get: function () { return chunkYPEPCZHF_cjs.DEFAULT_DISCOVERY_SPECS; }
+  get: function () { return chunkL5YO6PWL_cjs.DEFAULT_DISCOVERY_SPECS; }
 });
 exports.resolveContextImports = resolveContextImports;
 //# sourceMappingURL=index.cjs.map

package/dist/context/index.js

@@ -1,6 +1,6 @@
-import { resolveImports } from '../chunk-Q2PPSHBS.js';
-export { parseRules, runDiscovery, shouldActivateRule } from '../chunk-Q2PPSHBS.js';
-export { DEFAULT_DISCOVERY_SPECS } from '../chunk-UJ7IQJAG.js';
+import { resolveImports } from '../chunk-3NLOQEJR.js';
+export { parseRules, runDiscovery, shouldActivateRule } from '../chunk-3NLOQEJR.js';
+export { DEFAULT_DISCOVERY_SPECS } from '../chunk-4NAKHID5.js';
 
 // src/context/index.ts
 function resolveContextImports(content, basePath, options) {

package/dist/cron.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkEYEZDADP_cjs = require('./chunk-EYEZDADP.cjs');
-require('./chunk-YHQ3DG24.cjs');
+var chunk74VVGK7P_cjs = require('./chunk-74VVGK7P.cjs');
+require('./chunk-TSK4VVBW.cjs');
 require('./chunk-FAUKVJCC.cjs');
 require('./chunk-BV2MWEMV.cjs');
 require('./chunk-KCQUYQ3V.cjs');
@@ -14,7 +14,7 @@ require('./chunk-FZ4YMZA3.cjs');
 require('./chunk-GH52NOCL.cjs');
 require('./chunk-HECR7KF5.cjs');
 require('./chunk-BBZYXVLZ.cjs');
-require('./chunk-22EMHGBO.cjs');
+require('./chunk-UU7MAO2D.cjs');
 require('./chunk-6X2HUT4A.cjs');
 require('./chunk-7PESI6YD.cjs');
 require('./chunk-S4Q5OMIK.cjs');
@@ -23,7 +23,7 @@ require('./chunk-MUUQ2WFJ.cjs');
 require('./chunk-6JSIEDKL.cjs');
 require('./chunk-B4YA6BRS.cjs');
 require('./chunk-NINIJCHU.cjs');
-require('./chunk-YPEPCZHF.cjs');
+require('./chunk-L5YO6PWL.cjs');
 require('./chunk-VJ26EKGJ.cjs');
 require('./chunk-OEFFPR2S.cjs');
 require('./chunk-27DYRARU.cjs');
@@ -51,7 +51,7 @@ require('./chunk-ZHPET3LZ.cjs');
 
 Object.defineProperty(exports, "Cron", {
   enumerable: true,
-  get: function () { return chunkEYEZDADP_cjs.Cron; }
+  get: function () { return chunk74VVGK7P_cjs.Cron; }
 });
 //# sourceMappingURL=cron.cjs.map
 //# sourceMappingURL=cron.cjs.map

package/dist/cron.js

@@ -1,5 +1,5 @@
-export { Cron } from './chunk-MPD5EGJ6.js';
-import './chunk-KO5V6L3E.js';
+export { Cron } from './chunk-MZQHVN7C.js';
+import './chunk-XARLSCKA.js';
 import './chunk-UJ7HK7BX.js';
 import './chunk-2SFBB54R.js';
 import './chunk-GNMPCZNN.js';
@@ -12,7 +12,7 @@ import './chunk-ZTEAJAE6.js';
 import './chunk-RJBHWM6D.js';
 import './chunk-J5RW43IR.js';
 import './chunk-AM2CNBKE.js';
-import './chunk-Q2PPSHBS.js';
+import './chunk-3NLOQEJR.js';
 import './chunk-ZS6SLELQ.js';
 import './chunk-LLE7HPRI.js';
 import './chunk-SNKY3C2L.js';
@@ -21,7 +21,7 @@ import './chunk-FD2UT76F.js';
 import './chunk-U54XCYG3.js';
 import './chunk-RP5HQVLD.js';
 import './chunk-6X6ID4MO.js';
-import './chunk-UJ7IQJAG.js';
+import './chunk-4NAKHID5.js';
 import './chunk-7AD3ZTZL.js';
 import './chunk-AZ6FKDQR.js';
 import './chunk-Q4DTGCSD.js';

package/dist/eval.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
 var chunkR3CKCRK3_cjs = require('./chunk-R3CKCRK3.cjs');
-var chunkYHQ3DG24_cjs = require('./chunk-YHQ3DG24.cjs');
+var chunkTSK4VVBW_cjs = require('./chunk-TSK4VVBW.cjs');
 require('./chunk-FAUKVJCC.cjs');
 require('./chunk-BV2MWEMV.cjs');
 require('./chunk-KCQUYQ3V.cjs');
@@ -14,7 +14,7 @@ require('./chunk-FZ4YMZA3.cjs');
 require('./chunk-GH52NOCL.cjs');
 require('./chunk-HECR7KF5.cjs');
 require('./chunk-BBZYXVLZ.cjs');
-require('./chunk-22EMHGBO.cjs');
+require('./chunk-UU7MAO2D.cjs');
 require('./chunk-6X2HUT4A.cjs');
 require('./chunk-7PESI6YD.cjs');
 require('./chunk-S4Q5OMIK.cjs');
@@ -23,7 +23,7 @@ require('./chunk-MUUQ2WFJ.cjs');
 require('./chunk-6JSIEDKL.cjs');
 require('./chunk-B4YA6BRS.cjs');
 var chunkNINIJCHU_cjs = require('./chunk-NINIJCHU.cjs');
-require('./chunk-YPEPCZHF.cjs');
+require('./chunk-L5YO6PWL.cjs');
 require('./chunk-VJ26EKGJ.cjs');
 require('./chunk-OEFFPR2S.cjs');
 require('./chunk-27DYRARU.cjs');
@@ -774,7 +774,7 @@ function makeDefaultEmbedder(opts) {
   let runtime;
   return (texts) => {
     if (runtime === void 0) {
-      runtime = chunkYHQ3DG24_cjs.openRouterMemoryEmbeddingProviderAdapter.create(embedderCreateOptions(opts));
+      runtime = chunkTSK4VVBW_cjs.openRouterMemoryEmbeddingProviderAdapter.create(embedderCreateOptions(opts));
     }
     return runtime.then((rt) => rt.embed(texts));
   };

package/dist/eval.js

@@ -1,5 +1,5 @@
 import { shellEscapePosix, LocalSandbox } from './chunk-DEZ75ET5.js';
-import { openRouterMemoryEmbeddingProviderAdapter } from './chunk-KO5V6L3E.js';
+import { openRouterMemoryEmbeddingProviderAdapter } from './chunk-XARLSCKA.js';
 import './chunk-UJ7HK7BX.js';
 import './chunk-2SFBB54R.js';
 import './chunk-GNMPCZNN.js';
@@ -12,7 +12,7 @@ import './chunk-ZTEAJAE6.js';
 import './chunk-RJBHWM6D.js';
 import './chunk-J5RW43IR.js';
 import './chunk-AM2CNBKE.js';
-import './chunk-Q2PPSHBS.js';
+import './chunk-3NLOQEJR.js';
 import './chunk-ZS6SLELQ.js';
 import './chunk-LLE7HPRI.js';
 import './chunk-SNKY3C2L.js';
@@ -21,7 +21,7 @@ import './chunk-FD2UT76F.js';
 import './chunk-U54XCYG3.js';
 import './chunk-RP5HQVLD.js';
 import { getAgentFacade } from './chunk-6X6ID4MO.js';
-import './chunk-UJ7IQJAG.js';
+import './chunk-4NAKHID5.js';
 import './chunk-7AD3ZTZL.js';
 import './chunk-AZ6FKDQR.js';
 import './chunk-Q4DTGCSD.js';

package/dist/index.cjs

@@ -8,8 +8,8 @@ require('./chunk-WIGJGFH4.cjs');
 var chunkJO76RWCA_cjs = require('./chunk-JO76RWCA.cjs');
 require('./chunk-RBQYHEZD.cjs');
 require('./chunk-PNVDQL5Y.cjs');
-var chunkEYEZDADP_cjs = require('./chunk-EYEZDADP.cjs');
-var chunkYHQ3DG24_cjs = require('./chunk-YHQ3DG24.cjs');
+var chunk74VVGK7P_cjs = require('./chunk-74VVGK7P.cjs');
+var chunkTSK4VVBW_cjs = require('./chunk-TSK4VVBW.cjs');
 require('./chunk-FAUKVJCC.cjs');
 require('./chunk-BV2MWEMV.cjs');
 var chunkKCQUYQ3V_cjs = require('./chunk-KCQUYQ3V.cjs');
@@ -22,7 +22,7 @@ require('./chunk-FZ4YMZA3.cjs');
 var chunkGH52NOCL_cjs = require('./chunk-GH52NOCL.cjs');
 require('./chunk-HECR7KF5.cjs');
 require('./chunk-BBZYXVLZ.cjs');
-require('./chunk-22EMHGBO.cjs');
+require('./chunk-UU7MAO2D.cjs');
 require('./chunk-6X2HUT4A.cjs');
 require('./chunk-7PESI6YD.cjs');
 require('./chunk-S4Q5OMIK.cjs');
@@ -31,7 +31,7 @@ require('./chunk-MUUQ2WFJ.cjs');
 require('./chunk-6JSIEDKL.cjs');
 require('./chunk-B4YA6BRS.cjs');
 require('./chunk-NINIJCHU.cjs');
-require('./chunk-YPEPCZHF.cjs');
+require('./chunk-L5YO6PWL.cjs');
 require('./chunk-VJ26EKGJ.cjs');
 require('./chunk-OEFFPR2S.cjs');
 require('./chunk-27DYRARU.cjs');
@@ -63,8 +63,8 @@ var fs = require('fs');
 // src/agent-factory.ts
 function createAgentFactory(common) {
   return {
-    forSession: (agentId, overrides) => chunkYHQ3DG24_cjs.Agent.create(mergeAgentOptions(common, overrides, agentId)),
-    getOrCreate: (agentId, overrides) => chunkYHQ3DG24_cjs.Agent.getOrCreate(agentId, mergeAgentOptions(common, overrides, agentId))
+    forSession: (agentId, overrides) => chunkTSK4VVBW_cjs.Agent.create(mergeAgentOptions(common, overrides, agentId)),
+    getOrCreate: (agentId, overrides) => chunkTSK4VVBW_cjs.Agent.getOrCreate(agentId, mergeAgentOptions(common, overrides, agentId))
   };
 }
 function mergeAgentOptions(common, overrides, agentId) {
@@ -1168,7 +1168,7 @@ var Memory = {
       return await peer.IndexManager.open(openArgs);
     }
     const { IndexManager } = await import('./index-manager-YFFEPISE.cjs');
-    openArgs.embedding = await resolveEmbedding(opts.embedding, chunkYHQ3DG24_cjs.MEMORY_EMBEDDING_ADAPTERS);
+    openArgs.embedding = await resolveEmbedding(opts.embedding, chunkTSK4VVBW_cjs.MEMORY_EMBEDDING_ADAPTERS);
     return await IndexManager.open(openArgs);
   },
   /**
@@ -1179,7 +1179,7 @@ var Memory = {
    */
   async runDreamingSweep(opts) {
     const peer = await tryLoadSdkMemoryPeer();
-    const catalog = peer !== null ? peer.MEMORY_EMBEDDING_ADAPTERS : chunkYHQ3DG24_cjs.MEMORY_EMBEDDING_ADAPTERS;
+    const catalog = peer !== null ? peer.MEMORY_EMBEDDING_ADAPTERS : chunkTSK4VVBW_cjs.MEMORY_EMBEDDING_ADAPTERS;
     const sweepArgs = await buildDreamingSweepArgs(opts, catalog);
     const result = peer !== null ? (
       // biome-ignore lint/suspicious/noExplicitAny: peer is dynamically loaded — structural compat ensured by sdk-memory
@@ -1601,7 +1601,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-HGDXQEQQ.cjs');
+  const { Agent: Agent2 } = await import('./agent-JA4ILE5O.cjs');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create
@@ -1743,7 +1743,7 @@ var FIXTURE_USER = {
 };
 var FIXTURE_MODELS = [
   {
-    id: chunkYHQ3DG24_cjs.DEFAULT_AGENTIC_MODEL_ID,
+    id: chunkTSK4VVBW_cjs.DEFAULT_AGENTIC_MODEL_ID,
     name: "Gemini 2.0 Flash",
     displayName: "Gemini 2.0 Flash",
     parameters: [
@@ -1946,7 +1946,7 @@ var Theokit = class {
         envVars: p.envVars
       }));
     },
-    embeddingAdapters: () => Object.entries(chunkYHQ3DG24_cjs.MEMORY_EMBEDDING_ADAPTERS).map(([id, adapter]) => ({
+    embeddingAdapters: () => Object.entries(chunkTSK4VVBW_cjs.MEMORY_EMBEDDING_ADAPTERS).map(([id, adapter]) => ({
       id,
       transport: adapter.transport,
       defaultModel: adapter.defaultModel
@@ -1978,7 +1978,7 @@ function resolveLocalProviderBaseUrl(providerName, fallback) {
   return fallback;
 }
 async function executeCatalogRequest(request) {
-  const apiKey = chunkYHQ3DG24_cjs.resolveApiKey(request.apiKey);
+  const apiKey = chunkTSK4VVBW_cjs.resolveApiKey(request.apiKey);
   if (apiKey === void 0) {
     throw new chunkYULF6FPB_cjs.AuthenticationError("Missing API key", { code: "missing_api_key" });
   }
@@ -2104,35 +2104,35 @@ Object.defineProperty(exports, "GenerateObjectError", {
 });
 Object.defineProperty(exports, "Cron", {
   enumerable: true,
-  get: function () { return chunkEYEZDADP_cjs.Cron; }
+  get: function () { return chunk74VVGK7P_cjs.Cron; }
 });
 Object.defineProperty(exports, "Agent", {
   enumerable: true,
-  get: function () { return chunkYHQ3DG24_cjs.Agent; }
+  get: function () { return chunkTSK4VVBW_cjs.Agent; }
 });
 Object.defineProperty(exports, "AgentBuilder", {
   enumerable: true,
-  get: function () { return chunkYHQ3DG24_cjs.AgentBuilder; }
+  get: function () { return chunkTSK4VVBW_cjs.AgentBuilder; }
 });
 Object.defineProperty(exports, "Tool", {
   enumerable: true,
-  get: function () { return chunkYHQ3DG24_cjs.Tool; }
+  get: function () { return chunkTSK4VVBW_cjs.Tool; }
 });
 Object.defineProperty(exports, "ToolError", {
   enumerable: true,
-  get: function () { return chunkYHQ3DG24_cjs.ToolError; }
+  get: function () { return chunkTSK4VVBW_cjs.ToolError; }
 });
 Object.defineProperty(exports, "UsageAccumulator", {
   enumerable: true,
-  get: function () { return chunkYHQ3DG24_cjs.UsageAccumulator; }
+  get: function () { return chunkTSK4VVBW_cjs.UsageAccumulator; }
 });
 Object.defineProperty(exports, "computeCost", {
   enumerable: true,
-  get: function () { return chunkYHQ3DG24_cjs.computeCost; }
+  get: function () { return chunkTSK4VVBW_cjs.computeCost; }
 });
 Object.defineProperty(exports, "getPricingEntry", {
   enumerable: true,
-  get: function () { return chunkYHQ3DG24_cjs.getPricingEntry; }
+  get: function () { return chunkTSK4VVBW_cjs.getPricingEntry; }
 });
 Object.defineProperty(exports, "emitRunEvent", {
   enumerable: true,

package/dist/index.js

@@ -6,9 +6,9 @@ import './chunk-O3IZ7JEL.js';
 import { Workflow, agentStep } from './chunk-EON4YTR6.js';
 import './chunk-HK4HRLWE.js';
 import './chunk-CAH3G4IS.js';
-export { Cron } from './chunk-MPD5EGJ6.js';
-import { MEMORY_EMBEDDING_ADAPTERS, resolveApiKey, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-KO5V6L3E.js';
-export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry } from './chunk-KO5V6L3E.js';
+export { Cron } from './chunk-MZQHVN7C.js';
+import { MEMORY_EMBEDDING_ADAPTERS, resolveApiKey, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-XARLSCKA.js';
+export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry } from './chunk-XARLSCKA.js';
 import './chunk-UJ7HK7BX.js';
 import './chunk-2SFBB54R.js';
 import { configure, submit, list, get, cancel, subscribe } from './chunk-GNMPCZNN.js';
@@ -22,7 +22,7 @@ import './chunk-ZTEAJAE6.js';
 import { lanceStoragePath, LanceIndex, readFactsFromMarkdown, defaultIndexPath, openMemoryDb, memoryDir } from './chunk-RJBHWM6D.js';
 import './chunk-J5RW43IR.js';
 import './chunk-AM2CNBKE.js';
-import './chunk-Q2PPSHBS.js';
+import './chunk-3NLOQEJR.js';
 import './chunk-ZS6SLELQ.js';
 import './chunk-LLE7HPRI.js';
 import './chunk-SNKY3C2L.js';
@@ -31,7 +31,7 @@ import './chunk-FD2UT76F.js';
 import './chunk-U54XCYG3.js';
 import './chunk-RP5HQVLD.js';
 import './chunk-6X6ID4MO.js';
-import './chunk-UJ7IQJAG.js';
+import './chunk-4NAKHID5.js';
 import './chunk-7AD3ZTZL.js';
 import './chunk-AZ6FKDQR.js';
 import './chunk-Q4DTGCSD.js';
@@ -1604,7 +1604,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-WUVYXIFX.js');
+  const { Agent: Agent2 } = await import('./agent-GKX5FE5K.js');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create

package/dist/internal/runtime/context/path-containment.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The one rule for "is this resolved path inside that root".
+ *
+ * Extracted because the package held it twice, at different strengths, for the same question. The
+ * correct version lived as a private function in `context-import-resolver.ts`, written for the
+ * 4.41.1 patch; the context manager had its own `absolute.startsWith(resolvePath(cwd))`, which
+ * admits two escapes:
+ *
+ *   - **No separator boundary.** With `root = /home/user/proj`, the path `/home/user/proj-evil/x`
+ *     starts with the root string and is NOT inside it. A sibling directory whose name merely
+ *     extends the project's is enough; no `..` past the parent is needed.
+ *   - **Lexical, not real.** A symlink whose name sits inside the root and whose target does not
+ *     passes any comparison made before symlink resolution.
+ *
+ * The obvious escapes (`../../etc/passwd`, an absolute path) ARE refused by a prefix test, which is
+ * why the weaker version survived review: it looks like it works on the inputs a reader tries.
+ *
+ * Both readers of repository-supplied paths now share this module. That is DRY about the RULE
+ * rather than about line count — one piece of knowledge, one representation, so the two cannot
+ * drift apart again.
+ *
+ * @internal
+ */
+export {};

package/dist/project.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkYPEPCZHF_cjs = require('./chunk-YPEPCZHF.cjs');
+var chunkL5YO6PWL_cjs = require('./chunk-L5YO6PWL.cjs');
 var chunkNETYW4V3_cjs = require('./chunk-NETYW4V3.cjs');
 var chunkYULF6FPB_cjs = require('./chunk-YULF6FPB.cjs');
 require('./chunk-ZHPET3LZ.cjs');
@@ -11,7 +11,7 @@ var DEFAULT_FILENAME = "THEO.md";
 async function readProjectInstructions(cwd, options) {
   const filename = options?.filename ?? DEFAULT_FILENAME;
   const scope = options?.scope ?? "nearest";
-  const paths = chunkYPEPCZHF_cjs.walkUpForFile(cwd, filename, options?.stopDir);
+  const paths = chunkL5YO6PWL_cjs.walkUpForFile(cwd, filename, options?.stopDir);
   const files = [];
   for (const path of paths) {
     try {
@@ -30,7 +30,7 @@ function reduceContent(files, scope) {
 }
 async function writeProjectInstructions(cwd, content, options) {
   const filename = options?.filename ?? DEFAULT_FILENAME;
-  if (!chunkYPEPCZHF_cjs.isSafePattern(filename)) {
+  if (!chunkL5YO6PWL_cjs.isSafePattern(filename)) {
     throw new chunkYULF6FPB_cjs.ConfigurationError(
       `writeProjectInstructions: unsafe filename ${JSON.stringify(filename)} (no path traversal, separators, or absolute paths)`,
       { code: "unsafe_filename" }

package/dist/project.js

@@ -1,4 +1,4 @@
-import { walkUpForFile, isSafePattern } from './chunk-UJ7IQJAG.js';
+import { walkUpForFile, isSafePattern } from './chunk-4NAKHID5.js';
 import { replaceFileAtomic } from './chunk-VQFSEKU5.js';
 import { ConfigurationError } from './chunk-MRKSSN36.js';
 import './chunk-PBML2FHN.js';

package/dist/server/auth/index.d.cts

@@ -1,15 +1,211 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+
 /**
- * @theokit/sdk/server/auth — public barrel
+ * @theokit/sdk/server/auth — typed error classes
  *
- * Per ADR D6 (sub-path export) — consumers import via `@theokit/sdk/server/auth`
- * NOT main `@theokit/sdk` barrel. Tree-shaking + allows breaking changes in
- * auth surface without affecting Agent runtime consumers.
+ * Plan T1.2 + v1.1 EC-1 (AuthCancelledError for OAuth provider error response RFC 6749 §4.1.2.1).
+ */
+/**
+ * Thrown at `defineAuth()` time when configuration is invalid
+ * (e.g., duplicate provider name, invalid email shape per EC-V1-12).
+ */
+declare class AuthConfigError extends Error {
+    readonly name = "AuthConfigError";
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Thrown at `startSignIn(providerName, ...)` or `finishSignIn(providerName, ...)`
+ * when the named provider is not registered in `providers[]`.
+ */
+declare class AuthProviderNotFoundError extends Error {
+    readonly name = "AuthProviderNotFoundError";
+    readonly providerName: string;
+    constructor(providerName: string);
+}
+/**
+ * Thrown during OAuth callback handling for state mismatches, expired
+ * transactions, missing query params, or provider 4xx/5xx errors.
+ *
+ * Typed `code` field lets consumers branch on cause:
+ *   - 'oauth_transaction_expired' — cookie tx > 10min old (per ADR D5)
+ *   - 'oauth_state_mismatch' — query state ≠ cookie state (CSRF defense per RFC 6749 §10.12)
+ *   - 'oauth_provider_error' — non-access_denied error in callback URL
+ *   - 'oauth_token_exchange_failed' — provider rejected code-for-tokens swap
+ *   - 'oauth_userinfo_failed' — userinfo endpoint returned error
+ *   - 'oauth_missing_code_or_state' — required query params absent
+ */
+declare class AuthCallbackError extends Error {
+    readonly name: string;
+    readonly code: string;
+    constructor(code: string, message?: string);
+}
+/**
+ * Per v1.1 EC-1 MUST FIX — typed subclass of AuthCallbackError for the
+ * specific case where user declined consent at provider screen.
+ *
+ * OAuth 2.0 RFC 6749 §4.1.2.1: provider redirects with `?error=access_denied`.
+ * Apps can catch this distinctly from network/server errors to render
+ * "Login cancelled — try again" UX instead of opaque "callback failed".
+ */
+declare class AuthCancelledError extends AuthCallbackError {
+    readonly name: string;
+    readonly errorDescription?: string;
+    constructor(errorDescription?: string);
+}
+
+/**
+ * @theokit/sdk/server/auth — orchestrator types (Path C Hybrid per G11)
+ *
+ * Plan: g11-auth-architecture-implementation v1.4 (sha256 4d381020...)
+ * Blueprint: g11-auth-architecture-decision v1.1 (SHIPPABLE 97.9)
+ * AUTH-DELEGATION lock (theokit/CLAUDE.md:217-225) — these types are the
+ * orchestrator contract; concrete OAuth/email providers ship in opt-in
+ * @theokit/auth-* packages (adapters layer per ADR D11).
+ */
+
+/**
+ * SessionManager contract (matches theokit/packages/theo/src/server/auth/session.ts:49).
+ * Imported as type-only — runtime depends via peerDep `theokit@>=0.2.4`.
+ */
+interface SessionManager<TSession> {
+    getSession(req: IncomingMessage): Promise<TSession | null>;
+    createSession(res: ServerResponse, data: TSession): Promise<void>;
+    destroySession(res: ServerResponse): void;
+    rotateSession(req: IncomingMessage, res: ServerResponse): Promise<TSession | null>;
+}
+/**
+ * Per ADR D5 — OAuth transaction state stored in encrypted HttpOnly cookie
+ * (cookie-state pattern). Expires within 10 minutes per invariant.
+ */
+interface OAuthTransaction {
+    state: string;
+    pkceVerifier?: string;
+    returnTo?: string;
+    createdAt: number;
+    expiresAt: number;
+}
+/**
+ * Per ADR D9 — provider profile types are provider-specific (not unified).
+ * Each @theokit/auth-* package exports its own profile shape.
+ * Generic param TProfile lets consumers narrow via discriminated unions on providerName.
+ */
+interface AuthResult<TProfile, TName extends string = string> {
+    profile: TProfile;
+    providerName: TName;
+    rawTokens?: {
+        accessToken: string;
+        refreshToken?: string;
+        idToken?: string;
+        expiresAt?: number;
+    };
+}
+/**
+ * Provider contract — each @theokit/auth-* package implements this.
+ * Per blueprint Q5 + ADR D11 (adapters layer).
+ */
+interface AuthProvider<TProfile, TName extends string = string> {
+    name: TName;
+    createAuthorizationURL(tx: OAuthTransaction): URL | Promise<URL>;
+    handleCallback(req: IncomingMessage, tx: OAuthTransaction): Promise<AuthResult<TProfile, TName>>;
+}
+/**
+ * `defineAuth(opts)` configuration shape — Path C (Hybrid).
+ * `providers` optional: empty = Path A escape hatch (manual signIn only).
+ * `onSignIn` invoked after provider callback success; returns TSession to persist.
+ */
+interface DefineAuthOptions<TSession> {
+    session: SessionManager<TSession>;
+    providers?: AuthProvider<unknown, string>[];
+    onSignIn?: <TProfile>(args: {
+        profile: TProfile;
+        provider: string;
+    }) => Promise<TSession>;
+    onSignOut?: (session: TSession | null) => Promise<void> | void;
+}
+/**
+ * Returned by `defineAuth<TSession>(opts)` — 5-method orchestrator surface.
+ *
+ * - startSignIn: returns Response.redirect to provider authorization URL with state cookie
+ * - finishSignIn: handles provider callback; verifies state; calls onSignIn; rotates session ID
+ *   (OWASP A07:2021 per EC-10); creates session cookie; clears transaction cookie
+ * - signIn: Path A escape hatch — skip OAuth flow; directly persist session from external profile
+ * - signOut: destroys session cookie + invokes onSignOut callback
+ * - getSession: read-only passthrough to session.getSession
+ */
+interface AuthOrchestrator<TSession> {
+    startSignIn(providerName: string, req: IncomingMessage, opts?: {
+        returnTo?: string;
+    }): Promise<Response>;
+    finishSignIn(providerName: string, req: IncomingMessage, res: ServerResponse): Promise<{
+        session: TSession;
+        returnTo?: string;
+    }>;
+    signIn<TProfile>(profile: TProfile, providerName: string, req: IncomingMessage, res: ServerResponse): Promise<TSession>;
+    signOut(res: ServerResponse): void | Promise<void>;
+    getSession(req: IncomingMessage): Promise<TSession | null>;
+}
+
+/**
+ * @theokit/sdk/server/auth — encrypted OAuth transaction cookie store
+ *
+ * Per ADR D5 — cookie-state pattern (no Redis/db dependency in core).
+ *
+ * Stores OAuthTransaction (state + pkceVerifier + returnTo + expiry) in a
+ * single signed+encrypted HttpOnly cookie. Stateless, works in edge/serverless.
+ *
+ * Cookie name: `__Host-theo_oauth_tx` (T5.3 — RFC 6265bis prefix)
+ * Lifetime: 10 minutes (per D5 invariant)
+ * Encryption: AES-256-GCM via Node's webcrypto subtle API
+ *
+ * Note: this is a minimal in-package implementation. Production deployments
+ * may prefer using `theokit/server/auth/crypto`'s encrypt/decrypt helpers
+ * via the SessionManager's existing secret rotation chain. For T1.2 we keep
+ * it self-contained to avoid cross-package peer-dep complexity; T2+ may
+ * refactor to share SessionManager's encrypt path.
+ */
+
+/**
+ * T5.1 — Typed error thrown when an OAuth tx-cookie secret has < 32
+ * bytes of entropy. Surfaces the actual byte length so operators can
+ * diagnose mis-configured env vars without leaking the secret itself.
+ *
+ * @public
+ */
+declare class AuthSecretTooShortError extends Error {
+    readonly name = "AuthSecretTooShortError";
+    constructor(actualBytes: number);
+}
+
+/**
+ * @theokit/sdk/server/auth — defineAuth orchestrator runtime (Path C Hybrid)
+ *
+ * Plan T1.2 implementation per blueprint Q5 § Path C signatures.
+ * Composes existing primitives + the v1.1 EC-1/EC-2/EC-10 fixes.
+ */
+
+/** SE36 — `Auth.create` replaces `defineAuth` (ADR 0015). @public */
+declare class Auth {
+    private constructor();
+    static create<TSession>(opts: DefineAuthOptions<TSession>): AuthOrchestrator<TSession>;
+}
+
+/**
+ * @theokit/sdk/server/auth — same-origin returnTo validator
+ *
+ * Per v1.1 EC-2 MUST FIX — OWASP A01:2021 open-redirect mitigation.
+ *
+ * Without this check, attacker craft `/login?returnTo=https://evil.com` would
+ * cause post-login redirect to attacker domain with authenticated session cookie.
  *
- * T1.1 shipped types-only.
- * T1.2 adds runtime: defineAuth() + 4 typed error classes + validateReturnTo helper.
+ * Rules:
+ *   - undefined/empty returnTo → default '/'
+ *   - protocol-relative `//evil.com` → default '/' (URL parser would resolve to baseUrl protocol)
+ *   - absolute URL with origin ≠ baseUrl.origin → default '/' (cross-origin redirect)
+ *   - absolute URL with origin === baseUrl.origin → keep (same-origin allowed)
+ *   - relative path starting with '/' → keep (same-app navigation)
+ *   - relative path not starting with '/' → default '/' (defensive)
  */
-export { AuthCallbackError, AuthCancelledError, AuthConfigError, AuthProviderNotFoundError, } from "./errors.js";
-export { AuthSecretTooShortError } from "./oauth-transaction-store.js";
-export { Auth } from "./orchestrator.js";
-export type { AuthOrchestrator, AuthProvider, AuthResult, DefineAuthOptions, OAuthTransaction, SessionManager, } from "./types.js";
-export { validateReturnTo } from "./validate-return-to.js";
+declare function validateReturnTo(returnTo: string | undefined, baseUrl: URL): string;
+
+export { Auth, AuthCallbackError, AuthCancelledError, AuthConfigError, type AuthOrchestrator, type AuthProvider, AuthProviderNotFoundError, type AuthResult, AuthSecretTooShortError, type DefineAuthOptions, type OAuthTransaction, type SessionManager, validateReturnTo };