@theokit/sdk 4.51.1 → 4.52.1

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 4.52.1
+
+### Patch Changes
+
+- **`providerFromApiKeyPrefix` now appears in `dist/auth/index.d.ts`.** Fixes #283.
+
+  It shipped at runtime and was absent from the type declaration, so a TypeScript consumer could not
+  import it: `TS2305`. The same defect the export existed to close, one layer down.
+
+  Root cause, and it is worth naming precisely: `tsconfig.base.json` sets `stripInternal: true`, and
+  TypeScript matches that tag **anywhere in an attached JSDoc — prose included**. The docblock above
+  the export explained the fix by describing the module as having been marked internal, and naming the
+  tag deleted the very line it documented.
+
+  Guarded by outcome rather than by word: a test asserts that every runtime export of
+  `@theokit/sdk/auth` appears in the emitted `.d.ts`. A grep for the tag would forbid the word instead
+  of the failure, and would not catch the next way a declaration goes missing.
+
+## 4.52.0
+
+### Minor Changes
+
+- 40125a5: **`providerFromApiKeyPrefix` becomes reachable from `@theokit/sdk/auth`.**
+
+  "Which provider issued this key?" was already answered here — in
+  `internal/local-agent/real-local-run-provider.ts`, marked internal and exported from no entry
+  point. A measured consumer needs it at login (`opts.provider ?? inferProvider(key)`), could not
+  import it, and wrote its own copy. A capability that exists and cannot be reached costs exactly
+  what an absent one costs.
+
+  Two things separate this from a re-export:
+
+  1. **The longest prefix wins, by construction.** The internal version walked a hand-ordered array
+     and was correct only because `sk-or-` and `sk-ant-` happened to precede `sk-`. Order-as-
+     convention breaks the first time somebody appends a longer prefix or sorts the list for
+     readability — silently, resolving an Anthropic key as OpenAI. The ordering is now derived from
+     prefix length.
+  2. **No provider-profile gate.** That gate belongs to the local-run path, which will not name a
+     provider it cannot construct. A caller asking "whose key is this?" at login has no profile
+     registered yet, and returning `undefined` there would answer a different question.
+
+  The prefix table no longer exists in two copies: `inferProviderFromApiKey` delegates and keeps only
+  what is its own policy.
+
 ## 4.51.1
 
 ### Patch Changes

package/dist/{agent-QWNWBCQZ.js → agent-RDHK6MVT.js}

@@ -1,10 +1,10 @@
-export { Agent } from './chunk-6CSIUJ5W.js';
-import './chunk-DRRSUUI5.js';
+export { Agent } from './chunk-KELIQH7K.js';
+import './chunk-42PLABFU.js';
 import './chunk-2SFBB54R.js';
 import './chunk-7TB5U7RK.js';
 import './chunk-K2BQQ445.js';
 import './chunk-J4RY5DTI.js';
-import './chunk-QVIUICFM.js';
+import './chunk-M5EK7N6R.js';
 import './chunk-4QEC4CCS.js';
 import './chunk-DHVNJYTO.js';
 import './chunk-UJ3SXRZZ.js';
@@ -18,6 +18,7 @@ import './chunk-OZXPA3ME.js';
 import './chunk-OXNYIMZZ.js';
 import './chunk-FD2UT76F.js';
 import './chunk-U54XCYG3.js';
+import './chunk-NAF4L3T6.js';
 import './chunk-RP5HQVLD.js';
 import './chunk-6X6ID4MO.js';
 import './chunk-4NAKHID5.js';
@@ -44,5 +45,5 @@ import './chunk-RIAM53CP.js';
 import './chunk-5XXUYU3M.js';
 import './chunk-HI4ZW62S.js';
 import './chunk-4X3SBHPK.js';
-//# sourceMappingURL=agent-QWNWBCQZ.js.map
-//# sourceMappingURL=agent-QWNWBCQZ.js.map
+//# sourceMappingURL=agent-RDHK6MVT.js.map
+//# sourceMappingURL=agent-RDHK6MVT.js.map

package/dist/{agent-QWNWBCQZ.js.map → agent-RDHK6MVT.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-QWNWBCQZ.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-RDHK6MVT.js"}

package/dist/{agent-2KSLHB6B.cjs → agent-U2R2R5JP.cjs}

@@ -1,12 +1,12 @@
 'use strict';
 
-var chunkXI4L45SS_cjs = require('./chunk-XI4L45SS.cjs');
-require('./chunk-3BKWFISQ.cjs');
+var chunk6GS7JI64_cjs = require('./chunk-6GS7JI64.cjs');
+require('./chunk-CY7MIMI4.cjs');
 require('./chunk-BV2MWEMV.cjs');
 require('./chunk-6DCTL32L.cjs');
 require('./chunk-BUUUWQMB.cjs');
 require('./chunk-OI6RHLGC.cjs');
-require('./chunk-N6NUMXAJ.cjs');
+require('./chunk-WLESQ3ZQ.cjs');
 require('./chunk-4JBHSLQO.cjs');
 require('./chunk-RAACTJ7C.cjs');
 require('./chunk-3R4ZCQAZ.cjs');
@@ -20,6 +20,7 @@ require('./chunk-E3OCRJU6.cjs');
 require('./chunk-2RW7K6FN.cjs');
 require('./chunk-MUUQ2WFJ.cjs');
 require('./chunk-6JSIEDKL.cjs');
+require('./chunk-FRITRLZQ.cjs');
 require('./chunk-B4YA6BRS.cjs');
 require('./chunk-NINIJCHU.cjs');
 require('./chunk-L5YO6PWL.cjs');
@@ -51,7 +52,7 @@ require('./chunk-SXSPMRSV.cjs');
 
 Object.defineProperty(exports, "Agent", {
   enumerable: true,
-  get: function () { return chunkXI4L45SS_cjs.Agent; }
+  get: function () { return chunk6GS7JI64_cjs.Agent; }
 });
-//# sourceMappingURL=agent-2KSLHB6B.cjs.map
-//# sourceMappingURL=agent-2KSLHB6B.cjs.map
+//# sourceMappingURL=agent-U2R2R5JP.cjs.map
+//# sourceMappingURL=agent-U2R2R5JP.cjs.map

package/dist/{agent-2KSLHB6B.cjs.map → agent-U2R2R5JP.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-2KSLHB6B.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"agent-U2R2R5JP.cjs"}

package/dist/auth/index.cjs

@@ -1,5 +1,6 @@
 'use strict';
 
+var chunkFRITRLZQ_cjs = require('../chunk-FRITRLZQ.cjs');
 var chunkXK54DTRF_cjs = require('../chunk-XK54DTRF.cjs');
 var chunkC6Y6CWYD_cjs = require('../chunk-C6Y6CWYD.cjs');
 require('../chunk-2YGIBOUH.cjs');
@@ -225,6 +226,10 @@ function extractAccountId(tokens) {
   return void 0;
 }
 
+Object.defineProperty(exports, "providerFromApiKeyPrefix", {
+  enumerable: true,
+  get: function () { return chunkFRITRLZQ_cjs.providerFromApiKeyPrefix; }
+});
 Object.defineProperty(exports, "CredentialError", {
   enumerable: true,
   get: function () { return chunkXK54DTRF_cjs.CredentialError; }

package/dist/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":["AuthCallbackError","exchangeCode"],"mappings":";;;;;;;;AA8BA,IAAM,wBAAA,GAA2B,GAAA;AAIjC,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAQ7B,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAMA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAK7B,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAI7B,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAIA,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAMC,8BAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAID,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n * Adaptations: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop (upstream loops unbounded).\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./auth-types.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early (from OpenCode). */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle, mirroring OpenCode's copilot flow.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step; ADAPTED FROM OpenCode codex.ts, MIT © 2025) ───\n\n/** The OpenAI two-step device config: usercode + poll endpoints return an authorization_code (not tokens). */\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await res.json()) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. Adapted from OpenCode's codex plugin. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). Adapted from OpenCode. */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}
+{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":["AuthCallbackError","exchangeCode"],"mappings":";;;;;;;;;AA8BA,IAAM,wBAAA,GAA2B,GAAA;AAIjC,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAQ7B,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAMA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAK7B,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAIA,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAI7B,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAIA,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAMC,8BAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAID,mCAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAIA,mCAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n * Adaptations: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop (upstream loops unbounded).\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./auth-types.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early (from OpenCode). */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle, mirroring OpenCode's copilot flow.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step; ADAPTED FROM OpenCode codex.ts, MIT © 2025) ───\n\n/** The OpenAI two-step device config: usercode + poll endpoints return an authorization_code (not tokens). */\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await res.json()) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. Adapted from OpenCode's codex plugin. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). Adapted from OpenCode. */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}

package/dist/auth/index.d.cts

@@ -12,6 +12,21 @@
  *
  * @packageDocumentation
  */
+/**
+ * "Which provider issued this key?" — the question a login flow asks before any profile exists.
+ *
+ * Made REACHABLE rather than written: the SDK already answered it, from a module no entry point
+ * exported, and a measured consumer wrote its own copy because it could not import ours. The lookup
+ * now derives its longest-first ordering instead of depending on the order the table happens to be
+ * typed in.
+ *
+ * NOTE — do not name the internal-visibility tag in this docblock. `tsconfig.base.json` sets
+ * `stripInternal: true`, and TypeScript matches the tag anywhere in an attached JSDoc, prose
+ * included. Mentioning it here deleted this very line from `dist/auth/index.d.ts`: the symbol
+ * shipped at runtime and could not be imported with types — the exact defect this export exists to
+ * fix, reintroduced by the comment explaining the fix (usetheodev/theokit-sdk#283).
+ */
+export { providerFromApiKeyPrefix } from "../internal/auth/api-key-prefix.js";
 export type { CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, HttpDeps, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolvedCredential, StoredApiCredential, StoredCredential, StoredOAuthCredential, } from "../internal/auth/auth-types.js";
 export { assertSecureModes, authFilePath, CredentialError, credentialHome, readAuthFile, readStoredOAuth, writeCredential, } from "../internal/auth/credential-store.js";
 export { deviceLogin, extractAccountId, openaiDeviceLogin, parseJwtClaims, pollDeviceToken, requestDeviceCode, requestOpenAIUsercode, } from "../internal/auth/oauth-device.js";

package/dist/auth/index.d.ts

@@ -12,6 +12,21 @@
  *
  * @packageDocumentation
  */
+/**
+ * "Which provider issued this key?" — the question a login flow asks before any profile exists.
+ *
+ * Made REACHABLE rather than written: the SDK already answered it, from a module no entry point
+ * exported, and a measured consumer wrote its own copy because it could not import ours. The lookup
+ * now derives its longest-first ordering instead of depending on the order the table happens to be
+ * typed in.
+ *
+ * NOTE — do not name the internal-visibility tag in this docblock. `tsconfig.base.json` sets
+ * `stripInternal: true`, and TypeScript matches the tag anywhere in an attached JSDoc, prose
+ * included. Mentioning it here deleted this very line from `dist/auth/index.d.ts`: the symbol
+ * shipped at runtime and could not be imported with types — the exact defect this export exists to
+ * fix, reintroduced by the comment explaining the fix (usetheodev/theokit-sdk#283).
+ */
+export { providerFromApiKeyPrefix } from "../internal/auth/api-key-prefix.js";
 export type { CredentialStoreConfig, DeviceCodeGrant, DeviceDeps, DeviceOAuthConfig, HttpDeps, OAuthProviderConfig, OAuthTokens, OpenAIDeviceConfig, ResolvedCredential, StoredApiCredential, StoredCredential, StoredOAuthCredential, } from "../internal/auth/auth-types.js";
 export { assertSecureModes, authFilePath, CredentialError, credentialHome, readAuthFile, readStoredOAuth, writeCredential, } from "../internal/auth/credential-store.js";
 export { deviceLogin, extractAccountId, openaiDeviceLogin, parseJwtClaims, pollDeviceToken, requestDeviceCode, requestOpenAIUsercode, } from "../internal/auth/oauth-device.js";

package/dist/auth/index.js

@@ -1,3 +1,4 @@
+export { providerFromApiKeyPrefix } from '../chunk-NAF4L3T6.js';
 import { exchangeCode } from '../chunk-BKRTYDVN.js';
 export { CredentialError, assertSecureModes, authFilePath, credentialHome, ensureFreshCredential, exchangeCode, persistOAuthTokens, readAuthFile, readStoredOAuth, refreshOAuthTokens, resolveCredential, writeCredential } from '../chunk-BKRTYDVN.js';
 import { AuthCallbackError } from '../chunk-5NBUH3NO.js';

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":[],"mappings":";;;;;;;AA8BA,IAAM,wBAAA,GAA2B,GAAA;AAIjC,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAQ7B,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAMA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAK7B,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAI7B,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAM,YAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n * Adaptations: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop (upstream loops unbounded).\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./auth-types.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early (from OpenCode). */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle, mirroring OpenCode's copilot flow.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step; ADAPTED FROM OpenCode codex.ts, MIT © 2025) ───\n\n/** The OpenAI two-step device config: usercode + poll endpoints return an authorization_code (not tokens). */\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await res.json()) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. Adapted from OpenCode's codex plugin. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). Adapted from OpenCode. */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}
+{"version":3,"sources":["../../src/internal/auth/oauth-device.ts"],"names":[],"mappings":";;;;;;;;AA8BA,IAAM,wBAAA,GAA2B,GAAA;AAIjC,eAAsB,iBAAA,CACpB,QACA,IAAA,EAC0B;AAC1B,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,WAAW,MAAA,CAAO,QAAA;AAAA,QAClB,KAAA,EAAO,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,GAAG;AAAA,OAC9B,EAAE,QAAA;AAAS,KACb,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,uBAAA,EAA2B,IAAc,OAAO,CAAA;AAAA,KAClD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,8BAAA,EAAiC,IAAI,MAAM,CAAA;AAAA,KAC7C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAQ7B,EAAA,IAAI,OAAO,IAAA,CAAK,WAAA,KAAgB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AAC9E,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAA,GACJ,OAAO,IAAA,CAAK,gBAAA,KAAqB,QAAA,GAC7B,IAAA,CAAK,gBAAA,GACL,OAAO,IAAA,CAAK,yBAAA,KAA8B,QAAA,GACxC,IAAA,CAAK,yBAAA,GACL,EAAA;AACR,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,WAAA;AAAA,IACjB,UAAU,IAAA,CAAK,SAAA;AAAA,IACf,eAAA,EAAiB,YAAA;AAAA,IACjB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA,KAAa,YAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,QAAA,GAAW,CAAA;AAAA,IACnF,SAAA,EAAW,OAAO,IAAA,CAAK,UAAA,KAAe,YAAY,IAAA,CAAK,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,UAAA,GAAa;AAAA,GAC5F;AACF;AAQA,eAAsB,eAAA,CACpB,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,MAAM,SAAA,GAAY,GAAA;AAChD,EAAA,IAAI,UAAA,GAAa,MAAM,QAAA,GAAW,GAAA;AAElC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,QAC3C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,cAAA,EAAgB,mCAAA;AAAA,UAChB,MAAA,EAAQ;AAAA,SACV;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,UACxB,WAAW,MAAA,CAAO,QAAA;AAAA,UAClB,aAAa,KAAA,CAAM,UAAA;AAAA,UACnB,UAAA,EAAY;AAAA,SACb,EAAE,QAAA;AAAS,OACb,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA8B,IAAc,OAAO,CAAA;AAAA,OACrD;AAAA,IACF;AAGA,IAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAQ/C,IAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,OAAO,IAAA,CAAK,UAAU,QAAA,EAAU;AAC7C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,OACnD;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,YAAY,IAAA,CAAK,YAAA,CAAa,SAAS,CAAA,EAAG;AACzE,MAAA,MAAM,YAAY,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,CAAA;AAC1E,MAAA,MAAM,YAAY,gBAAA,CAAiB;AAAA,QACjC,cAAc,IAAA,CAAK,YAAA;AAAA,QACnB,UAAU,IAAA,CAAK;AAAA,OAChB,CAAA;AACD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,YAAA;AAAA;AAAA;AAAA,QAGb,OAAA,EAAS,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAAA,QACpC,OAAA,EAAS,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QAClC,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACjD;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,UAAU,uBAAA,EAAyB;AAC1C,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,UAAU,WAAA,EAAa;AAE9B,MAAA,UAAA,GAAA,CACG,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IAAY,IAAA,CAAK,QAAA,GAAW,CAAA,GAClD,IAAA,CAAK,QAAA,GACL,KAAA,CAAM,QAAA,GAAW,CAAA,IAAK,GAAA;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AACtD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,QAAA,EAAU;AAClC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,+BAAA,EAAkC,KAAK,KAAK,CAAA;AAAA,OAC9C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAMA,eAAsB,WAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EAGsB;AACtB,EAAA,MAAM,KAAA,GAAQ,MAAM,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAClD,EAAA,KAAA,CAAM,QAAA,CAAS;AAAA,IACb,UAAU,KAAA,CAAM,QAAA;AAAA,IAChB,iBAAiB,KAAA,CAAM,eAAA;AAAA,IACvB,WAAW,KAAA,CAAM;AAAA,GAClB,CAAA;AACD,EAAA,OAAO,eAAA,CAAgB,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA;AAC5C;AAMA,eAAsB,qBAAA,CACpB,QACA,IAAA,EACuE;AACvE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,sBAAA,EAAwB;AAAA,MACpD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,MAC1E,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,SAAA,EAAW,MAAA,CAAO,UAAU;AAAA,KACpD,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,yBAAA,EAA6B,IAAc,OAAO,CAAA;AAAA,KACpD;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA,CAAA,gCAAA,EAAmC,IAAI,MAAM,CAAA;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAK7B,EAAA,IAAI,OAAO,IAAA,CAAK,cAAA,KAAmB,YAAY,OAAO,IAAA,CAAK,cAAc,QAAA,EAAU;AACjF,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,mCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,WAAW,IAAA,CAAK,GAAA;AAAA,IACpB,OAAO,KAAK,QAAA,KAAa,QAAA,GAAW,SAAS,IAAA,CAAK,QAAA,EAAU,EAAE,CAAA,IAAK,CAAA,GAAI,CAAA;AAAA,IACvE;AAAA,GACF;AACA,EAAA,OAAO,EAAE,YAAA,EAAc,IAAA,CAAK,gBAAgB,QAAA,EAAU,IAAA,CAAK,WAAW,QAAA,EAAS;AACjF;AAOA,eAAsB,iBAAA,CACpB,MAAA,EACA,IAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,EAAE,cAAc,QAAA,EAAU,QAAA,KAAa,MAAM,qBAAA,CAAsB,QAAQ,IAAI,CAAA;AACrF,EAAA,KAAA,CAAM,SAAS,EAAE,QAAA,EAAU,eAAA,EAAiB,MAAA,CAAO,iBAAiB,CAAA;AAEpE,EAAA,MAAM,aAAa,QAAA,GAAW,GAAA;AAE9B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,KAAK,EAAA,GAAK,GAAA;AACxC,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,QAChD,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,QAAQ,kBAAA,EAAmB;AAAA,QAC1E,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,gBAAgB,YAAA,EAAc,SAAA,EAAW,UAAU;AAAA,OAC3E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,oBAAA,EAAwB,IAAc,OAAO,CAAA;AAAA,OAC/C;AAAA,IACF;AACA,IAAA,IAAI,IAAI,EAAA,EAAI;AACV,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAI7B,MAAA,IAAI,OAAO,IAAA,CAAK,kBAAA,KAAuB,YAAY,OAAO,IAAA,CAAK,kBAAkB,QAAA,EAAU;AACzF,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAM,SAAS,MAAM,YAAA;AAAA,QACnB,MAAA;AAAA,QACA,EAAE,IAAA,EAAM,IAAA,CAAK,kBAAA,EAAoB,QAAA,EAAU,KAAK,aAAA,EAAc;AAAA,QAC9D;AAAA,OACF;AAIA,MAAA,OAAO;AAAA,QACL,GAAG,MAAA;AAAA,QACH,SAAA,EAAW,OAAO,SAAA,IAAa,gBAAA,CAAiB,EAAE,YAAA,EAAc,MAAA,CAAO,QAAQ;AAAA,OACjF;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,WAAW,GAAA,EAAK;AAC5C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,6BAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,IAAI,MAAM,CAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,wBAAwB,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,IAAI,iBAAA;AAAA,IACR,2BAAA;AAAA,IACA;AAAA,GACF;AACF;AAUO,SAAS,eAAe,KAAA,EAA0C;AACvE,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA,EAAa,WAAW,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EAC3E,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,iBAAiB,MAAA,EAGV;AACrB,EAAA,KAAA,MAAW,SAAS,CAAC,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AAC1D,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,MAAM,MAAA,GAAS,eAAe,KAAK,CAAA;AACnC,IAAA,MAAM,EAAA,GACJ,MAAA,EAAQ,kBAAA,IACR,MAAA,GAAS,6BAA6B,GAAG,kBAAA,IACzC,MAAA,EAAQ,aAAA,GAAgB,CAAC,CAAA,EAAG,EAAA;AAC9B,IAAA,IAAI,EAAA,KAAO,QAAW,OAAO,EAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["/**\n * M42 — the SDK OAuth device-authorization flows (RFC 8628 + OpenAI two-step headless). Split out of\n * oauth-engine.ts to respect the 500-line file budget; a sibling of the core engine. Promoted DOWN from\n * agent-builder's hardened `agents/lib/oauth-device.ts` (M37).\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n * Adaptations: network I/O + clock + sleep are INJECTED (deterministic tests), failures raise the SDK's\n * typed `AuthCallbackError`, and a device-code expiry DEADLINE guards each poll loop (upstream loops unbounded).\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  DeviceCodeGrant,\n  DeviceDeps,\n  DeviceOAuthConfig,\n  OAuthTokens,\n  OpenAIDeviceConfig,\n} from \"./auth-types.js\";\nimport { exchangeCode } from \"./oauth-engine.js\";\n\n// ─── OAuth 2.0 Device Authorization Grant (RFC 8628) — terminal-first / headless login ───\n\n/** Buffer added to every poll interval to avoid hitting the server a hair early (from OpenCode). */\nconst POLLING_SAFETY_MARGIN_MS = 3000;\n\n/** Step 1 — request a device code. POSTs `{client_id, scope}` to the device endpoint. */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 device-code request — cohesive network response parser ported verbatim (ADR D3).\nexport async function requestDeviceCode(\n  config: DeviceOAuthConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<DeviceCodeGrant> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceCodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams({\n        client_id: config.clientId,\n        scope: config.scopes.join(\" \"),\n      }).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `device endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_code?: unknown;\n    user_code?: unknown;\n    verification_uri?: unknown;\n    verification_uri_complete?: unknown;\n    interval?: unknown;\n    expires_in?: unknown;\n  };\n  if (typeof data.device_code !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"device response missing device_code/user_code\",\n    );\n  }\n  const verification =\n    typeof data.verification_uri === \"string\"\n      ? data.verification_uri\n      : typeof data.verification_uri_complete === \"string\"\n        ? data.verification_uri_complete\n        : \"\";\n  return {\n    deviceCode: data.device_code,\n    userCode: data.user_code,\n    verificationUri: verification,\n    interval: typeof data.interval === \"number\" && data.interval > 0 ? data.interval : 5,\n    expiresIn: typeof data.expires_in === \"number\" && data.expires_in > 0 ? data.expires_in : 900,\n  };\n}\n\n/**\n * Step 2 — poll the token endpoint until the user approves (or the code expires). Handles RFC 8628\n * `authorization_pending` (keep waiting) and `slow_down` (back off), with an expiry deadline so it cannot\n * spin forever.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: RFC 8628 poll state machine (authorization_pending / slow_down / success / expiry) — a cohesive loop ported verbatim (ADR D3); fragmenting it would obscure the protocol.\nexport async function pollDeviceToken(\n  config: DeviceOAuthConfig,\n  grant: DeviceCodeGrant,\n  deps: DeviceDeps,\n): Promise<OAuthTokens> {\n  const deadline = deps.now() + grant.expiresIn * 1000;\n  let intervalMs = grant.interval * 1000;\n\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.tokenEndpoint, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          accept: \"application/json\",\n        },\n        body: new URLSearchParams({\n          client_id: config.clientId,\n          device_code: grant.deviceCode,\n          grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        }).toString(),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token poll failed: ${(err as Error).message}`,\n      );\n    }\n    // RFC 8628 §3.5: `authorization_pending` / `slow_down` arrive as a 400 with an `error` body — so the\n    // body MUST be read before deciding failure. Parse first; only a non-OAuth-shaped body on a non-2xx fails.\n    const data = (await res.json().catch(() => ({}))) as {\n      access_token?: string;\n      refresh_token?: string;\n      expires_in?: number;\n      id_token?: string;\n      error?: string;\n      interval?: number;\n    };\n    if (!res.ok && typeof data.error !== \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device token endpoint returned HTTP ${res.status}`,\n      );\n    }\n\n    if (typeof data.access_token === \"string\" && data.access_token.length > 0) {\n      const expiresIn = typeof data.expires_in === \"number\" ? data.expires_in : 0;\n      const accountId = extractAccountId({\n        access_token: data.access_token,\n        id_token: data.id_token,\n      });\n      return {\n        access: data.access_token,\n        // Some device-grant providers (e.g. GitHub) issue no separate refresh token — reuse the access\n        // token as the refresh handle, mirroring OpenCode's copilot flow.\n        refresh: data.refresh_token ?? data.access_token,\n        expires: deps.now() + expiresIn * 1000,\n        ...(accountId !== undefined ? { accountId } : {}),\n      };\n    }\n\n    if (data.error === \"authorization_pending\") {\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (data.error === \"slow_down\") {\n      // RFC 8628 §3.5: add 5s to the interval, or honor a server-provided one.\n      intervalMs =\n        (typeof data.interval === \"number\" && data.interval > 0\n          ? data.interval\n          : grant.interval + 5) * 1000;\n      await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n      continue;\n    }\n    if (typeof data.error === \"string\") {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device authorization rejected: ${data.error}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device code expired before it was approved\",\n  );\n}\n\n/**\n * The full device login: request a code, hand the user the verification URL + user code via `onPrompt`\n * (never printed here — the caller renders it, keeping this module output-free), then poll to completion.\n */\nexport async function deviceLogin(\n  config: DeviceOAuthConfig,\n  deps: DeviceDeps,\n  hooks: {\n    onPrompt: (p: { userCode: string; verificationUri: string; expiresIn: number }) => void;\n  },\n): Promise<OAuthTokens> {\n  const grant = await requestDeviceCode(config, deps);\n  hooks.onPrompt({\n    userCode: grant.userCode,\n    verificationUri: grant.verificationUri,\n    expiresIn: grant.expiresIn,\n  });\n  return pollDeviceToken(config, grant, deps);\n}\n\n// ─── OpenAI / ChatGPT \"headless\" device flow (two-step; ADAPTED FROM OpenCode codex.ts, MIT © 2025) ───\n\n/** The OpenAI two-step device config: usercode + poll endpoints return an authorization_code (not tokens). */\n/** Step 1 (OpenAI) — request the user code. */\nexport async function requestOpenAIUsercode(\n  config: OpenAIDeviceConfig,\n  deps: Pick<DeviceDeps, \"fetch\">,\n): Promise<{ deviceAuthId: string; userCode: string; interval: number }> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.deviceUsercodeEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ client_id: config.clientId }),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      `usercode endpoint returned HTTP ${res.status}`,\n    );\n  }\n  const data = (await res.json()) as {\n    device_auth_id?: unknown;\n    user_code?: unknown;\n    interval?: unknown;\n  };\n  if (typeof data.device_auth_id !== \"string\" || typeof data.user_code !== \"string\") {\n    throw new AuthCallbackError(\n      \"oauth_device_authorization_failed\",\n      \"usercode response missing device_auth_id/user_code\",\n    );\n  }\n  const interval = Math.max(\n    typeof data.interval === \"string\" ? parseInt(data.interval, 10) || 5 : 5,\n    1,\n  );\n  return { deviceAuthId: data.device_auth_id, userCode: data.user_code, interval };\n}\n\n/**\n * Step 2+3 (OpenAI) — poll for the authorization code (200 = ready; 403/404 = pending; else fail), then\n * exchange it for tokens at the standard `/oauth/token` endpoint (reuses `exchangeCode`).\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OpenAI two-step headless poll loop (200 ready / 403,404 pending / else fail) — cohesive network state machine ported verbatim (ADR D3).\nexport async function openaiDeviceLogin(\n  config: OpenAIDeviceConfig,\n  deps: DeviceDeps,\n  hooks: { onPrompt: (p: { userCode: string; verificationUri: string }) => void },\n): Promise<OAuthTokens> {\n  const { deviceAuthId, userCode, interval } = await requestOpenAIUsercode(config, deps);\n  hooks.onPrompt({ userCode, verificationUri: config.verificationUri });\n\n  const intervalMs = interval * 1000;\n  // Bound the loop so it cannot spin forever if the provider never resolves (upstream loops unbounded).\n  const deadline = deps.now() + 15 * 60 * 1000;\n  while (deps.now() < deadline) {\n    let res: Response;\n    try {\n      res = await deps.fetch(config.devicePollEndpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n        body: JSON.stringify({ device_auth_id: deviceAuthId, user_code: userCode }),\n      });\n    } catch (err) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll failed: ${(err as Error).message}`,\n      );\n    }\n    if (res.ok) {\n      const data = (await res.json()) as {\n        authorization_code?: unknown;\n        code_verifier?: unknown;\n      };\n      if (typeof data.authorization_code !== \"string\" || typeof data.code_verifier !== \"string\") {\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"device poll returned no authorization_code\",\n        );\n      }\n      const tokens = await exchangeCode(\n        config,\n        { code: data.authorization_code, verifier: data.code_verifier },\n        deps,\n      );\n      // M43 D4 fix #2 — the two-step exchange returns a JWT access token but `parseTokenResponse` only reads a\n      // top-level `account_id`. JWT-extract the `chatgpt_account_id` (as the generic device poll already does)\n      // so the login persists a non-empty account_id for the Codex `ChatGPT-Account-Id` header.\n      return {\n        ...tokens,\n        accountId: tokens.accountId ?? extractAccountId({ access_token: tokens.access }),\n      };\n    }\n    // 403/404 = still pending (user has not approved yet); anything else is a hard failure.\n    if (res.status !== 403 && res.status !== 404) {\n      throw new AuthCallbackError(\n        \"oauth_token_exchange_failed\",\n        `device poll returned HTTP ${res.status}`,\n      );\n    }\n    await deps.sleep(intervalMs + POLLING_SAFETY_MARGIN_MS);\n  }\n  throw new AuthCallbackError(\n    \"oauth_device_code_expired\",\n    \"the device authorization expired before approval\",\n  );\n}\n\n/** JWT id/access-token claims we read to attribute an account. Adapted from OpenCode's codex plugin. */\ninterface IdTokenClaims {\n  chatgpt_account_id?: string;\n  organizations?: Array<{ id: string }>;\n  \"https://api.openai.com/auth\"?: { chatgpt_account_id?: string };\n}\n\n/** Decode a JWT's claim set (no signature verification — used only to read a self-reported account id). */\nexport function parseJwtClaims(token: string): IdTokenClaims | undefined {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) return undefined;\n  try {\n    return JSON.parse(Buffer.from(parts[1] as string, \"base64url\").toString()) as IdTokenClaims;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Best-effort account id from an id/access token's claims (OpenAI/ChatGPT shape). Adapted from OpenCode. */\nexport function extractAccountId(tokens: {\n  id_token?: string;\n  access_token?: string;\n}): string | undefined {\n  for (const token of [tokens.id_token, tokens.access_token]) {\n    if (token === undefined) continue;\n    const claims = parseJwtClaims(token);\n    const id =\n      claims?.chatgpt_account_id ??\n      claims?.[\"https://api.openai.com/auth\"]?.chatgpt_account_id ??\n      claims?.organizations?.[0]?.id;\n    if (id !== undefined) return id;\n  }\n  return undefined;\n}\n"]}

package/dist/{chunk-DRRSUUI5.js → chunk-42PLABFU.js}

@@ -46,7 +46,7 @@ function persistTurnToTranscript(store, loc, sessionId, turn, onCompact) {
       const count = (recordCounts.get(key) ?? 0) + 1;
       recordCounts.set(key, count);
       if (turn.autoCompact !== void 0) {
-        const { autoCompactIfNeeded } = await import('./compact-session-LR73ESZX.js');
+        const { autoCompactIfNeeded } = await import('./compact-session-XLXC2CZN.js');
         const fired = await autoCompactIfNeeded({
           store,
           loc,
@@ -105,5 +105,5 @@ function enqueueSessionWrite(cwd, agentId, fn) {
 }
 
 export { appendSessionMessage, clearSession, discardSession, enqueueSessionWrite, flushSessionWrites, getSessionMessages, hydrateSession, persistTurnToTranscript };
-//# sourceMappingURL=chunk-DRRSUUI5.js.map
-//# sourceMappingURL=chunk-DRRSUUI5.js.map
+//# sourceMappingURL=chunk-42PLABFU.js.map
+//# sourceMappingURL=chunk-42PLABFU.js.map

package/dist/{chunk-DRRSUUI5.js.map → chunk-42PLABFU.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/session/agent-session.ts"],"names":[],"mappings":";;;;;AAwCA,IAAM,aAAA,uBAAoB,GAAA,EAA2B;AACrD,IAAM,YAAA,uBAAmB,GAAA,EAAoB;AAStC,SAAS,oBAAA,CAAqB,SAAiB,OAAA,EAA+B;AACnF,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,OAAO,KAAK,EAAC;AAC3C,EAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AAIrB,EAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACvB,EAAA,QAAA,CAAS,GAAA,CAAI,SAAS,QAAQ,CAAA;AAC9B,EAAA,cAAA,EAAe;AACjB;AAWO,IAAM,mBAAA,GAAsB,EAAA;AAEnC,SAAS,cAAA,GAAuB;AAC9B,EAAA,OAAO,QAAA,CAAS,OAAO,mBAAA,EAAqB;AAC1C,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACtC,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AACtB,IAAA,iBAAA,CAAkB,MAAM,CAAA;AAAA,EAC1B;AACF;AAeA,SAAS,kBAAkB,OAAA,EAAuB;AAChD,EAAA,MAAM,MAAA,GAAS,cAAc,EAAA,EAAI,OAAO,EAAE,KAAA,CAAM,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA;AACtE,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,YAAY,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,YAAA,CAAa,MAAA,CAAO,CAAC,CAAA;AAChF,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,aAAA,CAAc,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,aAAA,CAAc,OAAO,CAAC,CAAA;AACzF,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,YAAA,CAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,YAAA,CAAa,OAAO,CAAC,CAAA;AACzF;AAaO,SAAS,cAAA,CAAe,KAAa,OAAA,EAAyB;AACnE,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,OAAA,GAAU,CAAA;AAUd,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC9B,EAAA,IAAI,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC/B,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC9B,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,mBAAmB,OAAA,EAAmC;AACpE,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA,IAAK,EAAC;AACnC;AAWO,SAAS,uBAAA,CACd,KAAA,EACA,GAAA,EACA,SAAA,EACA,MACA,SAAA,EACM;AACN,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,GAAA,EAAK,IAAI,OAAO,CAAA;AAM9C,EAAA,MAAM,OAAA,GAAA,CAAW,cAAc,GAAA,CAAI,GAAG,KAAK,OAAA,CAAQ,OAAA,EAAQ,EAAG,IAAA,CAAK,YAAY;AAC7E,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,CAAY,KAAA,EAAO,GAAA,EAAK,SAAA,EAAW,IAAI,CAAA;AAC7C,MAAA,MAAM,KAAA,GAAA,CAAS,YAAA,CAAa,GAAA,CAAI,GAAG,KAAK,CAAA,IAAK,CAAA;AAC7C,MAAA,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAA;AAI3B,MAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,CAAA,EAAW;AAClC,QAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,OAAO,+BAAsB,CAAA;AACnE,QAAA,MAAM,KAAA,GAAQ,MAAM,mBAAA,CAAoB;AAAA,UACtC,KAAA;AAAA,UACA,GAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA,EAAY,KAAK,WAAA,CAAY,UAAA;AAAA,UAC7B,aAAA,EAAe,KAAK,WAAA,CAAY,aAAA;AAAA,UAChC,SAAA,EAAW,KAAA;AAAA,UACX,SAAA,EAAW,KAAK,WAAA,CAAY;AAAA,SAC7B,CAAA;AACD,QAAA,IAAI,OAAO,SAAA,IAAY;AAAA,MACzB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,MAAM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACjE,MAAA,IAAA,CAAK,CAAA,+CAAA,EAAkD,GAAA,CAAI,OAAO,CAAA,GAAA,EAAM,GAAG;AAAA,CAAI,CAAA;AAAA,IACjF;AAAA,EACF,CAAC,CAAA;AACD,EAAA,aAAA,CAAc,GAAA;AAAA,IACZ,GAAA;AAAA,IACA,OAAA,CAAQ,IAAA;AAAA,MACN,MAAM,MAAA;AAAA,MACN,MAAM;AAAA;AACR,GACF;AACF;AAQA,eAAsB,cAAA,CACpB,SACA,GAAA,EACe;AACf,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC1C,EAAA,IAAI,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3B,EAAA,YAAA,CAAa,IAAI,GAAG,CAAA;AAEpB,EAAA,MAAM,SAAA,GAAY,MAAM,mBAAA,CAAoB,GAAA,CAAI,OAAO,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAM5B,EAAA,QAAA,CAAS,GAAA,CAAI,SAAS,SAAS,CAAA;AACjC;AAQA,eAAsB,kBAAA,GAAoC;AACxD,EAAA,OAAO,aAAA,CAAc,OAAO,CAAA,EAAG;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AAC7C,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,MAAM,OAAA,CAAQ,IAAI,GAAG,CAAA;AAAA,EACvB;AACF;AAEO,SAAS,aAAa,OAAA,EAAuB;AAClD,EAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACzB;AAYO,SAAS,mBAAA,CACd,GAAA,EACA,OAAA,EACA,EAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,MAAM,QAAQ,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,IAAK,QAAQ,OAAA,EAAQ;AACxD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA;AAC5B,EAAA,aAAA,CAAc,GAAA;AAAA,IACZ,GAAA;AAAA,IACA,MAAA,CAAO,IAAA;AAAA,MACL,MAAM,MAAA;AAAA,MACN,MAAM;AAAA;AACR,GACF;AACA,EAAA,OAAO,MAAA;AACT","file":"chunk-DRRSUUI5.js","sourcesContent":["import type { SessionStore } from \"../../types/session-store.js\";\nimport {\n  type PersistTurnInput,\n  persistTurn,\n  readSessionMessages,\n  type TranscriptLocation,\n} from \"./agent-session-store.js\";\n\n/**\n * Per-agent conversation history kept across runs (and across `Agent.resume()`\n * within the same process). Lets the fixture responder recall prior facts when\n * the user asks a follow-up question.\n *\n * SE40 — disk persistence IS the native Claude-shaped `.jsonl` transcript. The\n * in-memory cache holds the narrowed `SessionMessage[]` (user/assistant text) so\n * a send can read `priorMessages` synchronously; the whole rich turn (user +\n * assistant + tool blocks) lands on disk once per send via {@link persistTurnToTranscript}\n * (fed by `run.conversation()`). Hydration on resume reconstructs the session by\n * walking the transcript DAG (`readSessionMessages`).\n *\n * @internal\n */\n\n// `SessionMessage` lives in `./session-types.ts` (leaf types file). Re-exported\n// for back-compat with downstream importers that pulled it from here.\nexport type { SessionMessage } from \"./session-types.js\";\n\nimport type { SessionMessage } from \"./session-types.js\";\n\n// M75 — the cache lives in a leaf; see session-cache.ts for the reason (cycle broken by extraction).\nexport {\n  hydratedKeys,\n  invalidateSessionCache,\n  sessions,\n  transcriptKey,\n} from \"./session-cache.js\";\n\nimport { diag } from \"../diagnostics.js\";\nimport { hydratedKeys, sessions, transcriptKey } from \"./session-cache.js\";\n\nconst pendingWrites = new Map<string, Promise<void>>();\nconst recordCounts = new Map<string, number>();\n\n/**\n * Append a session message to the in-memory cache only. Disk persistence for the\n * whole turn happens once per send via {@link persistTurnToTranscript}; the cache\n * feeds `priorMessages` / `onBeforeSend.previousMessageCount` synchronously.\n *\n * @internal\n */\nexport function appendSessionMessage(agentId: string, message: SessionMessage): void {\n  const existing = sessions.get(agentId) ?? [];\n  existing.push(message);\n  // `delete` + `set` reinserts at the END: a JS `Map` preserves insertion order, so the first key\n  // is always the least recently touched. That is the entire LRU, with no new structure (parsimony\n  // rungs 2/5 — the ordering we need is already a language guarantee).\n  sessions.delete(agentId);\n  sessions.set(agentId, existing);\n  enforceCeiling();\n}\n\n/**\n * Ceiling on sessions kept in memory.\n *\n * The runtime only reads the **active** session; the rest is pure cache, rebuildable from the\n * on-disk transcript. 32 is deliberately generous — the primary removal path is the explicit\n * `discardSession()` at the end of the agent's life, and this ceiling is a safety net against a\n * long-lived process running hundreds of sessions (plan risk #2: a tight ceiling could evict a\n * session still referenced by an in-flight async path).\n */\nexport const MAX_CACHED_SESSIONS = 32;\n\nfunction enforceCeiling(): void {\n  while (sessions.size > MAX_CACHED_SESSIONS) {\n    const oldest = sessions.keys().next().value;\n    if (oldest === undefined) return;\n    sessions.delete(oldest);\n    forgetBookkeeping(oldest);\n  }\n}\n\n/**\n * Erases the bookkeeping for an `agentId` across EVERY `cwd` it appears in.\n *\n * The three maps are keyed by `transcriptKey(cwd, agentId)`; `sessions` is the only one keyed by the\n * raw `agentId`. The ceiling's first version deleted from all three using `sessions`' key — that is,\n * deleted nothing — and left `hydratedKeys` **orphaned**. Since `hydrateSession` returns early when\n * the marker is present, an evicted session came back **empty** instead of rehydrating from disk:\n * silent amnesia, and a regression new to M95, because before it nothing evicted.\n *\n * The ceiling only knows the `agentId`, not the `cwd`, so it scans by suffix — which is the format\n * `transcriptKey` produces. A scan rather than an index because these maps hold tens of entries, not\n * thousands: a reverse index here would be new structure for a problem that does not exist.\n */\nfunction forgetBookkeeping(agentId: string): void {\n  const suffix = transcriptKey(\"\", agentId).slice(0 - agentId.length - 2);\n  for (const k of [...hydratedKeys]) if (k.endsWith(suffix)) hydratedKeys.delete(k);\n  for (const k of [...pendingWrites.keys()]) if (k.endsWith(suffix)) pendingWrites.delete(k);\n  for (const k of [...recordCounts.keys()]) if (k.endsWith(suffix)) recordCounts.delete(k);\n}\n\n/**\n * Erases the agent's module bookkeeping and returns how many entries were removed.\n *\n * M95 — `invalidateSessionCache` used to clear **two** of the four maps (`sessions`, `hydratedKeys`);\n * `pendingWrites` and `recordCounts` were never touched by id, so they grew for the life of the\n * process. Neither is large per entry — the leak is in count, not volume — but a cache with no owner\n * for removal is a cache that only grows.\n *\n * Returns the count so the caller can prove the removal; a second discard returns 0, which is what\n * makes the idempotency test possible without exposing the maps.\n */\nexport function discardSession(cwd: string, agentId: string): number {\n  const key = transcriptKey(cwd, agentId);\n  let removed = 0;\n  // `sessions` is NOT erased here — and the distinction is measured, not aesthetic. It holds the\n  // readable conversation, and there is a legitimate reader AFTER dispose: the golden\n  // `two-concurrent-sends-serialize` calls `getSessionMessages(agentId)` after `agent.dispose()`.\n  // Erasing it here returned an empty list and broke two goldens. What bounds it is the LRU ceiling\n  // above; the three below are pure bookkeeping, with no post-dispose reader.\n  //\n  // The key is `transcriptKey(cwd, agentId)` in ALL THREE — not the raw `agentId`. The first version\n  // erased two of them by `agentId` and therefore **never erased anything**; the test did not catch\n  // it because it only asserted that the SECOND call returns 0, which is true either way.\n  if (hydratedKeys.delete(key)) removed++;\n  if (pendingWrites.delete(key)) removed++;\n  if (recordCounts.delete(key)) removed++;\n  return removed;\n}\n\nexport function getSessionMessages(agentId: string): SessionMessage[] {\n  return sessions.get(agentId) ?? [];\n}\n\n/**\n * Persist a full conversation turn (user + assistant + tool blocks) to the native\n * transcript. Chained per-(agent, transcript) so on-disk order matches send order,\n * and fire-and-forget so `send()` is not blocked by disk I/O. Every\n * M50 — when the caller supplies `turn.autoCompact`, size-driven auto-compaction (usage real vs\n * the model's context window) runs in this same chain, surfaced via the optional `onCompact` observer.\n *\n * @internal\n */\nexport function persistTurnToTranscript(\n  store: SessionStore,\n  loc: TranscriptLocation,\n  sessionId: string,\n  turn: PersistTurnInput,\n  onCompact?: () => void,\n): void {\n  const key = transcriptKey(loc.cwd, loc.agentId);\n  // PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n  // sweeping these files (a nested root under refactor/). It is not new code and was not touched\n  // by M75; refactoring SDK internals without review would trade a visible problem for a diff\n  // risky. Tracked in usetheodev/theokit-sdk#151.\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\n  const chained = (pendingWrites.get(key) ?? Promise.resolve()).then(async () => {\n    try {\n      await persistTurn(store, loc, sessionId, turn);\n      const count = (recordCounts.get(key) ?? 0) + 1;\n      recordCounts.set(key, count);\n      // M50 — the 50-turn no-summary boundary stub is GONE (it silently amnesia'd the session).\n      // Auto-compaction is now size-driven with a real summary: see `maybeAutoCompact` below,\n      // invoked in this same write chain by the post-run lifecycle when usage is known.\n      if (turn.autoCompact !== undefined) {\n        const { autoCompactIfNeeded } = await import(\"./compact-session.js\");\n        const fired = await autoCompactIfNeeded({\n          store,\n          loc,\n          sessionId,\n          usageTotal: turn.autoCompact.usageTotal,\n          contextWindow: turn.autoCompact.contextWindow,\n          turnCount: count,\n          summarize: turn.autoCompact.summarize,\n        });\n        if (fired) onCompact?.();\n      }\n    } catch (cause) {\n      const msg = cause instanceof Error ? cause.message : String(cause);\n      diag(`[theokit-sdk] session transcript write failed (${loc.agentId}): ${msg}\\n`);\n    }\n  });\n  pendingWrites.set(\n    key,\n    chained.then(\n      () => undefined,\n      () => undefined,\n    ),\n  );\n}\n\n/**\n * Load the persisted transcript into the in-memory cache. Idempotent per\n * (baseDir, cwd, agentId). Call once per agent lifecycle before the first read.\n *\n * @internal\n */\nexport async function hydrateSession(\n  agentId: string,\n  loc: { store: SessionStore; cwd: string },\n): Promise<void> {\n  const key = transcriptKey(loc.cwd, agentId);\n  if (hydratedKeys.has(key)) return;\n  hydratedKeys.add(key);\n\n  const persisted = await readSessionMessages(loc.store, agentId);\n  if (persisted.length === 0) return;\n  // M51 review F4 — the DISK is the source of truth at hydration time: after an invalidation\n  // (compact/inject), an in-flight turn may have repopulated the cache with a SINGLE message before\n  // this hydrate ran; the old \"skip when non-empty\" guard then pinned the parent to a 1-message\n  // context (history + injected pair lost until restart). The persist chain serializes writes, so\n  // the disk already contains that in-flight turn — replacing is always correct.\n  sessions.set(agentId, persisted);\n}\n\n/**\n * Wait for all pending transcript writes to settle. Used by tests and by the\n * agent dispose path so on-disk state matches in-memory before the caller proceeds.\n *\n * @internal\n */\nexport async function flushSessionWrites(): Promise<void> {\n  while (pendingWrites.size > 0) {\n    const all = Array.from(pendingWrites.values());\n    pendingWrites.clear();\n    await Promise.all(all);\n  }\n}\n\nexport function clearSession(agentId: string): void {\n  sessions.delete(agentId);\n}\n\n/**\n * M50 review F1 — drop BOTH the message cache and the hydration marker so the NEXT send re-hydrates\n * from disk. Without this, a compaction only helps after a process restart: the live process keeps\n * sending the full pre-compact history (the cache is read synchronously by every send).\n */\n/**\n * M50 review F5 — run `fn` serialized on the SAME per-(cwd,agentId) write chain the per-turn\n * persistence uses, so a manual `Agent.compact` can never interleave with an in-flight turn's\n * writes (boundary landing mid-turn would orphan the turn from the replay).\n */\nexport function enqueueSessionWrite<T>(\n  cwd: string,\n  agentId: string,\n  fn: () => Promise<T>,\n): Promise<T> {\n  const key = transcriptKey(cwd, agentId);\n  const prior = pendingWrites.get(key) ?? Promise.resolve();\n  const result = prior.then(fn);\n  pendingWrites.set(\n    key,\n    result.then(\n      () => undefined,\n      () => undefined,\n    ),\n  );\n  return result;\n}\n\n/** Test-only: drop every cached session and hydration marker. @internal */\nexport function clearAllSessions(): void {\n  sessions.clear();\n  hydratedKeys.clear();\n  recordCounts.clear();\n  // M50 review F11 — the auto-compact attempt marks live on globalThis; tests reset them here.\n  const g = globalThis as unknown as Record<symbol, Map<string, number>>;\n  const sym = Symbol.for(\"theokit-sdk.session.auto-compact-attempts\");\n  g[sym]?.clear();\n}\n"]}
+{"version":3,"sources":["../src/internal/session/agent-session.ts"],"names":[],"mappings":";;;;;AAwCA,IAAM,aAAA,uBAAoB,GAAA,EAA2B;AACrD,IAAM,YAAA,uBAAmB,GAAA,EAAoB;AAStC,SAAS,oBAAA,CAAqB,SAAiB,OAAA,EAA+B;AACnF,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,OAAO,KAAK,EAAC;AAC3C,EAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AAIrB,EAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACvB,EAAA,QAAA,CAAS,GAAA,CAAI,SAAS,QAAQ,CAAA;AAC9B,EAAA,cAAA,EAAe;AACjB;AAWO,IAAM,mBAAA,GAAsB,EAAA;AAEnC,SAAS,cAAA,GAAuB;AAC9B,EAAA,OAAO,QAAA,CAAS,OAAO,mBAAA,EAAqB;AAC1C,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACtC,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AACtB,IAAA,iBAAA,CAAkB,MAAM,CAAA;AAAA,EAC1B;AACF;AAeA,SAAS,kBAAkB,OAAA,EAAuB;AAChD,EAAA,MAAM,MAAA,GAAS,cAAc,EAAA,EAAI,OAAO,EAAE,KAAA,CAAM,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA;AACtE,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,YAAY,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,YAAA,CAAa,MAAA,CAAO,CAAC,CAAA;AAChF,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,aAAA,CAAc,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,aAAA,CAAc,OAAO,CAAC,CAAA;AACzF,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,YAAA,CAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,YAAA,CAAa,OAAO,CAAC,CAAA;AACzF;AAaO,SAAS,cAAA,CAAe,KAAa,OAAA,EAAyB;AACnE,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,OAAA,GAAU,CAAA;AAUd,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC9B,EAAA,IAAI,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC/B,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC9B,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,mBAAmB,OAAA,EAAmC;AACpE,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA,IAAK,EAAC;AACnC;AAWO,SAAS,uBAAA,CACd,KAAA,EACA,GAAA,EACA,SAAA,EACA,MACA,SAAA,EACM;AACN,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,GAAA,EAAK,IAAI,OAAO,CAAA;AAM9C,EAAA,MAAM,OAAA,GAAA,CAAW,cAAc,GAAA,CAAI,GAAG,KAAK,OAAA,CAAQ,OAAA,EAAQ,EAAG,IAAA,CAAK,YAAY;AAC7E,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,CAAY,KAAA,EAAO,GAAA,EAAK,SAAA,EAAW,IAAI,CAAA;AAC7C,MAAA,MAAM,KAAA,GAAA,CAAS,YAAA,CAAa,GAAA,CAAI,GAAG,KAAK,CAAA,IAAK,CAAA;AAC7C,MAAA,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAA;AAI3B,MAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,CAAA,EAAW;AAClC,QAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,OAAO,+BAAsB,CAAA;AACnE,QAAA,MAAM,KAAA,GAAQ,MAAM,mBAAA,CAAoB;AAAA,UACtC,KAAA;AAAA,UACA,GAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA,EAAY,KAAK,WAAA,CAAY,UAAA;AAAA,UAC7B,aAAA,EAAe,KAAK,WAAA,CAAY,aAAA;AAAA,UAChC,SAAA,EAAW,KAAA;AAAA,UACX,SAAA,EAAW,KAAK,WAAA,CAAY;AAAA,SAC7B,CAAA;AACD,QAAA,IAAI,OAAO,SAAA,IAAY;AAAA,MACzB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,MAAM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACjE,MAAA,IAAA,CAAK,CAAA,+CAAA,EAAkD,GAAA,CAAI,OAAO,CAAA,GAAA,EAAM,GAAG;AAAA,CAAI,CAAA;AAAA,IACjF;AAAA,EACF,CAAC,CAAA;AACD,EAAA,aAAA,CAAc,GAAA;AAAA,IACZ,GAAA;AAAA,IACA,OAAA,CAAQ,IAAA;AAAA,MACN,MAAM,MAAA;AAAA,MACN,MAAM;AAAA;AACR,GACF;AACF;AAQA,eAAsB,cAAA,CACpB,SACA,GAAA,EACe;AACf,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC1C,EAAA,IAAI,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3B,EAAA,YAAA,CAAa,IAAI,GAAG,CAAA;AAEpB,EAAA,MAAM,SAAA,GAAY,MAAM,mBAAA,CAAoB,GAAA,CAAI,OAAO,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAM5B,EAAA,QAAA,CAAS,GAAA,CAAI,SAAS,SAAS,CAAA;AACjC;AAQA,eAAsB,kBAAA,GAAoC;AACxD,EAAA,OAAO,aAAA,CAAc,OAAO,CAAA,EAAG;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AAC7C,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,MAAM,OAAA,CAAQ,IAAI,GAAG,CAAA;AAAA,EACvB;AACF;AAEO,SAAS,aAAa,OAAA,EAAuB;AAClD,EAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACzB;AAYO,SAAS,mBAAA,CACd,GAAA,EACA,OAAA,EACA,EAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,MAAM,QAAQ,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,IAAK,QAAQ,OAAA,EAAQ;AACxD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA;AAC5B,EAAA,aAAA,CAAc,GAAA;AAAA,IACZ,GAAA;AAAA,IACA,MAAA,CAAO,IAAA;AAAA,MACL,MAAM,MAAA;AAAA,MACN,MAAM;AAAA;AACR,GACF;AACA,EAAA,OAAO,MAAA;AACT","file":"chunk-42PLABFU.js","sourcesContent":["import type { SessionStore } from \"../../types/session-store.js\";\nimport {\n  type PersistTurnInput,\n  persistTurn,\n  readSessionMessages,\n  type TranscriptLocation,\n} from \"./agent-session-store.js\";\n\n/**\n * Per-agent conversation history kept across runs (and across `Agent.resume()`\n * within the same process). Lets the fixture responder recall prior facts when\n * the user asks a follow-up question.\n *\n * SE40 — disk persistence IS the native Claude-shaped `.jsonl` transcript. The\n * in-memory cache holds the narrowed `SessionMessage[]` (user/assistant text) so\n * a send can read `priorMessages` synchronously; the whole rich turn (user +\n * assistant + tool blocks) lands on disk once per send via {@link persistTurnToTranscript}\n * (fed by `run.conversation()`). Hydration on resume reconstructs the session by\n * walking the transcript DAG (`readSessionMessages`).\n *\n * @internal\n */\n\n// `SessionMessage` lives in `./session-types.ts` (leaf types file). Re-exported\n// for back-compat with downstream importers that pulled it from here.\nexport type { SessionMessage } from \"./session-types.js\";\n\nimport type { SessionMessage } from \"./session-types.js\";\n\n// M75 — the cache lives in a leaf; see session-cache.ts for the reason (cycle broken by extraction).\nexport {\n  hydratedKeys,\n  invalidateSessionCache,\n  sessions,\n  transcriptKey,\n} from \"./session-cache.js\";\n\nimport { diag } from \"../diagnostics.js\";\nimport { hydratedKeys, sessions, transcriptKey } from \"./session-cache.js\";\n\nconst pendingWrites = new Map<string, Promise<void>>();\nconst recordCounts = new Map<string, number>();\n\n/**\n * Append a session message to the in-memory cache only. Disk persistence for the\n * whole turn happens once per send via {@link persistTurnToTranscript}; the cache\n * feeds `priorMessages` / `onBeforeSend.previousMessageCount` synchronously.\n *\n * @internal\n */\nexport function appendSessionMessage(agentId: string, message: SessionMessage): void {\n  const existing = sessions.get(agentId) ?? [];\n  existing.push(message);\n  // `delete` + `set` reinserts at the END: a JS `Map` preserves insertion order, so the first key\n  // is always the least recently touched. That is the entire LRU, with no new structure (parsimony\n  // rungs 2/5 — the ordering we need is already a language guarantee).\n  sessions.delete(agentId);\n  sessions.set(agentId, existing);\n  enforceCeiling();\n}\n\n/**\n * Ceiling on sessions kept in memory.\n *\n * The runtime only reads the **active** session; the rest is pure cache, rebuildable from the\n * on-disk transcript. 32 is deliberately generous — the primary removal path is the explicit\n * `discardSession()` at the end of the agent's life, and this ceiling is a safety net against a\n * long-lived process running hundreds of sessions (plan risk #2: a tight ceiling could evict a\n * session still referenced by an in-flight async path).\n */\nexport const MAX_CACHED_SESSIONS = 32;\n\nfunction enforceCeiling(): void {\n  while (sessions.size > MAX_CACHED_SESSIONS) {\n    const oldest = sessions.keys().next().value;\n    if (oldest === undefined) return;\n    sessions.delete(oldest);\n    forgetBookkeeping(oldest);\n  }\n}\n\n/**\n * Erases the bookkeeping for an `agentId` across EVERY `cwd` it appears in.\n *\n * The three maps are keyed by `transcriptKey(cwd, agentId)`; `sessions` is the only one keyed by the\n * raw `agentId`. The ceiling's first version deleted from all three using `sessions`' key — that is,\n * deleted nothing — and left `hydratedKeys` **orphaned**. Since `hydrateSession` returns early when\n * the marker is present, an evicted session came back **empty** instead of rehydrating from disk:\n * silent amnesia, and a regression new to M95, because before it nothing evicted.\n *\n * The ceiling only knows the `agentId`, not the `cwd`, so it scans by suffix — which is the format\n * `transcriptKey` produces. A scan rather than an index because these maps hold tens of entries, not\n * thousands: a reverse index here would be new structure for a problem that does not exist.\n */\nfunction forgetBookkeeping(agentId: string): void {\n  const suffix = transcriptKey(\"\", agentId).slice(0 - agentId.length - 2);\n  for (const k of [...hydratedKeys]) if (k.endsWith(suffix)) hydratedKeys.delete(k);\n  for (const k of [...pendingWrites.keys()]) if (k.endsWith(suffix)) pendingWrites.delete(k);\n  for (const k of [...recordCounts.keys()]) if (k.endsWith(suffix)) recordCounts.delete(k);\n}\n\n/**\n * Erases the agent's module bookkeeping and returns how many entries were removed.\n *\n * M95 — `invalidateSessionCache` used to clear **two** of the four maps (`sessions`, `hydratedKeys`);\n * `pendingWrites` and `recordCounts` were never touched by id, so they grew for the life of the\n * process. Neither is large per entry — the leak is in count, not volume — but a cache with no owner\n * for removal is a cache that only grows.\n *\n * Returns the count so the caller can prove the removal; a second discard returns 0, which is what\n * makes the idempotency test possible without exposing the maps.\n */\nexport function discardSession(cwd: string, agentId: string): number {\n  const key = transcriptKey(cwd, agentId);\n  let removed = 0;\n  // `sessions` is NOT erased here — and the distinction is measured, not aesthetic. It holds the\n  // readable conversation, and there is a legitimate reader AFTER dispose: the golden\n  // `two-concurrent-sends-serialize` calls `getSessionMessages(agentId)` after `agent.dispose()`.\n  // Erasing it here returned an empty list and broke two goldens. What bounds it is the LRU ceiling\n  // above; the three below are pure bookkeeping, with no post-dispose reader.\n  //\n  // The key is `transcriptKey(cwd, agentId)` in ALL THREE — not the raw `agentId`. The first version\n  // erased two of them by `agentId` and therefore **never erased anything**; the test did not catch\n  // it because it only asserted that the SECOND call returns 0, which is true either way.\n  if (hydratedKeys.delete(key)) removed++;\n  if (pendingWrites.delete(key)) removed++;\n  if (recordCounts.delete(key)) removed++;\n  return removed;\n}\n\nexport function getSessionMessages(agentId: string): SessionMessage[] {\n  return sessions.get(agentId) ?? [];\n}\n\n/**\n * Persist a full conversation turn (user + assistant + tool blocks) to the native\n * transcript. Chained per-(agent, transcript) so on-disk order matches send order,\n * and fire-and-forget so `send()` is not blocked by disk I/O. Every\n * M50 — when the caller supplies `turn.autoCompact`, size-driven auto-compaction (usage real vs\n * the model's context window) runs in this same chain, surfaced via the optional `onCompact` observer.\n *\n * @internal\n */\nexport function persistTurnToTranscript(\n  store: SessionStore,\n  loc: TranscriptLocation,\n  sessionId: string,\n  turn: PersistTurnInput,\n  onCompact?: () => void,\n): void {\n  const key = transcriptKey(loc.cwd, loc.agentId);\n  // PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n  // sweeping these files (a nested root under refactor/). It is not new code and was not touched\n  // by M75; refactoring SDK internals without review would trade a visible problem for a diff\n  // risky. Tracked in usetheodev/theokit-sdk#151.\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\n  const chained = (pendingWrites.get(key) ?? Promise.resolve()).then(async () => {\n    try {\n      await persistTurn(store, loc, sessionId, turn);\n      const count = (recordCounts.get(key) ?? 0) + 1;\n      recordCounts.set(key, count);\n      // M50 — the 50-turn no-summary boundary stub is GONE (it silently amnesia'd the session).\n      // Auto-compaction is now size-driven with a real summary: see `maybeAutoCompact` below,\n      // invoked in this same write chain by the post-run lifecycle when usage is known.\n      if (turn.autoCompact !== undefined) {\n        const { autoCompactIfNeeded } = await import(\"./compact-session.js\");\n        const fired = await autoCompactIfNeeded({\n          store,\n          loc,\n          sessionId,\n          usageTotal: turn.autoCompact.usageTotal,\n          contextWindow: turn.autoCompact.contextWindow,\n          turnCount: count,\n          summarize: turn.autoCompact.summarize,\n        });\n        if (fired) onCompact?.();\n      }\n    } catch (cause) {\n      const msg = cause instanceof Error ? cause.message : String(cause);\n      diag(`[theokit-sdk] session transcript write failed (${loc.agentId}): ${msg}\\n`);\n    }\n  });\n  pendingWrites.set(\n    key,\n    chained.then(\n      () => undefined,\n      () => undefined,\n    ),\n  );\n}\n\n/**\n * Load the persisted transcript into the in-memory cache. Idempotent per\n * (baseDir, cwd, agentId). Call once per agent lifecycle before the first read.\n *\n * @internal\n */\nexport async function hydrateSession(\n  agentId: string,\n  loc: { store: SessionStore; cwd: string },\n): Promise<void> {\n  const key = transcriptKey(loc.cwd, agentId);\n  if (hydratedKeys.has(key)) return;\n  hydratedKeys.add(key);\n\n  const persisted = await readSessionMessages(loc.store, agentId);\n  if (persisted.length === 0) return;\n  // M51 review F4 — the DISK is the source of truth at hydration time: after an invalidation\n  // (compact/inject), an in-flight turn may have repopulated the cache with a SINGLE message before\n  // this hydrate ran; the old \"skip when non-empty\" guard then pinned the parent to a 1-message\n  // context (history + injected pair lost until restart). The persist chain serializes writes, so\n  // the disk already contains that in-flight turn — replacing is always correct.\n  sessions.set(agentId, persisted);\n}\n\n/**\n * Wait for all pending transcript writes to settle. Used by tests and by the\n * agent dispose path so on-disk state matches in-memory before the caller proceeds.\n *\n * @internal\n */\nexport async function flushSessionWrites(): Promise<void> {\n  while (pendingWrites.size > 0) {\n    const all = Array.from(pendingWrites.values());\n    pendingWrites.clear();\n    await Promise.all(all);\n  }\n}\n\nexport function clearSession(agentId: string): void {\n  sessions.delete(agentId);\n}\n\n/**\n * M50 review F1 — drop BOTH the message cache and the hydration marker so the NEXT send re-hydrates\n * from disk. Without this, a compaction only helps after a process restart: the live process keeps\n * sending the full pre-compact history (the cache is read synchronously by every send).\n */\n/**\n * M50 review F5 — run `fn` serialized on the SAME per-(cwd,agentId) write chain the per-turn\n * persistence uses, so a manual `Agent.compact` can never interleave with an in-flight turn's\n * writes (boundary landing mid-turn would orphan the turn from the replay).\n */\nexport function enqueueSessionWrite<T>(\n  cwd: string,\n  agentId: string,\n  fn: () => Promise<T>,\n): Promise<T> {\n  const key = transcriptKey(cwd, agentId);\n  const prior = pendingWrites.get(key) ?? Promise.resolve();\n  const result = prior.then(fn);\n  pendingWrites.set(\n    key,\n    result.then(\n      () => undefined,\n      () => undefined,\n    ),\n  );\n  return result;\n}\n\n/** Test-only: drop every cached session and hydration marker. @internal */\nexport function clearAllSessions(): void {\n  sessions.clear();\n  hydratedKeys.clear();\n  recordCounts.clear();\n  // M50 review F11 — the auto-compact attempt marks live on globalThis; tests reset them here.\n  const g = globalThis as unknown as Record<symbol, Map<string, number>>;\n  const sym = Symbol.for(\"theokit-sdk.session.auto-compact-attempts\");\n  g[sym]?.clear();\n}\n"]}