@theokit/sdk 4.52.0 → 4.53.0

package/dist/mcp-auth.js

@@ -0,0 +1,292 @@
+import { atomicWriteJson } from './chunk-CHVSMEKM.js';
+import { assertSecureModes } from './chunk-23VZBRDQ.js';
+import { ConfigurationError } from './chunk-HI4ZW62S.js';
+import { diag } from './chunk-4X3SBHPK.js';
+import { randomBytes, createHash } from 'crypto';
+import { createServer } from 'http';
+import { createInterface } from 'readline/promises';
+import { existsSync, readFileSync, chmodSync, mkdirSync } from 'fs';
+import { createRequire } from 'module';
+import { homedir } from 'os';
+import { join, dirname } from 'path';
+
+var KEYTAR_SERVICE = "theokit-mcp";
+var FILE_PATH = join(homedir(), ".theokit", "mcp-tokens.json");
+function ensurePrivateStoreDir() {
+  const dir = dirname(FILE_PATH);
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    chmodSync(dir, 448);
+  } catch {
+  }
+}
+var keytarWarned = false;
+var cachedKeytar;
+function tryRequireKeytar() {
+  if (cachedKeytar !== void 0) return cachedKeytar;
+  try {
+    const r = createRequire(import.meta.url);
+    cachedKeytar = r("keytar");
+  } catch {
+    if (!keytarWarned) {
+      diag(
+        "[theokit-sdk] keytar not installed; MCP OAuth tokens will be stored in ~/.theokit/mcp-tokens.json (chmod 600 where POSIX). Install `keytar` for OS keychain storage.\n"
+      );
+      keytarWarned = true;
+    }
+    cachedKeytar = null;
+  }
+  return cachedKeytar;
+}
+var inflightRefresh = /* @__PURE__ */ new Map();
+async function setTokens(serverName, tokens) {
+  const kt = tryRequireKeytar();
+  const payload = JSON.stringify(tokens);
+  if (kt !== null && kt !== void 0) {
+    await kt.setPassword(KEYTAR_SERVICE, serverName, payload);
+    return;
+  }
+  ensurePrivateStoreDir();
+  let allTokens = {};
+  if (existsSync(FILE_PATH)) {
+    try {
+      allTokens = JSON.parse(readFileSync(FILE_PATH, "utf8"));
+    } catch {
+      allTokens = {};
+    }
+  }
+  allTokens[serverName] = tokens;
+  await atomicWriteJson(FILE_PATH, allTokens);
+  try {
+    chmodSync(FILE_PATH, 384);
+  } catch {
+  }
+}
+async function getTokens(serverName) {
+  const kt = tryRequireKeytar();
+  if (kt !== null && kt !== void 0) {
+    const value = await kt.getPassword(KEYTAR_SERVICE, serverName);
+    if (typeof value !== "string") return void 0;
+    try {
+      return JSON.parse(value);
+    } catch {
+      return void 0;
+    }
+  }
+  if (!existsSync(FILE_PATH)) return void 0;
+  assertSecureModes(dirname(FILE_PATH), FILE_PATH);
+  try {
+    const all = JSON.parse(readFileSync(FILE_PATH, "utf8"));
+    return all[serverName];
+  } catch {
+    return void 0;
+  }
+}
+function lockedRefresh(serverName, refreshFn) {
+  const existing = inflightRefresh.get(serverName);
+  if (existing !== void 0) return existing;
+  const promise = (async () => {
+    try {
+      return await refreshFn();
+    } finally {
+      inflightRefresh.delete(serverName);
+    }
+  })();
+  inflightRefresh.set(serverName, promise);
+  return promise;
+}
+
+// src/internal/mcp/oauth.ts
+function base64url(n) {
+  return randomBytes(n).toString("base64url");
+}
+function challengeFor(verifier) {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+async function refreshAccessToken(serverName, clientId, refreshToken, oauth) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: clientId
+  });
+  const response = await fetch(oauth.tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    throw new ConfigurationError(`OAuth refresh failed: HTTP ${response.status}`, {
+      code: "oauth_refresh_failed"
+    });
+  }
+  const data = await response.json();
+  const obtainedAt = Date.now();
+  const tokens = {
+    accessToken: data.access_token,
+    refreshToken: data.refresh_token ?? refreshToken,
+    // EC-10: default conservative 3600s if expires_in missing.
+    expiresAt: obtainedAt + (data.expires_in ?? 3600) * 1e3,
+    obtainedAt,
+    ...data.scope !== void 0 ? { scope: data.scope } : {}
+  };
+  await setTokens(serverName, tokens);
+  return tokens;
+}
+async function runPkceFlow(serverName, clientId, scopes, oauth) {
+  const verifier = base64url(48);
+  const challenge = challengeFor(verifier);
+  const state = base64url(16);
+  const timeoutMs = oauth.timeoutMs ?? 3e5;
+  let redirectUri;
+  let codeWaiter;
+  let cleanup = () => {
+  };
+  if (oauth.redirectMode === "localhost") {
+    const result = await openLocalhostCallback(state, timeoutMs);
+    redirectUri = result.redirectUri;
+    codeWaiter = result.waitFor;
+    cleanup = result.close;
+  } else {
+    redirectUri = "urn:ietf:wg:oauth:2.0:oob";
+    codeWaiter = readCodeFromStdin(state, timeoutMs);
+  }
+  try {
+    const authUrl = new URL(oauth.authorizationEndpoint);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    if (scopes !== void 0 && scopes.length > 0) {
+      authUrl.searchParams.set("scope", scopes.join(" "));
+    }
+    authUrl.searchParams.set("code_challenge", challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    authUrl.searchParams.set("state", state);
+    diag(
+      `
+[theokit-sdk] OAuth required for MCP server "${serverName}".
+Open this URL to authenticate:
+  ${authUrl.toString()}
+
+`
+    );
+    const { code, state: returnedState } = await codeWaiter;
+    if (returnedState !== state) {
+      throw new ConfigurationError(
+        "OAuth state mismatch \u2014 possible CSRF attempt; aborting token exchange.",
+        { code: "oauth_state_mismatch" }
+      );
+    }
+    const tokenBody = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      client_id: clientId,
+      code_verifier: verifier,
+      redirect_uri: redirectUri
+    });
+    const response = await fetch(oauth.tokenEndpoint, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: tokenBody.toString()
+    });
+    if (!response.ok) {
+      const errText = await response.text();
+      throw new ConfigurationError(
+        `OAuth token exchange failed: HTTP ${response.status}: ${errText.slice(0, 200)}`,
+        { code: "oauth_token_exchange_failed" }
+      );
+    }
+    const data = await response.json();
+    const obtainedAt = Date.now();
+    return {
+      accessToken: data.access_token,
+      ...data.refresh_token !== void 0 ? { refreshToken: data.refresh_token } : {},
+      // EC-10: default 3600s when expires_in absent.
+      expiresAt: obtainedAt + (data.expires_in ?? 3600) * 1e3,
+      obtainedAt,
+      ...data.scope !== void 0 ? { scope: data.scope } : {}
+    };
+  } finally {
+    cleanup();
+  }
+}
+async function openLocalhostCallback(expectedState, timeoutMs) {
+  let resolveCode;
+  let rejectCode;
+  const waitFor = new Promise((res, rej) => {
+    resolveCode = res;
+    rejectCode = rej;
+  });
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (typeof code !== "string" || typeof state !== "string") {
+      res.statusCode = 400;
+      res.end("Missing code or state");
+      return;
+    }
+    if (state !== expectedState) {
+      res.statusCode = 400;
+      res.end("State mismatch \u2014 request rejected.");
+      return;
+    }
+    res.statusCode = 200;
+    res.end("Authentication successful. You can close this tab and return to the terminal.");
+    resolveCode?.({ code, state });
+  });
+  server.listen(0, "127.0.0.1");
+  const timeoutHandle = setTimeout(() => {
+    rejectCode?.(new ConfigurationError("OAuth flow timed out", { code: "oauth_timeout" }));
+  }, timeoutMs);
+  await new Promise((r) => {
+    if (server.listening) r();
+    else server.once("listening", () => r());
+  });
+  const address = server.address();
+  if (typeof address !== "object" || address === null) {
+    server.close();
+    throw new ConfigurationError("OAuth localhost callback failed to bind", {
+      code: "oauth_bind_failed"
+    });
+  }
+  const port = address.port;
+  return {
+    redirectUri: `http://127.0.0.1:${port}/callback`,
+    waitFor,
+    close: () => {
+      clearTimeout(timeoutHandle);
+      server.close();
+    }
+  };
+}
+async function readCodeFromStdin(expectedState, timeoutMs) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  const promise = new Promise((resolve, reject) => {
+    rl.question("Paste the full callback URL (or just the code): ").then((answer) => {
+      rl.close();
+      const trimmed = answer.trim();
+      if (trimmed.includes("?")) {
+        try {
+          const parsed = new URL(trimmed);
+          const code = parsed.searchParams.get("code");
+          const state = parsed.searchParams.get("state") ?? "";
+          if (typeof code === "string") {
+            resolve({ code, state });
+            return;
+          }
+        } catch {
+        }
+      }
+      resolve({ code: trimmed, state: expectedState });
+    }).catch(reject);
+    setTimeout(() => {
+      rl.close();
+      reject(new ConfigurationError("OAuth manual input timed out", { code: "oauth_timeout" }));
+    }, timeoutMs);
+  });
+  return promise;
+}
+
+export { getTokens, lockedRefresh, refreshAccessToken, runPkceFlow, setTokens };
+//# sourceMappingURL=mcp-auth.js.map
+//# sourceMappingURL=mcp-auth.js.map

package/dist/mcp-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/mcp/token-storage.ts","../src/internal/mcp/oauth.ts"],"names":[],"mappings":";;;;;;;;;;;;AAqBA,IAAM,cAAA,GAAiB,aAAA;AACvB,IAAM,SAAA,GAAY,IAAA,CAAK,OAAA,EAAQ,EAAG,YAAY,iBAAiB,CAAA;AAgB/D,SAAS,qBAAA,GAA8B;AACrC,EAAA,MAAM,GAAA,GAAM,QAAQ,SAAS,CAAA;AAC7B,EAAA,IAAI;AACF,IAAA,SAAA,CAAU,KAAK,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAC/C,IAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AAAA,EAGR;AACF;AAQA,IAAI,YAAA,GAAe,KAAA;AACnB,IAAI,YAAA;AACJ,SAAS,gBAAA,GAAsC;AAC7C,EAAA,IAAI,YAAA,KAAiB,QAAW,OAAO,YAAA;AACvC,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACvC,IAAA,YAAA,GAAe,EAAE,QAAQ,CAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,IAAA;AAAA,QACE;AAAA,OACF;AACA,MAAA,YAAA,GAAe,IAAA;AAAA,IACjB;AACA,IAAA,YAAA,GAAe,IAAA;AAAA,EACjB;AACA,EAAA,OAAO,YAAA;AACT;AAIA,IAAM,eAAA,uBAAsB,GAAA,EAAkC;AAQ9D,eAAsB,SAAA,CAAU,YAAoB,MAAA,EAAoC;AACtF,EAAA,MAAM,KAAK,gBAAA,EAAiB;AAC5B,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AACrC,EAAA,IAAI,EAAA,KAAO,IAAA,IAAQ,EAAA,KAAO,MAAA,EAAW;AACnC,IAAA,MAAM,EAAA,CAAG,WAAA,CAAY,cAAA,EAAgB,UAAA,EAAY,OAAO,CAAA;AACxD,IAAA;AAAA,EACF;AAEA,EAAA,qBAAA,EAAsB;AACtB,EAAA,IAAI,YAAyC,EAAC;AAC9C,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,SAAA,EAAW,MAAM,CAAC,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AAEN,MAAA,SAAA,GAAY,EAAC;AAAA,IACf;AAAA,EACF;AACA,EAAA,SAAA,CAAU,UAAU,CAAA,GAAI,MAAA;AACxB,EAAA,MAAM,eAAA,CAAgB,WAAW,SAAS,CAAA;AAC1C,EAAA,IAAI;AACF,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAOA,eAAsB,UAAU,UAAA,EAAsD;AACpF,EAAA,MAAM,KAAK,gBAAA,EAAiB;AAC5B,EAAA,IAAI,EAAA,KAAO,IAAA,IAAQ,EAAA,KAAO,MAAA,EAAW;AACnC,IAAA,MAAM,KAAA,GAAQ,MAAM,EAAA,CAAG,WAAA,CAAY,gBAAgB,UAAU,CAAA;AAC7D,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,MAAA;AACtC,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,MAAA;AAMnC,EAAA,iBAAA,CAAkB,OAAA,CAAQ,SAAS,CAAA,EAAG,SAAS,CAAA;AAC/C,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,SAAA,EAAW,MAAM,CAAC,CAAA;AACtD,IAAA,OAAO,IAAI,UAAU,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AASO,SAAS,aAAA,CACd,YACA,SAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,GAAA,CAAI,UAAU,CAAA;AAC/C,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,EAAA,MAAM,WAAW,YAAY;AAC3B,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,EAAU;AAAA,IACzB,CAAA,SAAE;AACA,MAAA,eAAA,CAAgB,OAAO,UAAU,CAAA;AAAA,IACnC;AAAA,EACF,CAAA,GAAG;AACH,EAAA,eAAA,CAAgB,GAAA,CAAI,YAAY,OAAO,CAAA;AACvC,EAAA,OAAO,OAAA;AACT;;;ACjJA,SAAS,UAAU,CAAA,EAAmB;AACpC,EAAA,OAAO,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,WAAW,CAAA;AAC5C;AAKA,SAAS,aAAa,QAAA,EAA0B;AAC9C,EAAA,OAAO,WAAW,QAAQ,CAAA,CAAE,OAAO,QAAQ,CAAA,CAAE,OAAO,WAAW,CAAA;AACjE;AAOA,eAAsB,kBAAA,CACpB,UAAA,EACA,QAAA,EACA,YAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,CAAgB;AAAA,IAC/B,UAAA,EAAY,eAAA;AAAA,IACZ,aAAA,EAAe,YAAA;AAAA,IACf,SAAA,EAAW;AAAA,GACZ,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IAChD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,KAAK,QAAA;AAAS,GACrB,CAAA;AACD,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,2BAAA,EAA8B,QAAA,CAAS,MAAM,CAAA,CAAA,EAAI;AAAA,MAC5E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,EAAA,MAAM,UAAA,GAAa,KAAK,GAAA,EAAI;AAC5B,EAAA,MAAM,MAAA,GAAsB;AAAA,IAC1B,aAAa,IAAA,CAAK,YAAA;AAAA,IAClB,YAAA,EAAc,KAAK,aAAA,IAAiB,YAAA;AAAA;AAAA,IAEpC,SAAA,EAAW,UAAA,GAAA,CAAc,IAAA,CAAK,UAAA,IAAc,IAAA,IAAQ,GAAA;AAAA,IACpD,UAAA;AAAA,IACA,GAAI,KAAK,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAM,GAAI;AAAC,GAC1D;AACA,EAAA,MAAM,SAAA,CAAU,YAAY,MAAM,CAAA;AAClC,EAAA,OAAO,MAAA;AACT;AAUA,eAAsB,WAAA,CACpB,UAAA,EACA,QAAA,EACA,MAAA,EACA,KAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,UAAU,EAAE,CAAA;AAC7B,EAAA,MAAM,SAAA,GAAY,aAAa,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,UAAU,EAAE,CAAA;AAC1B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,GAAA;AAErC,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI,UAAsB,MAAM;AAAA,EAAC,CAAA;AAEjC,EAAA,IAAI,KAAA,CAAM,iBAAiB,WAAA,EAAa;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,qBAAA,CAAsB,KAAA,EAAO,SAAS,CAAA;AAC3D,IAAA,WAAA,GAAc,MAAA,CAAO,WAAA;AACrB,IAAA,UAAA,GAAa,MAAA,CAAO,OAAA;AACpB,IAAA,OAAA,GAAU,MAAA,CAAO,KAAA;AAAA,EACnB,CAAA,MAAO;AACL,IAAA,WAAA,GAAc,2BAAA;AACd,IAAA,UAAA,GAAa,iBAAA,CAAkB,OAAO,SAAS,CAAA;AAAA,EACjD;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,KAAA,CAAM,qBAAqB,CAAA;AACnD,IAAA,OAAA,CAAQ,YAAA,CAAa,GAAA,CAAI,eAAA,EAAiB,MAAM,CAAA;AAChD,IAAA,OAAA,CAAQ,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,QAAQ,CAAA;AAC9C,IAAA,OAAA,CAAQ,YAAA,CAAa,GAAA,CAAI,cAAA,EAAgB,WAAW,CAAA;AACpD,IAAA,IAAI,MAAA,KAAW,KAAA,CAAA,IAAa,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG;AAC7C,MAAA,OAAA,CAAQ,aAAa,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,IACpD;AACA,IAAA,OAAA,CAAQ,YAAA,CAAa,GAAA,CAAI,gBAAA,EAAkB,SAAS,CAAA;AACpD,IAAA,OAAA,CAAQ,YAAA,CAAa,GAAA,CAAI,uBAAA,EAAyB,MAAM,CAAA;AACxD,IAAA,OAAA,CAAQ,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AAEvC,IAAA,IAAA;AAAA,MACE;AAAA,6CAAA,EAAkD,UAAU,CAAA;AAAA;AAAA,EAAA,EACrB,OAAA,CAAQ,UAAU;;AAAA;AAAA,KAC3D;AAEA,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,aAAA,KAAkB,MAAM,UAAA;AAE7C,IAAA,IAAI,kBAAkB,KAAA,EAAO;AAC3B,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,6EAAA;AAAA,QACA,EAAE,MAAM,sBAAA;AAAuB,OACjC;AAAA,IACF;AAGA,IAAA,MAAM,SAAA,GAAY,IAAI,eAAA,CAAgB;AAAA,MACpC,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,SAAA,EAAW,QAAA;AAAA,MACX,aAAA,EAAe,QAAA;AAAA,MACf,YAAA,EAAc;AAAA,KACf,CAAA;AACD,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,UAAU,QAAA;AAAS,KAC1B,CAAA;AACD,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,IAAA,EAAK;AACpC,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,CAAA,kCAAA,EAAqC,SAAS,MAAM,CAAA,EAAA,EAAK,QAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAAA,QAC9E,EAAE,MAAM,6BAAA;AAA8B,OACxC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,IAAA,MAAM,UAAA,GAAa,KAAK,GAAA,EAAI;AAC5B,IAAA,OAAO;AAAA,MACL,aAAa,IAAA,CAAK,YAAA;AAAA,MAClB,GAAI,KAAK,aAAA,KAAkB,KAAA,CAAA,GAAY,EAAE,YAAA,EAAc,IAAA,CAAK,aAAA,EAAc,GAAI,EAAC;AAAA;AAAA,MAE/E,SAAA,EAAW,UAAA,GAAA,CAAc,IAAA,CAAK,UAAA,IAAc,IAAA,IAAQ,GAAA;AAAA,MACpD,UAAA;AAAA,MACA,GAAI,KAAK,KAAA,KAAU,KAAA,CAAA,GAAY,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAM,GAAI;AAAC,KAC1D;AAAA,EACF,CAAA,SAAE;AACA,IAAA,OAAA,EAAQ;AAAA,EACV;AACF;AASA,eAAe,qBAAA,CACb,eACA,SAAA,EAKC;AACD,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,UAAA;AACJ,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAyC,CAAC,KAAK,GAAA,KAAQ;AACzE,IAAA,WAAA,GAAc,GAAA;AACd,IAAA,UAAA,GAAa,GAAA;AAAA,EACf,CAAC,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,CAAC,GAAA,EAAsB,GAAA,KAAwB;AACzE,IAAA,MAAM,MAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAA,IAAO,KAAK,kBAAkB,CAAA;AACtD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACxC,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAC1C,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,UAAU,QAAA,EAAU;AACzD,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,IAAI,uBAAuB,CAAA;AAC/B,MAAA;AAAA,IACF;AAGA,IAAA,IAAI,UAAU,aAAA,EAAe;AAC3B,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,IAAI,yCAAoC,CAAA;AAC5C,MAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,IAAA,GAAA,CAAI,IAAI,+EAA+E,CAAA;AACvF,IAAA,WAAA,GAAc,EAAE,IAAA,EAAM,KAAA,EAAO,CAAA;AAAA,EAC/B,CAAC,CAAA;AACD,EAAA,MAAA,CAAO,MAAA,CAAO,GAAG,WAAW,CAAA;AAC5B,EAAA,MAAM,aAAA,GAAgB,WAAW,MAAM;AACrC,IAAA,UAAA,GAAa,IAAI,kBAAA,CAAmB,sBAAA,EAAwB,EAAE,IAAA,EAAM,eAAA,EAAiB,CAAC,CAAA;AAAA,EACxF,GAAG,SAAS,CAAA;AAEZ,EAAA,MAAM,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM;AAC7B,IAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAE;AAAA,SACnB,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,MAAM,GAAG,CAAA;AAAA,EACzC,CAAC,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,EAAQ;AAC/B,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,KAAY,IAAA,EAAM;AACnD,IAAA,MAAA,CAAO,KAAA,EAAM;AACb,IAAA,MAAM,IAAI,mBAAmB,yCAAA,EAA2C;AAAA,MACtE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AACrB,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,oBAAoB,IAAI,CAAA,SAAA,CAAA;AAAA,IACrC,OAAA;AAAA,IACA,OAAO,MAAM;AACX,MAAA,YAAA,CAAa,aAAa,CAAA;AAC1B,MAAA,MAAA,CAAO,KAAA,EAAM;AAAA,IACf;AAAA,GACF;AACF;AAQA,eAAe,iBAAA,CACb,eACA,SAAA,EAC0C;AAC1C,EAAA,MAAM,EAAA,GAAK,gBAAgB,EAAE,KAAA,EAAO,QAAQ,KAAA,EAAO,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAA;AAC3E,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAyC,CAAC,SAAS,MAAA,KAAW;AAChF,IAAA,EAAA,CAAG,QAAA,CAAS,kDAAkD,CAAA,CAE3D,IAAA,CAAK,CAAC,MAAA,KAAW;AAChB,MAAA,EAAA,CAAG,KAAA,EAAM;AACT,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAE5B,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACzB,QAAA,IAAI;AACF,UAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,OAAO,CAAA;AAC9B,UAAA,MAAM,IAAA,GAAO,MAAA,CAAO,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AAC3C,UAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA,IAAK,EAAA;AAClD,UAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,YAAA,OAAA,CAAQ,EAAE,IAAA,EAAM,KAAA,EAAO,CAAA;AACvB,YAAA;AAAA,UACF;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAIA,MAAA,OAAA,CAAQ,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,eAAe,CAAA;AAAA,IACjD,CAAC,CAAA,CACA,KAAA,CAAM,MAAM,CAAA;AACf,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,EAAA,CAAG,KAAA,EAAM;AACT,MAAA,MAAA,CAAO,IAAI,kBAAA,CAAmB,8BAAA,EAAgC,EAAE,IAAA,EAAM,eAAA,EAAiB,CAAC,CAAA;AAAA,IAC1F,GAAG,SAAS,CAAA;AAAA,EACd,CAAC,CAAA;AACD,EAAA,OAAO,OAAA;AACT","file":"mcp-auth.js","sourcesContent":["import { chmodSync, existsSync, mkdirSync, readFileSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport { assertSecureModes } from \"../auth/credential-store.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { atomicWriteJson } from \"../persistence/atomic-write.js\";\n\n/**\n * OAuth token bundle persisted per MCP server. See ADR D41.\n *\n * @internal\n */\nexport interface OAuthTokens {\n  accessToken: string;\n  refreshToken?: string;\n  expiresAt: number; // ms epoch\n  scope?: string;\n  obtainedAt: number; // ms epoch\n}\n\nconst KEYTAR_SERVICE = \"theokit-mcp\";\nconst FILE_PATH = join(homedir(), \".theokit\", \"mcp-tokens.json\");\n\n/**\n * Make the directory private BEFORE anything is written into it.\n *\n * `atomicWriteJson` auto-creates the parent with a bare recursive `mkdir`, so under the common umask\n * 002 `~/.theokit` was born 0775 — and the `chmod 600` applied to the file afterwards protects the\n * wrong thing. Write permission on a DIRECTORY is permission to unlink and recreate its contents, so\n * a 0600 file inside a group-writable directory can be replaced wholesale by another local user. The\n * secret here is a REFRESH TOKEN: replacing it swaps which account the agent authenticates as.\n *\n * The `chmod` is unconditional and not a fallback for the `mkdir` mode: `mkdir`'s mode applies only\n * at CREATION, so every machine that already ran an older build has the loose directory sitting\n * there, and a fix that only covers fresh installs does not reach the population that has the\n * problem.\n */\nfunction ensurePrivateStoreDir(): void {\n  const dir = dirname(FILE_PATH);\n  try {\n    mkdirSync(dir, { recursive: true, mode: 0o700 });\n    chmodSync(dir, 0o700);\n  } catch {\n    // Windows: chmod is a no-op and the mode argument is meaningless. Same posture as the file\n    // chmod below — documented in ADR D41 / EC-14.\n  }\n}\n\ninterface KeytarLike {\n  setPassword: (service: string, account: string, password: string) => Promise<void>;\n  getPassword: (service: string, account: string) => Promise<string | null>;\n  deletePassword: (service: string, account: string) => Promise<boolean>;\n}\n\nlet keytarWarned = false;\nlet cachedKeytar: KeytarLike | undefined | null;\nfunction tryRequireKeytar(): KeytarLike | null {\n  if (cachedKeytar !== undefined) return cachedKeytar;\n  try {\n    const r = createRequire(import.meta.url);\n    cachedKeytar = r(\"keytar\") as KeytarLike;\n  } catch {\n    if (!keytarWarned) {\n      diag(\n        \"[theokit-sdk] keytar not installed; MCP OAuth tokens will be stored in ~/.theokit/mcp-tokens.json (chmod 600 where POSIX). Install `keytar` for OS keychain storage.\\n\",\n      );\n      keytarWarned = true;\n    }\n    cachedKeytar = null;\n  }\n  return cachedKeytar;\n}\n\n// EC-9 (race): serialize concurrent refreshes per server. Each key maps to\n// the in-flight refresh Promise; subsequent callers await the same promise.\nconst inflightRefresh = new Map<string, Promise<OAuthTokens>>();\n\n/**\n * Persist tokens for `serverName`. Tries keychain first, falls back to file\n * with chmod 600 (POSIX). Idempotent.\n *\n * @internal\n */\nexport async function setTokens(serverName: string, tokens: OAuthTokens): Promise<void> {\n  const kt = tryRequireKeytar();\n  const payload = JSON.stringify(tokens);\n  if (kt !== null && kt !== undefined) {\n    await kt.setPassword(KEYTAR_SERVICE, serverName, payload);\n    return;\n  }\n  // File fallback. The directory is locked down first — see `ensurePrivateStoreDir`.\n  ensurePrivateStoreDir();\n  let allTokens: Record<string, OAuthTokens> = {};\n  if (existsSync(FILE_PATH)) {\n    try {\n      allTokens = JSON.parse(readFileSync(FILE_PATH, \"utf8\")) as Record<string, OAuthTokens>;\n    } catch {\n      // corrupt file — start fresh\n      allTokens = {};\n    }\n  }\n  allTokens[serverName] = tokens;\n  await atomicWriteJson(FILE_PATH, allTokens);\n  try {\n    chmodSync(FILE_PATH, 0o600);\n  } catch {\n    // Windows: chmod is a no-op. Documented in ADR D41 / EC-14.\n  }\n}\n\n/**\n * Retrieve tokens for `serverName`. Returns undefined if absent.\n *\n * @internal\n */\nexport async function getTokens(serverName: string): Promise<OAuthTokens | undefined> {\n  const kt = tryRequireKeytar();\n  if (kt !== null && kt !== undefined) {\n    const value = await kt.getPassword(KEYTAR_SERVICE, serverName);\n    if (typeof value !== \"string\") return undefined;\n    try {\n      return JSON.parse(value) as OAuthTokens;\n    } catch {\n      return undefined;\n    }\n  }\n  if (!existsSync(FILE_PATH)) return undefined;\n  // The same gate the credential file gets, and deliberately the same implementation rather than a\n  // second one: a refresh token is a credential, and `assertSecureModes` already carries the attack\n  // it defends against in its docstring. It is called OUTSIDE the try/catch on purpose — the catch\n  // below exists to treat a corrupt file as absent, and letting it swallow this would turn \"someone\n  // else can replace your token\" into a silent `undefined`, which reads as \"not logged in\".\n  assertSecureModes(dirname(FILE_PATH), FILE_PATH);\n  try {\n    const all = JSON.parse(readFileSync(FILE_PATH, \"utf8\")) as Record<string, OAuthTokens>;\n    return all[serverName];\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Serialize concurrent refresh attempts per server (EC-9). If a refresh is\n * already in flight for the same `serverName`, the second caller awaits\n * the same Promise.\n *\n * @internal\n */\nexport function lockedRefresh(\n  serverName: string,\n  refreshFn: () => Promise<OAuthTokens>,\n): Promise<OAuthTokens> {\n  const existing = inflightRefresh.get(serverName);\n  if (existing !== undefined) return existing;\n  const promise = (async () => {\n    try {\n      return await refreshFn();\n    } finally {\n      inflightRefresh.delete(serverName);\n    }\n  })();\n  inflightRefresh.set(serverName, promise);\n  return promise;\n}\n\n/**\n * Reset all cached state. Test-only helper.\n *\n * @internal\n */\nexport function _resetForTests(): void {\n  inflightRefresh.clear();\n  cachedKeytar = undefined;\n  keytarWarned = false;\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { createServer, type IncomingMessage, type ServerResponse } from \"node:http\";\nimport { createInterface } from \"node:readline/promises\";\n\nimport { ConfigurationError } from \"../../errors.js\";\nimport type { McpOAuthConfig } from \"../../types/mcp.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { type OAuthTokens, setTokens } from \"./token-storage.js\";\n\n/**\n * OAuth 2.1 PKCE flow runner for MCP HTTP servers. See ADR D41.\n *\n * @internal\n */\n\n/**\n * Generate a random base64url-encoded string. Used for both code_verifier\n * (43-128 chars) and state (CSRF protection).\n */\nfunction base64url(n: number): string {\n  return randomBytes(n).toString(\"base64url\");\n}\n\n/**\n * Compute PKCE code_challenge = base64url(SHA256(code_verifier)).\n */\nfunction challengeFor(verifier: string): string {\n  return createHash(\"sha256\").update(verifier).digest(\"base64url\");\n}\n\n/**\n * Refresh an access token using `refresh_token`. Throws on failure.\n *\n * @internal\n */\nexport async function refreshAccessToken(\n  serverName: string,\n  clientId: string,\n  refreshToken: string,\n  oauth: McpOAuthConfig,\n): Promise<OAuthTokens> {\n  const body = new URLSearchParams({\n    grant_type: \"refresh_token\",\n    refresh_token: refreshToken,\n    client_id: clientId,\n  });\n  const response = await fetch(oauth.tokenEndpoint, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: body.toString(),\n  });\n  if (!response.ok) {\n    throw new ConfigurationError(`OAuth refresh failed: HTTP ${response.status}`, {\n      code: \"oauth_refresh_failed\",\n    });\n  }\n  const data = (await response.json()) as {\n    access_token: string;\n    refresh_token?: string;\n    expires_in?: number;\n    scope?: string;\n  };\n  const obtainedAt = Date.now();\n  const tokens: OAuthTokens = {\n    accessToken: data.access_token,\n    refreshToken: data.refresh_token ?? refreshToken,\n    // EC-10: default conservative 3600s if expires_in missing.\n    expiresAt: obtainedAt + (data.expires_in ?? 3600) * 1000,\n    obtainedAt,\n    ...(data.scope !== undefined ? { scope: data.scope } : {}),\n  };\n  await setTokens(serverName, tokens);\n  return tokens;\n}\n\n/**\n * Run the full PKCE flow. Generates verifier+challenge+state, opens the\n * authorization URL (browser or manual print), waits for the callback\n * (localhost or stdin), exchanges code for tokens.\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: PKCE flow is a linear protocol step (verifier → challenge → state → URL → wait → exchange); refactoring fragments the RFC 7636 narrative.\nexport async function runPkceFlow(\n  serverName: string,\n  clientId: string,\n  scopes: string[] | undefined,\n  oauth: McpOAuthConfig,\n): Promise<OAuthTokens> {\n  const verifier = base64url(48);\n  const challenge = challengeFor(verifier);\n  const state = base64url(16);\n  const timeoutMs = oauth.timeoutMs ?? 300_000;\n\n  let redirectUri: string;\n  let codeWaiter: Promise<{ code: string; state: string }>;\n  let cleanup: () => void = () => {};\n\n  if (oauth.redirectMode === \"localhost\") {\n    const result = await openLocalhostCallback(state, timeoutMs);\n    redirectUri = result.redirectUri;\n    codeWaiter = result.waitFor;\n    cleanup = result.close;\n  } else {\n    redirectUri = \"urn:ietf:wg:oauth:2.0:oob\";\n    codeWaiter = readCodeFromStdin(state, timeoutMs);\n  }\n\n  try {\n    const authUrl = new URL(oauth.authorizationEndpoint);\n    authUrl.searchParams.set(\"response_type\", \"code\");\n    authUrl.searchParams.set(\"client_id\", clientId);\n    authUrl.searchParams.set(\"redirect_uri\", redirectUri);\n    if (scopes !== undefined && scopes.length > 0) {\n      authUrl.searchParams.set(\"scope\", scopes.join(\" \"));\n    }\n    authUrl.searchParams.set(\"code_challenge\", challenge);\n    authUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n    authUrl.searchParams.set(\"state\", state);\n\n    diag(\n      `\\n[theokit-sdk] OAuth required for MCP server \"${serverName}\".\\n` +\n        `Open this URL to authenticate:\\n  ${authUrl.toString()}\\n\\n`,\n    );\n\n    const { code, state: returnedState } = await codeWaiter;\n    // EC-2 MUST FIX: validate state.\n    if (returnedState !== state) {\n      throw new ConfigurationError(\n        \"OAuth state mismatch — possible CSRF attempt; aborting token exchange.\",\n        { code: \"oauth_state_mismatch\" },\n      );\n    }\n\n    // Exchange code for tokens.\n    const tokenBody = new URLSearchParams({\n      grant_type: \"authorization_code\",\n      code,\n      client_id: clientId,\n      code_verifier: verifier,\n      redirect_uri: redirectUri,\n    });\n    const response = await fetch(oauth.tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: tokenBody.toString(),\n    });\n    if (!response.ok) {\n      const errText = await response.text();\n      throw new ConfigurationError(\n        `OAuth token exchange failed: HTTP ${response.status}: ${errText.slice(0, 200)}`,\n        { code: \"oauth_token_exchange_failed\" },\n      );\n    }\n    const data = (await response.json()) as {\n      access_token: string;\n      refresh_token?: string;\n      expires_in?: number;\n      scope?: string;\n    };\n    const obtainedAt = Date.now();\n    return {\n      accessToken: data.access_token,\n      ...(data.refresh_token !== undefined ? { refreshToken: data.refresh_token } : {}),\n      // EC-10: default 3600s when expires_in absent.\n      expiresAt: obtainedAt + (data.expires_in ?? 3600) * 1000,\n      obtainedAt,\n      ...(data.scope !== undefined ? { scope: data.scope } : {}),\n    };\n  } finally {\n    cleanup();\n  }\n}\n\n/**\n * Start a localhost HTTP server on a free port; return the redirect URI,\n * a promise that resolves with the code+state from the first valid request,\n * and a close handle.\n *\n * @internal\n */\nasync function openLocalhostCallback(\n  expectedState: string,\n  timeoutMs: number,\n): Promise<{\n  redirectUri: string;\n  waitFor: Promise<{ code: string; state: string }>;\n  close: () => void;\n}> {\n  let resolveCode: ((value: { code: string; state: string }) => void) | undefined;\n  let rejectCode: ((reason: unknown) => void) | undefined;\n  const waitFor = new Promise<{ code: string; state: string }>((res, rej) => {\n    resolveCode = res;\n    rejectCode = rej;\n  });\n  const server = createServer((req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url ?? \"/\", \"http://127.0.0.1\");\n    const code = url.searchParams.get(\"code\");\n    const state = url.searchParams.get(\"state\");\n    if (typeof code !== \"string\" || typeof state !== \"string\") {\n      res.statusCode = 400;\n      res.end(\"Missing code or state\");\n      return;\n    }\n    // EC-2: state must match the one we generated. We DO NOT trust any\n    // localhost GET — only the one carrying our exact state.\n    if (state !== expectedState) {\n      res.statusCode = 400;\n      res.end(\"State mismatch — request rejected.\");\n      return;\n    }\n    res.statusCode = 200;\n    res.end(\"Authentication successful. You can close this tab and return to the terminal.\");\n    resolveCode?.({ code, state });\n  });\n  server.listen(0, \"127.0.0.1\");\n  const timeoutHandle = setTimeout(() => {\n    rejectCode?.(new ConfigurationError(\"OAuth flow timed out\", { code: \"oauth_timeout\" }));\n  }, timeoutMs);\n  // Wait for server.listen to bind so we can read the port.\n  await new Promise<void>((r) => {\n    if (server.listening) r();\n    else server.once(\"listening\", () => r());\n  });\n  const address = server.address();\n  if (typeof address !== \"object\" || address === null) {\n    server.close();\n    throw new ConfigurationError(\"OAuth localhost callback failed to bind\", {\n      code: \"oauth_bind_failed\",\n    });\n  }\n  const port = address.port;\n  return {\n    redirectUri: `http://127.0.0.1:${port}/callback`,\n    waitFor,\n    close: () => {\n      clearTimeout(timeoutHandle);\n      server.close();\n    },\n  };\n}\n\n/**\n * Read `code` (and `state`) from stdin (manual mode). User pastes the\n * full callback URL or just the code value.\n *\n * @internal\n */\nasync function readCodeFromStdin(\n  expectedState: string,\n  timeoutMs: number,\n): Promise<{ code: string; state: string }> {\n  const rl = createInterface({ input: process.stdin, output: process.stderr });\n  const promise = new Promise<{ code: string; state: string }>((resolve, reject) => {\n    rl.question(\"Paste the full callback URL (or just the code): \")\n      // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: stdin reader handles 2 input formats (full URL vs raw code) inline; splitting fragments the manual-mode UX.\n      .then((answer) => {\n        rl.close();\n        const trimmed = answer.trim();\n        // Try to parse as URL first.\n        if (trimmed.includes(\"?\")) {\n          try {\n            const parsed = new URL(trimmed);\n            const code = parsed.searchParams.get(\"code\");\n            const state = parsed.searchParams.get(\"state\") ?? \"\";\n            if (typeof code === \"string\") {\n              resolve({ code, state });\n              return;\n            }\n          } catch {\n            // not a URL — fall through\n          }\n        }\n        // Treat the entire input as the code. State validation will fail\n        // unless the user also provided state — but in manual mode they\n        // typically paste the URL with state baked in.\n        resolve({ code: trimmed, state: expectedState });\n      })\n      .catch(reject);\n    setTimeout(() => {\n      rl.close();\n      reject(new ConfigurationError(\"OAuth manual input timed out\", { code: \"oauth_timeout\" }));\n    }, timeoutMs);\n  });\n  return promise;\n}\n"]}

package/dist/models.cjs

@@ -2,8 +2,9 @@
 
 var chunkPVBANCWU_cjs = require('./chunk-PVBANCWU.cjs');
 var chunkVYHJZVL5_cjs = require('./chunk-VYHJZVL5.cjs');
-var chunkT6ZCG5AP_cjs = require('./chunk-T6ZCG5AP.cjs');
-require('./chunk-XK54DTRF.cjs');
+var chunkBC5EUG7R_cjs = require('./chunk-BC5EUG7R.cjs');
+require('./chunk-33L2NVTJ.cjs');
+require('./chunk-NUEL6RCZ.cjs');
 require('./chunk-C6Y6CWYD.cjs');
 require('./chunk-2YGIBOUH.cjs');
 var chunkSXSPMRSV_cjs = require('./chunk-SXSPMRSV.cjs');
@@ -34,11 +35,11 @@ function capsFromCatalog(m) {
 }
 function resolveModelCapabilities(modelId) {
   const bare = stripVariantSuffix(stripRoutingPrefix(modelId));
-  const fromIndex = chunkT6ZCG5AP_cjs.getCatalogModelInfo(bare);
+  const fromIndex = chunkBC5EUG7R_cjs.getCatalogModelInfo(bare);
   if (fromIndex !== void 0) return capsFromCatalog(fromIndex);
   const withVendor = inferVendorPrefix(bare);
   if (withVendor !== bare) {
-    const vendored = chunkT6ZCG5AP_cjs.getCatalogModelInfo(withVendor);
+    const vendored = chunkBC5EUG7R_cjs.getCatalogModelInfo(withVendor);
     if (vendored !== void 0) return capsFromCatalog(vendored);
   }
   return CONSERVATIVE_DEFAULTS;
@@ -123,7 +124,7 @@ function catalogTargets() {
   if (_catalogTargets !== void 0) return _catalogTargets;
   _catalogTargets = /* @__PURE__ */ new Map();
   try {
-    for (const entry of Object.values(chunkT6ZCG5AP_cjs.loadProviderCatalog())) {
+    for (const entry of Object.values(chunkBC5EUG7R_cjs.loadProviderCatalog())) {
       const keys = [entry.id, ...entry.aliases ?? []];
       for (const k of keys) {
         if (!_catalogTargets.has(k)) _catalogTargets.set(k, { keys });
@@ -137,7 +138,7 @@ function resolvePatchKeys(externalId) {
   const mapped = MODELS_DEV_ID_MAP[externalId] ?? externalId;
   const fromCatalog = catalogTargets().get(mapped);
   if (fromCatalog !== void 0) return fromCatalog.keys;
-  const profile = chunkT6ZCG5AP_cjs.getProviderProfile(mapped);
+  const profile = chunkBC5EUG7R_cjs.getProviderProfile(mapped);
   if (profile !== void 0) return [profile.name, ...profile.aliases ?? []];
   return void 0;
 }
@@ -154,9 +155,9 @@ function patchIndexFromApiJson(raw) {
       continue;
     }
     for (const [modelId, rawModel] of Object.entries(models)) {
-      const parsed = chunkT6ZCG5AP_cjs.catalogModelSchema.safeParse(rawModel);
+      const parsed = chunkBC5EUG7R_cjs.catalogModelSchema.safeParse(rawModel);
       if (!parsed.success) continue;
-      for (const key of keys) chunkT6ZCG5AP_cjs.patchModelInfo(`${key}/${modelId}`, parsed.data);
+      for (const key of keys) chunkBC5EUG7R_cjs.patchModelInfo(`${key}/${modelId}`, parsed.data);
       patched++;
     }
   }
@@ -197,7 +198,7 @@ function loadCacheIntoIndex(url = DEFAULT_URL) {
   }
 }
 async function refreshModelCatalog(opts = {}) {
-  chunkT6ZCG5AP_cjs.registerBuiltins();
+  chunkBC5EUG7R_cjs.registerBuiltins();
   const kill = process.env.THEOKIT_DISABLE_MODELS_FETCH;
   if (kill !== void 0 && kill !== "" && kill !== "0" && kill.toLowerCase() !== "false") {
     return { source: "skipped", models: 0 };
@@ -253,7 +254,7 @@ async function refreshModelCatalog(opts = {}) {
   }
 }
 function getModelInfo(modelId) {
-  return chunkT6ZCG5AP_cjs.getCatalogModelInfo(modelId);
+  return chunkBC5EUG7R_cjs.getCatalogModelInfo(modelId);
 }
 
 Object.defineProperty(exports, "parseModelId", {

package/dist/models.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/llm/model-capabilities.ts","../src/internal/llm/model-option.ts","../src/internal/providers/catalog-source-models-dev.ts"],"names":["getCatalogModelInfo","parseModelId","join","homedir","createHash","path","mkdirSync","dirname","randomBytes","writeFileSync","renameSync","unlinkSync","loadProviderCatalog","getProviderProfile","catalogModelSchema","patchModelInfo","diag","readFileSync","registerBuiltins","statSync","Retry"],"mappings":";;;;;;;;;;;;;;;AAgCA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,eAAA,EAAiB,KAAA;AAAA,EACjB,oBAAA,EAAsB,KAAA;AAAA,EACtB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAGA,IAAM,gBAAA,GAAmB,CAAC,aAAA,EAAe,SAAA,EAAW,UAAU,CAAA;AAM9D,SAAS,gBAAgB,CAAA,EAAoC;AAC3D,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,EAAE,UAAA,EAAY,KAAA,EAAO,SAAS,OAAO,CAAA,IAAK,EAAE,UAAA,IAAc,KAAA;AAAA,IAC1E,wBAAA,EAA0B,EAAE,iBAAA,IAAqB,KAAA;AAAA,IACjD,eAAA,EAAiB,EAAE,SAAA,IAAa,KAAA;AAAA,IAChC,oBAAA,EAAuB,EAAkC,aAAA,IAAiB,KAAA;AAAA,IAC1E,gBAAA,EAAkB,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,qBAAA,CAAsB,gBAAA;AAAA,IAC5D,eAAA,EAAiB,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU,qBAAA,CAAsB;AAAA,GAC5D;AACF;AAWO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAG3D,EAAA,MAAM,SAAA,GAAYA,sCAAoB,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,eAAA,CAAgB,SAAS,CAAA;AAG7D,EAAA,MAAM,UAAA,GAAa,kBAAkB,IAAI,CAAA;AACzC,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,QAAA,GAAWA,sCAAoB,UAAU,CAAA;AAC/C,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,eAAA,CAAgB,QAAQ,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,qBAAA;AACT;AAEA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,KAAA,MAAW,UAAU,gBAAA,EAAkB;AACrC,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAM,CAAA,SAAU,OAAA,CAAQ,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,OAAA;AACT;AAOA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,OAAO,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,GAAI,OAAA;AACxC;AAGA,SAAS,kBAAkB,IAAA,EAAsB;AAC/C,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,aAAa,IAAI,CAAA,CAAA;AACvD,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,IAAI,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAC1E,IAAA,OAAO,UAAU,IAAI,CAAA,CAAA;AACvB,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,UAAU,IAAI,CAAA,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;;;ACzFA,IAAM,QAAA,mBAAW,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,IAAI,CAAC,CAAA;AAE7E,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,IAAI,QAAA,CAAS,IAAI,KAAA,CAAM,WAAA,EAAa,CAAA,EAAG,OAAO,MAAM,WAAA,EAAY;AAChE,EAAA,OAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,aAAY,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AACtD;AAeO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAIC,8BAAA,CAAa,OAAO,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAG9B,EAAA,MAAM,IAAA,GAAA,CAAQ,KAAA,IAAS,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAA,EAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC1E,EAAA,MAAM,UAAU,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,EAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,MAAM,OAAO,SAAA,IAAa,CAAA,GAAI,KAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA,GAAI,IAAA;AAC1D,EAAA,MAAM,QAAQ,IAAA,CACX,KAAA,CAAM,UAAU,CAAA,CAChB,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,WAAW,CAAA,CACf,KAAK,GAAG,CAAA;AACX,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,QAAQ,MAAA,GAAS,CAAA,GAAI,GAAG,KAAK,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,CAAA,GAAM,KAAA;AACxD;AAUO,SAAS,cAAc,OAAA,EAA8B;AAC1D,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAA;AAAA,IACP,KAAA,EAAO,kBAAkB,OAAO,CAAA;AAAA,IAChC,QAAA,EAAUA,8BAAA,CAAa,OAAO,CAAA,CAAE;AAAA,GAClC;AACF;AC9CA,IAAM,WAAA,GAAc,6BAAA;AACpB,IAAM,MAAA,GAAS,KAAK,EAAA,GAAK,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAmBlB,SAAS,aAAa,GAAA,EAAqB;AAEhD,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAKC,SAAA,CAAKC,UAAA,EAAQ,EAAG,UAAU,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAMD,SAAA,CAAK,IAAA,EAAM,OAAA,EAAS,YAAY,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAOA,SAAA,CAAK,KAAK,UAAU,CAAA;AACpD,EAAA,MAAM,IAAA,GAAOE,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACvE,EAAA,OAAOF,SAAA,CAAK,GAAA,EAAK,CAAA,IAAA,EAAO,IAAI,CAAA,KAAA,CAAO,CAAA;AACrC;AAGA,SAAS,gBAAA,CAAiBG,QAAc,IAAA,EAAoB;AAC1D,EAAAC,YAAA,CAAUC,aAAQF,MAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,GAAGA,MAAI,CAAA,KAAA,EAAQG,mBAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAAC,gBAAA,CAAc,KAAK,IAAI,CAAA;AACvB,IAAAC,aAAA,CAAW,KAAKL,MAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAAM,aAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAQA,IAAM,iBAAA,GAA4C;AAAA,EAChD,MAAA,EAAQ,eAAA;AAAA,EACR,GAAA,EAAK,OAAA;AAAA,EACL,UAAA,EAAY,UAAA;AAAA,EACZ,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB,SAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAEA,IAAI,eAAA;AAEJ,SAAS,cAAA,GAAkD;AACzD,EAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,EAAA,eAAA,uBAAsB,GAAA,EAAI;AAC1B,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAOC,qCAAA,EAAqB,CAAA,EAAG;AACxD,MAAA,MAAM,IAAA,GAAO,CAAC,KAAA,CAAM,EAAA,EAAI,GAAI,KAAA,CAAM,OAAA,IAAW,EAAG,CAAA;AAChD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,kBAAmB,GAAA,CAAI,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,eAAA;AACT;AAEA,SAAS,iBAAiB,UAAA,EAA0C;AAClE,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAChD,EAAA,MAAM,WAAA,GAAc,cAAA,EAAe,CAAE,GAAA,CAAI,MAAM,CAAA;AAC/C,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,WAAA,CAAY,IAAA;AAClD,EAAA,MAAM,OAAA,GAAUC,qCAAmB,MAAM,CAAA;AACzC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,OAAO,CAAC,OAAA,CAAQ,MAAM,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA;AAC3E,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,sBAAsB,GAAA,EAAsB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,CAAA;AACpD,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AACnF,IAAA,MAAM,SAAU,QAAA,EAAmD,MAAA;AACnE,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,OAAO,MAAA,KAAW,QAAA,EAAU;AAGxD,IAAA,MAAM,IAAA,GAAO,iBAAiB,UAAU,CAAA;AACxC,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,KAAK,UAAU,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACxD,MAAA,MAAM,MAAA,GAASC,oCAAA,CAAmB,SAAA,CAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAMC,gCAAA,CAAe,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA;AACvE,MAAA,OAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAAC,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAkD,OAAA,CAAQ,MAAM,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAAA,KAC9H;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,kBAAA,CAAmB,MAAc,WAAA,EAAqB;AACpE,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAOC,eAAA,CAAa,MAAM,OAAO,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAGN,IAAA,IAAI;AACF,MAAAN,aAAA,CAAW,IAAI,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAAK,sBAAA,CAAK,yDAAyD,IAAI,CAAA;AAAA,CAAK,CAAA;AACvE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,sBAAsB,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AACtF,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAYA,eAAsB,mBAAA,CACpB,IAAA,GAAmC,EAAC,EACA;AAGpC,EAAAE,kCAAA,EAAiB;AAEjB,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,4BAAA;AACzB,EAAA,IAAI,IAAA,KAAS,UAAa,IAAA,KAAS,EAAA,IAAM,SAAS,GAAA,IAAO,IAAA,CAAK,WAAA,EAAY,KAAM,OAAA,EAAS;AACvF,IAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,MAAA,EAAQ,CAAA,EAAE;AAAA,EACxC;AACA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,IAAI,kBAAA,IAAsB,WAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAM,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAG9C,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,GAAA,EAAI,GAAIC,WAAA,CAAS,IAAI,CAAA,CAAE,OAAA;AACnC,MAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,QAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAAA,MAC5D;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,KAAA,IAAS,KAAA;AACtC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMC,uBAAA,CAAM,MAAA;AAAA,MACtB,YAAY;AACV,QAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA,EAAG,CAAA;AAChF,QAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,QAAA,OAAO,CAAA;AAAA,MACT,CAAA;AAAA;AAAA;AAAA,MAGA,EAAE,OAAA,EAAS,CAAA,EAAG,aAAa,MAAM,IAAA,EAAM,gBAAgB,GAAA;AAAI,KAC7D;AACA,IAAA,IAAA,GAAO,MAAM,IAAI,IAAA,EAAK;AACtB,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACjB,SAAS,GAAA,EAAK;AACZ,IAAAJ,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAmD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC1E;AAEA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAAA,EAC5D;AAEA,EAAA,IAAI;AACF,IAAA,gBAAA,CAAiB,MAAM,IAAI,CAAA;AAAA,EAC7B,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AAAA,EACxF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAA,EAAQ,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,EAAE;AAAA,EAC9E,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA;AAAA,MACE,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA;AAAA,KACxE;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA,EAAE;AAAA,EACtC;AACF;AAGO,SAAS,aAAa,OAAA,EAAyD;AACpF,EAAA,OAAOhB,sCAAoB,OAAO,CAAA;AACpC","file":"models.cjs","sourcesContent":["/**\n * T3.10c — Model capability registry (DR3 #17).\n *\n * Typed per-model flags that let the SDK gate features at the boundary\n * (before hitting the provider) instead of letting opaque 400s surface.\n *\n * Resolution algorithm:\n *   1. Strip routing prefixes (openrouter/, vertex/, bedrock/) AND the\n *      OpenRouter `:variant` suffix (:free/:nitro/…) to find the bare vendor id.\n *   2. Exact match in the `EXACT` catalog → return entry.\n *   3. Vendor inference (e.g., `claude-*` → `anthropic/claude-*`) → return entry.\n *   4. No match → conservative defaults (all false, minimum tokens).\n *\n * Module is internal, but `ModelCapabilities` + `resolveModelCapabilities` are\n * re-exported publicly via the `@theokit/sdk/models` subpath (see their @public tags).\n */\n\n/**\n * Per-model capability shape. Consumers use this to gate features at\n * the SDK boundary (before request construction, not after 400).\n *\n * @public\n */\nexport interface ModelCapabilities {\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsToolUse: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens: number;\n  maxOutputTokens: number;\n}\n\nconst CONSERVATIVE_DEFAULTS: ModelCapabilities = {\n  supportsVision: false,\n  supportsStructuredOutput: false,\n  supportsToolUse: false,\n  supportsCacheControl: false,\n  maxContextTokens: 4096,\n  maxOutputTokens: 4096,\n};\n\n/** Routing prefixes to strip to find the underlying vendor model. */\nconst ROUTING_PREFIXES = [\"openrouter/\", \"vertex/\", \"bedrock/\"] as const;\n\nimport { getCatalogModelInfo } from \"../providers/catalog-loader.js\";\nimport type { CatalogModel } from \"../providers/catalog-schema.js\";\n\n/** Map a catalog model block (models.dev shape) to the SDK's ModelCapabilities (M44 — catalog-backed). */\nfunction capsFromCatalog(m: CatalogModel): ModelCapabilities {\n  return {\n    supportsVision: m.modalities?.input?.includes(\"image\") ?? m.attachment ?? false,\n    supportsStructuredOutput: m.structured_output ?? false,\n    supportsToolUse: m.tool_call ?? false,\n    supportsCacheControl: (m as { cache_control?: boolean }).cache_control ?? false,\n    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,\n    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens,\n  };\n}\n\n/**\n * Resolve per-model capability flags (vision/structured-output/tool-use/cache +\n * `maxContextTokens`/`maxOutputTokens`) for a model id. Pure, sync, offline (a\n * static catalog — no network). Strips routing prefixes (`openrouter/`/`vertex/`/\n * `bedrock/`) and OpenRouter `:variant` suffixes before lookup; unknown models get\n * conservative defaults. Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function resolveModelCapabilities(modelId: string): ModelCapabilities {\n  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));\n  // M44 — the catalog model-info index replaced the hand-curated EXACT map (single source of truth; the\n  // vendored provider-catalog.json carries the migrated data — parity-tested against the old map snapshot).\n  const fromIndex = getCatalogModelInfo(bare);\n  if (fromIndex !== undefined) return capsFromCatalog(fromIndex);\n  // Routing-prefixed models (vertex/claude-3-5-sonnet) strip to bare\n  // model name without vendor. Try inferring the vendor from the name.\n  const withVendor = inferVendorPrefix(bare);\n  if (withVendor !== bare) {\n    const vendored = getCatalogModelInfo(withVendor);\n    if (vendored !== undefined) return capsFromCatalog(vendored);\n  }\n  return CONSERVATIVE_DEFAULTS;\n}\n\nfunction stripRoutingPrefix(modelId: string): string {\n  for (const prefix of ROUTING_PREFIXES) {\n    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);\n  }\n  return modelId;\n}\n\n/**\n * Strip an OpenRouter variant suffix (`:free`/`:nitro`/`:floor`/`:beta`/…) so the\n * catalog lookup hits the underlying model. Model slugs contain no `:` except the\n * variant separator, so cutting at the first `:` is safe.\n */\nfunction stripVariantSuffix(modelId: string): string {\n  const i = modelId.indexOf(\":\");\n  return i >= 0 ? modelId.slice(0, i) : modelId;\n}\n\n/** Infer vendor prefix from bare model name for routing-prefixed lookups. */\nfunction inferVendorPrefix(bare: string): string {\n  if (bare.startsWith(\"claude\")) return `anthropic/${bare}`;\n  if (bare.startsWith(\"gpt-\") || bare.startsWith(\"o1\") || bare.startsWith(\"o3\"))\n    return `openai/${bare}`;\n  if (bare.startsWith(\"gemini\")) return `google/${bare}`;\n  return bare;\n}\n","import { parseModelId } from \"./model-identifier.js\";\n\n/**\n * A UI-friendly model option — the shape a `<select>`/dropdown consumes.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport interface ModelOption {\n  /** The original model id (what you pass back to the SDK). */\n  value: string;\n  /** Best-effort human label (see {@link humanizeModelName}). */\n  label: string;\n  /** Provider from the slug prefix, or `undefined` when none. */\n  provider: string | undefined;\n}\n\n/** Tokens rendered upper-case rather than title-case. */\nconst ACRONYMS = new Set([\"gpt\", \"ai\", \"hd\", \"ui\", \"api\", \"sdk\", \"llm\", \"xl\"]);\n\nfunction prettyToken(token: string): string {\n  if (ACRONYMS.has(token.toLowerCase())) return token.toUpperCase();\n  return token.charAt(0).toUpperCase() + token.slice(1);\n}\n\n/**\n * Turn a model id into a best-effort human label: strip the routing/vendor\n * prefix to the core model segment, split on `-`/`_`/`.`/whitespace, title-case\n * each token (known acronyms upper-cased), and append an OpenRouter `:variant`\n * in parentheses. Deterministic, pure, dependency-free.\n *\n * Best-effort, NOT vendor-canonical: `\"anthropic/claude-3-5-sonnet\"` →\n * `\"Claude 3 5 Sonnet\"`. A UI wanting exact marketing names overrides per id.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function humanizeModelName(modelId: string): string {\n  const { name } = parseModelId(modelId);\n  if (name.length === 0) return \"\";\n  const colon = name.indexOf(\":\");\n  // Strip a trailing slash so a typo'd `gpt-4o/` keeps its name (not lost to an\n  // empty last segment).\n  const base = (colon >= 0 ? name.slice(0, colon) : name).replace(/\\/+$/, \"\");\n  const variant = colon >= 0 ? name.slice(colon + 1) : \"\";\n  const lastSlash = base.lastIndexOf(\"/\");\n  const core = lastSlash >= 0 ? base.slice(lastSlash + 1) : base;\n  const label = core\n    .split(/[-_.\\s]+/)\n    .filter((t) => t.length > 0)\n    .map(prettyToken)\n    .join(\" \");\n  if (label.length === 0) return variant; // no base label (e.g. \":free\") → bare variant\n  return variant.length > 0 ? `${label} (${variant})` : label;\n}\n\n/**\n * Build a {@link ModelOption} (`{ value, label, provider }`) for a model id —\n * a dropdown-ready entry composing {@link humanizeModelName} + `parseModelId`.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function toModelOption(modelId: string): ModelOption {\n  return {\n    value: modelId,\n    label: humanizeModelName(modelId),\n    provider: parseModelId(modelId).provider,\n  };\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { Retry } from \"../../retry.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { registerBuiltins } from \"./builtin/index.js\";\nimport { getCatalogModelInfo, loadProviderCatalog, patchModelInfo } from \"./catalog-loader.js\";\nimport { catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile } from \"./registry.js\";\n\n/**\n * M44 — the OPTIONAL models.dev catalog source. Explicit opt-in ONLY (`refreshModelCatalog()`): the SDK\n * NEVER fetches at startup or per-request — the vendored catalog + any existing disk cache are the offline\n * base, and every failure mode fails CLOSED back to them (ROADMAP constraint: no runtime hard network dep).\n *\n * Mechanism adapted from OpenCode's models.dev consumption (MIT © 2025 opencode — `core/src/models-dev.ts`):\n * disk cache with mtime TTL, atomic tempfile+rename write, corrupt-cache delete-and-fall-through, kill-switch\n * env. Library adaptations: NO background refresh loop (a consumer composes refresh with the SDK's cron);\n * TTL 1h (not 5min — no background refresher to keep it warm); no cross-process flock v1 (atomic rename +\n * idempotent upstream content — at most one wasted fetch).\n *\n * @internal (the public surface is `refreshModelCatalog` re-exported via `@theokit/sdk/models`)\n */\n\nconst DEFAULT_URL = \"https://models.dev/api.json\";\nconst TTL_MS = 60 * 60 * 1000; // 1 hour\nconst FETCH_TIMEOUT_MS = 10_000;\n\nexport interface RefreshModelCatalogOptions {\n  /** Override the source URL (`THEOKIT_MODELS_URL` env also honored). */\n  url?: string;\n  /** Bypass the TTL freshness gate. */\n  force?: boolean;\n  /** Injected for tests. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\nexport interface RefreshModelCatalogResult {\n  /** Where the data came from: a fresh network fetch, the still-fresh disk cache, or skipped entirely. */\n  source: \"network\" | \"cache\" | \"skipped\";\n  /** How many models were patched into the index. */\n  models: number;\n}\n\n/** The cache file for a source URL (custom URLs get a hash-suffixed name, mirroring OpenCode). */\nexport function cachePathFor(url: string): string {\n  // M44 L8 fix — honor the SDK home override so tests and multi-home setups never touch the real ~/.theokit.\n  const base = process.env.THEOKIT_HOME?.trim() || join(homedir(), \".theokit\");\n  const dir = join(base, \"cache\", \"models-dev\");\n  if (url === DEFAULT_URL) return join(dir, \"api.json\");\n  const hash = createHash(\"sha256\").update(url).digest(\"hex\").slice(0, 12);\n  return join(dir, `api-${hash}.json`);\n}\n\n/** Atomic write: temp file + rename (crash mid-write never leaves a partial cache). */\nfunction writeCacheAtomic(path: string, body: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.tmp-${randomBytes(6).toString(\"hex\")}`;\n  try {\n    writeFileSync(tmp, body);\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // best effort\n    }\n    throw err;\n  }\n}\n\n/**\n * M44 H3 fix — models.dev provider ids ≠ theokit ids (google↔google-gemini, zai↔zhipu, togetherai↔together,\n * fireworks-ai↔fireworks, amazon-bedrock↔bedrock, google-vertex↔vertex). The RUNTIME mapping mirrors the\n * maintenance script's table; targets resolve against the CATALOG entries (id + aliases — the same namespace\n * the vendored index uses) first, then the registry.\n */\nconst MODELS_DEV_ID_MAP: Record<string, string> = {\n  google: \"google-gemini\",\n  zai: \"zhipu\",\n  togetherai: \"together\",\n  \"fireworks-ai\": \"fireworks\",\n  \"amazon-bedrock\": \"bedrock\",\n  \"google-vertex\": \"vertex\",\n};\n\nlet _catalogTargets: Map<string, { keys: string[] }> | undefined;\n/** external-id → the index keys (entry id + aliases) its models patch under. Lazy; catalog-first. */\nfunction catalogTargets(): Map<string, { keys: string[] }> {\n  if (_catalogTargets !== undefined) return _catalogTargets;\n  _catalogTargets = new Map();\n  try {\n    for (const entry of Object.values(loadProviderCatalog())) {\n      const keys = [entry.id, ...(entry.aliases ?? [])];\n      for (const k of keys) {\n        if (!_catalogTargets.has(k)) _catalogTargets.set(k, { keys });\n      }\n    }\n  } catch {\n    // catalog unavailable — registry fallback below still works\n  }\n  return _catalogTargets;\n}\n\nfunction resolvePatchKeys(externalId: string): string[] | undefined {\n  const mapped = MODELS_DEV_ID_MAP[externalId] ?? externalId;\n  const fromCatalog = catalogTargets().get(mapped);\n  if (fromCatalog !== undefined) return fromCatalog.keys;\n  const profile = getProviderProfile(mapped);\n  if (profile !== undefined) return [profile.name, ...(profile.aliases ?? [])];\n  return undefined;\n}\n\n/** Parse + patch the index from an api.json payload. Unknown providers are skipped with WARN (once each). */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nfunction patchIndexFromApiJson(raw: unknown): number {\n  if (typeof raw !== \"object\" || raw === null) return 0;\n  let patched = 0;\n  const skipped: string[] = [];\n  for (const [providerId, provider] of Object.entries(raw as Record<string, unknown>)) {\n    const models = (provider as { models?: Record<string, unknown> })?.models;\n    if (models === undefined || typeof models !== \"object\") continue;\n    // Enrich ONLY providers the SDK knows — models.dev's npm/api fields cannot be mapped to a theokit\n    // apiMode/authType safely, so unknown providers are data we cannot route.\n    const keys = resolvePatchKeys(providerId);\n    if (keys === undefined) {\n      skipped.push(providerId);\n      continue;\n    }\n    for (const [modelId, rawModel] of Object.entries(models)) {\n      const parsed = catalogModelSchema.safeParse(rawModel);\n      if (!parsed.success) continue; // malformed model — drop silently (live data, additive drift expected)\n      for (const key of keys) patchModelInfo(`${key}/${modelId}`, parsed.data);\n      patched++;\n    }\n  }\n  if (skipped.length > 0) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh skipped ${skipped.length} unknown provider(s) (e.g. ${skipped.slice(0, 3).join(\", \")})\\n`,\n    );\n  }\n  return patched;\n}\n\n/**\n * Load an existing disk cache into the index (called by refresh when fresh, or opportunistically by a\n * consumer at startup — NEVER fetches). Corrupt cache → delete + fall through to vendored data.\n */\nexport function loadCacheIntoIndex(url: string = DEFAULT_URL): number {\n  const path = cachePathFor(url);\n  let body: string;\n  try {\n    body = readFileSync(path, \"utf-8\");\n  } catch {\n    return 0; // no cache — vendored data only\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body);\n  } catch {\n    // corrupt cache: delete and fall through to the vendored catalog (OpenCode's delete-and-fall-through).\n    // M44 L9 fix — only a PARSE failure is cache corruption; a patch error must never delete a valid cache.\n    try {\n      unlinkSync(path);\n    } catch {\n      // best effort\n    }\n    diag(`[theokit-sdk] WARN: corrupt models-dev cache deleted (${path})\\n`);\n    return 0;\n  }\n  try {\n    return patchIndexFromApiJson(parsed);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache patch failed (${(err as Error).message})\\n`);\n    return 0;\n  }\n}\n\n/**\n * Explicitly refresh the model catalog from models.dev (the ONLY network trigger in the subsystem).\n * Fail-closed: any failure keeps serving the current index (cache or vendored). Kill-switch:\n * `THEOKIT_DISABLE_MODELS_FETCH`.\n */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nexport async function refreshModelCatalog(\n  opts: RefreshModelCatalogOptions = {},\n): Promise<RefreshModelCatalogResult> {\n  // M44 M4 fix — self-initialize provider registration so the `@theokit/sdk/models` subpath works standalone\n  // (without the consumer having built an Agent first).\n  registerBuiltins();\n  // M44 L11 fix — presence-based would treat \"0\"/\"false\"/\"\" as disabled; only truthy values disable.\n  const kill = process.env.THEOKIT_DISABLE_MODELS_FETCH;\n  if (kill !== undefined && kill !== \"\" && kill !== \"0\" && kill.toLowerCase() !== \"false\") {\n    return { source: \"skipped\", models: 0 };\n  }\n  const url = opts.url ?? process.env.THEOKIT_MODELS_URL ?? DEFAULT_URL;\n  const path = cachePathFor(url);\n  const now = opts.deps?.now ?? (() => Date.now());\n\n  // TTL gate: a fresh cache serves without network (mtime freshness, OpenCode's gate).\n  if (opts.force !== true) {\n    try {\n      const age = now() - statSync(path).mtimeMs;\n      if (age < TTL_MS) {\n        return { source: \"cache\", models: loadCacheIntoIndex(url) };\n      }\n    } catch {\n      // no cache — proceed to fetch\n    }\n  }\n\n  const fetchImpl = opts.deps?.fetch ?? fetch;\n  let body: string;\n  try {\n    const res = await Retry.create(\n      async () => {\n        const r = await fetchImpl(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        return r;\n      },\n      // 2 transient retries with backoff (OpenCode does the same); every error here is worth one more try —\n      // the whole call is already fail-closed at the caller.\n      { retries: 2, isRetryable: () => true, initialDelayMs: 200 },\n    );\n    body = await res.text();\n    JSON.parse(body); // validate before persisting — never cache garbage\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    // fail-closed: serve whatever we already have (stale cache if present, else vendored)\n    return { source: \"cache\", models: loadCacheIntoIndex(url) };\n  }\n\n  try {\n    writeCacheAtomic(path, body);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache write failed (${(err as Error).message})\\n`);\n  }\n  try {\n    return { source: \"network\", models: patchIndexFromApiJson(JSON.parse(body)) };\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev patch failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return { source: \"cache\", models: 0 };\n  }\n}\n\n/** The enriched per-model view (public via `@theokit/sdk/models`): index lookup by (possibly prefixed) id. */\nexport function getModelInfo(modelId: string): ReturnType<typeof getCatalogModelInfo> {\n  return getCatalogModelInfo(modelId);\n}\n"]}
+{"version":3,"sources":["../src/internal/llm/model-capabilities.ts","../src/internal/llm/model-option.ts","../src/internal/providers/catalog-source-models-dev.ts"],"names":["getCatalogModelInfo","parseModelId","join","homedir","createHash","path","mkdirSync","dirname","randomBytes","writeFileSync","renameSync","unlinkSync","loadProviderCatalog","getProviderProfile","catalogModelSchema","patchModelInfo","diag","readFileSync","registerBuiltins","statSync","Retry"],"mappings":";;;;;;;;;;;;;;;;AAgCA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,eAAA,EAAiB,KAAA;AAAA,EACjB,oBAAA,EAAsB,KAAA;AAAA,EACtB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAGA,IAAM,gBAAA,GAAmB,CAAC,aAAA,EAAe,SAAA,EAAW,UAAU,CAAA;AAM9D,SAAS,gBAAgB,CAAA,EAAoC;AAC3D,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,EAAE,UAAA,EAAY,KAAA,EAAO,SAAS,OAAO,CAAA,IAAK,EAAE,UAAA,IAAc,KAAA;AAAA,IAC1E,wBAAA,EAA0B,EAAE,iBAAA,IAAqB,KAAA;AAAA,IACjD,eAAA,EAAiB,EAAE,SAAA,IAAa,KAAA;AAAA,IAChC,oBAAA,EAAuB,EAAkC,aAAA,IAAiB,KAAA;AAAA,IAC1E,gBAAA,EAAkB,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,qBAAA,CAAsB,gBAAA;AAAA,IAC5D,eAAA,EAAiB,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU,qBAAA,CAAsB;AAAA,GAC5D;AACF;AAWO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAG3D,EAAA,MAAM,SAAA,GAAYA,sCAAoB,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,eAAA,CAAgB,SAAS,CAAA;AAG7D,EAAA,MAAM,UAAA,GAAa,kBAAkB,IAAI,CAAA;AACzC,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,QAAA,GAAWA,sCAAoB,UAAU,CAAA;AAC/C,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,eAAA,CAAgB,QAAQ,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,qBAAA;AACT;AAEA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,KAAA,MAAW,UAAU,gBAAA,EAAkB;AACrC,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAM,CAAA,SAAU,OAAA,CAAQ,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,OAAA;AACT;AAOA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,OAAO,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,GAAI,OAAA;AACxC;AAGA,SAAS,kBAAkB,IAAA,EAAsB;AAC/C,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,aAAa,IAAI,CAAA,CAAA;AACvD,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,IAAI,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAC1E,IAAA,OAAO,UAAU,IAAI,CAAA,CAAA;AACvB,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,UAAU,IAAI,CAAA,CAAA;AACpD,EAAA,OAAO,IAAA;AACT;;;ACzFA,IAAM,QAAA,mBAAW,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,IAAI,CAAC,CAAA;AAE7E,SAAS,YAAY,KAAA,EAAuB;AAC1C,EAAA,IAAI,QAAA,CAAS,IAAI,KAAA,CAAM,WAAA,EAAa,CAAA,EAAG,OAAO,MAAM,WAAA,EAAY;AAChE,EAAA,OAAO,KAAA,CAAM,OAAO,CAAC,CAAA,CAAE,aAAY,GAAI,KAAA,CAAM,MAAM,CAAC,CAAA;AACtD;AAeO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,MAAM,EAAE,IAAA,EAAK,GAAIC,8BAAA,CAAa,OAAO,CAAA;AACrC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAG9B,EAAA,MAAM,IAAA,GAAA,CAAQ,KAAA,IAAS,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAA,EAAM,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC1E,EAAA,MAAM,UAAU,KAAA,IAAS,CAAA,GAAI,KAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,EAAA;AACrD,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,MAAM,OAAO,SAAA,IAAa,CAAA,GAAI,KAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA,GAAI,IAAA;AAC1D,EAAA,MAAM,QAAQ,IAAA,CACX,KAAA,CAAM,UAAU,CAAA,CAChB,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,GAAA,CAAI,WAAW,CAAA,CACf,KAAK,GAAG,CAAA;AACX,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AAC/B,EAAA,OAAO,QAAQ,MAAA,GAAS,CAAA,GAAI,GAAG,KAAK,CAAA,EAAA,EAAK,OAAO,CAAA,CAAA,CAAA,GAAM,KAAA;AACxD;AAUO,SAAS,cAAc,OAAA,EAA8B;AAC1D,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,OAAA;AAAA,IACP,KAAA,EAAO,kBAAkB,OAAO,CAAA;AAAA,IAChC,QAAA,EAAUA,8BAAA,CAAa,OAAO,CAAA,CAAE;AAAA,GAClC;AACF;AC9CA,IAAM,WAAA,GAAc,6BAAA;AACpB,IAAM,MAAA,GAAS,KAAK,EAAA,GAAK,GAAA;AACzB,IAAM,gBAAA,GAAmB,GAAA;AAmBlB,SAAS,aAAa,GAAA,EAAqB;AAEhD,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,YAAA,EAAc,MAAK,IAAKC,SAAA,CAAKC,UAAA,EAAQ,EAAG,UAAU,CAAA;AAC3E,EAAA,MAAM,GAAA,GAAMD,SAAA,CAAK,IAAA,EAAM,OAAA,EAAS,YAAY,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,WAAA,EAAa,OAAOA,SAAA,CAAK,KAAK,UAAU,CAAA;AACpD,EAAA,MAAM,IAAA,GAAOE,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACvE,EAAA,OAAOF,SAAA,CAAK,GAAA,EAAK,CAAA,IAAA,EAAO,IAAI,CAAA,KAAA,CAAO,CAAA;AACrC;AAGA,SAAS,gBAAA,CAAiBG,QAAc,IAAA,EAAoB;AAC1D,EAAAC,YAAA,CAAUC,aAAQF,MAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,GAAA,GAAM,GAAGA,MAAI,CAAA,KAAA,EAAQG,mBAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAAC,gBAAA,CAAc,KAAK,IAAI,CAAA;AACvB,IAAAC,aAAA,CAAW,KAAKL,MAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAAM,aAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAQA,IAAM,iBAAA,GAA4C;AAAA,EAChD,MAAA,EAAQ,eAAA;AAAA,EACR,GAAA,EAAK,OAAA;AAAA,EACL,UAAA,EAAY,UAAA;AAAA,EACZ,cAAA,EAAgB,WAAA;AAAA,EAChB,gBAAA,EAAkB,SAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAEA,IAAI,eAAA;AAEJ,SAAS,cAAA,GAAkD;AACzD,EAAA,IAAI,eAAA,KAAoB,QAAW,OAAO,eAAA;AAC1C,EAAA,eAAA,uBAAsB,GAAA,EAAI;AAC1B,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAOC,qCAAA,EAAqB,CAAA,EAAG;AACxD,MAAA,MAAM,IAAA,GAAO,CAAC,KAAA,CAAM,EAAA,EAAI,GAAI,KAAA,CAAM,OAAA,IAAW,EAAG,CAAA;AAChD,MAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,QAAA,IAAI,CAAC,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,kBAAmB,GAAA,CAAI,CAAA,EAAG,EAAE,IAAA,EAAM,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,eAAA;AACT;AAEA,SAAS,iBAAiB,UAAA,EAA0C;AAClE,EAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA;AAChD,EAAA,MAAM,WAAA,GAAc,cAAA,EAAe,CAAE,GAAA,CAAI,MAAM,CAAA;AAC/C,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,WAAA,CAAY,IAAA;AAClD,EAAA,MAAM,OAAA,GAAUC,qCAAmB,MAAM,CAAA;AACzC,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,OAAO,CAAC,OAAA,CAAQ,MAAM,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA;AAC3E,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,sBAAsB,GAAA,EAAsB;AACnD,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,CAAA;AACpD,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,CAAC,UAAA,EAAY,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,GAA8B,CAAA,EAAG;AACnF,IAAA,MAAM,SAAU,QAAA,EAAmD,MAAA;AACnE,IAAA,IAAI,MAAA,KAAW,MAAA,IAAa,OAAO,MAAA,KAAW,QAAA,EAAU;AAGxD,IAAA,MAAM,IAAA,GAAO,iBAAiB,UAAU,CAAA;AACxC,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,OAAA,CAAQ,KAAK,UAAU,CAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,CAAC,OAAA,EAAS,QAAQ,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACxD,MAAA,MAAM,MAAA,GAASC,oCAAA,CAAmB,SAAA,CAAU,QAAQ,CAAA;AACpD,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACrB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAMC,gCAAA,CAAe,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,MAAA,CAAO,IAAI,CAAA;AACvE,MAAA,OAAA,EAAA;AAAA,IACF;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAAC,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAkD,OAAA,CAAQ,MAAM,CAAA,2BAAA,EAA8B,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA;AAAA,KAC9H;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT;AAMO,SAAS,kBAAA,CAAmB,MAAc,WAAA,EAAqB;AACpE,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAOC,eAAA,CAAa,MAAM,OAAO,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAGN,IAAA,IAAI;AACF,MAAAN,aAAA,CAAW,IAAI,CAAA;AAAA,IACjB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAAK,sBAAA,CAAK,yDAAyD,IAAI,CAAA;AAAA,CAAK,CAAA;AACvE,IAAA,OAAO,CAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,sBAAsB,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AACtF,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAYA,eAAsB,mBAAA,CACpB,IAAA,GAAmC,EAAC,EACA;AAGpC,EAAAE,kCAAA,EAAiB;AAEjB,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,CAAI,4BAAA;AACzB,EAAA,IAAI,IAAA,KAAS,UAAa,IAAA,KAAS,EAAA,IAAM,SAAS,GAAA,IAAO,IAAA,CAAK,WAAA,EAAY,KAAM,OAAA,EAAS;AACvF,IAAA,OAAO,EAAE,MAAA,EAAQ,SAAA,EAAW,MAAA,EAAQ,CAAA,EAAE;AAAA,EACxC;AACA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,OAAA,CAAQ,IAAI,kBAAA,IAAsB,WAAA;AAC1D,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAM,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI,CAAA;AAG9C,EAAA,IAAI,IAAA,CAAK,UAAU,IAAA,EAAM;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,GAAA,EAAI,GAAIC,WAAA,CAAS,IAAI,CAAA,CAAE,OAAA;AACnC,MAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,QAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAAA,MAC5D;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,KAAA,IAAS,KAAA;AACtC,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMC,uBAAA,CAAM,MAAA;AAAA,MACtB,YAAY;AACV,QAAA,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,GAAA,EAAK,EAAE,QAAQ,WAAA,CAAY,OAAA,CAAQ,gBAAgB,CAAA,EAAG,CAAA;AAChF,QAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,KAAA,EAAQ,CAAA,CAAE,MAAM,CAAA,CAAE,CAAA;AAC7C,QAAA,OAAO,CAAA;AAAA,MACT,CAAA;AAAA;AAAA;AAAA,MAGA,EAAE,OAAA,EAAS,CAAA,EAAG,aAAa,MAAM,IAAA,EAAM,gBAAgB,GAAA;AAAI,KAC7D;AACA,IAAA,IAAA,GAAO,MAAM,IAAI,IAAA,EAAK;AACtB,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACjB,SAAS,GAAA,EAAK;AACZ,IAAAJ,sBAAA;AAAA,MACE,CAAA,+CAAA,EAAmD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC1E;AAEA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,kBAAA,CAAmB,GAAG,CAAA,EAAE;AAAA,EAC5D;AAEA,EAAA,IAAI;AACF,IAAA,gBAAA,CAAiB,MAAM,IAAI,CAAA;AAAA,EAC7B,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA,CAAK,CAAA,mDAAA,EAAuD,IAAc,OAAO,CAAA;AAAA,CAAK,CAAA;AAAA,EACxF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,EAAE,QAAQ,SAAA,EAAW,MAAA,EAAQ,sBAAsB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,EAAE;AAAA,EAC9E,SAAS,GAAA,EAAK;AACZ,IAAAA,sBAAA;AAAA,MACE,CAAA,6CAAA,EAAiD,IAAc,OAAO,CAAA;AAAA;AAAA,KACxE;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,CAAA,EAAE;AAAA,EACtC;AACF;AAGO,SAAS,aAAa,OAAA,EAAyD;AACpF,EAAA,OAAOhB,sCAAoB,OAAO,CAAA;AACpC","file":"models.cjs","sourcesContent":["/**\n * T3.10c — Model capability registry (DR3 #17).\n *\n * Typed per-model flags that let the SDK gate features at the boundary\n * (before hitting the provider) instead of letting opaque 400s surface.\n *\n * Resolution algorithm:\n *   1. Strip routing prefixes (openrouter/, vertex/, bedrock/) AND the\n *      OpenRouter `:variant` suffix (:free/:nitro/…) to find the bare vendor id.\n *   2. Exact match in the `EXACT` catalog → return entry.\n *   3. Vendor inference (e.g., `claude-*` → `anthropic/claude-*`) → return entry.\n *   4. No match → conservative defaults (all false, minimum tokens).\n *\n * Module is internal, but `ModelCapabilities` + `resolveModelCapabilities` are\n * re-exported publicly via the `@theokit/sdk/models` subpath (see their @public tags).\n */\n\n/**\n * Per-model capability shape. Consumers use this to gate features at\n * the SDK boundary (before request construction, not after 400).\n *\n * @public\n */\nexport interface ModelCapabilities {\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsToolUse: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens: number;\n  maxOutputTokens: number;\n}\n\nconst CONSERVATIVE_DEFAULTS: ModelCapabilities = {\n  supportsVision: false,\n  supportsStructuredOutput: false,\n  supportsToolUse: false,\n  supportsCacheControl: false,\n  maxContextTokens: 4096,\n  maxOutputTokens: 4096,\n};\n\n/** Routing prefixes to strip to find the underlying vendor model. */\nconst ROUTING_PREFIXES = [\"openrouter/\", \"vertex/\", \"bedrock/\"] as const;\n\nimport { getCatalogModelInfo } from \"../providers/catalog-loader.js\";\nimport type { CatalogModel } from \"../providers/catalog-schema.js\";\n\n/** Map a catalog model block (models.dev shape) to the SDK's ModelCapabilities (M44 — catalog-backed). */\nfunction capsFromCatalog(m: CatalogModel): ModelCapabilities {\n  return {\n    supportsVision: m.modalities?.input?.includes(\"image\") ?? m.attachment ?? false,\n    supportsStructuredOutput: m.structured_output ?? false,\n    supportsToolUse: m.tool_call ?? false,\n    supportsCacheControl: (m as { cache_control?: boolean }).cache_control ?? false,\n    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,\n    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens,\n  };\n}\n\n/**\n * Resolve per-model capability flags (vision/structured-output/tool-use/cache +\n * `maxContextTokens`/`maxOutputTokens`) for a model id. Pure, sync, offline (a\n * static catalog — no network). Strips routing prefixes (`openrouter/`/`vertex/`/\n * `bedrock/`) and OpenRouter `:variant` suffixes before lookup; unknown models get\n * conservative defaults. Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function resolveModelCapabilities(modelId: string): ModelCapabilities {\n  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));\n  // M44 — the catalog model-info index replaced the hand-curated EXACT map (single source of truth; the\n  // vendored provider-catalog.json carries the migrated data — parity-tested against the old map snapshot).\n  const fromIndex = getCatalogModelInfo(bare);\n  if (fromIndex !== undefined) return capsFromCatalog(fromIndex);\n  // Routing-prefixed models (vertex/claude-3-5-sonnet) strip to bare\n  // model name without vendor. Try inferring the vendor from the name.\n  const withVendor = inferVendorPrefix(bare);\n  if (withVendor !== bare) {\n    const vendored = getCatalogModelInfo(withVendor);\n    if (vendored !== undefined) return capsFromCatalog(vendored);\n  }\n  return CONSERVATIVE_DEFAULTS;\n}\n\nfunction stripRoutingPrefix(modelId: string): string {\n  for (const prefix of ROUTING_PREFIXES) {\n    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);\n  }\n  return modelId;\n}\n\n/**\n * Strip an OpenRouter variant suffix (`:free`/`:nitro`/`:floor`/`:beta`/…) so the\n * catalog lookup hits the underlying model. Model slugs contain no `:` except the\n * variant separator, so cutting at the first `:` is safe.\n */\nfunction stripVariantSuffix(modelId: string): string {\n  const i = modelId.indexOf(\":\");\n  return i >= 0 ? modelId.slice(0, i) : modelId;\n}\n\n/** Infer vendor prefix from bare model name for routing-prefixed lookups. */\nfunction inferVendorPrefix(bare: string): string {\n  if (bare.startsWith(\"claude\")) return `anthropic/${bare}`;\n  if (bare.startsWith(\"gpt-\") || bare.startsWith(\"o1\") || bare.startsWith(\"o3\"))\n    return `openai/${bare}`;\n  if (bare.startsWith(\"gemini\")) return `google/${bare}`;\n  return bare;\n}\n","import { parseModelId } from \"./model-identifier.js\";\n\n/**\n * A UI-friendly model option — the shape a `<select>`/dropdown consumes.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport interface ModelOption {\n  /** The original model id (what you pass back to the SDK). */\n  value: string;\n  /** Best-effort human label (see {@link humanizeModelName}). */\n  label: string;\n  /** Provider from the slug prefix, or `undefined` when none. */\n  provider: string | undefined;\n}\n\n/** Tokens rendered upper-case rather than title-case. */\nconst ACRONYMS = new Set([\"gpt\", \"ai\", \"hd\", \"ui\", \"api\", \"sdk\", \"llm\", \"xl\"]);\n\nfunction prettyToken(token: string): string {\n  if (ACRONYMS.has(token.toLowerCase())) return token.toUpperCase();\n  return token.charAt(0).toUpperCase() + token.slice(1);\n}\n\n/**\n * Turn a model id into a best-effort human label: strip the routing/vendor\n * prefix to the core model segment, split on `-`/`_`/`.`/whitespace, title-case\n * each token (known acronyms upper-cased), and append an OpenRouter `:variant`\n * in parentheses. Deterministic, pure, dependency-free.\n *\n * Best-effort, NOT vendor-canonical: `\"anthropic/claude-3-5-sonnet\"` →\n * `\"Claude 3 5 Sonnet\"`. A UI wanting exact marketing names overrides per id.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function humanizeModelName(modelId: string): string {\n  const { name } = parseModelId(modelId);\n  if (name.length === 0) return \"\";\n  const colon = name.indexOf(\":\");\n  // Strip a trailing slash so a typo'd `gpt-4o/` keeps its name (not lost to an\n  // empty last segment).\n  const base = (colon >= 0 ? name.slice(0, colon) : name).replace(/\\/+$/, \"\");\n  const variant = colon >= 0 ? name.slice(colon + 1) : \"\";\n  const lastSlash = base.lastIndexOf(\"/\");\n  const core = lastSlash >= 0 ? base.slice(lastSlash + 1) : base;\n  const label = core\n    .split(/[-_.\\s]+/)\n    .filter((t) => t.length > 0)\n    .map(prettyToken)\n    .join(\" \");\n  if (label.length === 0) return variant; // no base label (e.g. \":free\") → bare variant\n  return variant.length > 0 ? `${label} (${variant})` : label;\n}\n\n/**\n * Build a {@link ModelOption} (`{ value, label, provider }`) for a model id —\n * a dropdown-ready entry composing {@link humanizeModelName} + `parseModelId`.\n *\n * Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function toModelOption(modelId: string): ModelOption {\n  return {\n    value: modelId,\n    label: humanizeModelName(modelId),\n    provider: parseModelId(modelId).provider,\n  };\n}\n","import { createHash, randomBytes } from \"node:crypto\";\nimport { mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { Retry } from \"../../retry.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { registerBuiltins } from \"./builtin/index.js\";\nimport { getCatalogModelInfo, loadProviderCatalog, patchModelInfo } from \"./catalog-loader.js\";\nimport { catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile } from \"./registry.js\";\n\n/**\n * M44 — the OPTIONAL models.dev catalog source. Explicit opt-in ONLY (`refreshModelCatalog()`): the SDK\n * NEVER fetches at startup or per-request — the vendored catalog + any existing disk cache are the offline\n * base, and every failure mode fails CLOSED back to them (ROADMAP constraint: no runtime hard network dep).\n *\n * Mechanism adapted from OpenCode's models.dev consumption (MIT © 2025 opencode — `core/src/models-dev.ts`):\n * disk cache with mtime TTL, atomic tempfile+rename write, corrupt-cache delete-and-fall-through, kill-switch\n * env. Library adaptations: NO background refresh loop (a consumer composes refresh with the SDK's cron);\n * TTL 1h (not 5min — no background refresher to keep it warm); no cross-process flock v1 (atomic rename +\n * idempotent upstream content — at most one wasted fetch).\n *\n * @internal (the public surface is `refreshModelCatalog` re-exported via `@theokit/sdk/models`)\n */\n\nconst DEFAULT_URL = \"https://models.dev/api.json\";\nconst TTL_MS = 60 * 60 * 1000; // 1 hour\nconst FETCH_TIMEOUT_MS = 10_000;\n\nexport interface RefreshModelCatalogOptions {\n  /** Override the source URL (`THEOKIT_MODELS_URL` env also honored). */\n  url?: string;\n  /** Bypass the TTL freshness gate. */\n  force?: boolean;\n  /** Injected for tests. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\nexport interface RefreshModelCatalogResult {\n  /** Where the data came from: a fresh network fetch, the still-fresh disk cache, or skipped entirely. */\n  source: \"network\" | \"cache\" | \"skipped\";\n  /** How many models were patched into the index. */\n  models: number;\n}\n\n/** The cache file for a source URL (custom URLs get a hash-suffixed name, mirroring OpenCode). */\nexport function cachePathFor(url: string): string {\n  // M44 L8 fix — honor the SDK home override so tests and multi-home setups never touch the real ~/.theokit.\n  const base = process.env.THEOKIT_HOME?.trim() || join(homedir(), \".theokit\");\n  const dir = join(base, \"cache\", \"models-dev\");\n  if (url === DEFAULT_URL) return join(dir, \"api.json\");\n  const hash = createHash(\"sha256\").update(url).digest(\"hex\").slice(0, 12);\n  return join(dir, `api-${hash}.json`);\n}\n\n/** Atomic write: temp file + rename (crash mid-write never leaves a partial cache). */\nfunction writeCacheAtomic(path: string, body: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.tmp-${randomBytes(6).toString(\"hex\")}`;\n  try {\n    writeFileSync(tmp, body);\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // best effort\n    }\n    throw err;\n  }\n}\n\n/**\n * M44 H3 fix — models.dev provider ids ≠ theokit ids (google↔google-gemini, zai↔zhipu, togetherai↔together,\n * fireworks-ai↔fireworks, amazon-bedrock↔bedrock, google-vertex↔vertex). The RUNTIME mapping mirrors the\n * maintenance script's table; targets resolve against the CATALOG entries (id + aliases — the same namespace\n * the vendored index uses) first, then the registry.\n */\nconst MODELS_DEV_ID_MAP: Record<string, string> = {\n  google: \"google-gemini\",\n  zai: \"zhipu\",\n  togetherai: \"together\",\n  \"fireworks-ai\": \"fireworks\",\n  \"amazon-bedrock\": \"bedrock\",\n  \"google-vertex\": \"vertex\",\n};\n\nlet _catalogTargets: Map<string, { keys: string[] }> | undefined;\n/** external-id → the index keys (entry id + aliases) its models patch under. Lazy; catalog-first. */\nfunction catalogTargets(): Map<string, { keys: string[] }> {\n  if (_catalogTargets !== undefined) return _catalogTargets;\n  _catalogTargets = new Map();\n  try {\n    for (const entry of Object.values(loadProviderCatalog())) {\n      const keys = [entry.id, ...(entry.aliases ?? [])];\n      for (const k of keys) {\n        if (!_catalogTargets.has(k)) _catalogTargets.set(k, { keys });\n      }\n    }\n  } catch {\n    // catalog unavailable — registry fallback below still works\n  }\n  return _catalogTargets;\n}\n\nfunction resolvePatchKeys(externalId: string): string[] | undefined {\n  const mapped = MODELS_DEV_ID_MAP[externalId] ?? externalId;\n  const fromCatalog = catalogTargets().get(mapped);\n  if (fromCatalog !== undefined) return fromCatalog.keys;\n  const profile = getProviderProfile(mapped);\n  if (profile !== undefined) return [profile.name, ...(profile.aliases ?? [])];\n  return undefined;\n}\n\n/** Parse + patch the index from an api.json payload. Unknown providers are skipped with WARN (once each). */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nfunction patchIndexFromApiJson(raw: unknown): number {\n  if (typeof raw !== \"object\" || raw === null) return 0;\n  let patched = 0;\n  const skipped: string[] = [];\n  for (const [providerId, provider] of Object.entries(raw as Record<string, unknown>)) {\n    const models = (provider as { models?: Record<string, unknown> })?.models;\n    if (models === undefined || typeof models !== \"object\") continue;\n    // Enrich ONLY providers the SDK knows — models.dev's npm/api fields cannot be mapped to a theokit\n    // apiMode/authType safely, so unknown providers are data we cannot route.\n    const keys = resolvePatchKeys(providerId);\n    if (keys === undefined) {\n      skipped.push(providerId);\n      continue;\n    }\n    for (const [modelId, rawModel] of Object.entries(models)) {\n      const parsed = catalogModelSchema.safeParse(rawModel);\n      if (!parsed.success) continue; // malformed model — drop silently (live data, additive drift expected)\n      for (const key of keys) patchModelInfo(`${key}/${modelId}`, parsed.data);\n      patched++;\n    }\n  }\n  if (skipped.length > 0) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh skipped ${skipped.length} unknown provider(s) (e.g. ${skipped.slice(0, 3).join(\", \")})\\n`,\n    );\n  }\n  return patched;\n}\n\n/**\n * Load an existing disk cache into the index (called by refresh when fresh, or opportunistically by a\n * consumer at startup — NEVER fetches). Corrupt cache → delete + fall through to vendored data.\n */\nexport function loadCacheIntoIndex(url: string = DEFAULT_URL): number {\n  const path = cachePathFor(url);\n  let body: string;\n  try {\n    body = readFileSync(path, \"utf-8\");\n  } catch {\n    return 0; // no cache — vendored data only\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(body);\n  } catch {\n    // corrupt cache: delete and fall through to the vendored catalog (OpenCode's delete-and-fall-through).\n    // M44 L9 fix — only a PARSE failure is cache corruption; a patch error must never delete a valid cache.\n    try {\n      unlinkSync(path);\n    } catch {\n      // best effort\n    }\n    diag(`[theokit-sdk] WARN: corrupt models-dev cache deleted (${path})\\n`);\n    return 0;\n  }\n  try {\n    return patchIndexFromApiJson(parsed);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache patch failed (${(err as Error).message})\\n`);\n    return 0;\n  }\n}\n\n/**\n * Explicitly refresh the model catalog from models.dev (the ONLY network trigger in the subsystem).\n * Fail-closed: any failure keeps serving the current index (cache or vendored). Kill-switch:\n * `THEOKIT_DISABLE_MODELS_FETCH`.\n */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nexport async function refreshModelCatalog(\n  opts: RefreshModelCatalogOptions = {},\n): Promise<RefreshModelCatalogResult> {\n  // M44 M4 fix — self-initialize provider registration so the `@theokit/sdk/models` subpath works standalone\n  // (without the consumer having built an Agent first).\n  registerBuiltins();\n  // M44 L11 fix — presence-based would treat \"0\"/\"false\"/\"\" as disabled; only truthy values disable.\n  const kill = process.env.THEOKIT_DISABLE_MODELS_FETCH;\n  if (kill !== undefined && kill !== \"\" && kill !== \"0\" && kill.toLowerCase() !== \"false\") {\n    return { source: \"skipped\", models: 0 };\n  }\n  const url = opts.url ?? process.env.THEOKIT_MODELS_URL ?? DEFAULT_URL;\n  const path = cachePathFor(url);\n  const now = opts.deps?.now ?? (() => Date.now());\n\n  // TTL gate: a fresh cache serves without network (mtime freshness, OpenCode's gate).\n  if (opts.force !== true) {\n    try {\n      const age = now() - statSync(path).mtimeMs;\n      if (age < TTL_MS) {\n        return { source: \"cache\", models: loadCacheIntoIndex(url) };\n      }\n    } catch {\n      // no cache — proceed to fetch\n    }\n  }\n\n  const fetchImpl = opts.deps?.fetch ?? fetch;\n  let body: string;\n  try {\n    const res = await Retry.create(\n      async () => {\n        const r = await fetchImpl(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });\n        if (!r.ok) throw new Error(`HTTP ${r.status}`);\n        return r;\n      },\n      // 2 transient retries with backoff (OpenCode does the same); every error here is worth one more try —\n      // the whole call is already fail-closed at the caller.\n      { retries: 2, isRetryable: () => true, initialDelayMs: 200 },\n    );\n    body = await res.text();\n    JSON.parse(body); // validate before persisting — never cache garbage\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev refresh failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    // fail-closed: serve whatever we already have (stale cache if present, else vendored)\n    return { source: \"cache\", models: loadCacheIntoIndex(url) };\n  }\n\n  try {\n    writeCacheAtomic(path, body);\n  } catch (err) {\n    diag(`[theokit-sdk] WARN: models-dev cache write failed (${(err as Error).message})\\n`);\n  }\n  try {\n    return { source: \"network\", models: patchIndexFromApiJson(JSON.parse(body)) };\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: models-dev patch failed (${(err as Error).message}) — serving existing data\\n`,\n    );\n    return { source: \"cache\", models: 0 };\n  }\n}\n\n/** The enriched per-model view (public via `@theokit/sdk/models`): index lookup by (possibly prefixed) id. */\nexport function getModelInfo(modelId: string): ReturnType<typeof getCatalogModelInfo> {\n  return getCatalogModelInfo(modelId);\n}\n"]}

package/dist/models.js

@@ -1,8 +1,9 @@
 import { Retry } from './chunk-MV4TOCUK.js';
 import { parseModelId } from './chunk-X2FR4OIT.js';
 export { parseModelId } from './chunk-X2FR4OIT.js';
-import { getCatalogModelInfo, registerBuiltins, catalogModelSchema, patchModelInfo, getProviderProfile, loadProviderCatalog } from './chunk-V2EJLKGA.js';
-import './chunk-BKRTYDVN.js';
+import { getCatalogModelInfo, registerBuiltins, catalogModelSchema, patchModelInfo, getProviderProfile, loadProviderCatalog } from './chunk-2YWWPCGX.js';
+import './chunk-XRI6DXPZ.js';
+import './chunk-23VZBRDQ.js';
 import './chunk-5NBUH3NO.js';
 import './chunk-HI4ZW62S.js';
 import { diag } from './chunk-4X3SBHPK.js';