@theokit/sdk 4.52.1 → 4.53.1

package/dist/chunk-VF7X6HDR.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/auth/oauth-engine.ts","../src/internal/auth/resolve-credential.ts"],"names":["AuthCallbackError","writeCredential","authFilePath","readStoredOAuth","fresh","readAuthFile"],"mappings":";;;;;;AA0BA,IAAM,eAAA,GAAkB,GAAA;AAGxB,SAAS,kBAAA,CAAmB,MAAe,GAAA,EAA0B;AACnE,EAAA,MAAM,CAAA,GAAI,IAAA;AAMV,EAAA,IAAI,OAAO,CAAA,CAAE,YAAA,KAAiB,YAAY,CAAA,CAAE,YAAA,CAAa,WAAW,CAAA,EAAG;AACrE,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,aAAA,KAAkB,YAAY,CAAA,CAAE,aAAA,CAAc,WAAW,CAAA,EAAG;AACvE,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAY,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,UAAA,GAAa,IAAA;AACpE,EAAA,OAAO;AAAA,IACL,QAAQ,CAAA,CAAE,YAAA;AAAA,IACV,SAAS,CAAA,CAAE,aAAA;AAAA,IACX,OAAA,EAAS,MAAM,SAAA,GAAY,GAAA;AAAA,IAC3B,GAAI,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW,GAAI;AAAC,GACxE;AACF;AAGA,eAAe,SAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACsB;AACtB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB,IAAI,EAAE,QAAA;AAAS,KAC1C,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,+BAAA,EAAmC,IAAc,OAAO,CAAA;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AAGX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,IAAI,MAAM,CAAA;AAAA,KAC5C;AAAA,EACF;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAI,IAAA,EAAK;AAAA,EACxB,CAAA,CAAA,MAAQ;AAGN,IAAA,MAAM,IAAIA,mCAAA,CAAkB,6BAAA,EAA+B,mCAAmC,CAAA;AAAA,EAChG;AACA,EAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,CAAA;AAC5C;AAGO,SAAS,YAAA,CACd,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA;AAAA,MACE,UAAA,EAAY,oBAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,MAAA,CAAO,WAAA;AAAA,MACrB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,eAAe,KAAA,CAAM;AAAA,KACvB;AAAA,IACA;AAAA,GACF;AACF;AAGO,SAAS,kBAAA,CACd,MAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA,EAAE,UAAA,EAAY,eAAA,EAAiB,eAAe,OAAA,EAAS,SAAA,EAAW,OAAO,QAAA,EAAS;AAAA,IAClF;AAAA,GACF;AACF;AAGO,SAAS,mBACd,QAAA,EACA,MAAA,EACA,KAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,OAAOC,iCAAA;AAAA,IACL;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,QAAA;AAAA,MACA,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,GAAI,OAAO,SAAA,KAAc,MAAA,GAAY,EAAE,UAAA,EAAY,MAAA,CAAO,SAAA,EAAU,GAAI;AAAC,KAC3E;AAAA,IACA,KAAA;AAAA,IACA;AAAA,GACF;AACF;AAQA,IAAM,eAAA,uBAAsB,GAAA,EAAkC;AAQ9D,eAAsB,qBAAA,CACpB,QAAA,EACA,IAAA,EAKA,IAAA,EAC6B;AAC7B,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,OAAA,EAAS,OAAO,QAAA;AAEtC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,SAAS,SAAA,KAAc,MAAA,IAAa,QAAA,CAAS,SAAA,GAAY,MAAM,eAAA,EAAiB;AAClF,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,IAAA,GAAOC,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACzC,EAAA,IAAI,OAAA,GAAU,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AACtC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,OAAA,GAAA,CAAW,YAAkC;AAC3C,MAAA,MAAM,MAAA,GAASC,iCAAA,CAAgB,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC9C,MAAA,IAAI,WAAW,MAAA,EAAW;AAExB,QAAA,MAAM,IAAIH,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAMI,SAAQ,MAAM,kBAAA,CAAmB,KAAK,MAAA,EAAQ,MAAA,CAAO,SAAS,IAAI,CAAA;AAKxE,MAAA,MAAM,MAAA,GAAsB;AAAA,QAC1B,GAAGA,MAAAA;AAAA,QACH,SAAA,EAAWA,MAAAA,CAAM,SAAA,IAAa,MAAA,CAAO;AAAA,OACvC;AACA,MAAA,kBAAA,CAAmB,QAAA,CAAS,QAAA,EAAU,MAAA,EAAQ,IAAA,CAAK,OAAO,GAAG,CAAA;AAC7D,MAAA,OAAO,MAAA;AAAA,IACT,CAAA,GAAG;AACH,IAAA,eAAA,CAAgB,GAAA,CAAI,MAAM,OAAO,CAAA;AACjC,IAAA,OAAA,CAAQ,OAAA,CAAQ,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,QAAQ,MAAM,OAAA;AACpB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;;;AChLA,eAAe,YAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACA,GAAA,EACyC;AACzC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,MAAM,IAAA,GAA2B;AAAA,IAC/B,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,MAAA,CAAO;AAAA,GACpB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AACrC,EAAA,MAAM,IAAA,GAAiB;AAAA,IACrB,KAAA,EAAO,IAAA,CAAK,IAAA,EAAM,KAAA,IAAS,KAAA;AAAA,IAC3B,KAAK,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI;AAAA,GACzC;AACA,EAAA,OAAO,qBAAA,CAAsB,IAAA,EAAM,EAAE,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,GAAA,EAAI,EAAG,IAAI,CAAA;AACzF;AAEA,eAAsB,kBACpB,IAAA,EACyC;AACzC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,MAAA,GAASC,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC3C,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAEjC,EAAA,MAAM,IAAA,GAAOH,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,SAAS,OAAA,EAAS;AAC3B,IAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,GAAG,CAAA;AAAA,EAC7C;AAOA,EAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACxC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,OAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF","file":"chunk-VF7X6HDR.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth engine. Promoted DOWN from agent-builder's hardened `agents/lib/oauth.ts` +\n * `oauth-device.ts` (M37), generalized to `provider: string` + a caller-supplied {@link CredentialStoreConfig}\n * (no hardcoded client IDs — the caller declares its provider's endpoints). Ported VERBATIM (ADR D3): the\n * refresh coalescing lock, the no-token-in-error discipline, and the RFC 8628 device grant.\n *\n * Reuses the SDK's typed error taxonomy (`AuthCallbackError` from `server/auth`) for exchange/refresh\n * failures. All network I/O + clock + sleep are INJECTED so the flow is deterministic.\n *\n * The device flows follow their published specs: the RFC 8628 device grant (device_code →\n * authorization_pending / slow_down) and OpenAI's two-step headless flow with JWT-claim account attribution.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  OAuthTokens,\n  ResolvedCredential,\n} from \"./auth-types.js\";\nimport { authFilePath, readStoredOAuth, writeCredential } from \"./credential-store.js\";\n\n/** Refresh a token this many ms BEFORE it actually expires (avoid a last-second, mid-request expiry). */\nconst REFRESH_SKEW_MS = 60_000;\n\n/** Parse an OAuth token endpoint response into our token triple. Throws a typed error on a bad shape. */\nfunction parseTokenResponse(body: unknown, now: number): OAuthTokens {\n  const b = body as {\n    access_token?: unknown;\n    refresh_token?: unknown;\n    expires_in?: unknown;\n    account_id?: unknown;\n  };\n  if (typeof b.access_token !== \"string\" || b.access_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no access_token\",\n    );\n  }\n  if (typeof b.refresh_token !== \"string\" || b.refresh_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no refresh_token\",\n    );\n  }\n  const expiresIn = typeof b.expires_in === \"number\" ? b.expires_in : 3600;\n  return {\n    access: b.access_token,\n    refresh: b.refresh_token,\n    expires: now + expiresIn * 1000,\n    ...(typeof b.account_id === \"string\" ? { accountId: b.account_id } : {}),\n  };\n}\n\n/** POST a form-encoded grant to the token endpoint; return the parsed JSON or throw a typed error. */\nasync function postGrant(\n  config: OAuthProviderConfig,\n  form: Record<string, string>,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams(form).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    // The body may carry an OAuth `error` code, but never echo it verbatim — it can contain a token in\n    // some providers' error payloads. Report the status only.\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint returned HTTP ${res.status}`,\n    );\n  }\n  let json: unknown;\n  try {\n    json = await res.json();\n  } catch {\n    // Do NOT echo the parser message — on a 200 non-JSON body it embeds a snippet of the response, which\n    // in a token context can contain access/refresh material.\n    throw new AuthCallbackError(\"oauth_token_exchange_failed\", \"token response was not valid JSON\");\n  }\n  return parseTokenResponse(json, deps.now());\n}\n\n/** Exchange an authorization `code` (+ PKCE verifier) for the token pair. */\nexport function exchangeCode(\n  config: OAuthProviderConfig,\n  input: { code: string; verifier: string },\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    {\n      grant_type: \"authorization_code\",\n      code: input.code,\n      redirect_uri: config.redirectUri,\n      client_id: config.clientId,\n      code_verifier: input.verifier,\n    },\n    deps,\n  );\n}\n\n/** Swap a refresh token for a fresh access (and possibly rotated refresh) token. */\nexport function refreshOAuthTokens(\n  config: OAuthProviderConfig,\n  refresh: string,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    { grant_type: \"refresh_token\", refresh_token: refresh, client_id: config.clientId },\n    deps,\n  );\n}\n\n/** Persist a token triple to the store's oauth variant through the hardened 0600 writer. */\nexport function persistOAuthTokens(\n  provider: string,\n  tokens: OAuthTokens,\n  store: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  return writeCredential(\n    {\n      type: \"oauth\",\n      provider,\n      access: tokens.access,\n      refresh: tokens.refresh,\n      expires: tokens.expires,\n      ...(tokens.accountId !== undefined ? { account_id: tokens.accountId } : {}),\n    },\n    store,\n    env,\n  );\n}\n\n/**\n * In-flight refreshes, keyed by the auth-file path. Refresh tokens ROTATE (single-use) on many providers,\n * so two concurrent turns must NOT both POST the same refresh token — the second would present an\n * already-consumed token and fail. This coalesces concurrent refreshes of the same store onto one promise.\n * Process-local — the single-credential store is per-user; a cross-process lock would be over-engineering.\n */\nconst inFlightRefresh = new Map<string, Promise<OAuthTokens>>();\n\n/**\n * Return a credential guaranteed fresh enough to use. An `api` credential passes through untouched. An\n * `oauth` credential still valid (beyond the skew window) passes through; an expired one is refreshed,\n * re-persisted 0600, and returned with the new access token. Concurrent refreshes of the same store are\n * coalesced (single-use refresh tokens); the rejected promise is evicted so a failure is not cached-poison.\n */\nexport async function ensureFreshCredential(\n  resolved: ResolvedCredential,\n  opts: {\n    config: OAuthProviderConfig;\n    store: CredentialStoreConfig;\n    env?: Record<string, string | undefined>;\n  },\n  deps: HttpDeps,\n): Promise<ResolvedCredential> {\n  if (resolved.kind !== \"oauth\") return resolved;\n\n  const now = deps.now();\n  if (resolved.expiresAt !== undefined && resolved.expiresAt > now + REFRESH_SKEW_MS) {\n    return resolved; // still valid — no network, no rewrite\n  }\n\n  const env = opts.env ?? {};\n  const path = authFilePath(opts.store, env);\n  let refresh = inFlightRefresh.get(path);\n  if (refresh === undefined) {\n    refresh = (async (): Promise<OAuthTokens> => {\n      const stored = readStoredOAuth(opts.store, env);\n      if (stored === undefined) {\n        // The resolved credential said oauth but the store no longer holds it — do not fabricate; surface it.\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"no stored oauth credential to refresh\",\n        );\n      }\n      const fresh = await refreshOAuthTokens(opts.config, stored.refresh, deps);\n      // M43 D4 fix #1 — the OAuth refresh response returns JWTs, not a top-level `account_id`, so\n      // `parseTokenResponse` leaves `fresh.accountId` undefined. Prefer a freshly-derived id, else PRESERVE\n      // the stored one (account_id is stable) — otherwise the Codex `ChatGPT-Account-Id` header empties after\n      // the first refresh and the backend 401/403s.\n      const merged: OAuthTokens = {\n        ...fresh,\n        accountId: fresh.accountId ?? stored.account_id,\n      };\n      persistOAuthTokens(resolved.provider, merged, opts.store, env);\n      return merged;\n    })();\n    inFlightRefresh.set(path, refresh);\n    refresh.finally(() => inFlightRefresh.delete(path)).catch(() => {});\n  }\n\n  const fresh = await refresh;\n  return {\n    kind: \"oauth\",\n    provider: resolved.provider,\n    apiKey: fresh.access,\n    source: resolved.source,\n    inferred: false,\n    expiresAt: fresh.expires,\n  };\n}\n","/**\n * M42 — `resolveCredential`: the public composition entrypoint over the credential store + oauth engine.\n * Given a provider name + a {@link CredentialStoreConfig} (and, for oauth, an {@link OAuthProviderConfig}),\n * read the store and return a FRESH `ResolvedCredential` — an api credential passes through by identity; an\n * oauth credential is transparently refreshed when its access token is within the skew window. Returns\n * `undefined` when the store holds no credential for `provider` (the caller then falls back to env / apiKeys).\n *\n * Mirrors agent-builder's `resolveFreshCredential` composition (store read → oauth → ensureFreshCredential),\n * defaulting `fetch`/`now` to globals. This is the async surface an oauth provider's M41 `transform.fetch`\n * calls at stream time, so a mid-turn token expiry refreshes without rebuilding the agent.\n *\n * @internal (re-exported from the package barrel as public)\n */\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  ResolvedCredential,\n} from \"./auth-types.js\";\nimport { authFilePath, readAuthFile } from \"./credential-store.js\";\nimport { ensureFreshCredential } from \"./oauth-engine.js\";\n\nexport interface ResolveCredentialOptions {\n  /** The provider whose stored credential to resolve. */\n  provider: string;\n  /** Where the credential store lives. */\n  store: CredentialStoreConfig;\n  /** Env for the store's optional `homeEnvVar` override. Never an ambient read. */\n  env?: Record<string, string | undefined>;\n  /** Required to refresh an oauth credential; omit for an api-only store. */\n  oauth?: OAuthProviderConfig;\n  /** Injected HTTP + clock for deterministic tests; default globals. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/**\n * Resolve a fresh credential for `provider` from the store, or `undefined` if the store holds none for it.\n * oauth credentials are auto-refreshed when `opts.oauth` is supplied; api credentials pass through.\n */\n/** Resolve (and, when a config is supplied, refresh) the oauth variant for the requested provider. */\nasync function resolveOAuth(\n  stored: { provider: string; access: string; expires: number },\n  path: string,\n  opts: ResolveCredentialOptions,\n  env: Record<string, string | undefined>,\n): Promise<ResolvedCredential | undefined> {\n  if (stored.provider !== opts.provider) return undefined;\n  const base: ResolvedCredential = {\n    kind: \"oauth\",\n    provider: opts.provider,\n    apiKey: stored.access,\n    source: path,\n    inferred: false,\n    expiresAt: stored.expires,\n  };\n  if (opts.oauth === undefined) return base; // no config to refresh with — return the stored access token\n  const deps: HttpDeps = {\n    fetch: opts.deps?.fetch ?? fetch,\n    now: opts.deps?.now ?? (() => Date.now()),\n  };\n  return ensureFreshCredential(base, { config: opts.oauth, store: opts.store, env }, deps);\n}\n\nexport async function resolveCredential(\n  opts: ResolveCredentialOptions,\n): Promise<ResolvedCredential | undefined> {\n  const env = opts.env ?? {};\n  const stored = readAuthFile(opts.store, env);\n  if (stored === undefined) return undefined;\n\n  const path = authFilePath(opts.store, env);\n\n  if (stored.type === \"oauth\") {\n    return resolveOAuth(stored, path, opts, env);\n  }\n\n  // api variant: require the stored `provider` to MATCH the requested provider (M42 review MEDIUM-2).\n  // The generic SDK cannot infer a provider from a key prefix (that was agent-builder app policy), so a\n  // provider-less or mismatched stored key is NOT attributed to the requested provider — otherwise a legacy\n  // `{api_key:\"sk-ant-…\"}` file could be POSTed to the wrong vendor's endpoint (cross-vendor key exposure).\n  // Fail-closed: credential resolution never attributes a key across providers.\n  if (stored.api_key.length === 0) return undefined;\n  if (stored.provider !== opts.provider) return undefined;\n  return {\n    kind: \"api\",\n    provider: opts.provider,\n    apiKey: stored.api_key,\n    source: path,\n    inferred: false,\n  };\n}\n"]}

package/dist/{chunk-7HQVDLFI.cjs → chunk-VGPXHHF3.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunk2CFEET3Y_cjs = require('./chunk-2CFEET3Y.cjs');
-var chunk2YGIBOUH_cjs = require('./chunk-2YGIBOUH.cjs');
-var chunkSXSPMRSV_cjs = require('./chunk-SXSPMRSV.cjs');
+var chunkC4H6PB5J_cjs = require('./chunk-C4H6PB5J.cjs');
+var chunkLPVIRJVF_cjs = require('./chunk-LPVIRJVF.cjs');
+var chunkBM6N4KHO_cjs = require('./chunk-BM6N4KHO.cjs');
 var fs = require('fs');
 var promises = require('fs/promises');
 var path = require('path');
@@ -18,6 +18,7 @@ function isValidTaskId(id, allowReserved) {
   }
   return true;
 }
+var TASK_RESERVED_PREFIXES = RESERVED_PREFIXES;
 var JSON_LOAD_CAP = 256;
 var DEFAULT_LIST_LIMIT = 100;
 function assertValidIdForStore(id) {
@@ -26,7 +27,7 @@ function assertValidIdForStore(id) {
     /* allowReserved */
     true
   )) {
-    throw new chunk2YGIBOUH_cjs.InvalidTaskIdError(`store rejects invalid task id: ${id}`, id);
+    throw new chunkLPVIRJVF_cjs.InvalidTaskIdError(`store rejects invalid task id: ${id}`, id);
   }
 }
 function terminalTimestamp(h) {
@@ -120,14 +121,14 @@ var JsonFileTaskStore = class {
   }
   async insert(handle) {
     assertValidIdForStore(handle.id);
-    await chunk2CFEET3Y_cjs.atomicWriteText(this.filePath(handle.id), JSON.stringify(handle));
+    await chunkC4H6PB5J_cjs.atomicWriteText(this.filePath(handle.id), JSON.stringify(handle));
   }
   async update(id, mutate) {
     assertValidIdForStore(id);
     const existing = await this.get(id);
     if (existing === void 0) return void 0;
     const next = mutate(existing);
-    await chunk2CFEET3Y_cjs.atomicWriteText(this.filePath(id), JSON.stringify(next));
+    await chunkC4H6PB5J_cjs.atomicWriteText(this.filePath(id), JSON.stringify(next));
     return next;
   }
   async get(id) {
@@ -138,7 +139,7 @@ var JsonFileTaskStore = class {
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return void 0;
-      chunkSXSPMRSV_cjs.diag(`[task-store] failed to read ${id}: ${err.message}
+      chunkBM6N4KHO_cjs.diag(`[task-store] failed to read ${id}: ${err.message}
 `);
       return void 0;
     }
@@ -191,7 +192,8 @@ function getTaskStoreFor(options) {
 
 exports.InMemoryTaskStore = InMemoryTaskStore;
 exports.JsonFileTaskStore = JsonFileTaskStore;
+exports.TASK_RESERVED_PREFIXES = TASK_RESERVED_PREFIXES;
 exports.getTaskStoreFor = getTaskStoreFor;
 exports.isValidTaskId = isValidTaskId;
-//# sourceMappingURL=chunk-7HQVDLFI.cjs.map
-//# sourceMappingURL=chunk-7HQVDLFI.cjs.map
+//# sourceMappingURL=chunk-VGPXHHF3.cjs.map
+//# sourceMappingURL=chunk-VGPXHHF3.cjs.map

package/dist/chunk-VGPXHHF3.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types/task.ts","../src/internal/task/store.ts"],"names":["InvalidTaskIdError","mkdirSync","join","atomicWriteText","readFile","diag","readdirSync","unlink"],"mappings":";;;;;;;;;;AA0IA,IAAM,eAAA,GAAkB,uBAAA;AAGxB,IAAM,iBAAA,GAAoB,CAAC,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAUxC,SAAS,aAAA,CAAc,IAAY,aAAA,EAAiC;AACzE,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,EAAE,GAAG,OAAO,KAAA;AACtC,EAAA,IAAI,eAAe,OAAO,IAAA;AAC1B,EAAA,KAAA,MAAW,UAAU,iBAAA,EAAmB;AACtC,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,KAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,sBAAA,GAA4C;AC5HzD,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,kBAAA,GAAqB,GAAA;AAkB3B,SAAS,sBAAsB,EAAA,EAAkB;AAC/C,EAAA,IAAI,CAAC,aAAA;AAAA,IAAc,EAAA;AAAA;AAAA,IAAwB;AAAA,GAAI,EAAG;AAChD,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,+BAAA,EAAkC,EAAE,IAAI,EAAE,CAAA;AAAA,EACzE;AACF;AAEA,SAAS,kBAAkB,CAAA,EAAmC;AAC5D,EAAA,IAAI,CAAA,CAAE,KAAA,KAAU,UAAA,EAAY,OAAO,CAAA,CAAE,UAAA;AACrC,EAAA,IAAI,CAAA,CAAE,KAAA,KAAU,OAAA,EAAS,OAAO,CAAA,CAAE,SAAA;AAClC,EAAA,IAAI,CAAA,CAAE,KAAA,KAAU,WAAA,EAAa,OAAO,CAAA,CAAE,WAAA;AACtC,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC7C,EAAA,OAAO,KAAA,KAAU,UAAA,IAAc,KAAA,KAAU,OAAA,IAAW,KAAA,KAAU,WAAA;AAChE;AAEA,SAAS,YAAA,CAAa,GAAe,MAAA,EAA6B;AAChE,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AACvC,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,KAAK,IAAI,MAAA,CAAO,KAAA,GAAQ,CAAC,MAAA,CAAO,KAAK,CAAA;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAA,CAAE,KAAK,CAAA;AAChC;AACA,SAAS,WAAA,CAAY,GAAe,MAAA,EAA6B;AAC/D,EAAA,IAAI,MAAA,CAAO,IAAA,KAAS,MAAA,EAAW,OAAO,IAAA;AACtC,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,IAAI,MAAA,CAAO,IAAA,GAAO,CAAC,MAAA,CAAO,IAAI,CAAA;AACrE,EAAA,OAAO,KAAA,CAAM,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA;AAC9B;AACA,SAAS,WAAA,CAAY,GAAe,MAAA,EAA6B;AAC/D,EAAA,IAAI,OAAO,cAAA,KAAmB,MAAA,IAAa,EAAE,WAAA,IAAe,MAAA,CAAO,gBAAgB,OAAO,KAAA;AAC1F,EAAA,IAAI,OAAO,eAAA,KAAoB,MAAA,IAAa,EAAE,WAAA,IAAe,MAAA,CAAO,iBAAiB,OAAO,KAAA;AAC5F,EAAA,OAAO,IAAA;AACT;AACA,SAAS,aAAA,CAAc,GAAe,MAAA,EAA6B;AACjE,EAAA,OAAO,YAAA,CAAa,CAAA,EAAG,MAAM,CAAA,IAAK,WAAA,CAAY,GAAG,MAAM,CAAA,IAAK,WAAA,CAAY,CAAA,EAAG,MAAM,CAAA;AACnF;AAEA,SAAS,WAAA,CAAY,QAA8B,MAAA,EAAkC;AACnF,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,kBAAA;AAC9B,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAI,aAAA,CAAc,CAAA,EAAG,MAAM,CAAA,EAAG;AAC5B,MAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AACV,MAAA,IAAI,GAAA,CAAI,UAAU,KAAA,EAAO;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAIO,IAAM,oBAAN,MAA6C;AAAA,EACjC,GAAA,uBAAU,GAAA,EAAwB;AAAA,EAEnD,MAAM,OAAO,MAAA,EAAmC;AAC9C,IAAA,qBAAA,CAAsB,OAAO,EAAE,CAAA;AAC/B,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,EAAA,EAAI,MAAM,CAAA;AAAA,EAChC;AAAA,EAEA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,EAAwE;AAC/F,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAChC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,MAAM,IAAA,GAAO,OAAO,QAAQ,CAAA;AAC5B,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,IAAI,CAAA;AACrB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,EAAA,EAA6C;AACrD,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAAA,EACxB;AAAA,EAEA,MAAM,KAAK,MAAA,EAA2C;AACpD,IAAA,OAAO,WAAA,CAAY,IAAA,CAAK,GAAA,CAAI,MAAA,IAAU,MAAM,CAAA;AAAA,EAC9C;AAAA,EAEA,MAAM,OAAO,EAAA,EAA8B;AACzC,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAAA,EAC3B;AAAA,EAEA,MAAM,uBAAuB,OAAA,EAAkC;AAC7D,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,CAAC,KAAK,IAAA,CAAK,GAAA,CAAI,SAAQ,EAAG;AACxC,MAAA,IAAI,CAAC,UAAA,CAAW,CAAA,CAAE,KAAK,CAAA,EAAG;AAC1B,MAAA,MAAM,EAAA,GAAK,kBAAkB,CAAC,CAAA;AAC9B,MAAA,IAAI,EAAA,KAAO,MAAA,IAAa,EAAA,GAAK,OAAA,EAAS;AACpC,QAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,QAAA,KAAA,EAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAYO,IAAM,oBAAN,MAA6C;AAAA,EAClD,YAA6B,GAAA,EAAa;AAAb,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAE3B,IAAA,IAAI;AACF,MAAAC,YAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,IACpC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,MAAM,GAAA;AAAA,IAC9D;AAAA,EACF;AAAA,EAP6B,GAAA;AAAA,EASrB,SAAS,EAAA,EAAoB;AACnC,IAAA,OAAOC,SAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,EAAG,EAAE,CAAA,KAAA,CAAO,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,OAAO,MAAA,EAAmC;AAC9C,IAAA,qBAAA,CAAsB,OAAO,EAAE,CAAA;AAC/B,IAAA,MAAMC,iCAAA,CAAgB,KAAK,QAAA,CAAS,MAAA,CAAO,EAAE,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,EACxE;AAAA,EAEA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,EAAwE;AAC/F,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA;AAClC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,MAAM,IAAA,GAAO,OAAO,QAAQ,CAAA;AAC5B,IAAA,MAAMA,iCAAA,CAAgB,KAAK,QAAA,CAAS,EAAE,GAAG,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAC7D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,EAAA,EAA6C;AACrD,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAMC,iBAAA,CAAS,KAAK,QAAA,CAAS,EAAE,GAAG,MAAM,CAAA;AACpD,MAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,IACvB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAQ,GAAA,CAA8B,IAAA;AAC5C,MAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAE9B,MAAAC,sBAAA,CAAK,CAAA,4BAAA,EAA+B,EAAE,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO;AAAA,CAAI,CAAA;AACrE,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,MAAA,EAA2C;AACpD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUC,cAAA,CAAY,KAAK,GAAG,CAAA;AAAA,IAChC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,EAAC;AAC9D,MAAA,MAAM,GAAA;AAAA,IACR;AAEA,IAAA,MAAM,aAAa,OAAA,CAChB,MAAA,CAAO,CAAC,IAAA,KAAS,KAAK,QAAA,CAAS,OAAO,CAAA,IAAK,CAAC,KAAK,QAAA,CAAS,MAAM,CAAC,CAAA,CACjE,KAAA,CAAM,GAAG,aAAa,CAAA;AAEzB,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA;AAAA,MAC3B,UAAA,CAAW,GAAA,CAAI,OAAO,IAAA,KAAS;AAC7B,QAAA,MAAM,KAAK,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,QAAQ,MAAM,CAAA;AACxC,QAAA,IAAI,CAAC,aAAA,CAAc,EAAA,EAAI,IAAI,GAAG,OAAO,MAAA;AACrC,QAAA,OAAO,IAAA,CAAK,IAAI,EAAE,CAAA;AAAA,MACpB,CAAC;AAAA,KACH;AACA,IAAA,MAAM,UAAU,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAuB,MAAM,MAAS,CAAA;AACrE,IAAA,OAAO,WAAA,CAAY,SAAS,MAAM,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,OAAO,EAAA,EAA8B;AACzC,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,IAAI;AACF,MAAA,MAAMC,eAAA,CAAO,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA;AAC9B,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,KAAA;AAC7D,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,uBAAuB,OAAA,EAAkC;AAC7D,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,IAAA,CAAK,EAAE,KAAA,EAAO,CAAC,UAAA,EAAY,OAAA,EAAS,WAAW,CAAA,EAAG,KAAA,EAAO,KAAK,CAAA;AACzF,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,MAAM,EAAA,GAAK,kBAAkB,CAAC,CAAA;AAC9B,MAAA,IAAI,EAAA,KAAO,MAAA,IAAa,EAAA,GAAK,OAAA,EAAS;AACpC,QAAA,IAAI,MAAM,IAAA,CAAK,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA,EAAG,KAAA,EAAA;AAAA,MAC/B;AAAA,IACF;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAAA,EAAsC;AACpE,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,QAAA,EAAU,OAAO,IAAI,iBAAA,EAAkB;AAC/D,EAAA,OAAO,IAAI,iBAAA,CAAkB,OAAA,CAAQ,GAAG,CAAA;AAC1C","file":"chunk-VGPXHHF3.cjs","sourcesContent":["/**\n * Public type contract for the Task observability registry (ADRs D361-D374).\n *\n * Tasks are an opt-in observability layer over async work in the SDK\n * (`Agent.send`, `Agent.batch`, `Workflow.run`, `Cron` fires). They have\n * a closed 5-state lifecycle (D362), discriminated events (D366), and a\n * pluggable store (D364). The `Task` facade in `task.ts` is the public\n * surface; consumers import these types from `@theokit/sdk`.\n *\n * @public\n */\n\n/**\n * Closed enum of the 5 lifecycle states (D362).\n *\n * Transitions are acyclic:\n *   queued → running → (finished | error | cancelled)\n *   queued → cancelled (direct, no run started)\n */\nexport type TaskState = \"queued\" | \"running\" | \"finished\" | \"error\" | \"cancelled\";\n\n/** Discriminator of the runtime that produced a task (D374). */\nexport type TaskKind = \"run\" | \"batch\" | \"workflow\" | \"cron\" | \"custom\";\n\n/** Discriminated union of task lifecycle events (D366). */\nexport type TaskEvent =\n  | {\n      readonly type: \"submitted\";\n      readonly taskId: string;\n      readonly kind: TaskKind;\n      readonly submittedAt: number;\n      readonly meta?: Record<string, unknown>;\n      /** D372 — flag set on the first yielded event when the ring buffer was at cap. */\n      readonly truncated?: boolean;\n    }\n  | { readonly type: \"started\"; readonly taskId: string; readonly startedAt: number }\n  | {\n      readonly type: \"progress\";\n      readonly taskId: string;\n      readonly at: number;\n      readonly payload: unknown;\n    }\n  | {\n      readonly type: \"finished\";\n      readonly taskId: string;\n      readonly finishedAt: number;\n      readonly result: unknown;\n    }\n  | {\n      readonly type: \"errored\";\n      readonly taskId: string;\n      readonly erroredAt: number;\n      readonly error: { readonly code: string; readonly message: string };\n    }\n  | {\n      readonly type: \"cancelled\";\n      readonly taskId: string;\n      readonly cancelledAt: number;\n      readonly reason?: string;\n    };\n\n/** Public read-only view of a task entry in the registry. */\nexport interface TaskHandle {\n  readonly id: string;\n  readonly kind: TaskKind;\n  readonly state: TaskState;\n  readonly submittedAt: number;\n  readonly startedAt?: number;\n  readonly finishedAt?: number;\n  readonly cancelledAt?: number;\n  readonly erroredAt?: number;\n  readonly result?: unknown;\n  readonly error?: { readonly code: string; readonly message: string };\n  readonly meta?: Record<string, unknown>;\n  /**\n   * EC-7 — cross-process best-effort cancel flag. Set by CLI\n   * `theokit tasks cancel` via JsonFileTaskStore. The owning process\n   * polls at checkpoints and honors via AbortController. Always\n   * `undefined` for in-process cancel paths (which go directly through\n   * AbortController).\n   */\n  readonly cancelRequested?: boolean;\n}\n\n/** Query filter for `Task.list`. */\nexport interface TaskFilter {\n  readonly state?: TaskState | readonly TaskState[];\n  readonly kind?: TaskKind | readonly TaskKind[];\n  readonly submittedAfter?: number;\n  readonly submittedBefore?: number;\n  /** Defaults to 100. JsonFileTaskStore hard-caps loaded entries at 256 (D364). */\n  readonly limit?: number;\n}\n\n/** Options for `Task.submit`. */\nexport interface TaskSubmitOptions {\n  /**\n   * Optional user-supplied ID. Must match grammar `^[a-z0-9][a-z0-9_-]*$`\n   * and MUST NOT start with the reserved prefixes `wf-` / `b-` / `cron-`\n   * (D368, EC-5). When omitted, `crypto.randomUUID()` is used.\n   */\n  readonly id?: string;\n  readonly meta?: Record<string, unknown>;\n  /**\n   * Optional caller-provided AbortSignal. If already aborted at submit\n   * time, the registry short-circuits to `cancelled` without acquiring\n   * a semaphore slot (EC-4).\n   */\n  readonly signal?: AbortSignal;\n  /**\n   * SE2 — an opt-in {@link import(\"./run-events.js\").RunEventSink}. The task's\n   * lifecycle is forwarded to it as typed `task_started` / `task_updated` /\n   * `task_completed` RunEvents, so a caller that spawned the task can observe it\n   * through the same `onRunEvent` channel as the rest of the run. Best-effort (a\n   * throwing sink never breaks the task). The dedicated `Task.subscribe(id)`\n   * channel is unaffected.\n   */\n  readonly onRunEvent?: import(\"./run-events.js\").RunEventSink;\n}\n\n/** Options shape for `TaskStore` factory (D364). */\nexport type TaskStoreOptions =\n  | { readonly backend: \"memory\" }\n  | { readonly backend: \"json\"; readonly dir: string };\n\n/** Result of `Task.cancel` (D365 — idempotent). */\nexport interface TaskCancelResult {\n  readonly cancelled: boolean;\n  readonly alreadyTerminal: boolean;\n}\n\n/**\n * Grammar for user-supplied task IDs (D368).\n * `crypto.randomUUID()` outputs do NOT match this (UUIDs have dashes\n * AND uppercase letters in their canonical form on some Node versions),\n * but the registry normalizes auto-generated IDs to lowercase before\n * insertion, so they pass the same regex.\n */\nconst TASK_ID_GRAMMAR = /^[a-z0-9][a-z0-9_-]*$/;\n\n/** Reserved prefixes for adapter-generated IDs (D368, EC-5). */\nconst RESERVED_PREFIXES = [\"wf-\", \"b-\", \"cron-\"] as const;\n\n/**\n * Validates a task ID against the public grammar + reserved prefixes.\n * Throws `InvalidTaskIdError` from `../errors.js` on rejection.\n *\n * Adapter callers (workflow/batch/cron) MUST set `allowReserved: true`\n * to register their own IDs; user-facing surfaces (`Task.submit`,\n * `agent.send({ task: { id } })`) leave it false.\n */\nexport function isValidTaskId(id: string, allowReserved: boolean): boolean {\n  if (!TASK_ID_GRAMMAR.test(id)) return false;\n  if (allowReserved) return true;\n  for (const prefix of RESERVED_PREFIXES) {\n    if (id.startsWith(prefix)) return false;\n  }\n  return true;\n}\n\n/** Re-exported for adapter implementations + tests. */\nexport const TASK_RESERVED_PREFIXES: readonly string[] = RESERVED_PREFIXES;\n","/**\n * `TaskStore` interface + 2 implementations (ADR D364).\n *\n *   - `InMemoryTaskStore` — default, transient, single-process.\n *   - `JsonFileTaskStore` — opt-in, one JSON file per task under a\n *     dedicated dir; single-process invariant (EC-15 documented).\n *\n * Edge cases absorbed:\n *   - EC-1: constructor auto-creates dir (mkdirSync recursive idempotent).\n *   - EC-2: every method validates the task id against the public\n *     grammar (D368) BEFORE doing any path I/O — path-traversal defense.\n *   - EC-6: `list()` returns `[]` on ENOENT (fresh install path).\n *   - EC-8: `list()` skips `.tmp.*` orphan files left by interrupted\n *     atomic writes.\n *   - EC-14 (DOCUMENT): `list()` JSDoc documents the 256-row hard cap\n *     and the `submittedBefore` paging idiom.\n *   - EC-15 (DOCUMENT): `JsonFileTaskStore` JSDoc documents the\n *     single-process invariant; v0.2 SQLite covers cross-process.\n *\n * @internal\n */\n\nimport { mkdirSync, readdirSync } from \"node:fs\";\nimport { readFile, unlink } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { InvalidTaskIdError } from \"../../errors.js\";\nimport {\n  isValidTaskId,\n  type TaskFilter,\n  type TaskHandle,\n  type TaskState,\n  type TaskStoreOptions,\n} from \"../../types/task.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { atomicWriteText } from \"../persistence/atomic-write.js\";\n\nconst JSON_LOAD_CAP = 256;\nconst DEFAULT_LIST_LIMIT = 100;\n\n/** Storage interface used by `TaskRegistry`. */\nexport interface TaskStore {\n  insert(handle: TaskHandle): Promise<void>;\n  update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined>;\n  get(id: string): Promise<TaskHandle | undefined>;\n  /**\n   * Returns at most `filter.limit ?? 100` matching handles. JsonFile\n   * backend hard-caps loaded entries at 256 — callers needing larger\n   * pages must use `submittedBefore` to walk the timeline.\n   */\n  list(filter: TaskFilter): Promise<TaskHandle[]>;\n  delete(id: string): Promise<boolean>;\n  /** Removes terminal handles whose terminal-timestamp is older than `epochMs`. */\n  evictTerminalOlderThan(epochMs: number): Promise<number>;\n}\n\nfunction assertValidIdForStore(id: string): void {\n  if (!isValidTaskId(id, /* allowReserved */ true)) {\n    throw new InvalidTaskIdError(`store rejects invalid task id: ${id}`, id);\n  }\n}\n\nfunction terminalTimestamp(h: TaskHandle): number | undefined {\n  if (h.state === \"finished\") return h.finishedAt;\n  if (h.state === \"error\") return h.erroredAt;\n  if (h.state === \"cancelled\") return h.cancelledAt;\n  return undefined;\n}\n\nfunction isTerminal(state: TaskState): boolean {\n  return state === \"finished\" || state === \"error\" || state === \"cancelled\";\n}\n\nfunction matchesState(h: TaskHandle, filter: TaskFilter): boolean {\n  if (filter.state === undefined) return true;\n  const states = Array.isArray(filter.state) ? filter.state : [filter.state];\n  return states.includes(h.state);\n}\nfunction matchesKind(h: TaskHandle, filter: TaskFilter): boolean {\n  if (filter.kind === undefined) return true;\n  const kinds = Array.isArray(filter.kind) ? filter.kind : [filter.kind];\n  return kinds.includes(h.kind);\n}\nfunction matchesTime(h: TaskHandle, filter: TaskFilter): boolean {\n  if (filter.submittedAfter !== undefined && h.submittedAt <= filter.submittedAfter) return false;\n  if (filter.submittedBefore !== undefined && h.submittedAt >= filter.submittedBefore) return false;\n  return true;\n}\nfunction matchesFilter(h: TaskHandle, filter: TaskFilter): boolean {\n  return matchesState(h, filter) && matchesKind(h, filter) && matchesTime(h, filter);\n}\n\nfunction applyFilter(values: Iterable<TaskHandle>, filter: TaskFilter): TaskHandle[] {\n  const limit = filter.limit ?? DEFAULT_LIST_LIMIT;\n  const out: TaskHandle[] = [];\n  for (const h of values) {\n    if (matchesFilter(h, filter)) {\n      out.push(h);\n      if (out.length >= limit) break;\n    }\n  }\n  return out;\n}\n\n/* ─── InMemory ─── */\n\nexport class InMemoryTaskStore implements TaskStore {\n  private readonly map = new Map<string, TaskHandle>();\n\n  async insert(handle: TaskHandle): Promise<void> {\n    assertValidIdForStore(handle.id);\n    this.map.set(handle.id, handle);\n  }\n\n  async update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    const existing = this.map.get(id);\n    if (existing === undefined) return undefined;\n    const next = mutate(existing);\n    this.map.set(id, next);\n    return next;\n  }\n\n  async get(id: string): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    return this.map.get(id);\n  }\n\n  async list(filter: TaskFilter): Promise<TaskHandle[]> {\n    return applyFilter(this.map.values(), filter);\n  }\n\n  async delete(id: string): Promise<boolean> {\n    assertValidIdForStore(id);\n    return this.map.delete(id);\n  }\n\n  async evictTerminalOlderThan(epochMs: number): Promise<number> {\n    let count = 0;\n    for (const [id, h] of this.map.entries()) {\n      if (!isTerminal(h.state)) continue;\n      const ts = terminalTimestamp(h);\n      if (ts !== undefined && ts < epochMs) {\n        this.map.delete(id);\n        count++;\n      }\n    }\n    return count;\n  }\n}\n\n/* ─── JsonFile (opt-in) ───\n *\n * IMPORTANT (EC-15): `JsonFileTaskStore` is **single-process**.\n * Concurrent writers from multiple Node processes against the same\n * directory may corrupt entries (atomic-write protects per-file, but\n * the `list()` scan + `update()` read-modify-write cycle is not\n * serialised across processes). Use only when the `TaskRegistry`\n * runs in exactly one process. v0.2 will add a SQLite backend with\n * the same interface for cross-process scenarios (D364 + D61).\n */\nexport class JsonFileTaskStore implements TaskStore {\n  constructor(private readonly dir: string) {\n    // EC-1: idempotent mkdir; ignore EEXIST.\n    try {\n      mkdirSync(dir, { recursive: true });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n    }\n  }\n\n  private filePath(id: string): string {\n    return join(this.dir, `${id}.json`);\n  }\n\n  async insert(handle: TaskHandle): Promise<void> {\n    assertValidIdForStore(handle.id);\n    await atomicWriteText(this.filePath(handle.id), JSON.stringify(handle));\n  }\n\n  async update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    const existing = await this.get(id);\n    if (existing === undefined) return undefined;\n    const next = mutate(existing);\n    await atomicWriteText(this.filePath(id), JSON.stringify(next));\n    return next;\n  }\n\n  async get(id: string): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    try {\n      const raw = await readFile(this.filePath(id), \"utf8\");\n      return JSON.parse(raw) as TaskHandle;\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === \"ENOENT\") return undefined;\n      // Corrupt JSON or other I/O error — log + degrade gracefully (D50/EC-7 cache pattern).\n      diag(`[task-store] failed to read ${id}: ${(err as Error).message}\\n`);\n      return undefined;\n    }\n  }\n\n  async list(filter: TaskFilter): Promise<TaskHandle[]> {\n    let entries: string[];\n    try {\n      entries = readdirSync(this.dir);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return []; // EC-6\n      throw err;\n    }\n    // EC-8: skip orphan .tmp files left by interrupted atomic writes.\n    const candidates = entries\n      .filter((name) => name.endsWith(\".json\") && !name.includes(\".tmp\"))\n      .slice(0, JSON_LOAD_CAP);\n\n    const loaded = await Promise.all(\n      candidates.map(async (name) => {\n        const id = name.slice(0, -\".json\".length);\n        if (!isValidTaskId(id, true)) return undefined;\n        return this.get(id);\n      }),\n    );\n    const handles = loaded.filter((h): h is TaskHandle => h !== undefined);\n    return applyFilter(handles, filter);\n  }\n\n  async delete(id: string): Promise<boolean> {\n    assertValidIdForStore(id);\n    try {\n      await unlink(this.filePath(id));\n      return true;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n      throw err;\n    }\n  }\n\n  async evictTerminalOlderThan(epochMs: number): Promise<number> {\n    const handles = await this.list({ state: [\"finished\", \"error\", \"cancelled\"], limit: 256 });\n    let count = 0;\n    for (const h of handles) {\n      const ts = terminalTimestamp(h);\n      if (ts !== undefined && ts < epochMs) {\n        if (await this.delete(h.id)) count++;\n      }\n    }\n    return count;\n  }\n}\n\n/** Factory used by `TaskRegistry.configure` (D364). */\nexport function getTaskStoreFor(options: TaskStoreOptions): TaskStore {\n  if (options.backend === \"memory\") return new InMemoryTaskStore();\n  return new JsonFileTaskStore(options.dir);\n}\n"]}

package/dist/{chunk-T6ZCG5AP.cjs → chunk-VUKQL3L2.cjs}

@@ -1,7 +1,8 @@
 'use strict';
 
-var chunkXK54DTRF_cjs = require('./chunk-XK54DTRF.cjs');
-var chunkSXSPMRSV_cjs = require('./chunk-SXSPMRSV.cjs');
+var chunkVF7X6HDR_cjs = require('./chunk-VF7X6HDR.cjs');
+var chunk5YKNEMXR_cjs = require('./chunk-5YKNEMXR.cjs');
+var chunkBM6N4KHO_cjs = require('./chunk-BM6N4KHO.cjs');
 var fs = require('fs');
 var path = require('path');
 var url = require('url');
@@ -25,14 +26,14 @@ var REGISTRY = globalSingleton(
 var ALIASES = globalSingleton("theokit-sdk.providers.aliases", () => /* @__PURE__ */ new Map());
 function registerProvider(profile) {
   if (REGISTRY.has(profile.name)) {
-    chunkSXSPMRSV_cjs.diag(`[theokit-sdk] Provider "${profile.name}" overridden by user plugin.
+    chunkBM6N4KHO_cjs.diag(`[theokit-sdk] Provider "${profile.name}" overridden by user plugin.
 `);
   }
   REGISTRY.set(profile.name, profile);
   for (const alias of profile.aliases ?? []) {
     const previous = ALIASES.get(alias);
     if (previous !== void 0 && previous !== profile.name) {
-      chunkSXSPMRSV_cjs.diag(`[theokit-sdk] Alias "${alias}" collision: was "${previous}", now "${profile.name}".
+      chunkBM6N4KHO_cjs.diag(`[theokit-sdk] Alias "${alias}" collision: was "${previous}", now "${profile.name}".
 `);
     }
     ALIASES.set(alias, profile.name);
@@ -80,7 +81,7 @@ var catalogModelSchema = zod.z.object({
 }).loose();
 
 // src/internal/providers/catalog-loader.ts
-var __dirname_resolved = path.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-T6ZCG5AP.cjs', document.baseURI).href))));
+var __dirname_resolved = path.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-VUKQL3L2.cjs', document.baseURI).href))));
 var modelInfoIndex = globalSingleton(
   "theokit-sdk.providers.model-info-index",
   () => /* @__PURE__ */ new Map()
@@ -114,7 +115,7 @@ function ensureModelIndexLoaded() {
       indexEntryModels(entry);
     }
   } catch (err) {
-    chunkSXSPMRSV_cjs.diag(
+    chunkBM6N4KHO_cjs.diag(
       `[theokit-sdk] WARN: provider catalog unavailable (${err.message}) \u2014 per-model data disabled
 `
     );
@@ -125,7 +126,7 @@ function indexEntryModels(entry) {
   for (const [modelId, raw] of Object.entries(entry.models)) {
     const parsed = catalogModelSchema.safeParse(raw);
     if (!parsed.success) {
-      chunkSXSPMRSV_cjs.diag(
+      chunkBM6N4KHO_cjs.diag(
         `[theokit-sdk] WARN: Skipping malformed catalog model "${entry.id}/${modelId}": ${parsed.error.issues[0]?.message ?? "invalid"}
 `
       );
@@ -158,7 +159,7 @@ function loadProviderCatalog(opts) {
   for (const raw of entries) {
     const validated = validateEntry(raw);
     if (validated === null) {
-      chunkSXSPMRSV_cjs.diag(
+      chunkBM6N4KHO_cjs.diag(
         `[theokit-sdk] WARN: Skipping malformed catalog entry: ${JSON.stringify(raw).slice(0, 100)}
 `
       );
@@ -215,7 +216,7 @@ var ANTHROPIC = {
   hostname: "api.anthropic.com",
   fallbackModels: ["claude-opus-4-7", "claude-sonnet-4-6", "claude-haiku-4-5-20251001"],
   // M45 — the Anthropic beta-features header (interleaved thinking + fine-grained tool streaming). An
-  // Anthropic API constant, adapted verbatim from OpenCode's anthropic plugin (MIT © 2025 opencode). The
+  // Anthropic API constant. The
   // SANCTIONED behavior delta of M45 (ADR D4) — consumed by the anthropic transport's extraHeaders wiring.
   extraHeaders: {
     "anthropic-beta": "interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14"
@@ -396,7 +397,7 @@ var OPENAI_OAUTH_CONFIG = {
 function codexFetch() {
   return (async (input, init) => {
     const env = process.env;
-    const resolved = await chunkXK54DTRF_cjs.resolveCredential({
+    const resolved = await chunkVF7X6HDR_cjs.resolveCredential({
       provider: "openai",
       store: DEFAULT_STORE,
       oauth: OPENAI_OAUTH_CONFIG,
@@ -407,7 +408,7 @@ function codexFetch() {
         'openai-chatgpt: no ChatGPT credential found \u2014 run the OpenAI device login (e.g. "/login openai") first.'
       );
     }
-    const accountId = chunkXK54DTRF_cjs.readStoredOAuth(DEFAULT_STORE, env)?.account_id;
+    const accountId = chunk5YKNEMXR_cjs.readStoredOAuth(DEFAULT_STORE, env)?.account_id;
     const headers = new Headers(init?.headers);
     headers.set("authorization", `Bearer ${resolved.apiKey}`);
     if (accountId !== void 0) headers.set("ChatGPT-Account-Id", accountId);
@@ -425,11 +426,9 @@ var OPENAI_CHATGPT = {
     "openai-chatgpt/gpt-5.4-mini",
     "openai-chatgpt/gpt-5.5"
   ],
-  // #165 — this shipped as `codex_cli_rs`, which is the OFFICIAL Codex CLI's own value
-  // (`codex-rs/login/src/auth/default_client.rs`, `DEFAULT_ORIGINATOR`). Claiming to be a different
-  // vendor's client is a false statement of identity, and it diverged from the very prior art this
-  // file is adapted from: OpenCode sends `originator: "opencode"` — its own name — against this same
-  // endpoint, which also shows the route is not restricted to the official client.
+  // #165 — this shipped as `codex_cli_rs`, another vendor's client identifier. Claiming to be a different
+  // vendor's client is a false statement of identity. Third-party clients send their OWN name against
+  // this same endpoint, which also shows the route is not restricted to the official client.
   extraHeaders: { originator: "theokit" },
   transform: {
     // Only `fetch` (async) can await the credential refresh; `headers` is sync and cannot.
@@ -450,7 +449,7 @@ var OPENROUTER = {
   hostname: "openrouter.ai",
   // M45 — models refreshed (claude-3-haiku retired upstream).
   fallbackModels: ["openai/gpt-4o-mini", "anthropic/claude-haiku-4-5"],
-  // M45 — OpenRouter app-attribution headers (mechanism from OpenCode's openrouter plugin, MIT; VALUES are
+  // M45 — OpenRouter app-attribution headers. VALUES are
   // theokit's own — copying another app's referer would misattribute traffic).
   extraHeaders: { "HTTP-Referer": "https://usetheo.dev", "X-Title": "theokit" }
 };
@@ -565,5 +564,5 @@ exports.resolveBedrockBaseUrl = resolveBedrockBaseUrl;
 exports.resolveVertexBaseUrl = resolveVertexBaseUrl;
 exports.stripBedrockPrefix = stripBedrockPrefix;
 exports.stripVertexPrefix = stripVertexPrefix;
-//# sourceMappingURL=chunk-T6ZCG5AP.cjs.map
-//# sourceMappingURL=chunk-T6ZCG5AP.cjs.map
+//# sourceMappingURL=chunk-VUKQL3L2.cjs.map
+//# sourceMappingURL=chunk-VUKQL3L2.cjs.map

package/dist/chunk-VUKQL3L2.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/global-singleton.ts","../src/internal/providers/registry.ts","../src/internal/providers/catalog-schema.ts","../src/internal/providers/catalog-loader.ts","../src/internal/providers/builtin/anthropic.ts","../src/internal/providers/builtin/bedrock.ts","../src/internal/providers/builtin/openai-compatible.ts","../src/internal/providers/builtin/cerebras.ts","../src/internal/providers/builtin/cohere.ts","../src/internal/providers/builtin/deepinfra.ts","../src/internal/providers/builtin/gemini.ts","../src/internal/providers/builtin/google.ts","../src/internal/providers/builtin/groq.ts","../src/internal/providers/builtin/llamacpp.ts","../src/internal/providers/builtin/lmstudio.ts","../src/internal/providers/builtin/mistral.ts","../src/internal/providers/builtin/ollama.ts","../src/internal/providers/builtin/openai.ts","../src/internal/providers/builtin/openai-chatgpt.ts","../src/internal/providers/builtin/openrouter.ts","../src/internal/providers/builtin/perplexity.ts","../src/internal/providers/builtin/together.ts","../src/internal/providers/builtin/vertex.ts","../src/internal/providers/builtin/xai.ts","../src/internal/providers/builtin/index.ts"],"names":["diag","z","dirname","fileURLToPath","join","readFileSync","homedir","resolveCredential","readStoredOAuth"],"mappings":";;;;;;;;;;;;;AAYO,SAAS,eAAA,CAAmB,KAAa,MAAA,EAAoB;AAClE,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAC1B,EAAA,IAAI,EAAE,GAAG,CAAA,KAAM,QAAW,CAAA,CAAE,GAAG,IAAI,MAAA,EAAO;AAC1C,EAAA,OAAO,EAAE,GAAG,CAAA;AACd;;;ACIA,IAAM,QAAA,GAAW,eAAA;AAAA,EACf,gCAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AACA,IAAM,UAAU,eAAA,CAAgB,+BAAA,EAAiC,sBAAM,IAAI,KAAqB,CAAA;AAEzF,SAAS,iBAAiB,OAAA,EAAgC;AAC/D,EAAA,IAAI,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC9B,IAAAA,sBAAA,CAAK,CAAA,wBAAA,EAA2B,QAAQ,IAAI,CAAA;AAAA,CAAgC,CAAA;AAAA,EAC9E;AACA,EAAA,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAClC,EAAA,KAAA,MAAW,KAAA,IAAS,OAAA,CAAQ,OAAA,IAAW,EAAC,EAAG;AAEzC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,OAAA,CAAQ,IAAA,EAAM;AACvD,MAAAA,sBAAA,CAAK,wBAAwB,KAAK,CAAA,kBAAA,EAAqB,QAAQ,CAAA,QAAA,EAAW,QAAQ,IAAI,CAAA;AAAA,CAAM,CAAA;AAAA,IAC9F;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,EAAO,OAAA,CAAQ,IAAI,CAAA;AAAA,EACjC;AACF;AAEO,SAAS,mBAAmB,IAAA,EAA2C;AAC5E,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA;AACvC,EAAA,OAAO,QAAA,CAAS,IAAI,SAAS,CAAA;AAC/B;AAEO,SAAS,aAAA,GAAmC;AACjD,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAA,EAAQ,CAAA;AACrC;AClCO,IAAM,aAAa,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAA,EAAS,SAAS,KAAK,CAAA;AAGnE,IAAM,UAAA,GAAaC,MAChB,MAAA,CAAO;AAAA;AAAA,EAEN,KAAA,EAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,WAAA,EAAY;AAAA,EAC9B,MAAA,EAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,WAAA,EAAY;AAAA,EAC/B,YAAYA,KAAA,CAAE,MAAA,EAAO,CAAE,WAAA,GAAc,QAAA,EAAS;AAAA,EAC9C,aAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,WAAA,GAAc,QAAA;AACxC,CAAC,EACA,KAAA,EAAM;AAET,IAAM,WAAA,GAAcA,MACjB,MAAA,CAAO;AAAA,EACN,OAAA,EAASA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAOA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACtC,QAAQA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA;AAChC,CAAC,EACA,KAAA,EAAM;AAET,IAAM,gBAAA,GAAmBA,MACtB,MAAA,CAAO;AAAA,EACN,KAAA,EAAOA,MAAE,KAAA,CAAMA,KAAA,CAAE,KAAK,UAAU,CAAC,EAAE,QAAA,EAAS;AAAA,EAC5C,MAAA,EAAQA,MAAE,KAAA,CAAMA,KAAA,CAAE,KAAK,UAAU,CAAC,EAAE,QAAA;AACtC,CAAC,EACA,KAAA,EAAM;AAEF,IAAM,kBAAA,GAAqBA,MAC/B,MAAA,CAAO;AAAA,EACN,IAAA,EAAMA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,YAAA,EAAcA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,UAAA,EAAYA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACjC,SAAA,EAAWA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAChC,WAAA,EAAaA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAClC,SAAA,EAAWA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAEhC,iBAAA,EAAmBA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAExC,aAAA,EAAeA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACpC,IAAA,EAAM,WAAW,QAAA,EAAS;AAAA,EAC1B,KAAA,EAAO,YAAY,QAAA,EAAS;AAAA,EAC5B,UAAA,EAAY,iBAAiB,QAAA,EAAS;AAAA,EACtC,MAAA,EAAQA,MAAE,IAAA,CAAK,CAAC,SAAS,MAAA,EAAQ,YAAY,CAAC,CAAA,CAAE,QAAA;AAClD,CAAC,EACA,KAAA;;;AC1CH,IAAM,kBAAA,GAAqBC,YAAA,CAAQC,iBAAA,CAAc,oQAAe,CAAC,CAAA;AAyCjE,IAAM,cAAA,GAAiB,eAAA;AAAA,EACrB,wCAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AAEA,IAAM,gBAAA,GAAmB,eAAA;AAAA,EACvB,0CAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AACA,IAAM,UAAA,GAAa,eAAA,CAAgB,yCAAA,EAA2C,OAAO;AAAA,EACnF,MAAA,EAAQ;AACV,CAAA,CAAE,CAAA;AAGK,SAAS,oBAAoB,GAAA,EAAuC;AACzE,EAAA,sBAAA,EAAuB;AACvB,EAAA,OAAO,cAAA,CAAe,IAAI,GAAG,CAAA;AAC/B;AAGO,SAAS,kBAAkB,GAAA,EAAsB;AACtD,EAAA,OAAO,gBAAA,CAAiB,IAAI,GAAG,CAAA;AACjC;AASO,SAAS,cAAA,CAAe,KAAa,KAAA,EAA2B;AACrE,EAAA,sBAAA,EAAuB;AACvB,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA;AACvC,EAAA,cAAA,CAAe,GAAA,CAAI,GAAA,EAAK,QAAA,KAAa,MAAA,GAAY,KAAA,GAAQ,EAAE,GAAG,QAAA,EAAU,GAAG,KAAA,EAAO,CAAA;AAClF,EAAA,gBAAA,CAAiB,IAAI,GAAG,CAAA;AAC1B;AAQA,SAAS,sBAAA,GAA+B;AACtC,EAAA,IAAI,WAAW,MAAA,EAAQ;AACvB,EAAA,UAAA,CAAW,MAAA,GAAS,IAAA;AAGpB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,mBAAA,EAAoB;AACpC,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAC1C,MAAA,gBAAA,CAAiB,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAAH,sBAAA;AAAA,MACE,CAAA,kDAAA,EAAsD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC7E;AAAA,EACF;AACF;AAYA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,MAAM,MAAA,KAAW,MAAA,IAAa,OAAO,KAAA,CAAM,WAAW,QAAA,EAAU;AACpE,EAAA,KAAA,MAAW,CAAC,SAAS,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA,EAAG;AACzD,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,SAAA,CAAU,GAAG,CAAA;AAC/C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAAA,sBAAA;AAAA,QACE,CAAA,sDAAA,EAAyD,KAAA,CAAM,EAAE,CAAA,CAAA,EAAI,OAAO,CAAA,GAAA,EACvE,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,OAAA,IAAW,SAAS;AAAA;AAAA,OACnD;AACA,MAAA;AAAA,IACF;AAIA,IAAA,cAAA,CAAe,GAAA,CAAI,GAAG,KAAA,CAAM,EAAE,IAAI,OAAO,CAAA,CAAA,EAAI,OAAO,IAAI,CAAA;AACxD,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACvC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAC/B,MAAA,IAAI,CAAC,eAAe,GAAA,CAAI,GAAG,GAAG,cAAA,CAAe,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,IAAI,CAAA;AAAA,IACnE;AAAA,EACF;AACF;AAaA,SAAS,cAAc,GAAA,EAAmD;AACxE,EAAA,IACE,OAAO,GAAA,CAAI,EAAA,KAAO,QAAA,IAClB,OAAO,IAAI,WAAA,KAAgB,QAAA,IAC3B,OAAO,GAAA,CAAI,YAAY,QAAA,IACvB,OAAO,IAAI,QAAA,KAAa,QAAA,IACxB,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IACvB,CAAC,MAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAC1B,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,KACjC,GAAA,CAAI,YAAA,IAAgB,QACpB,OAAO,GAAA,CAAI,iBAAiB,QAAA,EAC5B;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,oBAAoB,IAAA,EAAkD;AACpF,EAAA,MAAM,WAAA,GAAcI,SAAA,CAAK,kBAAA,EAAoB,uBAAuB,CAAA;AACpE,EAAA,MAAM,OAAA,GAAUC,eAAA,CAAa,WAAA,EAAa,OAAO,CAAA;AACjD,EAAA,IAAI,OAAA,GAAqC,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAE3D,EAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,IAAA,OAAA,GAAU;AAAA,MACR,GAAG,OAAA;AAAA,MACH,EAAE,EAAA,EAAI,oBAAA,EAAsB,WAAA,EAAa,KAAA;AAAM,KACjD;AAAA,EACF;AAEA,EAAA,MAAM,SAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,IAAA,MAAM,SAAA,GAAY,cAAc,GAA8B,CAAA;AAC9D,IAAA,IAAI,cAAc,IAAA,EAAM;AACtB,MAAAL,sBAAA;AAAA,QACE,CAAA,sDAAA,EAAyD,KAAK,SAAA,CAAU,GAAG,EAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC;AAAA;AAAA,OAC5F;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA,GAAI,SAAA;AAAA,EACzB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,IAAI,kBAAA,GAAkE,IAAA;AAO/D,SAAS,uBAAuB,UAAA,EAAsD;AAC3F,EAAA,IAAI,uBAAuB,IAAA,EAAM;AAC/B,IAAA,MAAM,UAAU,mBAAA,EAAoB;AACpC,IAAA,kBAAA,GAAqB,EAAC;AACtB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAC1C,MAAA,kBAAA,CAAmB,KAAA,CAAM,EAAE,CAAA,GAAI,KAAA,CAAM,YAAA;AAGrC,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACvC,QAAA,IAAI,mBAAmB,KAAK,CAAA,KAAM,QAAW,kBAAA,CAAmB,KAAK,IAAI,KAAA,CAAM,YAAA;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,mBAAmB,UAAU,CAAA;AACtC;AAEO,SAAS,yBAAyB,IAAA,EAA0B;AACjE,EAAA,MAAM,OAAA,GAAU,oBAAoB,IAAI,CAAA;AACxC,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAI1C,IAAA,IAAI,kBAAA,CAAmB,KAAA,CAAM,EAAE,CAAA,KAAM,MAAA,EAAW;AAChD,IAAA,IAAI,KAAA,CAAM,SAAS,IAAA,CAAK,CAAC,MAAM,kBAAA,CAAmB,CAAC,CAAA,KAAM,MAAS,CAAA,EAAG;AAErE,IAAA,MAAM,OAAA,GAA2B;AAAA,MAC/B,MAAM,KAAA,CAAM,EAAA;AAAA,MACZ,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,gBAAgB,KAAA,CAAM,cAAA;AAAA,MACtB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,WAAW,KAAA,CAAM,SAAA;AAAA,MACjB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,cAAc,KAAA,CAAM;AAAA,KACtB;AACA,IAAA,gBAAA,CAAiB,OAAO,CAAA;AAAA,EAC1B;AACF;;;AC3PO,IAAM,SAAA,GAA6B;AAAA,EACxC,IAAA,EAAM,WAAA;AAAA,EACN,OAAA,EAAS,oBAAA;AAAA,EACT,OAAA,EAAS,CAAC,mBAAmB,CAAA;AAAA,EAC7B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,SAAA,EAAW,qCAAA;AAAA,EACX,QAAA,EAAU,mBAAA;AAAA,EACV,cAAA,EAAgB,CAAC,iBAAA,EAAmB,mBAAA,EAAqB,2BAA2B,CAAA;AAAA;AAAA;AAAA;AAAA,EAIpF,YAAA,EAAc;AAAA,IACZ,gBAAA,EAAkB;AAAA;AAEtB,CAAA;;;ACDO,IAAM,OAAA,GAA2B;AAAA,EACtC,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,mBAAA;AAAA,EACT,OAAA,EAAS,CAAC,0BAA0B,CAAA;AAAA,EACpC,QAAA,EAAU,YAAA;AAAA,EACV,OAAA,EAAS,iDAAA;AAAA,EACT,SAAA,EAAW,MAAA;AAAA,EACX,QAAA,EAAU,+BAAA;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,6CAAA;AAAA,IACA,2CAAA;AAAA,IACA;AAAA;AAEJ,CAAA;AAGO,SAAS,mBAAmB,OAAA,EAAyB;AAC1D,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AACzC;AAQO,SAAS,uBAAuB,OAAA,EAAqC;AAC1E,EAAA,MAAM,EAAA,GAAK,mBAAmB,OAAO,CAAA;AACrC,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,WAAA;AACrC,EAAA,IAAI,GAAG,UAAA,CAAW,KAAK,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC3D,EAAA,IAAI,GAAG,UAAA,CAAW,KAAK,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC3D,EAAA,IAAI,GAAG,UAAA,CAAW,OAAO,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,gBAAA;AAC7D,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,gBAAA;AACjC,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,sBAAsB,OAAA,EAAyB;AAC7D,EAAA,MAAM,SAAS,sBAAA,CAAuB,OAAO,CAAA,IAAK,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC5E,EAAA,OAAO,2BAA2B,MAAM,CAAA,cAAA,CAAA;AAC1C;;;AC9CO,SAAS,wBACd,CAAA,EACiB;AACjB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,kBAAA;AAAA,IACT,QAAA,EAAU,SAAA;AAAA,IACV,gBAAgB,EAAC;AAAA,IACjB,GAAG;AAAA,GACL;AACF;;;ACbO,IAAM,WAAW,uBAAA,CAAwB;AAAA,EAC9C,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,4BAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,cAAA,EAAgB,CAAC,cAAA,EAAgB,aAAa,CAAA;AAAA,EAC9C,YAAA,EAAc,EAAE,kCAAA,EAAoC,SAAA,EAAU;AAAA,EAC9D,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACJM,IAAM,SAAS,uBAAA,CAAwB;AAAA,EAC5C,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,wCAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAA,EAAkB,YAAY,CAAA;AAAA,EACxC,cAAA,EAAgB,CAAC,mBAAmB,CAAA;AAAA,EACpC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACZM,IAAM,YAAY,uBAAA,CAAwB;AAAA,EAC/C,IAAA,EAAM,WAAA;AAAA,EACN,OAAA,EAAS,qCAAA;AAAA,EACT,OAAA,EAAS,CAAC,mBAAmB,CAAA;AAAA,EAC7B,cAAA,EAAgB,CAAC,gBAAgB,CAAA;AAAA,EACjC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACCM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,oBAAoB,CAAA;AAAA,EAC9B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,QAAA,EAAU,eAAA;AAAA,EACV,cAAA,EAAgB,CAAC,6BAA6B;AAChD,CAAA;;;ACXO,IAAM,SAAS,uBAAA,CAAwB;AAAA,EAC5C,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,yDAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,8BAA8B,CAAA;AAAA,EAC5E,cAAA,EAAgB,CAAC,gBAAA,EAAkB,kBAAkB,CAAA;AAAA,EACrD,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACVM,IAAM,OAAO,uBAAA,CAAwB;AAAA,EAC1C,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS,gCAAA;AAAA,EACT,OAAA,EAAS,CAAC,cAAc,CAAA;AAAA,EACxB,cAAA,EAAgB,CAAC,yBAAA,EAA2B,sBAAsB,CAAA;AAAA,EAClE,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACcM,IAAM,QAAA,GAA4B;AAAA,EACvC,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,WAAA,EAAa,WAAW,CAAA;AAAA,EAClC,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,uBAAA;AAAA,EACT,SAAA,EAAW,iCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,cAAc;AACjC,CAAA;;;ACZO,IAAM,QAAA,GAA4B;AAAA,EACvC,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,WAAA,EAAa,WAAW,CAAA;AAAA,EAClC,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,uBAAA;AAAA,EACT,SAAA,EAAW,iCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,cAAc;AACjC,CAAA;;;AC5BO,IAAM,UAAU,uBAAA,CAAwB;AAAA,EAC7C,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,2BAAA;AAAA,EACT,OAAA,EAAS,CAAC,iBAAiB,CAAA;AAAA,EAC3B,cAAA,EAAgB,CAAC,sBAAA,EAAwB,kBAAkB,CAAA;AAAA,EAC3D,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACQM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,wBAAA;AAAA,EACT,SAAA,EAAW,kCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,UAAA,EAAY,SAAA,EAAW,SAAS;AACnD,CAAA;;;ACxBO,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,wBAAA;AAAA,EACT,SAAA,EAAW,kCAAA;AAAA,EACX,QAAA,EAAU,gBAAA;AAAA,EACV,cAAA,EAAgB,CAAC,QAAA,EAAU,aAAa;AAC1C,CAAA;ACeA,IAAM,aAAA,GAAuC;AAAA,EAC3C,MAAMM,UAAA,EAAQ;AAAA,EACd,OAAA,EAAS,UAAA;AAAA,EACT,QAAA,EAAU,WAAA;AAAA,EACV,UAAA,EAAY;AACd,CAAA;AAQA,IAAM,mBAAA,GAA2C;AAAA,EAC/C,QAAA,EAAU,QAAA;AAAA,EACV,iBAAA,EAAmB,yCAAA;AAAA,EACnB,aAAA,EAAe,qCAAA;AAAA,EACf,QAAA,EAAU,8BAAA;AAAA,EACV,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,gBAAgB,CAAA;AAAA,EACvD,WAAA,EAAa;AACf,CAAA;AASA,SAAS,UAAA,GAA2B;AAClC,EAAA,QAAQ,OAAO,OAAoC,IAAA,KAAuC;AACxF,IAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,IAAA,MAAM,QAAA,GAAW,MAAMC,mCAAA,CAAkB;AAAA,MACvC,QAAA,EAAU,QAAA;AAAA,MACV,KAAA,EAAO,aAAA;AAAA,MACP,KAAA,EAAO,mBAAA;AAAA,MACP;AAAA,KACD,CAAA;AACD,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,SAAA,GAAYC,iCAAA,CAAgB,aAAA,EAAe,GAAG,CAAA,EAAG,UAAA;AACvD,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AACxD,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,sBAAsB,SAAS,CAAA;AACxE,IAAA,OAAO,MAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC1C,CAAA;AACF;AAEO,IAAM,cAAA,GAAkC;AAAA,EAC7C,IAAA,EAAM,gBAAA;AAAA,EACN,OAAA,EAAS,eAAA;AAAA,EACT,QAAA,EAAU,mBAAA;AAAA,EACV,OAAA,EAAS,uCAAA;AAAA,EACT,SAAS,EAAC;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,wBAAA;AAAA,IACA,6BAAA;AAAA,IACA;AAAA,GACF;AAAA;AAAA;AAAA;AAAA,EAIA,YAAA,EAAc,EAAE,UAAA,EAAY,SAAA,EAAU;AAAA,EACtC,SAAA,EAAW;AAAA;AAAA,IAET,KAAA,EAAO,MAAM,UAAA;AAAW;AAE5B,CAAA;;;AC9FO,IAAM,UAAA,GAA8B;AAAA,EACzC,IAAA,EAAM,YAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,IAAI,CAAA;AAAA;AAAA,EAEd,OAAA,EAAS,CAAC,oBAAA,EAAsB,gBAAgB,CAAA;AAAA,EAChD,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,SAAA,EAAW,qCAAA;AAAA,EACX,QAAA,EAAU,eAAA;AAAA;AAAA,EAEV,cAAA,EAAgB,CAAC,oBAAA,EAAsB,4BAA4B,CAAA;AAAA;AAAA;AAAA,EAGnE,YAAA,EAAc,EAAE,cAAA,EAAgB,qBAAA,EAAuB,WAAW,SAAA;AACpE,CAAA;;;ACXO,IAAM,aAAa,uBAAA,CAAwB;AAAA,EAChD,IAAA,EAAM,YAAA;AAAA,EACN,OAAA,EAAS,2BAAA;AAAA,EACT,mBAAA,EAAqB,mBAAA;AAAA,EACrB,OAAA,EAAS,CAAC,oBAAoB,CAAA;AAAA,EAC9B,cAAA,EAAgB,CAAC,WAAA,EAAa,OAAO,CAAA;AAAA,EACrC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACVM,IAAM,WAAW,uBAAA,CAAwB;AAAA,EAC9C,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,YAAY,CAAA;AAAA,EACtB,OAAA,EAAS,6BAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,cAAA,EAAgB,CAAC,gCAAgC,CAAA;AAAA,EACjD,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACKM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,oBAAA;AAAA;AAAA,EACT,OAAA,EAAS,CAAC,gCAAgC,CAAA;AAAA,EAC1C,QAAA,EAAU,WAAA;AAAA,EACV,OAAA,EAAS,+CAAA;AAAA,EACT,SAAA,EAAW,MAAA;AAAA,EACX,QAAA,EAAU,2BAAA;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,6CAAA;AAAA,IACA;AAAA;AAEJ,CAAA;AAOO,SAAS,qBAAqB,IAAA,EAI1B;AACT,EAAA,MAAM,OACJ,IAAA,CAAK,QAAA,KAAa,WACd,2BAAA,GACA,CAAA,EAAG,KAAK,QAAQ,CAAA,0BAAA,CAAA;AACtB,EAAA,IAAI,IAAA,CAAK,iBAAiB,QAAA,EAAU;AAElC,IAAA,OAAO,WAAW,IAAI,CAAA,aAAA,EAAgB,KAAK,SAAS,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,kBAAA,CAAA;AAAA,EACjF;AAEA,EAAA,OAAO,WAAW,IAAI,CAAA,aAAA,EAAgB,KAAK,SAAS,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,qBAAA,CAAA;AACjF;AAGO,SAAS,kBAAkB,OAAA,EAAyC;AACzE,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,WAAA;AAC5C,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG,OAAO,QAAA;AACzC,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,+BAAA,EAAiC,EAAE,CAAA;AAC5D;;;AC1DO,IAAM,MAAM,uBAAA,CAAwB;AAAA,EACzC,IAAA,EAAM,KAAA;AAAA,EACN,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,EAChB,OAAA,EAAS,qBAAA;AAAA,EACT,OAAA,EAAS,CAAC,aAAa,CAAA;AAAA,EACvB,cAAA,EAAgB,CAAC,UAAA,EAAY,UAAU,CAAA;AAAA,EACvC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACwBD,IAAM,oBAAoB,MAAyB;AACjD,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,MAAM,GAAA,mBAAM,MAAA,CAAO,GAAA,CAAI,2CAA2C,CAAA;AAClE,EAAA,IAAI,CAAA,CAAE,GAAG,CAAA,KAAM,MAAA,IAAa,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,KAAA,EAAM;AACjD,EAAA,OAAO,EAAE,GAAG,CAAA;AACd,CAAA,GAAG;AAEI,SAAS,gBAAA,GAAyB;AACvC,EAAA,IAAI,iBAAiB,IAAA,EAAM;AAC3B,EAAA,gBAAA,CAAiB,IAAA,GAAO,IAAA;AAExB,EAAA,gBAAA,CAAiB,SAAS,CAAA;AAC1B,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,cAAc,CAAA;AAC/B,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,OAAO,CAAA;AACxB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AAEvB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,OAAO,CAAA;AACxB,EAAA,gBAAA,CAAiB,IAAI,CAAA;AACrB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,SAAS,CAAA;AAC1B,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,GAAG,CAAA;AACpB,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AAEzB,EAAA,wBAAA,EAAyB;AAC3B","file":"chunk-VUKQL3L2.cjs","sourcesContent":["/**\n * One singleton per realm, keyed by `Symbol.for`.\n *\n * It exists because a package can be loaded more than once in the same process (two copies in\n * `node_modules`, ESM and CJS side by side, a monorepo with distinct versions) — and then a module-level\n * `const x = new Map()` produces TWO caches that cannot see each other. `Symbol.for` uses the global\n * symbol registry, which belongs to the realm and not the module, so every copy converges on one instance.\n *\n * It was copied verbatim into `providers/discovery.ts` and `providers/catalog-loader.ts`. That is\n * duplicated KNOWLEDGE, not a coincidence of shape: the two copies have to agree on the\n * mechanism, and one fixed without the other produces exactly the bug the function exists to avoid.\n */\nexport function globalSingleton<T>(key: string, create: () => T): T {\n  const g = globalThis as unknown as Record<symbol, T>;\n  const sym = Symbol.for(key);\n  if (g[sym] === undefined) g[sym] = create();\n  return g[sym];\n}\n","/**\n * Provider registry (T3.2, ADR D107).\n *\n * `registerProvider` is idempotent and surface-warning: re-registering\n * a `name` logs to stderr (D107 last-writer-wins with WARN). Alias\n * collisions also warn (EC-5).\n *\n * @internal\n */\n\nimport { diag } from \"../diagnostics.js\";\nimport { globalSingleton } from \"../global-singleton.js\";\nimport type { ProviderProfile } from \"./types.js\";\n\n/**\n * M44 B1 fix — the registry state lives on `globalThis` keyed by `Symbol.for`, so EVERY bundle copy of this\n * module (tsup bundles each entry separately with `splitting: false` — `dist/index.js` and `dist/models.js`\n * each embed their own copy) shares the SAME maps. Without this, `@theokit/sdk/models`'s\n * `refreshModelCatalog` saw an eternally-empty registry and its patches were invisible to the core bundle's\n * capability/pricing lookups (state duplication made load-bearing by M44).\n */\nconst REGISTRY = globalSingleton(\n  \"theokit-sdk.providers.registry\",\n  () => new Map<string, ProviderProfile>(),\n);\nconst ALIASES = globalSingleton(\"theokit-sdk.providers.aliases\", () => new Map<string, string>());\n\nexport function registerProvider(profile: ProviderProfile): void {\n  if (REGISTRY.has(profile.name)) {\n    diag(`[theokit-sdk] Provider \"${profile.name}\" overridden by user plugin.\\n`);\n  }\n  REGISTRY.set(profile.name, profile);\n  for (const alias of profile.aliases ?? []) {\n    // EC-5: surface alias collision so operators notice mis-routing.\n    const previous = ALIASES.get(alias);\n    if (previous !== undefined && previous !== profile.name) {\n      diag(`[theokit-sdk] Alias \"${alias}\" collision: was \"${previous}\", now \"${profile.name}\".\\n`);\n    }\n    ALIASES.set(alias, profile.name);\n  }\n}\n\nexport function getProviderProfile(name: string): ProviderProfile | undefined {\n  const canonical = ALIASES.get(name) ?? name;\n  return REGISTRY.get(canonical);\n}\n\nexport function listProviders(): ProviderProfile[] {\n  return Array.from(REGISTRY.values());\n}\n\n/** Test-only reset. @internal */\nexport function _resetProvidersForTests(): void {\n  REGISTRY.clear();\n  ALIASES.clear();\n}\n","import { z } from \"zod\";\n\n/**\n * M44 — the per-model catalog sub-schema. Field names mirror models.dev VERBATIM (snake_case) so\n * `scripts/refresh-catalog.mjs` regenerates the vendored data mechanically from `api.json` with zero\n * renaming (ADR D1).\n * TOLERANT by design: every field optional, unknown keys ignored — models.dev adds fields over time and\n * additive drift must never break the loader (Blueprint §6.4).\n *\n * theokit extensions beyond models.dev: `structured_output` / `cache_control` (both already exist on the\n * SDK's `ModelCapabilities`; models.dev has no such flags).\n *\n * @internal\n */\n\nexport const MODALITIES = [\"text\", \"audio\", \"image\", \"video\", \"pdf\"] as const;\nexport type Modality = (typeof MODALITIES)[number];\n\nconst costSchema = z\n  .object({\n    /** USD per 1M tokens (models.dev convention). */\n    input: z.number().nonnegative(),\n    output: z.number().nonnegative(),\n    cache_read: z.number().nonnegative().optional(),\n    cache_write: z.number().nonnegative().optional(),\n  })\n  .loose();\n\nconst limitSchema = z\n  .object({\n    context: z.number().positive(),\n    input: z.number().positive().optional(),\n    output: z.number().positive().optional(),\n  })\n  .loose();\n\nconst modalitiesSchema = z\n  .object({\n    input: z.array(z.enum(MODALITIES)).optional(),\n    output: z.array(z.enum(MODALITIES)).optional(),\n  })\n  .loose();\n\nexport const catalogModelSchema = z\n  .object({\n    name: z.string().optional(),\n    release_date: z.string().optional(),\n    attachment: z.boolean().optional(),\n    reasoning: z.boolean().optional(),\n    temperature: z.boolean().optional(),\n    tool_call: z.boolean().optional(),\n    /** theokit extension — maps to ModelCapabilities.supportsStructuredOutput. */\n    structured_output: z.boolean().optional(),\n    /** theokit extension — maps to ModelCapabilities.supportsCacheControl. */\n    cache_control: z.boolean().optional(),\n    cost: costSchema.optional(),\n    limit: limitSchema.optional(),\n    modalities: modalitiesSchema.optional(),\n    status: z.enum([\"alpha\", \"beta\", \"deprecated\"]).optional(),\n  })\n  .loose();\n\nexport type CatalogModel = z.infer<typeof catalogModelSchema>;\nexport type CatalogModelCost = z.infer<typeof costSchema>;\n","/**\n * Dynamic provider catalog loader (T10.1, ADR D447).\n *\n * Loads provider metadata from `provider-catalog.json` at runtime.\n * Malformed entries are skipped with WARN (EC-1) — never crash.\n *\n * @internal\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { diag } from \"../diagnostics.js\";\nimport { globalSingleton } from \"../global-singleton.js\";\nimport { type CatalogModel, catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile, registerProvider } from \"./registry.js\";\nimport type { ApiMode, AuthType, ProviderProfile } from \"./types.js\";\n\nconst __dirname_resolved = dirname(fileURLToPath(import.meta.url));\n\nexport interface ProviderCapabilities {\n  supportsToolUse: boolean;\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsStreaming: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens?: number;\n  maxOutputTokens?: number;\n}\n\nexport interface CatalogEntry {\n  id: string;\n  displayName: string;\n  apiMode: ApiMode;\n  authType: AuthType;\n  baseUrl: string;\n  envVars: string[];\n  fallbackModels: string[];\n  capabilities: ProviderCapabilities;\n  aliases?: string[];\n  modelsUrl?: string;\n  hostname?: string;\n  extraHeaders?: Record<string, string>;\n  /**\n   * M44 — OPTIONAL per-model data (models.dev shape, snake_case — see `catalog-schema.ts`), keyed by the\n   * BARE model id. Additive: entries without it behave byte-identically to before. The loader indexes this\n   * into the model-info index (`getCatalogModelInfo`) rather than onto `ProviderProfile` (ADR D2 — the\n   * builtins-first registration skip means profile-attached data would never reach builtin providers).\n   */\n  models?: Record<string, CatalogModel>;\n}\n\n/**\n * M44 — the model-info index: `provider/model` → per-model catalog data (the EXACT-map key convention).\n * Populated by the vendored catalog load AND patched by the optional models-dev source (cache entries win\n * per model). The single lookup surface for capability / cost / limit enrichment.\n */\n// M44 B1 fix — index state on globalThis (Symbol.for) so every bundle copy shares the SAME maps (see the\n// identical pattern + rationale in registry.ts).\nconst modelInfoIndex = globalSingleton(\n  \"theokit-sdk.providers.model-info-index\",\n  () => new Map<string, CatalogModel>(),\n);\n/** M44 M5 fix — keys patched by the live models-dev source (honest pricing provenance). */\nconst patchedModelKeys = globalSingleton(\n  \"theokit-sdk.providers.model-info-patched\",\n  () => new Set<string>(),\n);\nconst indexState = globalSingleton(\"theokit-sdk.providers.model-info-loaded\", () => ({\n  loaded: false,\n}));\n\n/** Look up per-model catalog data by `provider/model` key. @internal */\nexport function getCatalogModelInfo(key: string): CatalogModel | undefined {\n  ensureModelIndexLoaded();\n  return modelInfoIndex.get(key);\n}\n\n/** Was this key patched by the LIVE models-dev source (vs the vendored catalog)? @internal */\nexport function isPatchedModelKey(key: string): boolean {\n  return patchedModelKeys.has(key);\n}\n\n/**\n * Patch the index with fresher per-model data (the models-dev source). M44 H2 fix — a per-FIELD shallow\n * MERGE, not a wholesale replace: models.dev can never supply the theokit extension fields\n * (`cache_control`, `structured_output` overlays), so a replace would wipe them and silently flip\n * capability answers. Incoming fields win; existing fields survive when the patch omits them.\n * @internal\n */\nexport function patchModelInfo(key: string, model: CatalogModel): void {\n  ensureModelIndexLoaded();\n  const existing = modelInfoIndex.get(key);\n  modelInfoIndex.set(key, existing === undefined ? model : { ...existing, ...model });\n  patchedModelKeys.add(key);\n}\n\n/** All indexed `provider/model` keys (for maintenance/tests). @internal */\nexport function listModelInfoKeys(): string[] {\n  ensureModelIndexLoaded();\n  return [...modelInfoIndex.keys()];\n}\n\nfunction ensureModelIndexLoaded(): void {\n  if (indexState.loaded) return;\n  indexState.loaded = true;\n  // M44 L9 fix — never throw from a capability/pricing lookup: a missing/corrupt vendored catalog degrades\n  // to conservative defaults with a WARN (the deleted EXACT map could never throw; keep that property).\n  try {\n    const catalog = loadProviderCatalog();\n    for (const entry of Object.values(catalog)) {\n      indexEntryModels(entry);\n    }\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: provider catalog unavailable (${(err as Error).message}) — per-model data disabled\\n`,\n    );\n  }\n}\n\n/**\n * Index an entry's `models` block. Runs for EVERY catalog entry — including those whose PROVIDER\n * registration is skipped builtins-first — so builtin providers still get their per-model data (ADR D2).\n * A malformed model sub-entry drops THAT MODEL with WARN and keeps the provider (EC-1 philosophy extended).\n */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nfunction indexEntryModels(entry: CatalogEntry): void {\n  if (entry.models === undefined || typeof entry.models !== \"object\") return;\n  for (const [modelId, raw] of Object.entries(entry.models)) {\n    const parsed = catalogModelSchema.safeParse(raw);\n    if (!parsed.success) {\n      diag(\n        `[theokit-sdk] WARN: Skipping malformed catalog model \"${entry.id}/${modelId}\": ` +\n          `${parsed.error.issues[0]?.message ?? \"invalid\"}\\n`,\n      );\n      continue;\n    }\n    // Index under the entry id AND every alias — capability lookups are VENDOR-keyed (e.g.\n    // `google/gemini-2.5-pro` while the entry id is `google-gemini` with alias `google`), so alias keys are\n    // what make the vendor-keyed convention resolve without a second mapping table.\n    modelInfoIndex.set(`${entry.id}/${modelId}`, parsed.data);\n    for (const alias of entry.aliases ?? []) {\n      const key = `${alias}/${modelId}`;\n      if (!modelInfoIndex.has(key)) modelInfoIndex.set(key, parsed.data);\n    }\n  }\n}\n\n/** Test-only reset for the model-info index. @internal */\nexport function _resetModelInfoIndexForTests(): void {\n  modelInfoIndex.clear();\n  patchedModelKeys.clear();\n  indexState.loaded = false;\n}\n\ninterface LoadOptions {\n  _testInjectMalformed?: boolean;\n}\n\nfunction validateEntry(raw: Record<string, unknown>): CatalogEntry | null {\n  if (\n    typeof raw.id !== \"string\" ||\n    typeof raw.displayName !== \"string\" ||\n    typeof raw.apiMode !== \"string\" ||\n    typeof raw.authType !== \"string\" ||\n    typeof raw.baseUrl !== \"string\" ||\n    !Array.isArray(raw.envVars) ||\n    !Array.isArray(raw.fallbackModels) ||\n    raw.capabilities == null ||\n    typeof raw.capabilities !== \"object\"\n  ) {\n    return null;\n  }\n  return raw as unknown as CatalogEntry;\n}\n\nexport function loadProviderCatalog(opts?: LoadOptions): Record<string, CatalogEntry> {\n  const catalogPath = join(__dirname_resolved, \"provider-catalog.json\");\n  const rawText = readFileSync(catalogPath, \"utf-8\");\n  let entries: Record<string, unknown>[] = JSON.parse(rawText);\n\n  if (opts?._testInjectMalformed) {\n    entries = [\n      ...entries,\n      { id: \"malformed-provider\", displayName: \"Bad\" } as Record<string, unknown>,\n    ];\n  }\n\n  const result: Record<string, CatalogEntry> = {};\n  for (const raw of entries) {\n    const validated = validateEntry(raw as Record<string, unknown>);\n    if (validated === null) {\n      diag(\n        `[theokit-sdk] WARN: Skipping malformed catalog entry: ${JSON.stringify(raw).slice(0, 100)}\\n`,\n      );\n      continue;\n    }\n    result[validated.id] = validated;\n  }\n  return result;\n}\n\nlet _capabilitiesCache: Record<string, ProviderCapabilities> | null = null;\n\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nexport function getCatalogCapabilities(providerId: string): ProviderCapabilities | undefined {\n  if (_capabilitiesCache === null) {\n    const catalog = loadProviderCatalog();\n    _capabilitiesCache = {};\n    for (const entry of Object.values(catalog)) {\n      _capabilitiesCache[entry.id] = entry.capabilities;\n      // M45 review L4 — alias keys too (e.g. entry `google-gemini` alias `google`), consistent with the\n      // model-info index's alias-keyed convention.\n      for (const alias of entry.aliases ?? []) {\n        if (_capabilitiesCache[alias] === undefined) _capabilitiesCache[alias] = entry.capabilities;\n      }\n    }\n  }\n  return _capabilitiesCache[providerId];\n}\n\nexport function registerCatalogProviders(opts?: LoadOptions): void {\n  const catalog = loadProviderCatalog(opts);\n  for (const entry of Object.values(catalog)) {\n    // Skip catalog entries that would overwrite first-party builtins.\n    // Builtins have richer env-var handling and are registered first.\n    // Also skip if any alias collides with an existing provider name.\n    if (getProviderProfile(entry.id) !== undefined) continue;\n    if (entry.aliases?.some((a) => getProviderProfile(a) !== undefined)) continue;\n\n    const profile: ProviderProfile = {\n      name: entry.id,\n      apiMode: entry.apiMode,\n      authType: entry.authType,\n      baseUrl: entry.baseUrl,\n      envVars: entry.envVars,\n      fallbackModels: entry.fallbackModels,\n      displayName: entry.displayName,\n      aliases: entry.aliases,\n      modelsUrl: entry.modelsUrl,\n      hostname: entry.hostname,\n      extraHeaders: entry.extraHeaders,\n    };\n    registerProvider(profile);\n  }\n}\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const ANTHROPIC: ProviderProfile = {\n  name: \"anthropic\",\n  apiMode: \"anthropic_messages\",\n  envVars: [\"ANTHROPIC_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://api.anthropic.com\",\n  modelsUrl: \"https://api.anthropic.com/v1/models\",\n  hostname: \"api.anthropic.com\",\n  fallbackModels: [\"claude-opus-4-7\", \"claude-sonnet-4-6\", \"claude-haiku-4-5-20251001\"],\n  // M45 — the Anthropic beta-features header (interleaved thinking + fine-grained tool streaming). An\n  // Anthropic API constant. The\n  // SANCTIONED behavior delta of M45 (ADR D4) — consumed by the anthropic transport's extraHeaders wiring.\n  extraHeaders: {\n    \"anthropic-beta\": \"interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14\",\n  },\n};\n","/**\n * AWS Bedrock profile (Adoption Roadmap #8; ADRs D286-D302).\n *\n * Bearer-only auth via `AWS_BEARER_TOKEN_BEDROCK` env (GA Sep 2025).\n * Optional `@aws/bedrock-token-generator` peer dep auto-refreshes short-term\n * tokens (D287). Transport via native `fetch`; no `@aws-sdk/*` dependency.\n *\n * Model IDs follow the `bedrock/{aws-id}` convention so the router can\n * infer the provider via prefix routing (D186). The client strips the\n * `bedrock/` prefix before building the URL.\n *\n * @internal\n */\n\nimport type { ProviderProfile } from \"../types.js\";\n\nexport const BEDROCK: ProviderProfile = {\n  name: \"bedrock\",\n  apiMode: \"bedrock_anthropic\",\n  envVars: [\"AWS_BEARER_TOKEN_BEDROCK\"],\n  authType: \"aws_bearer\",\n  baseUrl: \"https://bedrock-runtime.us-east-1.amazonaws.com\",\n  modelsUrl: undefined,\n  hostname: \"bedrock-runtime.amazonaws.com\",\n  fallbackModels: [\n    \"bedrock/us.anthropic.claude-sonnet-4-5-v1:0\",\n    \"bedrock/us.anthropic.claude-opus-4-7-v1:0\",\n    \"bedrock/global.anthropic.claude-haiku-4-5-v1:0\",\n  ],\n};\n\n/** Strip `\"bedrock/\"` prefix so the raw AWS model id is used in the URL. */\nexport function stripBedrockPrefix(modelId: string): string {\n  return modelId.replace(/^bedrock\\//, \"\");\n}\n\n/**\n * Infer AWS region from a Bedrock model id prefix (D290).\n *\n * `global.*` routes via `us-east-1` (AWS default entrypoint for global\n * inference profiles).\n */\nexport function inferRegionFromModelId(modelId: string): string | undefined {\n  const id = stripBedrockPrefix(modelId);\n  if (id.startsWith(\"global.\")) return \"us-east-1\";\n  if (id.startsWith(\"us.\")) return process.env.AWS_REGION ?? \"us-east-1\";\n  if (id.startsWith(\"eu.\")) return process.env.AWS_REGION ?? \"eu-west-1\";\n  if (id.startsWith(\"apac.\")) return process.env.AWS_REGION ?? \"ap-southeast-1\";\n  if (id.startsWith(\"jp.\")) return \"ap-northeast-1\";\n  return undefined;\n}\n\n/** Resolve baseUrl from model id; falls back to `AWS_REGION` env or `us-east-1`. */\nexport function resolveBedrockBaseUrl(modelId: string): string {\n  const region = inferRegionFromModelId(modelId) ?? process.env.AWS_REGION ?? \"us-east-1\";\n  return `https://bedrock-runtime.${region}.amazonaws.com`;\n}\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * M45 — the data-only base for OpenAI-compatible chat_completions providers. A profile-map pattern\n * flattened to\n * theokit's data model: leaves declare name/baseUrl/envVars (+ overrides) in ~10 lines; the router's\n * URL-join rule (version-segment detection + `chatCompletionsPath` escape) derives the endpoint.\n *\n * @internal\n */\nexport function openAiCompatibleProfile(\n  p: { name: string; baseUrl: string; envVars: readonly string[] } & Partial<ProviderProfile>,\n): ProviderProfile {\n  return {\n    apiMode: \"chat_completions\",\n    authType: \"api_key\",\n    fallbackModels: [],\n    ...p,\n  };\n}\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Cerebras. The integration header value is theokit's own: the header attributes TRAFFIC.\n * Models per models.dev (2026-07 snapshot).\n */\nexport const CEREBRAS = openAiCompatibleProfile({\n  name: \"cerebras\",\n  baseUrl: \"https://api.cerebras.ai/v1\",\n  envVars: [\"CEREBRAS_API_KEY\"],\n  fallbackModels: [\"gpt-oss-120b\", \"zai-glm-4.7\"],\n  extraHeaders: { \"X-Cerebras-3rd-Party-Integration\": \"theokit\" },\n  hostname: \"api.cerebras.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Cohere via its OpenAI-compatibility surface (`api.cohere.ai/compatibility/v1` — the native v2 API\n * is NOT chat_completions; the discovery flagged the old catalog baseUrl as doubly wrong). Models per\n * models.dev `cohere` (2026-07 snapshot). SOURCE NOTE (review L2): the compatibility endpoint + `CO_API_KEY`\n * come from Cohere's own docs/python-SDK convention (not vendored in this repo's references) — verify with a\n * live smoke when a key is available.\n */\nexport const COHERE = openAiCompatibleProfile({\n  name: \"cohere\",\n  baseUrl: \"https://api.cohere.ai/compatibility/v1\",\n  envVars: [\"COHERE_API_KEY\", \"CO_API_KEY\"],\n  fallbackModels: [\"command-a-03-2025\"],\n  hostname: \"api.cohere.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — DeepInfra. OpenAI-compat surface under /v1/openai (models.dev `deepinfra`). */\nexport const DEEPINFRA = openAiCompatibleProfile({\n  name: \"deepinfra\",\n  baseUrl: \"https://api.deepinfra.com/v1/openai\",\n  envVars: [\"DEEPINFRA_API_KEY\"],\n  fallbackModels: [\"Qwen/Qwen3-32B\"],\n  hostname: \"api.deepinfra.com\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * Gemini via OpenRouter passthrough. Direct Gemini API uses a different\n * dialect (`generateContent`); SDK currently routes through OpenRouter's\n * OpenAI-compatible endpoint so the chat_completions transport works.\n *\n * A future plugin `@theokit-provider-gemini-direct` can override this with\n * `apiMode: \"gemini_generate_content\"` once that transport ships.\n */\nexport const GEMINI: ProviderProfile = {\n  name: \"gemini\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OPENROUTER_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://openrouter.ai/api\",\n  hostname: \"openrouter.ai\",\n  fallbackModels: [\"google/gemini-2.0-flash-001\"],\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Google Gemini via the DIRECT OpenAI-compat endpoint (a Google API key, not OpenRouter). Distinct\n * from the `gemini` builtin (an OpenRouter passthrough) by ADR D3 — two routes, two names. Endpoint + env\n * vars per Google's OpenAI-compatibility docs (mirrored by models.dev `google` + the M44 catalog entry).\n */\nexport const GOOGLE = openAiCompatibleProfile({\n  name: \"google\",\n  baseUrl: \"https://generativelanguage.googleapis.com/v1beta/openai\",\n  envVars: [\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\", \"GOOGLE_GENERATIVE_AI_API_KEY\"],\n  fallbackModels: [\"gemini-2.5-pro\", \"gemini-2.5-flash\"],\n  hostname: \"generativelanguage.googleapis.com\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Groq. Values per models.dev `groq` (2026-07 snapshot); OpenAI-compat surface under /openai/v1. */\nexport const GROQ = openAiCompatibleProfile({\n  name: \"groq\",\n  baseUrl: \"https://api.groq.com/openai/v1\",\n  envVars: [\"GROQ_API_KEY\"],\n  fallbackModels: [\"llama-3.3-70b-versatile\", \"llama-3.1-8b-instant\"],\n  hostname: \"api.groq.com\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * llama.cpp server provider profile (T7.2, ADR D189).\n *\n * llama.cpp ships a HTTP server binary (`./server` since b1500+) that\n * implements the OpenAI-compatible `/v1/chat/completions` endpoint on\n * `http://localhost:8080` by default. Inherits `authType: \"none\"` from\n * D182 — no API key required for local use.\n *\n * llama.cpp idiosyncrasies:\n *  - Server loads a single GGUF model at startup via `--model` CLI\n *    flag. The `model` field in the chat-completions request is\n *    cosmetic — any string works; the response comes from the loaded\n *    model regardless. This is documented in\n *    `.claude/knowledge-base/reviews/edge-case/ollama-integration-edge-cases-2026-05-21.md`\n *    as EC-O.\n *  - Tool calling support depends entirely on the underlying model.\n *\n * Override the default URL with `LLAMACPP_HOST`.\n *\n * @internal\n */\nexport const LLAMACPP: ProviderProfile = {\n  name: \"llamacpp\",\n  aliases: [\"llama-cpp\", \"llama.cpp\"],\n  apiMode: \"chat_completions\",\n  envVars: [\"LLAMACPP_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:8080\",\n  modelsUrl: \"http://localhost:8080/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"loaded-model\"],\n};\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * LM Studio provider profile (T7.1, ADR D188).\n *\n * LM Studio exposes an OpenAI-compatible `/v1/chat/completions` endpoint\n * on `http://localhost:1234` by default (configurable via the LM Studio\n * UI under \"Local Server\"). Inherits the `authType: \"none\"` primitive\n * from D182 — no API key required for local use.\n *\n * LM Studio idiosyncrasies:\n *  - Loads ONE model at a time via the desktop UI. The `model` field in\n *    the chat-completions request is informational only — LM Studio\n *    serves whatever model is currently loaded.\n *  - `/v1/models` returns a single entry pointing to the loaded model.\n *  - Tool calling depends on the underlying model.\n *\n * Override the default URL with `LMSTUDIO_HOST` (mirrors `OLLAMA_HOST`).\n *\n * @internal\n */\nexport const LMSTUDIO: ProviderProfile = {\n  name: \"lmstudio\",\n  aliases: [\"lm-studio\", \"lm_studio\"],\n  apiMode: \"chat_completions\",\n  envVars: [\"LMSTUDIO_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:1234\",\n  modelsUrl: \"http://localhost:1234/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"loaded-model\"],\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Mistral (La Plateforme). Values per models.dev `mistral` (2026-07 snapshot). */\nexport const MISTRAL = openAiCompatibleProfile({\n  name: \"mistral\",\n  baseUrl: \"https://api.mistral.ai/v1\",\n  envVars: [\"MISTRAL_API_KEY\"],\n  fallbackModels: [\"mistral-large-latest\", \"codestral-latest\"],\n  hostname: \"api.mistral.ai\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * Ollama — local-first LLM runtime (ADR D182).\n *\n * Ships as a builtin so `Agent.create({ model: \"ollama/llama3.2\" })` works\n * with zero configuration when `ollama serve` is running on the default\n * port. `authType: \"none\"` signals the router to skip env-key resolution\n * and use a placeholder credential (Ollama ignores Authorization headers\n * on local installs).\n *\n * Overrides:\n * - `OLLAMA_HOST` — replaces the default `http://localhost:11434` baseUrl\n *   (advanced users running Ollama on a remote machine).\n * - `OLLAMA_API_KEY` — replaces the placeholder when Ollama is behind a\n *   reverse-proxy with auth or when using Ollama Cloud (paid tier).\n */\nexport const OLLAMA: ProviderProfile = {\n  name: \"ollama\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OLLAMA_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:11434\",\n  modelsUrl: \"http://localhost:11434/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"llama3.2\", \"qwen2.5\", \"mistral\"],\n};\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const OPENAI: ProviderProfile = {\n  name: \"openai\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OPENAI_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://api.openai.com\",\n  modelsUrl: \"https://api.openai.com/v1/models\",\n  hostname: \"api.openai.com\",\n  fallbackModels: [\"gpt-4o\", \"gpt-4o-mini\"],\n};\n","import { homedir } from \"node:os\";\n\nimport type { CredentialStoreConfig, OAuthProviderConfig } from \"../../auth/auth-types.js\";\nimport { readStoredOAuth } from \"../../auth/credential-store.js\";\nimport { resolveCredential } from \"../../auth/resolve-credential.js\";\nimport type { ProviderProfile } from \"../types.js\";\n\n/**\n * M43 — the ChatGPT \"Codex\" backend as a first-class builtin `ProviderProfile`. Migrated from the\n * agent-builder M40 workaround; the SDK now owns the provider, so a consumer only selects\n * `openai-chatgpt/<model>` and logs in — ZERO provider logic in the consumer.\n *\n * The provider-auth model (see the codex-provider-in-sdk blueprint):\n * - static profile + a `transform.fetch` that resolves the LIVE credential per HTTP request (fresh Bearer +\n *   dynamic `ChatGPT-Account-Id`), so a mid-turn expiry refreshes transparently with NO agent rebuild;\n * - the protocol values (endpoint, models, oauth config, `originator` header) are SDK-owned constants.\n *\n * @internal\n */\n\n/**\n * The SDK-owned ambient credential store the transform reads. Defaults to `~/.theokit/auth.json`. A consumer\n * points it at its existing store dir via the DEDICATED `THEOKIT_AUTH_HOME` env var (NOT `THEOKIT_HOME` — that\n * is the SDK's whole home directory for personality/credential-pool/profiles; overloading it would redirect\n * the entire runtime). The SDK's ambient credential service.\n */\nconst DEFAULT_STORE: CredentialStoreConfig = {\n  home: homedir(),\n  dirName: \".theokit\",\n  fileName: \"auth.json\",\n  homeEnvVar: \"THEOKIT_AUTH_HOME\",\n};\n\n/**\n * The OpenAI OAuth config the transform resolves + refreshes against. `provider: \"openai\"` is the STORE\n * provider (what `/login` persists), deliberately distinct from this profile's routing name `openai-chatgpt`\n * — the two-namespace split separates the integration id from the routed provider. Endpoints/clientId/scopes\n * are OpenAI's published OAuth values.\n */\nconst OPENAI_OAUTH_CONFIG: OAuthProviderConfig = {\n  provider: \"openai\",\n  authorizeEndpoint: \"https://auth.openai.com/oauth/authorize\",\n  tokenEndpoint: \"https://auth.openai.com/oauth/token\",\n  clientId: \"app_EMoamEEZ73f0CkXaXp7hrann\",\n  scopes: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n  redirectUri: \"https://auth.openai.com/deviceauth/callback\",\n};\n\n/**\n * Build the per-request fetch: resolve a FRESH (refreshed) Bearer + the LIVE account-id from the ambient\n * store, and inject them as headers. Re-resolves on EVERY call → mid-turn refresh with no rebuild. A\n * `Headers` object is used so `authorization` is set case-insensitively (never doubled). If no credential is\n * logged in, throw a clear error rather than putting the router's `__oauth_lazy_token__` placeholder on the\n * wire (fail-closed — missing-credential semantics).\n */\nfunction codexFetch(): typeof fetch {\n  return (async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n    const env = process.env as Record<string, string | undefined>;\n    const resolved = await resolveCredential({\n      provider: \"openai\",\n      store: DEFAULT_STORE,\n      oauth: OPENAI_OAUTH_CONFIG,\n      env,\n    });\n    if (resolved === undefined) {\n      throw new Error(\n        'openai-chatgpt: no ChatGPT credential found — run the OpenAI device login (e.g. \"/login openai\") first.',\n      );\n    }\n    const accountId = readStoredOAuth(DEFAULT_STORE, env)?.account_id;\n    const headers = new Headers(init?.headers);\n    headers.set(\"authorization\", `Bearer ${resolved.apiKey}`);\n    if (accountId !== undefined) headers.set(\"ChatGPT-Account-Id\", accountId);\n    return fetch(input, { ...init, headers });\n  }) as typeof fetch;\n}\n\nexport const OPENAI_CHATGPT: ProviderProfile = {\n  name: \"openai-chatgpt\",\n  apiMode: \"responses_api\",\n  authType: \"oauth_device_code\",\n  baseUrl: \"https://chatgpt.com/backend-api/codex\",\n  envVars: [],\n  fallbackModels: [\n    \"openai-chatgpt/gpt-5.4\",\n    \"openai-chatgpt/gpt-5.4-mini\",\n    \"openai-chatgpt/gpt-5.5\",\n  ],\n  // #165 — this shipped as `codex_cli_rs`, another vendor's client identifier. Claiming to be a different\n  // vendor's client is a false statement of identity. Third-party clients send their OWN name against\n  // this same endpoint, which also shows the route is not restricted to the official client.\n  extraHeaders: { originator: \"theokit\" },\n  transform: {\n    // Only `fetch` (async) can await the credential refresh; `headers` is sync and cannot.\n    fetch: () => codexFetch(),\n  },\n};\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const OPENROUTER: ProviderProfile = {\n  name: \"openrouter\",\n  apiMode: \"chat_completions\",\n  aliases: [\"or\"],\n  // Ordered fallback (EC-10): OPENROUTER_API_KEY preferred, OPENAI_API_KEY as compat.\n  envVars: [\"OPENROUTER_API_KEY\", \"OPENAI_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://openrouter.ai/api\",\n  modelsUrl: \"https://openrouter.ai/api/v1/models\",\n  hostname: \"openrouter.ai\",\n  // M45 — models refreshed (claude-3-haiku retired upstream).\n  fallbackModels: [\"openai/gpt-4o-mini\", \"anthropic/claude-haiku-4-5\"],\n  // M45 — OpenRouter app-attribution headers. VALUES are\n  // theokit's own — copying another app's referer would misattribute traffic).\n  extraHeaders: { \"HTTP-Referer\": \"https://usetheo.dev\", \"X-Title\": \"theokit\" },\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Perplexity. Its endpoint is UNVERSIONED (`/chat/completions`) — the explicit `chatCompletionsPath`\n * escape expresses it (the sonar-online model family was retired; models per models.dev `perplexity`).\n */\nexport const PERPLEXITY = openAiCompatibleProfile({\n  name: \"perplexity\",\n  baseUrl: \"https://api.perplexity.ai\",\n  chatCompletionsPath: \"/chat/completions\",\n  envVars: [\"PERPLEXITY_API_KEY\"],\n  fallbackModels: [\"sonar-pro\", \"sonar\"],\n  hostname: \"api.perplexity.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Together AI (models.dev id `togetherai` — kept as an alias). Values per the 2026-07 snapshot. */\nexport const TOGETHER = openAiCompatibleProfile({\n  name: \"together\",\n  aliases: [\"togetherai\"],\n  baseUrl: \"https://api.together.xyz/v1\",\n  envVars: [\"TOGETHER_API_KEY\"],\n  fallbackModels: [\"Qwen/Qwen2.5-7B-Instruct-Turbo\"],\n  hostname: \"api.together.xyz\",\n});\n","/**\n * GCP Vertex AI profile (Adoption Roadmap #8; ADRs D286-D302).\n *\n * Required peer dep: `google-auth-library` (D288). Resolves access tokens\n * via ADC (env → gcloud → metadata server → WIF).\n *\n * Model IDs follow the convention `vertex/{dialect}/{model}`:\n *   - `vertex/google/gemini-2.0-flash-001` → OpenAI-compat endpoint (D291)\n *   - `vertex/anthropic/claude-sonnet-4-5@20250929` → :rawPredict (D292)\n *\n * @internal\n */\n\nimport type { ProviderProfile } from \"../types.js\";\n\nexport const VERTEX: ProviderProfile = {\n  name: \"vertex\",\n  apiMode: \"anthropic_messages\", // sub-dispatched in selectTransport by profile.name\n  envVars: [\"GOOGLE_APPLICATION_CREDENTIALS\"],\n  authType: \"gcp_oauth\",\n  baseUrl: \"https://us-central1-aiplatform.googleapis.com\",\n  modelsUrl: undefined,\n  hostname: \"aiplatform.googleapis.com\",\n  fallbackModels: [\n    \"vertex/anthropic/claude-sonnet-4-5@20250929\",\n    \"vertex/google/gemini-2.0-flash-001\",\n  ],\n};\n\n/**\n * D293 absorbed: when location === \"global\", use `aiplatform.googleapis.com`\n * (no `global-` prefix) — known bug `streamRawPredict` 404 at\n * `global-aiplatform.googleapis.com` (a peer#10287).\n */\nexport function resolveVertexBaseUrl(opts: {\n  projectId: string;\n  location: string;\n  modelDialect: \"anthropic\" | \"gemini\";\n}): string {\n  const host =\n    opts.location === \"global\"\n      ? \"aiplatform.googleapis.com\"\n      : `${opts.location}-aiplatform.googleapis.com`;\n  if (opts.modelDialect === \"gemini\") {\n    // OpenAI-compat endpoint (D291) — the client appends `/chat/completions`.\n    return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/endpoints/openapi`;\n  }\n  // Anthropic — base URL up to `/publishers/anthropic` (model id appended by client).\n  return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/publishers/anthropic`;\n}\n\n/** Detect dialect from a `vertex/{dialect}/{model}` id. Default: gemini. */\nexport function inferModelDialect(modelId: string): \"anthropic\" | \"gemini\" {\n  if (modelId.includes(\"/anthropic/\")) return \"anthropic\";\n  if (modelId.includes(\"/google/\")) return \"gemini\";\n  return \"gemini\";\n}\n\n/** Strip the `vertex/{dialect}/` prefix so the raw model id is used in the URL. */\nexport function stripVertexPrefix(modelId: string): string {\n  return modelId.replace(/^vertex\\/(anthropic|google)\\//, \"\");\n}\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — xAI (Grok). Values per models.dev `xai` (2026-07 snapshot; grok-2 retired). */\nexport const XAI = openAiCompatibleProfile({\n  name: \"xai\",\n  aliases: [\"grok\"],\n  baseUrl: \"https://api.x.ai/v1\",\n  envVars: [\"XAI_API_KEY\"],\n  fallbackModels: [\"grok-4.5\", \"grok-4.3\"],\n  hostname: \"api.x.ai\",\n});\n","/**\n * Eager registration of builtin providers (T3.3). Side-effect import:\n * importing this module registers the 4 builtins with the registry.\n *\n * Lazy user-plugin discovery is handled by `discovery.ts` (T3.4).\n *\n * @internal\n */\n\nimport { registerCatalogProviders } from \"../catalog-loader.js\";\nimport { registerProvider } from \"../registry.js\";\nimport { ANTHROPIC } from \"./anthropic.js\";\nimport { BEDROCK } from \"./bedrock.js\";\nimport { CEREBRAS } from \"./cerebras.js\";\nimport { COHERE } from \"./cohere.js\";\nimport { DEEPINFRA } from \"./deepinfra.js\";\nimport { GEMINI } from \"./gemini.js\";\nimport { GOOGLE } from \"./google.js\";\nimport { GROQ } from \"./groq.js\";\nimport { LLAMACPP } from \"./llamacpp.js\";\nimport { LMSTUDIO } from \"./lmstudio.js\";\nimport { MISTRAL } from \"./mistral.js\";\nimport { OLLAMA } from \"./ollama.js\";\nimport { OPENAI } from \"./openai.js\";\nimport { OPENAI_CHATGPT } from \"./openai-chatgpt.js\";\nimport { OPENROUTER } from \"./openrouter.js\";\nimport { PERPLEXITY } from \"./perplexity.js\";\nimport { TOGETHER } from \"./together.js\";\nimport { VERTEX } from \"./vertex.js\";\nimport { XAI } from \"./xai.js\";\n\n// M45 review M2 — the guard lives on globalThis like the registry itself (M44 B1): a process importing both\n// bundle copies (`@theokit/sdk` + `@theokit/sdk/models`) must not re-register 19 builtins with bogus\n// \"overridden by user plugin\" WARNs.\nconst _registeredState = ((): { done: boolean } => {\n  const g = globalThis as unknown as Record<symbol, { done: boolean }>;\n  const sym = Symbol.for(\"theokit-sdk.providers.builtins-registered\");\n  if (g[sym] === undefined) g[sym] = { done: false };\n  return g[sym];\n})();\n\nexport function registerBuiltins(): void {\n  if (_registeredState.done) return;\n  _registeredState.done = true;\n  // First-party builtins (take priority — registered first)\n  registerProvider(ANTHROPIC);\n  registerProvider(OPENAI);\n  registerProvider(OPENAI_CHATGPT);\n  registerProvider(OPENROUTER);\n  registerProvider(GEMINI);\n  registerProvider(OLLAMA);\n  registerProvider(LMSTUDIO);\n  registerProvider(LLAMACPP);\n  registerProvider(BEDROCK);\n  registerProvider(VERTEX);\n  // M45 — the data-provider fleet (one file each on the openai-compatible base).\n  registerProvider(GOOGLE);\n  registerProvider(MISTRAL);\n  registerProvider(GROQ);\n  registerProvider(COHERE);\n  registerProvider(DEEPINFRA);\n  registerProvider(TOGETHER);\n  registerProvider(XAI);\n  registerProvider(PERPLEXITY);\n  registerProvider(CEREBRAS);\n  // Dynamic catalog — 40+ providers from JSON (T10.1, ADR D447)\n  registerCatalogProviders();\n}\n\n/** Test-only reset. @internal */\nexport function _resetBuiltinsRegistered(): void {\n  _registeredState.done = false;\n}\n\nexport {\n  ANTHROPIC,\n  BEDROCK,\n  GEMINI,\n  LLAMACPP,\n  LMSTUDIO,\n  OLLAMA,\n  OPENAI,\n  OPENAI_CHATGPT,\n  OPENROUTER,\n  VERTEX,\n};\n"]}

package/dist/{chunk-PVBANCWU.cjs → chunk-VW6M4B3Z.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk2YGIBOUH_cjs = require('./chunk-2YGIBOUH.cjs');
+var chunkLPVIRJVF_cjs = require('./chunk-LPVIRJVF.cjs');
 
 // src/internal/runtime/retry/with-retry.ts
 function defaultSleep(ms, signal) {
@@ -23,14 +23,14 @@ function defaultSleep(ms, signal) {
 function resolveRetryOptions(options) {
   const retries = options?.retries ?? 3;
   if (!Number.isInteger(retries) || retries < 0) {
-    throw new chunk2YGIBOUH_cjs.ConfigurationError(
+    throw new chunkLPVIRJVF_cjs.ConfigurationError(
       `withRetry: retries must be a non-negative integer, got ${retries}`,
       { code: "invalid_retry_config" }
     );
   }
   return {
     retries,
-    isRetryable: options?.isRetryable ?? chunk2YGIBOUH_cjs.isTransientError,
+    isRetryable: options?.isRetryable ?? chunkLPVIRJVF_cjs.isTransientError,
     initialDelayMs: options?.initialDelayMs ?? 100,
     maxDelayMs: options?.maxDelayMs ?? 3e4,
     backoffMultiplier: options?.backoffMultiplier ?? 2,
@@ -67,5 +67,5 @@ var Retry = class {
 };
 
 exports.Retry = Retry;
-//# sourceMappingURL=chunk-PVBANCWU.cjs.map
-//# sourceMappingURL=chunk-PVBANCWU.cjs.map
+//# sourceMappingURL=chunk-VW6M4B3Z.cjs.map
+//# sourceMappingURL=chunk-VW6M4B3Z.cjs.map

package/dist/{chunk-PVBANCWU.cjs.map → chunk-VW6M4B3Z.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/runtime/retry/with-retry.ts","../src/retry.ts"],"names":["ConfigurationError","isTransientError"],"mappings":";;;;;AAkCA,SAAS,YAAA,CAAa,IAAY,MAAA,EAAqC;AACrE,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,MAAA,CAAO,MAAA,CAAO,kBAAkB,KAAA,GAAQ,MAAA,CAAO,SAAS,IAAI,KAAA,CAAM,oBAAoB,CAAC,CAAA;AACvF,MAAA;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,SAAS,OAAA,GAAgB;AACvB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,MAAA,EAAQ,kBAAkB,KAAA,GAAQ,MAAA,CAAO,SAAS,IAAI,KAAA,CAAM,oBAAoB,CAAC,CAAA;AAAA,IAC1F;AACA,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC,CAAA;AACH;AAaA,SAAS,oBAAoB,OAAA,EAAuC;AAClE,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,CAAA;AACpC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,UAAU,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,0DAA0D,OAAO,CAAA,CAAA;AAAA,MACjE,EAAE,MAAM,sBAAA;AAAuB,KACjC;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,WAAA,EAAa,SAAS,WAAA,IAAeC,kCAAA;AAAA,IACrC,cAAA,EAAgB,SAAS,cAAA,IAAkB,GAAA;AAAA,IAC3C,UAAA,EAAY,SAAS,UAAA,IAAc,GAAA;AAAA,IACnC,iBAAA,EAAmB,SAAS,iBAAA,IAAqB,CAAA;AAAA,IACjD,GAAA,EAAK,OAAA,EAAS,GAAA,IAAO,IAAA,CAAK,MAAA;AAAA,IAC1B,KAAA,EAAO,SAAS,KAAA,IAAS,YAAA;AAAA,IACzB,QAAQ,OAAA,EAAS;AAAA,GACnB;AACF;AAGA,SAAS,SAAA,CAAU,KAAoB,OAAA,EAAyB;AAC9D,EAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,GAAA,CAAI,YAAY,GAAA,CAAI,cAAA,GAAiB,GAAA,CAAI,iBAAA,IAAqB,OAAO,CAAA;AAC9F,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,KAAQ,OAAO,CAAA;AACvC;AAWA,eAAsB,SAAA,CAAa,IAAsB,OAAA,EAAoC;AAC3F,EAAA,MAAM,GAAA,GAAM,oBAAoB,OAAO,CAAA;AACvC,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,WAAS;AACP,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,EAAA,EAAG;AAAA,IAClB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,OAAA,IAAW,IAAI,OAAA,IAAW,CAAC,IAAI,WAAA,CAAY,GAAG,GAAG,MAAM,GAAA;AAC3D,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,KAAK,OAAO,CAAA,EAAG,IAAI,MAAM,CAAA;AACnD,MAAA,OAAA,IAAW,CAAA;AAAA,IACb;AAAA,EACF;AACF;;;AC3FO,IAAM,QAAN,MAAY;AAAA,EACT,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,MAAA,CAAU,EAAA,EAAsB,OAAA,EAAoC;AACzE,IAAA,OAAO,SAAA,CAAU,IAAI,OAAO,CAAA;AAAA,EAC9B;AACF","file":"chunk-PVBANCWU.cjs","sourcesContent":["/**\n * Generic retry wrapper (plan m0-foundation-expose-primitives, M0-3).\n *\n * Exponential backoff with full jitter, deterministically testable via an\n * injectable `sleep` and `rng` (no real timers in unit tests, per the repo\n * testing rule). The default `isRetryable` predicate is {@link isTransientError}\n * so SDK errors retry exactly as the SDK classifies them. The workflow-internal\n * `withRetry` (RetryPolicy-coupled) is intentionally separate (ADR-M0-3).\n *\n * @internal — public via `@theokit/sdk/retry`\n */\n\nimport { ConfigurationError, isTransientError } from \"../../../errors.js\";\n\n/** Options for {@link withRetry}. All fields optional; sensible defaults applied. */\nexport interface RetryOptions {\n  /** Number of retries after the first attempt (total attempts = retries + 1). Default 3. */\n  retries?: number;\n  /** Predicate deciding whether a thrown error is worth retrying. Default {@link isTransientError}. */\n  isRetryable?: (err: unknown) => boolean;\n  /** Base backoff in ms for the first retry. Default 100. */\n  initialDelayMs?: number;\n  /** Upper bound for a single backoff sleep. Default 30_000. */\n  maxDelayMs?: number;\n  /** Exponential multiplier applied per retry. Default 2. */\n  backoffMultiplier?: number;\n  /** [0, 1) source for full-jitter. Default `Math.random`. Inject for deterministic tests. */\n  rng?: () => number;\n  /** Sleep function. Default a `setTimeout`-based abortable sleep. Inject for deterministic tests. */\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;\n  /** Abort signal; once aborted, the abortable default sleep rejects and the loop stops. */\n  signal?: AbortSignal;\n}\n\nfunction defaultSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(signal.reason instanceof Error ? signal.reason : new Error(\"withRetry: aborted\"));\n      return;\n    }\n    const timer = setTimeout(() => {\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, ms);\n    function onAbort(): void {\n      clearTimeout(timer);\n      reject(signal?.reason instanceof Error ? signal.reason : new Error(\"withRetry: aborted\"));\n    }\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n\ninterface ResolvedRetry {\n  retries: number;\n  isRetryable: (err: unknown) => boolean;\n  initialDelayMs: number;\n  maxDelayMs: number;\n  backoffMultiplier: number;\n  rng: () => number;\n  sleep: (ms: number, signal?: AbortSignal) => Promise<void>;\n  signal?: AbortSignal;\n}\n\nfunction resolveRetryOptions(options?: RetryOptions): ResolvedRetry {\n  const retries = options?.retries ?? 3;\n  if (!Number.isInteger(retries) || retries < 0) {\n    throw new ConfigurationError(\n      `withRetry: retries must be a non-negative integer, got ${retries}`,\n      { code: \"invalid_retry_config\" },\n    );\n  }\n  return {\n    retries,\n    isRetryable: options?.isRetryable ?? isTransientError,\n    initialDelayMs: options?.initialDelayMs ?? 100,\n    maxDelayMs: options?.maxDelayMs ?? 30_000,\n    backoffMultiplier: options?.backoffMultiplier ?? 2,\n    rng: options?.rng ?? Math.random,\n    sleep: options?.sleep ?? defaultSleep,\n    signal: options?.signal,\n  };\n}\n\n/** Full-jitter backoff for the given (0-indexed) retry attempt. */\nfunction backoffMs(cfg: ResolvedRetry, attempt: number): number {\n  const ceiling = Math.min(cfg.maxDelayMs, cfg.initialDelayMs * cfg.backoffMultiplier ** attempt);\n  return Math.floor(cfg.rng() * ceiling);\n}\n\n/**\n * Run `fn`, retrying transient failures with exponential backoff + full jitter.\n *\n * @returns the resolved value of the first successful `fn()` call\n * @throws the last error when retries are exhausted or the error is not retryable\n *\n * @example\n *   const data = await withRetry(() => fetchJson(url)); // retries rate-limit/network\n */\nexport async function withRetry<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T> {\n  const cfg = resolveRetryOptions(options);\n  let attempt = 0;\n  for (;;) {\n    try {\n      return await fn();\n    } catch (err) {\n      if (attempt >= cfg.retries || !cfg.isRetryable(err)) throw err;\n      await cfg.sleep(backoffMs(cfg, attempt), cfg.signal);\n      attempt += 1;\n    }\n  }\n}\n","/**\n * Public generic retry primitive (plan m0-foundation-expose-primitives, M0-3).\n *\n * Split into its own top-level module so `tsup` builds a dedicated\n * `@theokit/sdk/retry` sub-path entry, mirroring the `path-safety` pattern.\n * The default retry predicate is `isTransientError`, so retries follow the\n * SDK's own error classification.\n */\n\nimport { type RetryOptions, withRetry } from \"./internal/runtime/retry/with-retry.js\";\n\nexport type { RetryOptions };\n\n/**\n * SE36 — `Retry.create` replaces `withRetry` (ADR 0015 / ADR-P2). NOTE: `withRetry` is an\n * EXECUTOR, not a constructor — `Retry.create(fn, opts)` RUNS `fn` with retry and resolves to\n * its result (`Promise<T>`), not a `Retry` instance. The `.create` name is the uniformity\n * mandate; the executor semantics are the documented, accepted awkwardness. @public\n */\nexport class Retry {\n  private constructor() {}\n  static create<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T> {\n    return withRetry(fn, options);\n  }\n}\n"]}
+{"version":3,"sources":["../src/internal/runtime/retry/with-retry.ts","../src/retry.ts"],"names":["ConfigurationError","isTransientError"],"mappings":";;;;;AAkCA,SAAS,YAAA,CAAa,IAAY,MAAA,EAAqC;AACrE,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,IAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,MAAA,MAAA,CAAO,MAAA,CAAO,kBAAkB,KAAA,GAAQ,MAAA,CAAO,SAAS,IAAI,KAAA,CAAM,oBAAoB,CAAC,CAAA;AACvF,MAAA;AAAA,IACF;AACA,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAC5C,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,SAAS,OAAA,GAAgB;AACvB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,MAAA,CAAO,MAAA,EAAQ,kBAAkB,KAAA,GAAQ,MAAA,CAAO,SAAS,IAAI,KAAA,CAAM,oBAAoB,CAAC,CAAA;AAAA,IAC1F;AACA,IAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC3D,CAAC,CAAA;AACH;AAaA,SAAS,oBAAoB,OAAA,EAAuC;AAClE,EAAA,MAAM,OAAA,GAAU,SAAS,OAAA,IAAW,CAAA;AACpC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,OAAO,CAAA,IAAK,UAAU,CAAA,EAAG;AAC7C,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,0DAA0D,OAAO,CAAA,CAAA;AAAA,MACjE,EAAE,MAAM,sBAAA;AAAuB,KACjC;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,WAAA,EAAa,SAAS,WAAA,IAAeC,kCAAA;AAAA,IACrC,cAAA,EAAgB,SAAS,cAAA,IAAkB,GAAA;AAAA,IAC3C,UAAA,EAAY,SAAS,UAAA,IAAc,GAAA;AAAA,IACnC,iBAAA,EAAmB,SAAS,iBAAA,IAAqB,CAAA;AAAA,IACjD,GAAA,EAAK,OAAA,EAAS,GAAA,IAAO,IAAA,CAAK,MAAA;AAAA,IAC1B,KAAA,EAAO,SAAS,KAAA,IAAS,YAAA;AAAA,IACzB,QAAQ,OAAA,EAAS;AAAA,GACnB;AACF;AAGA,SAAS,SAAA,CAAU,KAAoB,OAAA,EAAyB;AAC9D,EAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,GAAA,CAAI,YAAY,GAAA,CAAI,cAAA,GAAiB,GAAA,CAAI,iBAAA,IAAqB,OAAO,CAAA;AAC9F,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,KAAQ,OAAO,CAAA;AACvC;AAWA,eAAsB,SAAA,CAAa,IAAsB,OAAA,EAAoC;AAC3F,EAAA,MAAM,GAAA,GAAM,oBAAoB,OAAO,CAAA;AACvC,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,WAAS;AACP,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,EAAA,EAAG;AAAA,IAClB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,OAAA,IAAW,IAAI,OAAA,IAAW,CAAC,IAAI,WAAA,CAAY,GAAG,GAAG,MAAM,GAAA;AAC3D,MAAA,MAAM,IAAI,KAAA,CAAM,SAAA,CAAU,KAAK,OAAO,CAAA,EAAG,IAAI,MAAM,CAAA;AACnD,MAAA,OAAA,IAAW,CAAA;AAAA,IACb;AAAA,EACF;AACF;;;AC3FO,IAAM,QAAN,MAAY;AAAA,EACT,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,MAAA,CAAU,EAAA,EAAsB,OAAA,EAAoC;AACzE,IAAA,OAAO,SAAA,CAAU,IAAI,OAAO,CAAA;AAAA,EAC9B;AACF","file":"chunk-VW6M4B3Z.cjs","sourcesContent":["/**\n * Generic retry wrapper (plan m0-foundation-expose-primitives, M0-3).\n *\n * Exponential backoff with full jitter, deterministically testable via an\n * injectable `sleep` and `rng` (no real timers in unit tests, per the repo\n * testing rule). The default `isRetryable` predicate is {@link isTransientError}\n * so SDK errors retry exactly as the SDK classifies them. The workflow-internal\n * `withRetry` (RetryPolicy-coupled) is intentionally separate (ADR-M0-3).\n *\n * @internal — public via `@theokit/sdk/retry`\n */\n\nimport { ConfigurationError, isTransientError } from \"../../../errors.js\";\n\n/** Options for {@link withRetry}. All fields optional; sensible defaults applied. */\nexport interface RetryOptions {\n  /** Number of retries after the first attempt (total attempts = retries + 1). Default 3. */\n  retries?: number;\n  /** Predicate deciding whether a thrown error is worth retrying. Default {@link isTransientError}. */\n  isRetryable?: (err: unknown) => boolean;\n  /** Base backoff in ms for the first retry. Default 100. */\n  initialDelayMs?: number;\n  /** Upper bound for a single backoff sleep. Default 30_000. */\n  maxDelayMs?: number;\n  /** Exponential multiplier applied per retry. Default 2. */\n  backoffMultiplier?: number;\n  /** [0, 1) source for full-jitter. Default `Math.random`. Inject for deterministic tests. */\n  rng?: () => number;\n  /** Sleep function. Default a `setTimeout`-based abortable sleep. Inject for deterministic tests. */\n  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;\n  /** Abort signal; once aborted, the abortable default sleep rejects and the loop stops. */\n  signal?: AbortSignal;\n}\n\nfunction defaultSleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(signal.reason instanceof Error ? signal.reason : new Error(\"withRetry: aborted\"));\n      return;\n    }\n    const timer = setTimeout(() => {\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve();\n    }, ms);\n    function onAbort(): void {\n      clearTimeout(timer);\n      reject(signal?.reason instanceof Error ? signal.reason : new Error(\"withRetry: aborted\"));\n    }\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n\ninterface ResolvedRetry {\n  retries: number;\n  isRetryable: (err: unknown) => boolean;\n  initialDelayMs: number;\n  maxDelayMs: number;\n  backoffMultiplier: number;\n  rng: () => number;\n  sleep: (ms: number, signal?: AbortSignal) => Promise<void>;\n  signal?: AbortSignal;\n}\n\nfunction resolveRetryOptions(options?: RetryOptions): ResolvedRetry {\n  const retries = options?.retries ?? 3;\n  if (!Number.isInteger(retries) || retries < 0) {\n    throw new ConfigurationError(\n      `withRetry: retries must be a non-negative integer, got ${retries}`,\n      { code: \"invalid_retry_config\" },\n    );\n  }\n  return {\n    retries,\n    isRetryable: options?.isRetryable ?? isTransientError,\n    initialDelayMs: options?.initialDelayMs ?? 100,\n    maxDelayMs: options?.maxDelayMs ?? 30_000,\n    backoffMultiplier: options?.backoffMultiplier ?? 2,\n    rng: options?.rng ?? Math.random,\n    sleep: options?.sleep ?? defaultSleep,\n    signal: options?.signal,\n  };\n}\n\n/** Full-jitter backoff for the given (0-indexed) retry attempt. */\nfunction backoffMs(cfg: ResolvedRetry, attempt: number): number {\n  const ceiling = Math.min(cfg.maxDelayMs, cfg.initialDelayMs * cfg.backoffMultiplier ** attempt);\n  return Math.floor(cfg.rng() * ceiling);\n}\n\n/**\n * Run `fn`, retrying transient failures with exponential backoff + full jitter.\n *\n * @returns the resolved value of the first successful `fn()` call\n * @throws the last error when retries are exhausted or the error is not retryable\n *\n * @example\n *   const data = await withRetry(() => fetchJson(url)); // retries rate-limit/network\n */\nexport async function withRetry<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T> {\n  const cfg = resolveRetryOptions(options);\n  let attempt = 0;\n  for (;;) {\n    try {\n      return await fn();\n    } catch (err) {\n      if (attempt >= cfg.retries || !cfg.isRetryable(err)) throw err;\n      await cfg.sleep(backoffMs(cfg, attempt), cfg.signal);\n      attempt += 1;\n    }\n  }\n}\n","/**\n * Public generic retry primitive (plan m0-foundation-expose-primitives, M0-3).\n *\n * Split into its own top-level module so `tsup` builds a dedicated\n * `@theokit/sdk/retry` sub-path entry, mirroring the `path-safety` pattern.\n * The default retry predicate is `isTransientError`, so retries follow the\n * SDK's own error classification.\n */\n\nimport { type RetryOptions, withRetry } from \"./internal/runtime/retry/with-retry.js\";\n\nexport type { RetryOptions };\n\n/**\n * SE36 — `Retry.create` replaces `withRetry` (ADR 0015 / ADR-P2). NOTE: `withRetry` is an\n * EXECUTOR, not a constructor — `Retry.create(fn, opts)` RUNS `fn` with retry and resolves to\n * its result (`Promise<T>`), not a `Retry` instance. The `.create` name is the uniformity\n * mandate; the executor semantics are the documented, accepted awkwardness. @public\n */\nexport class Retry {\n  private constructor() {}\n  static create<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T> {\n    return withRetry(fn, options);\n  }\n}\n"]}

package/dist/{chunk-KNZU4YO5.cjs → chunk-WQ53UQL4.cjs}

@@ -1,11 +1,11 @@
 'use strict';
 
-var chunkNFATC6ZF_cjs = require('./chunk-NFATC6ZF.cjs');
+var chunkC5DEO6OI_cjs = require('./chunk-C5DEO6OI.cjs');
 
 // src/internal/runtime/concurrency/map-with-concurrency.ts
 var NEVER_ABORT = new AbortController().signal;
 async function mapWithConcurrency(items, concurrency, fn, options) {
-  const semaphore = chunkNFATC6ZF_cjs.createSemaphore(concurrency);
+  const semaphore = chunkC5DEO6OI_cjs.createSemaphore(concurrency);
   const signal = options?.signal ?? NEVER_ABORT;
   return Promise.all(
     items.map(async (item, index) => {
@@ -23,5 +23,5 @@ async function mapWithConcurrency(items, concurrency, fn, options) {
 }
 
 exports.mapWithConcurrency = mapWithConcurrency;
-//# sourceMappingURL=chunk-KNZU4YO5.cjs.map
-//# sourceMappingURL=chunk-KNZU4YO5.cjs.map
+//# sourceMappingURL=chunk-WQ53UQL4.cjs.map
+//# sourceMappingURL=chunk-WQ53UQL4.cjs.map

package/dist/{chunk-KNZU4YO5.cjs.map → chunk-WQ53UQL4.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/runtime/concurrency/map-with-concurrency.ts"],"names":["createSemaphore"],"mappings":";;;;;AAcA,IAAM,WAAA,GAA2B,IAAI,eAAA,EAAgB,CAAE,MAAA;AAgBvD,eAAsB,kBAAA,CACpB,KAAA,EACA,WAAA,EACA,EAAA,EACA,OAAA,EACc;AACd,EAAA,MAAM,SAAA,GAAYA,kCAAgB,WAAW,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,WAAA;AAClC,EAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,IACb,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,EAAM,KAAA,KAAU;AAC/B,MAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,OAAA,EAAQ;AACxC,MAAA,IAAI;AACF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,MAAM,OAAO,MAAA,YAAkB,KAAA,GAC3B,OAAO,MAAA,GACP,IAAI,MAAM,6BAA6B,CAAA;AAAA,QAC7C;AACA,QAAA,OAAO,MAAM,EAAA,CAAG,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACrC,CAAA,SAAE;AACA,QAAA,OAAA,EAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"chunk-KNZU4YO5.cjs","sourcesContent":["/**\n * Ordered, bounded-concurrency parallel map (plan m0-foundation-expose-primitives, M0-2).\n *\n * Runs `fn` over `items` with at most `concurrency` invocations in flight at\n * once, preserving input order in the result array. Fail-fast: rejects with the\n * first error a task throws (matching the in-house `boundedParallel`/`runBatches`\n * clones this consolidates). Backed by the in-house {@link createSemaphore}\n * (ADR D135 — no `p-limit`/`p-map` dependency).\n *\n * @internal — public via `@theokit/sdk/concurrency`\n */\n\nimport { createSemaphore } from \"./async-semaphore.js\";\n\nconst NEVER_ABORT: AbortSignal = new AbortController().signal;\n\n/**\n * Map `fn` over `items` with bounded concurrency, preserving order.\n *\n * @param items - inputs to process\n * @param concurrency - max in-flight invocations (positive integer; validated)\n * @param fn - async mapper; receives the item, its index, and an abort signal\n * @param options.signal - optional abort signal; once aborted, no new `fn`\n *   invocation is started (in-flight ones are not force-cancelled)\n * @returns results in the same order as `items`\n * @throws ConfigurationError when `concurrency` is not a positive integer\n *\n * @example\n *   await mapWithConcurrency([1, 2, 3], 2, async (n) => n * 2); // [2, 4, 6]\n */\nexport async function mapWithConcurrency<T, R>(\n  items: ReadonlyArray<T>,\n  concurrency: number,\n  fn: (item: T, index: number, signal: AbortSignal) => Promise<R>,\n  options?: { signal?: AbortSignal },\n): Promise<R[]> {\n  const semaphore = createSemaphore(concurrency);\n  const signal = options?.signal ?? NEVER_ABORT;\n  return Promise.all(\n    items.map(async (item, index) => {\n      const release = await semaphore.acquire();\n      try {\n        if (signal.aborted) {\n          throw signal.reason instanceof Error\n            ? signal.reason\n            : new Error(\"mapWithConcurrency: aborted\");\n        }\n        return await fn(item, index, signal);\n      } finally {\n        release();\n      }\n    }),\n  );\n}\n"]}
+{"version":3,"sources":["../src/internal/runtime/concurrency/map-with-concurrency.ts"],"names":["createSemaphore"],"mappings":";;;;;AAcA,IAAM,WAAA,GAA2B,IAAI,eAAA,EAAgB,CAAE,MAAA;AAgBvD,eAAsB,kBAAA,CACpB,KAAA,EACA,WAAA,EACA,EAAA,EACA,OAAA,EACc;AACd,EAAA,MAAM,SAAA,GAAYA,kCAAgB,WAAW,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,WAAA;AAClC,EAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,IACb,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,EAAM,KAAA,KAAU;AAC/B,MAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,OAAA,EAAQ;AACxC,MAAA,IAAI;AACF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,MAAM,OAAO,MAAA,YAAkB,KAAA,GAC3B,OAAO,MAAA,GACP,IAAI,MAAM,6BAA6B,CAAA;AAAA,QAC7C;AACA,QAAA,OAAO,MAAM,EAAA,CAAG,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACrC,CAAA,SAAE;AACA,QAAA,OAAA,EAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"chunk-WQ53UQL4.cjs","sourcesContent":["/**\n * Ordered, bounded-concurrency parallel map (plan m0-foundation-expose-primitives, M0-2).\n *\n * Runs `fn` over `items` with at most `concurrency` invocations in flight at\n * once, preserving input order in the result array. Fail-fast: rejects with the\n * first error a task throws (matching the in-house `boundedParallel`/`runBatches`\n * clones this consolidates). Backed by the in-house {@link createSemaphore}\n * (ADR D135 — no `p-limit`/`p-map` dependency).\n *\n * @internal — public via `@theokit/sdk/concurrency`\n */\n\nimport { createSemaphore } from \"./async-semaphore.js\";\n\nconst NEVER_ABORT: AbortSignal = new AbortController().signal;\n\n/**\n * Map `fn` over `items` with bounded concurrency, preserving order.\n *\n * @param items - inputs to process\n * @param concurrency - max in-flight invocations (positive integer; validated)\n * @param fn - async mapper; receives the item, its index, and an abort signal\n * @param options.signal - optional abort signal; once aborted, no new `fn`\n *   invocation is started (in-flight ones are not force-cancelled)\n * @returns results in the same order as `items`\n * @throws ConfigurationError when `concurrency` is not a positive integer\n *\n * @example\n *   await mapWithConcurrency([1, 2, 3], 2, async (n) => n * 2); // [2, 4, 6]\n */\nexport async function mapWithConcurrency<T, R>(\n  items: ReadonlyArray<T>,\n  concurrency: number,\n  fn: (item: T, index: number, signal: AbortSignal) => Promise<R>,\n  options?: { signal?: AbortSignal },\n): Promise<R[]> {\n  const semaphore = createSemaphore(concurrency);\n  const signal = options?.signal ?? NEVER_ABORT;\n  return Promise.all(\n    items.map(async (item, index) => {\n      const release = await semaphore.acquire();\n      try {\n        if (signal.aborted) {\n          throw signal.reason instanceof Error\n            ? signal.reason\n            : new Error(\"mapWithConcurrency: aborted\");\n        }\n        return await fn(item, index, signal);\n      } finally {\n        release();\n      }\n    }),\n  );\n}\n"]}