@theokit/sdk 4.53.0 → 4.54.0

package/dist/chunk-2YGIBOUH.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/retry/default-retriable.ts","../src/errors.ts"],"names":["redactSecrets"],"mappings":";;;;;AAUO,SAAS,wBAAwB,IAAA,EAAuB;AAC7D,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,YAAA;AAAA,IACL,KAAK,SAAA;AAAA,IACL,KAAK,cAAA;AAAA,IACL,KAAK,SAAA;AAAA,IACL,KAAK,sBAAA;AACH,MAAA,OAAO,IAAA;AAAA,IACT;AACE,MAAA,OAAO,KAAA;AAAA;AAEb;;;ACsDA,IAAM,2BAAA,uBAAkC,GAAA,CAAY;AAAA,EAClD,YAAA;AAAA,EACA,aAAA;AAAA,EACA,iBAAA;AAAA,EACA,SAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,gBAAA;AAAA,EACA,oBAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAUM,SAAS,+BAA+B,IAAA,EAAkD;AAC/F,EAAA,IAAI,IAAA,KAAS,MAAA,IAAa,2BAAA,CAA4B,GAAA,CAAI,IAAI,CAAA,EAAG;AAC/D,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA;AACT;AAmCO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAe,mBAAA;AAAA,EACxB,WAAA;AAAA,EACA,IAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA;AAAA,EAET,WAAA,CACE,OAAA,EACA,OAAA,GAMI,EAAC,EACL;AACA,IAAA,KAAA,CAAM,OAAA,EAAS,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,MAAS,CAAA;AACjF,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,KAAA;AAC1C,IAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,MAAA,EAAW,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpD,IAAA,IAAI,OAAA,CAAQ,cAAA,KAAmB,MAAA,EAAW,IAAA,CAAK,iBAAiB,OAAA,CAAQ,cAAA;AACxE,IAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AAAA,EAC9D;AACF;AAOO,IAAM,mBAAA,GAAN,cAAkC,iBAAA,CAAkB;AAAA,EACvC,IAAA,GAAe,qBAAA;AAAA,EAEjC,WAAA,CACE,OAAA,EACA,OAAA,GAAwE,EAAC,EACzE;AACA,IAAA,KAAA,CAAM,SAAS,EAAE,GAAG,OAAA,EAAS,WAAA,EAAa,OAAO,CAAA;AAAA,EACnD;AACF;AAOO,IAAM,cAAA,GAAN,cAA6B,iBAAA,CAAkB;AAAA,EAClC,IAAA,GAAe,gBAAA;AAAA,EAEjC,WAAA,CACE,OAAA,EACA,OAAA,GAAwE,EAAC,EACzE;AACA,IAAA,KAAA,CAAM,SAAS,EAAE,GAAG,OAAA,EAAS,WAAA,EAAa,MAAM,CAAA;AAAA,EAClD;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EACtC,IAAA,GAAe,oBAAA;AAAA,EAEjC,WAAA,CACE,OAAA,EACA,OAAA,GAAwE,EAAC,EACzE;AACA,IAAA,KAAA,CAAM,SAAS,EAAE,GAAG,OAAA,EAAS,WAAA,EAAa,OAAO,CAAA;AAAA,EACnD;AACF;AAQO,IAAM,4BAAA,GAAN,cAA2C,kBAAA,CAAmB;AAAA,EACjD,IAAA,GAAe,8BAAA;AAAA,EACxB,QAAA;AAAA,EACA,OAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EAOA;AACA,IAAA,KAAA,CAAM,SAAS,OAAO,CAAA;AACtB,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AAAA,EACzB;AACF;AAOO,IAAM,YAAA,GAAN,cAA2B,iBAAA,CAAkB;AAAA,EAChC,IAAA,GAAe,cAAA;AAAA,EAEjC,WAAA,CACE,OAAA,EACA,OAAA,GAAwE,EAAC,EACzE;AACA,IAAA,KAAA,CAAM,SAAS,EAAE,GAAG,OAAA,EAAS,WAAA,EAAa,MAAM,CAAA;AAAA,EAClD;AACF;AAOO,IAAM,iBAAA,GAAN,cAAgC,iBAAA,CAAkB;AAAA,EACrC,IAAA,GAAe,mBAAA;AAAA,EAEjC,WAAA,CACE,OAAA,EACA,OAAA,GAAwE,EAAC,EACzE;AACA,IAAA,KAAA,CAAM,SAAS,EAAE,GAAG,OAAA,EAAS,WAAA,EAAa,OAAO,CAAA;AAAA,EACnD;AACF;AAsBO,IAAM,aAAA,GAAN,cAA4B,iBAAA,CAAkB;AAAA,EACjC,IAAA,GAAe,eAAA;AAAA,EACxB,QAAA;AAAA,EACA,GAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,cAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EAUA;AACA,IAAA,KAAA,CAAM,OAAA,EAAS;AAAA,MACb,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,UAAU,OAAA,CAAQ,QAAA;AAAA;AAAA;AAAA;AAAA,MAIlB,WAAA,EAAa,OAAA,CAAQ,SAAA,IAAa,uBAAA,CAAwB,QAAQ,IAAI;AAAA,KACvE,CAAA;AACD,IAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AAC5D,IAAA,IAAI,OAAA,CAAQ,GAAA,KAAQ,MAAA,EAAW,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AAClD,IAAA,IAAI,OAAA,CAAQ,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,cAAA,KAAmB,MAAA,EAAW,IAAA,CAAK,iBAAiB,OAAA,CAAQ,cAAA;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,IAAI,YAAA,GAAmC;AACrC,IAAA,IAAI,IAAA,CAAK,QAAA,EAAU,UAAA,KAAe,MAAA,EAAW,OAAO,MAAA;AACpD,IAAA,OAAO,IAAA,CAAK,SAAS,UAAA,GAAa,GAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,aAAA,GAAyB;AAC3B,IAAA,MAAM,GAAA,GAAM,KAAK,QAAA,EAAU,GAAA;AAC3B,IAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAC9B,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAOA,gCAAc,GAAG,CAAA;AAErD,IAAA,IAAI;AACF,MAAA,OAAOA,+BAAA,CAAc,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAOA,+BAAA,CAAc,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAA,GAAkC;AAChC,IAAA,MAAM,IAAA,GAAgC;AAAA,MACpC,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,aAAa,IAAA,CAAK;AAAA,KACpB;AACA,IAAA,iBAAA,CAAkB,MAAM,IAAI,CAAA;AAC5B,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA;AAC/C,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,QAAA,GAAW,QAAA;AAC5C,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,iBAAA,CAAkB,MAA+B,GAAA,EAA0B;AAClF,EAAA,IAAI,GAAA,CAAI,IAAA,KAAS,MAAA,EAAW,IAAA,CAAK,OAAO,GAAA,CAAI,IAAA;AAC5C,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,WAAW,GAAA,CAAI,QAAA;AACpD,EAAA,IAAI,GAAA,CAAI,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,YAAY,GAAA,CAAI,SAAA;AACtD,EAAA,IAAI,GAAA,CAAI,cAAA,KAAmB,MAAA,EAAW,IAAA,CAAK,iBAAiB,GAAA,CAAI,cAAA;AAChE,EAAA,IAAI,IAAI,GAAA,KAAQ,MAAA,OAAgB,GAAA,GAAMA,+BAAA,CAAc,IAAI,GAAG,CAAA;AAC7D;AAEA,SAAS,iBAAiB,IAAA,EAA4D;AACpF,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,MAAA;AAC/B,EAAA,MAAM,EAAE,GAAA,EAAK,GAAG,IAAA,EAAK,GAAI,IAAA;AACzB,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,wBAAA,KAA6B,GAAA;AAC1D,EAAA,IAAI,QAAA,IAAY,QAAQ,MAAA,EAAW;AACjC,IAAA,MAAM,WAAA,GACJ,OAAO,GAAA,KAAQ,QAAA,GAAWA,+BAAA,CAAc,GAAG,CAAA,GAAIA,+BAAA,CAAc,aAAA,CAAc,GAAG,CAAC,CAAA;AACjF,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,GAAA,EAAK,WAAA,EAAY;AAAA,EACrC;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,cAAc,KAAA,EAAwB;AAC7C,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACF;AAuBO,SAAS,iBAAiB,GAAA,EAAuB;AACtD,EAAA,OAAO,GAAA,YAAe,iBAAA,IAAqB,GAAA,CAAI,WAAA,KAAgB,IAAA;AACjE;AAYO,IAAM,4BAAA,GAAN,cAA2C,iBAAA,CAAkB;AAAA,EAChD,IAAA,GAAe,8BAAA;AAAA,EACxB,SAAA;AAAA,EAET,WAAA,CACE,OAAA,EACA,SAAA,EACA,OAAA,GAA8C,EAAC,EAC/C;AACA,IAAA,KAAA,CAAM,OAAA,EAAS;AAAA,MACb,GAAG,OAAA;AAAA,MACH,WAAA,EAAa,KAAA;AAAA,MACb,IAAA,EAAM,QAAQ,IAAA,IAAQ;AAAA,KACvB,CAAA;AACD,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAaO,IAAM,4BAAA,GAAN,cAA2C,iBAAA,CAAkB;AAAA,EAChD,IAAA,GAAe,8BAAA;AAAA,EACxB,QAAA;AAAA,EACA,WAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EAOA;AACA,IAAA,KAAA,CAAM,OAAA,EAAS;AAAA,MACb,GAAG,OAAA;AAAA,MACH,WAAA,EAAa,IAAA;AAAA,MACb,IAAA,EAAM,QAAQ,IAAA,IAAQ;AAAA,KACvB,CAAA;AACD,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,EAC7B;AACF;AAqBO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EACtC,IAAA,GAAe,oBAAA;AAAA,EACxB,SAAA;AAAA,EAET,WAAA,CACE,SACA,OAAA,EAMA;AACA,IAAA,KAAA,CAAM,OAAA,EAAS;AAAA,MACb,WAAA,EAAa,OAAA,CAAQ,IAAA,KAAS,cAAA,IAAkB,QAAQ,IAAA,KAAS,SAAA;AAAA,MACjE,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,MAC9D,GAAI,QAAQ,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAS,GAAI;AAAC,KACxE,CAAA;AACD,IAAA,IAAA,CAAK,YAAY,OAAA,CAAQ,SAAA;AAAA,EAC3B;AACF;AASO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EACtC,IAAA,GAAe,oBAAA;AAAA,EACxB,MAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAAiB,MAAA,EAAgB,OAAA,GAA+B,EAAC,EAAG;AAC9E,IAAA,KAAA,CAAM,OAAA,EAAS;AAAA,MACb,GAAG,OAAA;AAAA,MACH,WAAA,EAAa,KAAA;AAAA,MACb,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;AAQO,IAAM,iBAAA,GAAN,cAAgC,iBAAA,CAAkB;AAAA,EACrC,IAAA,GAAe,mBAAA;AAAA,EACxB,MAAA;AAAA,EAET,WAAA,CAAY,MAAA,EAAgB,OAAA,GAA+B,EAAC,EAAG;AAC7D,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAA,EAAI;AAAA,MACjC,GAAG,OAAA;AAAA,MACH,WAAA,EAAa,KAAA;AAAA,MACb,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF;AAQO,IAAM,6BAAA,GAAN,cAA4C,iBAAA,CAAkB;AAAA,EACjD,IAAA,GAAe,+BAAA;AAAA,EACxB,SAAA;AAAA,EAET,WAAA,CAAY,SAAA,EAAmB,OAAA,GAA+B,EAAC,EAAG;AAChE,IAAA,KAAA;AAAA,MACE,mBAAmB,SAAS,CAAA,4DAAA,CAAA;AAAA,MAC5B;AAAA,QACE,GAAG,OAAA;AAAA,QACH,WAAA,EAAa,KAAA;AAAA,QACb,IAAA,EAAM;AAAA;AACR,KACF;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AASO,IAAM,mBAAA,GAAN,cAAkC,iBAAA,CAAkB;AAAA,EACvC,IAAA,GAAe,qBAAA;AAAA,EACxB,UAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,IAAA;AAAA,EAET,YAAY,IAAA,EAOT;AACD,IAAA,KAAA;AAAA,MACE,WAAW,IAAA,CAAK,UAAU,CAAA,sBAAA,EAAyB,IAAA,CAAK,MAAM,CAAA,SAAA,EAAY,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,CAAC,CAAC,CAAA,UAAA,EAAa,KAAK,QAAA,CAAS,OAAA,CAAQ,CAAC,CAAC,CAAA,CAAA;AAAA,MACvI;AAAA,QACE,GAAI,KAAK,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAM,GAAI,EAAC;AAAA,QACxD,WAAA,EAAa,KAAA;AAAA,QACb,IAAA,EAAM;AAAA;AACR,KACF;AACA,IAAA,IAAA,CAAK,aAAa,IAAA,CAAK,UAAA;AACvB,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AACnB,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,QAAA;AACrB,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,QAAA;AACrB,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AAAA,EACnB;AACF;AAgBO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EACtC,IAAA,GAAe,oBAAA;AAAA,EACxB,OAAA;AAAA,EAET,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,CAAA,OAAA,EAAU,OAAO,CAAA,8DAAA,CAAA,EAAkE;AAAA,MACvF,WAAA,EAAa,KAAA;AAAA,MACb,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AACF;AAEO,IAAM,+BAAA,GAAN,cAA8C,iBAAA,CAAkB;AAAA,EACnD,IAAA,GAAe,iCAAA;AAAA,EACxB,SAAA;AAAA,EAET,WAAA,CAAY,SAAA,EAAmB,OAAA,GAA+B,EAAC,EAAG;AAChE,IAAA,KAAA;AAAA,MACE,qBAAqB,SAAS,CAAA,4DAAA,CAAA;AAAA,MAC9B;AAAA,QACE,GAAG,OAAA;AAAA,QACH,WAAA,EAAa,KAAA;AAAA,QACb,IAAA,EAAM;AAAA;AACR,KACF;AACA,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF","file":"chunk-2YGIBOUH.cjs","sourcesContent":["/**\n * Default retryability verdict for an `AgentRunError` code.\n *\n * Extracted from `errors.ts` (G8 LoC budget — SRP). The parameter is typed\n * `string` (not the `AgentRunErrorCode` union) deliberately: this is a leaf\n * with NO import back into `errors.ts`, so it cannot form an import cycle. The\n * `default` branch makes the behavior identical to the typed switch.\n *\n * @internal\n */\nexport function defaultRetriableForCode(code: string): boolean {\n  switch (code) {\n    case \"rate_limit\":\n    case \"timeout\":\n    case \"server_error\":\n    case \"network\":\n    case \"provider_unreachable\":\n      return true;\n    default:\n      return false;\n  }\n}\n","import { defaultRetriableForCode } from \"./internal/runtime/retry/default-retriable.js\";\nimport { redactSecrets } from \"./internal/security/redact.js\";\nimport type { RunOperation } from \"./types/run.js\";\n\n/**\n * Finite, machine-readable error codes for provider-originated errors\n * (ADR D66). Consumers can `switch (err.metadata?.code)` exhaustively\n * — adding a new variant is an explicit decision + test coverage.\n *\n * @public\n */\nexport type ErrorCode =\n  | \"rate_limit\"\n  | \"auth_failed\"\n  | \"invalid_request\"\n  | \"timeout\"\n  | \"server_error\"\n  | \"context_too_long\"\n  | \"content_filtered\"\n  | \"model_unavailable\"\n  | \"network\"\n  | \"quota_exceeded\"\n  | \"unknown\";\n\n/**\n * Codes used by {@link AgentRunError} (Production-Readiness #3, ADR D311).\n *\n * Superset of {@link ErrorCode} extended with codes that do NOT originate\n * from a provider HTTP response:\n *\n * - `quota_exceeded` — billing limit hit (provider 402 or signalled error)\n * - `tool_runtime_error` — custom tool handler threw inside dispatch\n * - `aborted` — caller's `AbortSignal` fired (Phase 4)\n * - `invalid_model` — model id rejected by provider (400 \"model not found\")\n * - `safety_blocked` — provider safety filter blocked req or resp\n * - `provider_unreachable` — DNS/TCP/timeout/5xx at transport boundary\n *\n * The `& {}` tail keeps the literal-union ergonomics (autocomplete) while\n * accepting any string for forward compatibility with constructor calls\n * that pass arbitrary code values (legacy callers).\n *\n * @public\n */\n/**\n * T1.1 — closed literal union for `AgentRunError.code`. The previous\n * `(string & {})` escape hatch let arbitrary strings slip into the type\n * surface and defeated exhaustive `switch (code)` discrimination. This is\n * the canonical closed form. `AgentRunErrorCode` is re-aliased below for\n * source-level back-compat.\n *\n * Adding a new code: append the literal here AND audit every `switch (err.code)`\n * in callers. Type-checker enforces the audit via the `default: assertNever(code)`\n * convention.\n *\n * @public\n */\nexport type KnownAgentRunErrorCode =\n  | ErrorCode\n  | \"quota_exceeded\"\n  | \"tool_runtime_error\"\n  | \"aborted\"\n  | \"invalid_model\"\n  | \"safety_blocked\"\n  | \"provider_unreachable\";\n\n/**\n * Back-compat alias of {@link KnownAgentRunErrorCode}. Pre-T1.1 callers that\n * imported `AgentRunErrorCode` keep working; new code SHOULD prefer\n * `KnownAgentRunErrorCode` to make the closed-union intent explicit.\n *\n * @public\n */\nexport type AgentRunErrorCode = KnownAgentRunErrorCode;\n\n/** Snapshot of every known code at runtime — used by the boundary coercer. */\nconst KNOWN_AGENT_RUN_ERROR_CODES = new Set<string>([\n  \"rate_limit\",\n  \"auth_failed\",\n  \"invalid_request\",\n  \"timeout\",\n  \"server_error\",\n  \"context_too_long\",\n  \"content_filtered\",\n  \"model_unavailable\",\n  \"network\",\n  \"unknown\",\n  \"quota_exceeded\",\n  \"tool_runtime_error\",\n  \"aborted\",\n  \"invalid_model\",\n  \"safety_blocked\",\n  \"provider_unreachable\",\n]);\n\n/**\n * T1.1 boundary helper — coerce an arbitrary string (typically arriving from\n * a downstream `RunErrorDetail.code` or a deserialized cloud response) into a\n * `KnownAgentRunErrorCode`. Unknown strings collapse to `\"unknown\"` so the\n * closed type contract holds without forcing every caller to switch.\n *\n * @internal\n */\nexport function coerceToKnownAgentRunErrorCode(code: string | undefined): KnownAgentRunErrorCode {\n  if (code !== undefined && KNOWN_AGENT_RUN_ERROR_CODES.has(code)) {\n    return code as KnownAgentRunErrorCode;\n  }\n  return \"unknown\";\n}\n\n/**\n * Structured context for errors that originated from a provider HTTP\n * call (ADR D65). Lets callers retry with the right backoff (`retryAfter`),\n * surface actionable diagnostics (`provider`, `endpoint`), and inspect the\n * raw response body when needed (`raw`, capped at ~2KB by the mapper).\n *\n * @public\n */\nexport interface ErrorMetadata {\n  /** Provider canonical name (e.g., `\"anthropic\"`, `\"openai\"`, `\"openrouter\"`, `\"gemini\"`). */\n  provider: string;\n  /** HTTP endpoint that failed (e.g., `\"/v1/messages\"`, `\"/v1/chat/completions\"`). */\n  endpoint: string;\n  /** Machine-readable error code (finite enum). */\n  code: ErrorCode;\n  /** HTTP status code if applicable. */\n  statusCode?: number;\n  /** Seconds to wait before retry, per provider's `retry-after` header (numeric form only). */\n  retryAfter?: number;\n  /** Raw response body for debugging (truncated to ~2KB by the mapper). */\n  raw?: unknown;\n}\n\n/**\n * Base class for all errors thrown by `@theokit/sdk`.\n *\n * Use `isRetryable` to drive retry/backoff logic. `code` and `protoErrorCode`\n * are populated for server-originated errors when available. `metadata`\n * (ADR D65) carries structured `{ provider, endpoint, code, ... }` when\n * the error originated from a provider HTTP call.\n *\n * @public\n */\nexport class TheokitAgentError extends Error {\n  override readonly name: string = \"TheokitAgentError\";\n  readonly isRetryable: boolean;\n  readonly code?: string;\n  readonly protoErrorCode?: string;\n  readonly metadata?: ErrorMetadata;\n\n  constructor(\n    message: string,\n    options: {\n      isRetryable?: boolean;\n      code?: string;\n      protoErrorCode?: string;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    } = {},\n  ) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined);\n    this.isRetryable = options.isRetryable ?? false;\n    if (options.code !== undefined) this.code = options.code;\n    if (options.protoErrorCode !== undefined) this.protoErrorCode = options.protoErrorCode;\n    if (options.metadata !== undefined) this.metadata = options.metadata;\n  }\n}\n\n/**\n * Invalid API key, not logged in, insufficient permissions.\n *\n * @public\n */\nexport class AuthenticationError extends TheokitAgentError {\n  override readonly name: string = \"AuthenticationError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: false });\n  }\n}\n\n/**\n * Too many requests or usage limits exceeded.\n *\n * @public\n */\nexport class RateLimitError extends TheokitAgentError {\n  override readonly name: string = \"RateLimitError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: true });\n  }\n}\n\n/**\n * Invalid model, bad request parameters, malformed options.\n *\n * @public\n */\nexport class ConfigurationError extends TheokitAgentError {\n  override readonly name: string = \"ConfigurationError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: false });\n  }\n}\n\n/**\n * Thrown when creating a cloud agent for a repo whose SCM provider is not\n * connected. Use `helpUrl` to point the user at the right reconnect flow.\n *\n * @public\n */\nexport class IntegrationNotConnectedError extends ConfigurationError {\n  override readonly name: string = \"IntegrationNotConnectedError\";\n  readonly provider: string;\n  readonly helpUrl: string;\n\n  constructor(\n    message: string,\n    options: {\n      provider: string;\n      helpUrl: string;\n      code?: string;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, options);\n    this.provider = options.provider;\n    this.helpUrl = options.helpUrl;\n  }\n}\n\n/**\n * Service unavailable, timeout, transport-level failure.\n *\n * @public\n */\nexport class NetworkError extends TheokitAgentError {\n  override readonly name: string = \"NetworkError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: true });\n  }\n}\n\n/**\n * Catch-all for unclassified server or runtime errors.\n *\n * @public\n */\nexport class UnknownAgentError extends TheokitAgentError {\n  override readonly name: string = \"UnknownAgentError\";\n\n  constructor(\n    message: string,\n    options: { code?: string; cause?: unknown; metadata?: ErrorMetadata } = {},\n  ) {\n    super(message, { ...options, isRetryable: false });\n  }\n}\n\n/**\n * Thrown by `Agent.prompt` (and helpers that go through `run.wait()`) when\n * the option `{ throwOnError: true }` is set and the run terminates with\n * `status: 'error'`. Carries the structured `RunResult.error` fields so\n * callers can `catch` once and branch on `code` / `provider` instead of\n * unwrapping the run.\n *\n * Extends {@link TheokitAgentError} per ADR D65 — no new hierarchy.\n *\n * @example\n *   try {\n *     await Agent.prompt(msg, { apiKey, model, throwOnError: true });\n *   } catch (err) {\n *     if (err instanceof AgentRunError && err.code === 'auth_failed') {\n *       // bad key\n *     }\n *   }\n *\n * @public\n */\nexport class AgentRunError extends TheokitAgentError {\n  override readonly name: string = \"AgentRunError\";\n  readonly provider?: string;\n  readonly raw?: string;\n  /** Provider's request id (`x-request-id` / `request-id` header). Useful for support tickets. */\n  readonly requestId?: string;\n  /** SDK conversation id this error was raised inside. */\n  readonly conversationId?: string;\n\n  constructor(\n    message: string,\n    options: {\n      code: AgentRunErrorCode;\n      provider?: string;\n      raw?: string;\n      requestId?: string;\n      conversationId?: string;\n      retriable?: boolean;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, {\n      code: options.code,\n      cause: options.cause,\n      metadata: options.metadata,\n      // D311: most AgentRunErrors are not retriable (auth, validation, abort).\n      // Provider mappers (D314) override per-status — explicit `retriable` wins\n      // over the implicit default when supplied.\n      isRetryable: options.retriable ?? defaultRetriableForCode(options.code),\n    });\n    if (options.provider !== undefined) this.provider = options.provider;\n    if (options.raw !== undefined) this.raw = options.raw;\n    if (options.requestId !== undefined) this.requestId = options.requestId;\n    if (options.conversationId !== undefined) this.conversationId = options.conversationId;\n  }\n\n  /**\n   * Production-Readiness #3 (ADR D311): alias for `isRetryable` exposed as\n   * `retriable` to match the handoff contract. Future v2 will deprecate\n   * `isRetryable` in favor of this.\n   */\n  get retriable(): boolean {\n    return this.isRetryable;\n  }\n\n  /**\n   * D312: provider's `Retry-After` header in **milliseconds**. Mappers store\n   * the header value (seconds) in `metadata.retryAfter`; this getter\n   * multiplies by 1000 so the result composes with `Date.now()`/`setTimeout`.\n   *\n   * Returns `undefined` when no hint was provided. `0` is a legitimate value\n   * — use `=== undefined` check rather than truthy check.\n   */\n  get retryAfterMs(): number | undefined {\n    if (this.metadata?.retryAfter === undefined) return undefined;\n    return this.metadata.retryAfter * 1000;\n  }\n\n  /**\n   * D313 + T1.5: alias for `metadata.raw`. Provider response body for\n   * debugging. T1.5 wraps the value in `redactSecrets` at the getter\n   * boundary so secret-shaped substrings (`sk-...`, Bearer JWTs, etc.) are\n   * stripped before reaching the caller. Available but NEVER serialized\n   * into `.message` (anti-leak invariant).\n   */\n  get providerError(): unknown {\n    const raw = this.metadata?.raw;\n    if (raw === undefined) return undefined;\n    if (typeof raw === \"string\") return redactSecrets(raw);\n    // Non-string raw (object/buffer) — stringify then redact.\n    try {\n      return redactSecrets(JSON.stringify(raw));\n    } catch {\n      return redactSecrets(String(raw));\n    }\n  }\n\n  /**\n   * T1.5 — sanitized JSON form. `metadata.raw` is OMITTED by default; opt\n   * in via `THEOKIT_DEBUG_RAW_ERRORS=1` to surface the (redacted) raw\n   * payload for diagnostics. Every other field stays accessible.\n   *\n   * The single env-var gate is read each call so operators can toggle at\n   * runtime without restarting the process.\n   */\n  toJSON(): Record<string, unknown> {\n    const json: Record<string, unknown> = {\n      name: this.name,\n      message: this.message,\n      isRetryable: this.isRetryable,\n    };\n    addOptionalFields(json, this);\n    const safeMeta = sanitizeMetadata(this.metadata);\n    if (safeMeta !== undefined) json.metadata = safeMeta;\n    return json;\n  }\n}\n\nfunction addOptionalFields(json: Record<string, unknown>, err: AgentRunError): void {\n  if (err.code !== undefined) json.code = err.code;\n  if (err.provider !== undefined) json.provider = err.provider;\n  if (err.requestId !== undefined) json.requestId = err.requestId;\n  if (err.conversationId !== undefined) json.conversationId = err.conversationId;\n  if (err.raw !== undefined) json.raw = redactSecrets(err.raw);\n}\n\nfunction sanitizeMetadata(meta: ErrorMetadata | undefined): ErrorMetadata | undefined {\n  if (meta === undefined) return undefined;\n  const { raw, ...rest } = meta;\n  const debugRaw = process.env.THEOKIT_DEBUG_RAW_ERRORS === \"1\";\n  if (debugRaw && raw !== undefined) {\n    const redactedRaw =\n      typeof raw === \"string\" ? redactSecrets(raw) : redactSecrets(safeStringify(raw));\n    return { ...rest, raw: redactedRaw } as ErrorMetadata;\n  }\n  return rest as ErrorMetadata;\n}\n\nfunction safeStringify(value: unknown): string {\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return String(value);\n  }\n}\n\n/**\n * Is this error transient (worth retrying)?\n *\n * Returns the SDK's own retryability verdict: every {@link TheokitAgentError}\n * subclass computes `isRetryable` at construction (rate-limit / network /\n * credential-pool-exhausted are retryable; auth / configuration / unsupported\n * are not), so this predicate is a single source of truth rather than a\n * re-derivation. Non-SDK errors return `false` conservatively — wrap a foreign\n * error in the appropriate SDK error first if you want it considered transient.\n * It never inspects `err.message`.\n *\n * @example\n *   try {\n *     await agent.send(message, { throwOnError: true });\n *   } catch (err) {\n *     if (isTransientError(err)) return retryWithBackoff();\n *     throw err;\n *   }\n *\n * @public\n */\nexport function isTransientError(err: unknown): boolean {\n  return err instanceof TheokitAgentError && err.isRetryable === true;\n}\n\n/**\n * Thrown when a {@link Run} or agent operation is not available on the current\n * runtime. Check first with `run.supports(operation)`.\n *\n * Extends {@link TheokitAgentError} (so error-catching code that branches on\n * `instanceof TheokitAgentError` continues to work) but is never retryable —\n * an unsupported operation will not become supported on retry.\n *\n * @public\n */\nexport class UnsupportedRunOperationError extends TheokitAgentError {\n  override readonly name: string = \"UnsupportedRunOperationError\";\n  readonly operation: RunOperation;\n\n  constructor(\n    message: string,\n    operation: RunOperation,\n    options: { code?: string; cause?: unknown } = {},\n  ) {\n    super(message, {\n      ...options,\n      isRetryable: false,\n      code: options.code ?? \"unsupported_run_operation\",\n    });\n    this.operation = operation;\n  }\n}\n\n/**\n * Thrown when every credential in a per-provider pool is in cooldown\n * and no healthy key is available (ADR D133). The caller's\n * {@link import(\"./internal/llm/fallback-client.js\").FallbackLlmClient}\n * catches this and tries the next provider in the fallback chain.\n *\n * `metadata.nextRetryAt` (epoch ms) tells callers when the soonest\n * pool entry resumes — useful for manual retry scheduling.\n *\n * @public\n */\nexport class CredentialPoolExhaustedError extends TheokitAgentError {\n  override readonly name: string = \"CredentialPoolExhaustedError\";\n  readonly provider: string;\n  readonly nextRetryAt: number | undefined;\n\n  constructor(\n    message: string,\n    options: {\n      provider: string;\n      nextRetryAt?: number;\n      code?: string;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, {\n      ...options,\n      isRetryable: true,\n      code: options.code ?? \"credential_pool_exhausted\",\n    });\n    this.provider = options.provider;\n    this.nextRetryAt = options.nextRetryAt;\n  }\n}\n\n/**\n * Finite error codes specific to memory adapter operations (ADR D141).\n *\n * @public\n */\nexport type MemoryAdapterErrorCode =\n  | \"auth_failed\"\n  | \"rate_limited\"\n  | \"not_found\"\n  | \"network\"\n  | \"invalid_input\"\n  | \"unknown\";\n\n/**\n * Error raised by `@theokit-memory-*` adapters. Carries `adapterId`\n * so callers can branch on which provider failed (ADR D141).\n *\n * @public\n */\nexport class MemoryAdapterError extends TheokitAgentError {\n  override readonly name: string = \"MemoryAdapterError\";\n  readonly adapterId: string;\n\n  constructor(\n    message: string,\n    options: {\n      adapterId: string;\n      code: MemoryAdapterErrorCode;\n      cause?: unknown;\n      metadata?: ErrorMetadata;\n    },\n  ) {\n    super(message, {\n      isRetryable: options.code === \"rate_limited\" || options.code === \"network\",\n      code: options.code,\n      ...(options.cause !== undefined ? { cause: options.cause } : {}),\n      ...(options.metadata !== undefined ? { metadata: options.metadata } : {}),\n    });\n    this.adapterId = options.adapterId;\n  }\n}\n\n/**\n * Thrown when a user-supplied task ID violates the grammar\n * `^[a-z0-9][a-z0-9_-]*$` (D368) OR starts with a reserved adapter\n * prefix (`wf-` / `b-` / `cron-`, EC-5).\n *\n * @public\n */\nexport class InvalidTaskIdError extends TheokitAgentError {\n  override readonly name: string = \"InvalidTaskIdError\";\n  readonly taskId: string;\n\n  constructor(message: string, taskId: string, options: { cause?: unknown } = {}) {\n    super(message, {\n      ...options,\n      isRetryable: false,\n      code: \"invalid_task_id\",\n    });\n    this.taskId = taskId;\n  }\n}\n\n/**\n * Thrown when `Task.subscribe(id)` is called for a task that has been\n * evicted, never submitted, or evicted after retention (D373).\n *\n * @public\n */\nexport class TaskNotFoundError extends TheokitAgentError {\n  override readonly name: string = \"TaskNotFoundError\";\n  readonly taskId: string;\n\n  constructor(taskId: string, options: { cause?: unknown } = {}) {\n    super(`Task not found: ${taskId}`, {\n      ...options,\n      isRetryable: false,\n      code: \"task_not_found\",\n    });\n    this.taskId = taskId;\n  }\n}\n\n/**\n * Thrown when `CloudAgent` is asked to wrap a task (D370). Cloud\n * task observability is deferred until Theo PaaS GA.\n *\n * @public\n */\nexport class UnsupportedTaskOperationError extends TheokitAgentError {\n  override readonly name: string = \"UnsupportedTaskOperationError\";\n  readonly operation: string;\n\n  constructor(operation: string, options: { cause?: unknown } = {}) {\n    super(\n      `Task operation \"${operation}\" is not supported on CloudAgent (pre-release; see ADR D370)`,\n      {\n        ...options,\n        isRetryable: false,\n        code: \"task_op_unsupported\",\n      },\n    );\n    this.operation = operation;\n  }\n}\n\n/**\n * Thrown by `Budget` enforcement (ADR D386) when a `mode: \"block\"`\n * budget would be exceeded by the upcoming LLM call. The caller catches a\n * typed error to retry after the window resets, or surfaces it to the user.\n *\n * @public\n */\nexport class BudgetExceededError extends TheokitAgentError {\n  override readonly name: string = \"BudgetExceededError\";\n  readonly budgetName: string;\n  readonly window: import(\"./types/budget.js\").BudgetWindow;\n  readonly spentUsd: number;\n  readonly limitUsd: number;\n  readonly mode: import(\"./types/budget.js\").BudgetMode;\n\n  constructor(args: {\n    budgetName: string;\n    window: import(\"./types/budget.js\").BudgetWindow;\n    spentUsd: number;\n    limitUsd: number;\n    mode: import(\"./types/budget.js\").BudgetMode;\n    cause?: unknown;\n  }) {\n    super(\n      `Budget \"${args.budgetName}\" exceeded for window ${args.window}: spent $${args.spentUsd.toFixed(4)} > limit $${args.limitUsd.toFixed(4)}`,\n      {\n        ...(args.cause !== undefined ? { cause: args.cause } : {}),\n        isRetryable: false,\n        code: \"budget_exceeded\",\n      },\n    );\n    this.budgetName = args.budgetName;\n    this.window = args.window;\n    this.spentUsd = args.spentUsd;\n    this.limitUsd = args.limitUsd;\n    this.mode = args.mode;\n  }\n}\n\n/**\n * Thrown when `CloudAgent.send({ budget })` is invoked (D388). Cloud\n * budget surface waits for Theo PaaS GA.\n *\n * @public\n */\n/**\n * T1.6 — Thrown when a consumer calls `agent.send()` or any method\n * on an agent that has already been `dispose()`d. Pre-T1.6 this was\n * a generic `new Error(\"Agent has been disposed\")` — consumers\n * couldn't catch it without string-matching the message.\n *\n * @public\n */\nexport class AgentDisposedError extends TheokitAgentError {\n  override readonly name: string = \"AgentDisposedError\";\n  readonly agentId: string;\n\n  constructor(agentId: string) {\n    super(`Agent \"${agentId}\" has been disposed. Create a new agent or use Agent.resume().`, {\n      isRetryable: false,\n      code: \"agent_disposed\",\n    });\n    this.agentId = agentId;\n  }\n}\n\nexport class UnsupportedBudgetOperationError extends TheokitAgentError {\n  override readonly name: string = \"UnsupportedBudgetOperationError\";\n  readonly operation: string;\n\n  constructor(operation: string, options: { cause?: unknown } = {}) {\n    super(\n      `Budget operation \"${operation}\" is not supported on CloudAgent (pre-release; see ADR D388)`,\n      {\n        ...options,\n        isRetryable: false,\n        code: \"budget_op_unsupported\",\n      },\n    );\n    this.operation = operation;\n  }\n}\n"]}

package/dist/chunk-2YWWPCGX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/global-singleton.ts","../src/internal/providers/registry.ts","../src/internal/providers/catalog-schema.ts","../src/internal/providers/catalog-loader.ts","../src/internal/providers/builtin/anthropic.ts","../src/internal/providers/builtin/bedrock.ts","../src/internal/providers/builtin/openai-compatible.ts","../src/internal/providers/builtin/cerebras.ts","../src/internal/providers/builtin/cohere.ts","../src/internal/providers/builtin/deepinfra.ts","../src/internal/providers/builtin/gemini.ts","../src/internal/providers/builtin/google.ts","../src/internal/providers/builtin/groq.ts","../src/internal/providers/builtin/llamacpp.ts","../src/internal/providers/builtin/lmstudio.ts","../src/internal/providers/builtin/mistral.ts","../src/internal/providers/builtin/ollama.ts","../src/internal/providers/builtin/openai.ts","../src/internal/providers/builtin/openai-chatgpt.ts","../src/internal/providers/builtin/openrouter.ts","../src/internal/providers/builtin/perplexity.ts","../src/internal/providers/builtin/together.ts","../src/internal/providers/builtin/vertex.ts","../src/internal/providers/builtin/xai.ts","../src/internal/providers/builtin/index.ts"],"names":[],"mappings":";;;;;;;;;;AAYO,SAAS,eAAA,CAAmB,KAAa,MAAA,EAAoB;AAClE,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAC1B,EAAA,IAAI,EAAE,GAAG,CAAA,KAAM,QAAW,CAAA,CAAE,GAAG,IAAI,MAAA,EAAO;AAC1C,EAAA,OAAO,EAAE,GAAG,CAAA;AACd;;;ACIA,IAAM,QAAA,GAAW,eAAA;AAAA,EACf,gCAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AACA,IAAM,UAAU,eAAA,CAAgB,+BAAA,EAAiC,sBAAM,IAAI,KAAqB,CAAA;AAEzF,SAAS,iBAAiB,OAAA,EAAgC;AAC/D,EAAA,IAAI,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC9B,IAAA,IAAA,CAAK,CAAA,wBAAA,EAA2B,QAAQ,IAAI,CAAA;AAAA,CAAgC,CAAA;AAAA,EAC9E;AACA,EAAA,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAClC,EAAA,KAAA,MAAW,KAAA,IAAS,OAAA,CAAQ,OAAA,IAAW,EAAC,EAAG;AAEzC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,OAAA,CAAQ,IAAA,EAAM;AACvD,MAAA,IAAA,CAAK,wBAAwB,KAAK,CAAA,kBAAA,EAAqB,QAAQ,CAAA,QAAA,EAAW,QAAQ,IAAI,CAAA;AAAA,CAAM,CAAA;AAAA,IAC9F;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,EAAO,OAAA,CAAQ,IAAI,CAAA;AAAA,EACjC;AACF;AAEO,SAAS,mBAAmB,IAAA,EAA2C;AAC5E,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA;AACvC,EAAA,OAAO,QAAA,CAAS,IAAI,SAAS,CAAA;AAC/B;AAEO,SAAS,aAAA,GAAmC;AACjD,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAA,EAAQ,CAAA;AACrC;AClCO,IAAM,aAAa,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAA,EAAS,SAAS,KAAK,CAAA;AAGnE,IAAM,UAAA,GAAa,EAChB,MAAA,CAAO;AAAA;AAAA,EAEN,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,EAAY;AAAA,EAC9B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,EAAY;AAAA,EAC/B,YAAY,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,GAAc,QAAA,EAAS;AAAA,EAC9C,aAAa,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,GAAc,QAAA;AACxC,CAAC,EACA,KAAA,EAAM;AAET,IAAM,WAAA,GAAc,EACjB,MAAA,CAAO;AAAA,EACN,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACtC,QAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA;AAChC,CAAC,EACA,KAAA,EAAM;AAET,IAAM,gBAAA,GAAmB,EACtB,MAAA,CAAO;AAAA,EACN,KAAA,EAAO,EAAE,KAAA,CAAM,CAAA,CAAE,KAAK,UAAU,CAAC,EAAE,QAAA,EAAS;AAAA,EAC5C,MAAA,EAAQ,EAAE,KAAA,CAAM,CAAA,CAAE,KAAK,UAAU,CAAC,EAAE,QAAA;AACtC,CAAC,EACA,KAAA,EAAM;AAEF,IAAM,kBAAA,GAAqB,EAC/B,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,UAAA,EAAY,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACjC,SAAA,EAAW,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAChC,WAAA,EAAa,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAClC,SAAA,EAAW,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAEhC,iBAAA,EAAmB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAExC,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACpC,IAAA,EAAM,WAAW,QAAA,EAAS;AAAA,EAC1B,KAAA,EAAO,YAAY,QAAA,EAAS;AAAA,EAC5B,UAAA,EAAY,iBAAiB,QAAA,EAAS;AAAA,EACtC,MAAA,EAAQ,EAAE,IAAA,CAAK,CAAC,SAAS,MAAA,EAAQ,YAAY,CAAC,CAAA,CAAE,QAAA;AAClD,CAAC,EACA,KAAA;;;AC1CH,IAAM,kBAAA,GAAqB,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAyCjE,IAAM,cAAA,GAAiB,eAAA;AAAA,EACrB,wCAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AAEA,IAAM,gBAAA,GAAmB,eAAA;AAAA,EACvB,0CAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AACA,IAAM,UAAA,GAAa,eAAA,CAAgB,yCAAA,EAA2C,OAAO;AAAA,EACnF,MAAA,EAAQ;AACV,CAAA,CAAE,CAAA;AAGK,SAAS,oBAAoB,GAAA,EAAuC;AACzE,EAAA,sBAAA,EAAuB;AACvB,EAAA,OAAO,cAAA,CAAe,IAAI,GAAG,CAAA;AAC/B;AAGO,SAAS,kBAAkB,GAAA,EAAsB;AACtD,EAAA,OAAO,gBAAA,CAAiB,IAAI,GAAG,CAAA;AACjC;AASO,SAAS,cAAA,CAAe,KAAa,KAAA,EAA2B;AACrE,EAAA,sBAAA,EAAuB;AACvB,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA;AACvC,EAAA,cAAA,CAAe,GAAA,CAAI,GAAA,EAAK,QAAA,KAAa,MAAA,GAAY,KAAA,GAAQ,EAAE,GAAG,QAAA,EAAU,GAAG,KAAA,EAAO,CAAA;AAClF,EAAA,gBAAA,CAAiB,IAAI,GAAG,CAAA;AAC1B;AAQA,SAAS,sBAAA,GAA+B;AACtC,EAAA,IAAI,WAAW,MAAA,EAAQ;AACvB,EAAA,UAAA,CAAW,MAAA,GAAS,IAAA;AAGpB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,mBAAA,EAAoB;AACpC,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAC1C,MAAA,gBAAA,CAAiB,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,CAAA,kDAAA,EAAsD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC7E;AAAA,EACF;AACF;AAYA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,MAAM,MAAA,KAAW,MAAA,IAAa,OAAO,KAAA,CAAM,WAAW,QAAA,EAAU;AACpE,EAAA,KAAA,MAAW,CAAC,SAAS,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA,EAAG;AACzD,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,SAAA,CAAU,GAAG,CAAA;AAC/C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,IAAA;AAAA,QACE,CAAA,sDAAA,EAAyD,KAAA,CAAM,EAAE,CAAA,CAAA,EAAI,OAAO,CAAA,GAAA,EACvE,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,OAAA,IAAW,SAAS;AAAA;AAAA,OACnD;AACA,MAAA;AAAA,IACF;AAIA,IAAA,cAAA,CAAe,GAAA,CAAI,GAAG,KAAA,CAAM,EAAE,IAAI,OAAO,CAAA,CAAA,EAAI,OAAO,IAAI,CAAA;AACxD,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACvC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAC/B,MAAA,IAAI,CAAC,eAAe,GAAA,CAAI,GAAG,GAAG,cAAA,CAAe,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,IAAI,CAAA;AAAA,IACnE;AAAA,EACF;AACF;AAaA,SAAS,cAAc,GAAA,EAAmD;AACxE,EAAA,IACE,OAAO,GAAA,CAAI,EAAA,KAAO,QAAA,IAClB,OAAO,IAAI,WAAA,KAAgB,QAAA,IAC3B,OAAO,GAAA,CAAI,YAAY,QAAA,IACvB,OAAO,IAAI,QAAA,KAAa,QAAA,IACxB,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IACvB,CAAC,MAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAC1B,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,KACjC,GAAA,CAAI,YAAA,IAAgB,QACpB,OAAO,GAAA,CAAI,iBAAiB,QAAA,EAC5B;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,oBAAoB,IAAA,EAAkD;AACpF,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,kBAAA,EAAoB,uBAAuB,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,WAAA,EAAa,OAAO,CAAA;AACjD,EAAA,IAAI,OAAA,GAAqC,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAE3D,EAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,IAAA,OAAA,GAAU;AAAA,MACR,GAAG,OAAA;AAAA,MACH,EAAE,EAAA,EAAI,oBAAA,EAAsB,WAAA,EAAa,KAAA;AAAM,KACjD;AAAA,EACF;AAEA,EAAA,MAAM,SAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,IAAA,MAAM,SAAA,GAAY,cAAc,GAA8B,CAAA;AAC9D,IAAA,IAAI,cAAc,IAAA,EAAM;AACtB,MAAA,IAAA;AAAA,QACE,CAAA,sDAAA,EAAyD,KAAK,SAAA,CAAU,GAAG,EAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC;AAAA;AAAA,OAC5F;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA,GAAI,SAAA;AAAA,EACzB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,IAAI,kBAAA,GAAkE,IAAA;AAO/D,SAAS,uBAAuB,UAAA,EAAsD;AAC3F,EAAA,IAAI,uBAAuB,IAAA,EAAM;AAC/B,IAAA,MAAM,UAAU,mBAAA,EAAoB;AACpC,IAAA,kBAAA,GAAqB,EAAC;AACtB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAC1C,MAAA,kBAAA,CAAmB,KAAA,CAAM,EAAE,CAAA,GAAI,KAAA,CAAM,YAAA;AAGrC,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACvC,QAAA,IAAI,mBAAmB,KAAK,CAAA,KAAM,QAAW,kBAAA,CAAmB,KAAK,IAAI,KAAA,CAAM,YAAA;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,mBAAmB,UAAU,CAAA;AACtC;AAEO,SAAS,yBAAyB,IAAA,EAA0B;AACjE,EAAA,MAAM,OAAA,GAAU,oBAAoB,IAAI,CAAA;AACxC,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAI1C,IAAA,IAAI,kBAAA,CAAmB,KAAA,CAAM,EAAE,CAAA,KAAM,MAAA,EAAW;AAChD,IAAA,IAAI,KAAA,CAAM,SAAS,IAAA,CAAK,CAAC,MAAM,kBAAA,CAAmB,CAAC,CAAA,KAAM,MAAS,CAAA,EAAG;AAErE,IAAA,MAAM,OAAA,GAA2B;AAAA,MAC/B,MAAM,KAAA,CAAM,EAAA;AAAA,MACZ,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,gBAAgB,KAAA,CAAM,cAAA;AAAA,MACtB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,WAAW,KAAA,CAAM,SAAA;AAAA,MACjB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,cAAc,KAAA,CAAM;AAAA,KACtB;AACA,IAAA,gBAAA,CAAiB,OAAO,CAAA;AAAA,EAC1B;AACF;;;AC3PO,IAAM,SAAA,GAA6B;AAAA,EACxC,IAAA,EAAM,WAAA;AAAA,EACN,OAAA,EAAS,oBAAA;AAAA,EACT,OAAA,EAAS,CAAC,mBAAmB,CAAA;AAAA,EAC7B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,SAAA,EAAW,qCAAA;AAAA,EACX,QAAA,EAAU,mBAAA;AAAA,EACV,cAAA,EAAgB,CAAC,iBAAA,EAAmB,mBAAA,EAAqB,2BAA2B,CAAA;AAAA;AAAA;AAAA;AAAA,EAIpF,YAAA,EAAc;AAAA,IACZ,gBAAA,EAAkB;AAAA;AAEtB,CAAA;;;ACDO,IAAM,OAAA,GAA2B;AAAA,EACtC,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,mBAAA;AAAA,EACT,OAAA,EAAS,CAAC,0BAA0B,CAAA;AAAA,EACpC,QAAA,EAAU,YAAA;AAAA,EACV,OAAA,EAAS,iDAAA;AAAA,EACT,SAAA,EAAW,MAAA;AAAA,EACX,QAAA,EAAU,+BAAA;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,6CAAA;AAAA,IACA,2CAAA;AAAA,IACA;AAAA;AAEJ,CAAA;AAGO,SAAS,mBAAmB,OAAA,EAAyB;AAC1D,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AACzC;AAQO,SAAS,uBAAuB,OAAA,EAAqC;AAC1E,EAAA,MAAM,EAAA,GAAK,mBAAmB,OAAO,CAAA;AACrC,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,WAAA;AACrC,EAAA,IAAI,GAAG,UAAA,CAAW,KAAK,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC3D,EAAA,IAAI,GAAG,UAAA,CAAW,KAAK,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC3D,EAAA,IAAI,GAAG,UAAA,CAAW,OAAO,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,gBAAA;AAC7D,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,gBAAA;AACjC,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,sBAAsB,OAAA,EAAyB;AAC7D,EAAA,MAAM,SAAS,sBAAA,CAAuB,OAAO,CAAA,IAAK,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC5E,EAAA,OAAO,2BAA2B,MAAM,CAAA,cAAA,CAAA;AAC1C;;;AC9CO,SAAS,wBACd,CAAA,EACiB;AACjB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,kBAAA;AAAA,IACT,QAAA,EAAU,SAAA;AAAA,IACV,gBAAgB,EAAC;AAAA,IACjB,GAAG;AAAA,GACL;AACF;;;ACbO,IAAM,WAAW,uBAAA,CAAwB;AAAA,EAC9C,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,4BAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,cAAA,EAAgB,CAAC,cAAA,EAAgB,aAAa,CAAA;AAAA,EAC9C,YAAA,EAAc,EAAE,kCAAA,EAAoC,SAAA,EAAU;AAAA,EAC9D,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACJM,IAAM,SAAS,uBAAA,CAAwB;AAAA,EAC5C,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,wCAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAA,EAAkB,YAAY,CAAA;AAAA,EACxC,cAAA,EAAgB,CAAC,mBAAmB,CAAA;AAAA,EACpC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACZM,IAAM,YAAY,uBAAA,CAAwB;AAAA,EAC/C,IAAA,EAAM,WAAA;AAAA,EACN,OAAA,EAAS,qCAAA;AAAA,EACT,OAAA,EAAS,CAAC,mBAAmB,CAAA;AAAA,EAC7B,cAAA,EAAgB,CAAC,gBAAgB,CAAA;AAAA,EACjC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACCM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,oBAAoB,CAAA;AAAA,EAC9B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,QAAA,EAAU,eAAA;AAAA,EACV,cAAA,EAAgB,CAAC,6BAA6B;AAChD,CAAA;;;ACXO,IAAM,SAAS,uBAAA,CAAwB;AAAA,EAC5C,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,yDAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,8BAA8B,CAAA;AAAA,EAC5E,cAAA,EAAgB,CAAC,gBAAA,EAAkB,kBAAkB,CAAA;AAAA,EACrD,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACVM,IAAM,OAAO,uBAAA,CAAwB;AAAA,EAC1C,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS,gCAAA;AAAA,EACT,OAAA,EAAS,CAAC,cAAc,CAAA;AAAA,EACxB,cAAA,EAAgB,CAAC,yBAAA,EAA2B,sBAAsB,CAAA;AAAA,EAClE,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACcM,IAAM,QAAA,GAA4B;AAAA,EACvC,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,WAAA,EAAa,WAAW,CAAA;AAAA,EAClC,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,uBAAA;AAAA,EACT,SAAA,EAAW,iCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,cAAc;AACjC,CAAA;;;ACZO,IAAM,QAAA,GAA4B;AAAA,EACvC,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,WAAA,EAAa,WAAW,CAAA;AAAA,EAClC,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,uBAAA;AAAA,EACT,SAAA,EAAW,iCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,cAAc;AACjC,CAAA;;;AC5BO,IAAM,UAAU,uBAAA,CAAwB;AAAA,EAC7C,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,2BAAA;AAAA,EACT,OAAA,EAAS,CAAC,iBAAiB,CAAA;AAAA,EAC3B,cAAA,EAAgB,CAAC,sBAAA,EAAwB,kBAAkB,CAAA;AAAA,EAC3D,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACQM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,wBAAA;AAAA,EACT,SAAA,EAAW,kCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,UAAA,EAAY,SAAA,EAAW,SAAS;AACnD,CAAA;;;ACxBO,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,wBAAA;AAAA,EACT,SAAA,EAAW,kCAAA;AAAA,EACX,QAAA,EAAU,gBAAA;AAAA,EACV,cAAA,EAAgB,CAAC,QAAA,EAAU,aAAa;AAC1C,CAAA;ACgBA,IAAM,aAAA,GAAuC;AAAA,EAC3C,MAAM,OAAA,EAAQ;AAAA,EACd,OAAA,EAAS,UAAA;AAAA,EACT,QAAA,EAAU,WAAA;AAAA,EACV,UAAA,EAAY;AACd,CAAA;AAQA,IAAM,mBAAA,GAA2C;AAAA,EAC/C,QAAA,EAAU,QAAA;AAAA,EACV,iBAAA,EAAmB,yCAAA;AAAA,EACnB,aAAA,EAAe,qCAAA;AAAA,EACf,QAAA,EAAU,8BAAA;AAAA,EACV,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,gBAAgB,CAAA;AAAA,EACvD,WAAA,EAAa;AACf,CAAA;AASA,SAAS,UAAA,GAA2B;AAClC,EAAA,QAAQ,OAAO,OAAoC,IAAA,KAAuC;AACxF,IAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,IAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB;AAAA,MACvC,QAAA,EAAU,QAAA;AAAA,MACV,KAAA,EAAO,aAAA;AAAA,MACP,KAAA,EAAO,mBAAA;AAAA,MACP;AAAA,KACD,CAAA;AACD,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,aAAA,EAAe,GAAG,CAAA,EAAG,UAAA;AACvD,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AACxD,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,sBAAsB,SAAS,CAAA;AACxE,IAAA,OAAO,MAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC1C,CAAA;AACF;AAEO,IAAM,cAAA,GAAkC;AAAA,EAC7C,IAAA,EAAM,gBAAA;AAAA,EACN,OAAA,EAAS,eAAA;AAAA,EACT,QAAA,EAAU,mBAAA;AAAA,EACV,OAAA,EAAS,uCAAA;AAAA,EACT,SAAS,EAAC;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,wBAAA;AAAA,IACA,6BAAA;AAAA,IACA;AAAA,GACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,EAAc,EAAE,UAAA,EAAY,SAAA,EAAU;AAAA,EACtC,SAAA,EAAW;AAAA;AAAA,IAET,KAAA,EAAO,MAAM,UAAA;AAAW;AAE5B,CAAA;;;ACjGO,IAAM,UAAA,GAA8B;AAAA,EACzC,IAAA,EAAM,YAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,IAAI,CAAA;AAAA;AAAA,EAEd,OAAA,EAAS,CAAC,oBAAA,EAAsB,gBAAgB,CAAA;AAAA,EAChD,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,SAAA,EAAW,qCAAA;AAAA,EACX,QAAA,EAAU,eAAA;AAAA;AAAA,EAEV,cAAA,EAAgB,CAAC,oBAAA,EAAsB,4BAA4B,CAAA;AAAA;AAAA;AAAA,EAGnE,YAAA,EAAc,EAAE,cAAA,EAAgB,qBAAA,EAAuB,WAAW,SAAA;AACpE,CAAA;;;ACXO,IAAM,aAAa,uBAAA,CAAwB;AAAA,EAChD,IAAA,EAAM,YAAA;AAAA,EACN,OAAA,EAAS,2BAAA;AAAA,EACT,mBAAA,EAAqB,mBAAA;AAAA,EACrB,OAAA,EAAS,CAAC,oBAAoB,CAAA;AAAA,EAC9B,cAAA,EAAgB,CAAC,WAAA,EAAa,OAAO,CAAA;AAAA,EACrC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACVM,IAAM,WAAW,uBAAA,CAAwB;AAAA,EAC9C,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,YAAY,CAAA;AAAA,EACtB,OAAA,EAAS,6BAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,cAAA,EAAgB,CAAC,gCAAgC,CAAA;AAAA,EACjD,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACKM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,oBAAA;AAAA;AAAA,EACT,OAAA,EAAS,CAAC,gCAAgC,CAAA;AAAA,EAC1C,QAAA,EAAU,WAAA;AAAA,EACV,OAAA,EAAS,+CAAA;AAAA,EACT,SAAA,EAAW,MAAA;AAAA,EACX,QAAA,EAAU,2BAAA;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,6CAAA;AAAA,IACA;AAAA;AAEJ,CAAA;AAOO,SAAS,qBAAqB,IAAA,EAI1B;AACT,EAAA,MAAM,OACJ,IAAA,CAAK,QAAA,KAAa,WACd,2BAAA,GACA,CAAA,EAAG,KAAK,QAAQ,CAAA,0BAAA,CAAA;AACtB,EAAA,IAAI,IAAA,CAAK,iBAAiB,QAAA,EAAU;AAElC,IAAA,OAAO,WAAW,IAAI,CAAA,aAAA,EAAgB,KAAK,SAAS,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,kBAAA,CAAA;AAAA,EACjF;AAEA,EAAA,OAAO,WAAW,IAAI,CAAA,aAAA,EAAgB,KAAK,SAAS,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,qBAAA,CAAA;AACjF;AAGO,SAAS,kBAAkB,OAAA,EAAyC;AACzE,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,WAAA;AAC5C,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG,OAAO,QAAA;AACzC,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,+BAAA,EAAiC,EAAE,CAAA;AAC5D;;;AC1DO,IAAM,MAAM,uBAAA,CAAwB;AAAA,EACzC,IAAA,EAAM,KAAA;AAAA,EACN,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,EAChB,OAAA,EAAS,qBAAA;AAAA,EACT,OAAA,EAAS,CAAC,aAAa,CAAA;AAAA,EACvB,cAAA,EAAgB,CAAC,UAAA,EAAY,UAAU,CAAA;AAAA,EACvC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACwBD,IAAM,oBAAoB,MAAyB;AACjD,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,MAAM,GAAA,mBAAM,MAAA,CAAO,GAAA,CAAI,2CAA2C,CAAA;AAClE,EAAA,IAAI,CAAA,CAAE,GAAG,CAAA,KAAM,MAAA,IAAa,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,KAAA,EAAM;AACjD,EAAA,OAAO,EAAE,GAAG,CAAA;AACd,CAAA,GAAG;AAEI,SAAS,gBAAA,GAAyB;AACvC,EAAA,IAAI,iBAAiB,IAAA,EAAM;AAC3B,EAAA,gBAAA,CAAiB,IAAA,GAAO,IAAA;AAExB,EAAA,gBAAA,CAAiB,SAAS,CAAA;AAC1B,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,cAAc,CAAA;AAC/B,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,OAAO,CAAA;AACxB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AAEvB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,OAAO,CAAA;AACxB,EAAA,gBAAA,CAAiB,IAAI,CAAA;AACrB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,SAAS,CAAA;AAC1B,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,GAAG,CAAA;AACpB,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AAEzB,EAAA,wBAAA,EAAyB;AAC3B","file":"chunk-2YWWPCGX.js","sourcesContent":["/**\n * One singleton per realm, keyed by `Symbol.for`.\n *\n * It exists because a package can be loaded more than once in the same process (two copies in\n * `node_modules`, ESM and CJS side by side, a monorepo with distinct versions) — and then a module-level\n * `const x = new Map()` produces TWO caches that cannot see each other. `Symbol.for` uses the global\n * symbol registry, which belongs to the realm and not the module, so every copy converges on one instance.\n *\n * It was copied verbatim into `providers/discovery.ts` and `providers/catalog-loader.ts`. That is\n * duplicated KNOWLEDGE, not a coincidence of shape: the two copies have to agree on the\n * mechanism, and one fixed without the other produces exactly the bug the function exists to avoid.\n */\nexport function globalSingleton<T>(key: string, create: () => T): T {\n  const g = globalThis as unknown as Record<symbol, T>;\n  const sym = Symbol.for(key);\n  if (g[sym] === undefined) g[sym] = create();\n  return g[sym];\n}\n","/**\n * Provider registry (T3.2, ADR D107).\n *\n * `registerProvider` is idempotent and surface-warning: re-registering\n * a `name` logs to stderr (D107 last-writer-wins with WARN). Alias\n * collisions also warn (EC-5).\n *\n * @internal\n */\n\nimport { diag } from \"../diagnostics.js\";\nimport { globalSingleton } from \"../global-singleton.js\";\nimport type { ProviderProfile } from \"./types.js\";\n\n/**\n * M44 B1 fix — the registry state lives on `globalThis` keyed by `Symbol.for`, so EVERY bundle copy of this\n * module (tsup bundles each entry separately with `splitting: false` — `dist/index.js` and `dist/models.js`\n * each embed their own copy) shares the SAME maps. Without this, `@theokit/sdk/models`'s\n * `refreshModelCatalog` saw an eternally-empty registry and its patches were invisible to the core bundle's\n * capability/pricing lookups (state duplication made load-bearing by M44).\n */\nconst REGISTRY = globalSingleton(\n  \"theokit-sdk.providers.registry\",\n  () => new Map<string, ProviderProfile>(),\n);\nconst ALIASES = globalSingleton(\"theokit-sdk.providers.aliases\", () => new Map<string, string>());\n\nexport function registerProvider(profile: ProviderProfile): void {\n  if (REGISTRY.has(profile.name)) {\n    diag(`[theokit-sdk] Provider \"${profile.name}\" overridden by user plugin.\\n`);\n  }\n  REGISTRY.set(profile.name, profile);\n  for (const alias of profile.aliases ?? []) {\n    // EC-5: surface alias collision so operators notice mis-routing.\n    const previous = ALIASES.get(alias);\n    if (previous !== undefined && previous !== profile.name) {\n      diag(`[theokit-sdk] Alias \"${alias}\" collision: was \"${previous}\", now \"${profile.name}\".\\n`);\n    }\n    ALIASES.set(alias, profile.name);\n  }\n}\n\nexport function getProviderProfile(name: string): ProviderProfile | undefined {\n  const canonical = ALIASES.get(name) ?? name;\n  return REGISTRY.get(canonical);\n}\n\nexport function listProviders(): ProviderProfile[] {\n  return Array.from(REGISTRY.values());\n}\n\n/** Test-only reset. @internal */\nexport function _resetProvidersForTests(): void {\n  REGISTRY.clear();\n  ALIASES.clear();\n}\n","import { z } from \"zod\";\n\n/**\n * M44 — the per-model catalog sub-schema. Field names mirror models.dev VERBATIM (snake_case) so\n * `scripts/refresh-catalog.mjs` regenerates the vendored data mechanically from `api.json` with zero\n * renaming (ADR D1; OpenCode keeps the raw shape on disk and maps at load — `core/src/models-dev.ts`).\n * TOLERANT by design: every field optional, unknown keys ignored — models.dev adds fields over time and\n * additive drift must never break the loader (Blueprint §6.4).\n *\n * theokit extensions beyond models.dev: `structured_output` / `cache_control` (both already exist on the\n * SDK's `ModelCapabilities`; models.dev has no such flags).\n *\n * @internal\n */\n\nexport const MODALITIES = [\"text\", \"audio\", \"image\", \"video\", \"pdf\"] as const;\nexport type Modality = (typeof MODALITIES)[number];\n\nconst costSchema = z\n  .object({\n    /** USD per 1M tokens (models.dev convention). */\n    input: z.number().nonnegative(),\n    output: z.number().nonnegative(),\n    cache_read: z.number().nonnegative().optional(),\n    cache_write: z.number().nonnegative().optional(),\n  })\n  .loose();\n\nconst limitSchema = z\n  .object({\n    context: z.number().positive(),\n    input: z.number().positive().optional(),\n    output: z.number().positive().optional(),\n  })\n  .loose();\n\nconst modalitiesSchema = z\n  .object({\n    input: z.array(z.enum(MODALITIES)).optional(),\n    output: z.array(z.enum(MODALITIES)).optional(),\n  })\n  .loose();\n\nexport const catalogModelSchema = z\n  .object({\n    name: z.string().optional(),\n    release_date: z.string().optional(),\n    attachment: z.boolean().optional(),\n    reasoning: z.boolean().optional(),\n    temperature: z.boolean().optional(),\n    tool_call: z.boolean().optional(),\n    /** theokit extension — maps to ModelCapabilities.supportsStructuredOutput. */\n    structured_output: z.boolean().optional(),\n    /** theokit extension — maps to ModelCapabilities.supportsCacheControl. */\n    cache_control: z.boolean().optional(),\n    cost: costSchema.optional(),\n    limit: limitSchema.optional(),\n    modalities: modalitiesSchema.optional(),\n    status: z.enum([\"alpha\", \"beta\", \"deprecated\"]).optional(),\n  })\n  .loose();\n\nexport type CatalogModel = z.infer<typeof catalogModelSchema>;\nexport type CatalogModelCost = z.infer<typeof costSchema>;\n","/**\n * Dynamic provider catalog loader (T10.1, ADR D447).\n *\n * Loads provider metadata from `provider-catalog.json` at runtime.\n * Malformed entries are skipped with WARN (EC-1) — never crash.\n *\n * @internal\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { diag } from \"../diagnostics.js\";\nimport { globalSingleton } from \"../global-singleton.js\";\nimport { type CatalogModel, catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile, registerProvider } from \"./registry.js\";\nimport type { ApiMode, AuthType, ProviderProfile } from \"./types.js\";\n\nconst __dirname_resolved = dirname(fileURLToPath(import.meta.url));\n\nexport interface ProviderCapabilities {\n  supportsToolUse: boolean;\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsStreaming: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens?: number;\n  maxOutputTokens?: number;\n}\n\nexport interface CatalogEntry {\n  id: string;\n  displayName: string;\n  apiMode: ApiMode;\n  authType: AuthType;\n  baseUrl: string;\n  envVars: string[];\n  fallbackModels: string[];\n  capabilities: ProviderCapabilities;\n  aliases?: string[];\n  modelsUrl?: string;\n  hostname?: string;\n  extraHeaders?: Record<string, string>;\n  /**\n   * M44 — OPTIONAL per-model data (models.dev shape, snake_case — see `catalog-schema.ts`), keyed by the\n   * BARE model id. Additive: entries without it behave byte-identically to before. The loader indexes this\n   * into the model-info index (`getCatalogModelInfo`) rather than onto `ProviderProfile` (ADR D2 — the\n   * builtins-first registration skip means profile-attached data would never reach builtin providers).\n   */\n  models?: Record<string, CatalogModel>;\n}\n\n/**\n * M44 — the model-info index: `provider/model` → per-model catalog data (the EXACT-map key convention).\n * Populated by the vendored catalog load AND patched by the optional models-dev source (cache entries win\n * per model). The single lookup surface for capability / cost / limit enrichment.\n */\n// M44 B1 fix — index state on globalThis (Symbol.for) so every bundle copy shares the SAME maps (see the\n// identical pattern + rationale in registry.ts).\nconst modelInfoIndex = globalSingleton(\n  \"theokit-sdk.providers.model-info-index\",\n  () => new Map<string, CatalogModel>(),\n);\n/** M44 M5 fix — keys patched by the live models-dev source (honest pricing provenance). */\nconst patchedModelKeys = globalSingleton(\n  \"theokit-sdk.providers.model-info-patched\",\n  () => new Set<string>(),\n);\nconst indexState = globalSingleton(\"theokit-sdk.providers.model-info-loaded\", () => ({\n  loaded: false,\n}));\n\n/** Look up per-model catalog data by `provider/model` key. @internal */\nexport function getCatalogModelInfo(key: string): CatalogModel | undefined {\n  ensureModelIndexLoaded();\n  return modelInfoIndex.get(key);\n}\n\n/** Was this key patched by the LIVE models-dev source (vs the vendored catalog)? @internal */\nexport function isPatchedModelKey(key: string): boolean {\n  return patchedModelKeys.has(key);\n}\n\n/**\n * Patch the index with fresher per-model data (the models-dev source). M44 H2 fix — a per-FIELD shallow\n * MERGE, not a wholesale replace: models.dev can never supply the theokit extension fields\n * (`cache_control`, `structured_output` overlays), so a replace would wipe them and silently flip\n * capability answers. Incoming fields win; existing fields survive when the patch omits them.\n * @internal\n */\nexport function patchModelInfo(key: string, model: CatalogModel): void {\n  ensureModelIndexLoaded();\n  const existing = modelInfoIndex.get(key);\n  modelInfoIndex.set(key, existing === undefined ? model : { ...existing, ...model });\n  patchedModelKeys.add(key);\n}\n\n/** All indexed `provider/model` keys (for maintenance/tests). @internal */\nexport function listModelInfoKeys(): string[] {\n  ensureModelIndexLoaded();\n  return [...modelInfoIndex.keys()];\n}\n\nfunction ensureModelIndexLoaded(): void {\n  if (indexState.loaded) return;\n  indexState.loaded = true;\n  // M44 L9 fix — never throw from a capability/pricing lookup: a missing/corrupt vendored catalog degrades\n  // to conservative defaults with a WARN (the deleted EXACT map could never throw; keep that property).\n  try {\n    const catalog = loadProviderCatalog();\n    for (const entry of Object.values(catalog)) {\n      indexEntryModels(entry);\n    }\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: provider catalog unavailable (${(err as Error).message}) — per-model data disabled\\n`,\n    );\n  }\n}\n\n/**\n * Index an entry's `models` block. Runs for EVERY catalog entry — including those whose PROVIDER\n * registration is skipped builtins-first — so builtin providers still get their per-model data (ADR D2).\n * A malformed model sub-entry drops THAT MODEL with WARN and keeps the provider (EC-1 philosophy extended).\n */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nfunction indexEntryModels(entry: CatalogEntry): void {\n  if (entry.models === undefined || typeof entry.models !== \"object\") return;\n  for (const [modelId, raw] of Object.entries(entry.models)) {\n    const parsed = catalogModelSchema.safeParse(raw);\n    if (!parsed.success) {\n      diag(\n        `[theokit-sdk] WARN: Skipping malformed catalog model \"${entry.id}/${modelId}\": ` +\n          `${parsed.error.issues[0]?.message ?? \"invalid\"}\\n`,\n      );\n      continue;\n    }\n    // Index under the entry id AND every alias — capability lookups are VENDOR-keyed (e.g.\n    // `google/gemini-2.5-pro` while the entry id is `google-gemini` with alias `google`), so alias keys are\n    // what make the vendor-keyed convention resolve without a second mapping table.\n    modelInfoIndex.set(`${entry.id}/${modelId}`, parsed.data);\n    for (const alias of entry.aliases ?? []) {\n      const key = `${alias}/${modelId}`;\n      if (!modelInfoIndex.has(key)) modelInfoIndex.set(key, parsed.data);\n    }\n  }\n}\n\n/** Test-only reset for the model-info index. @internal */\nexport function _resetModelInfoIndexForTests(): void {\n  modelInfoIndex.clear();\n  patchedModelKeys.clear();\n  indexState.loaded = false;\n}\n\ninterface LoadOptions {\n  _testInjectMalformed?: boolean;\n}\n\nfunction validateEntry(raw: Record<string, unknown>): CatalogEntry | null {\n  if (\n    typeof raw.id !== \"string\" ||\n    typeof raw.displayName !== \"string\" ||\n    typeof raw.apiMode !== \"string\" ||\n    typeof raw.authType !== \"string\" ||\n    typeof raw.baseUrl !== \"string\" ||\n    !Array.isArray(raw.envVars) ||\n    !Array.isArray(raw.fallbackModels) ||\n    raw.capabilities == null ||\n    typeof raw.capabilities !== \"object\"\n  ) {\n    return null;\n  }\n  return raw as unknown as CatalogEntry;\n}\n\nexport function loadProviderCatalog(opts?: LoadOptions): Record<string, CatalogEntry> {\n  const catalogPath = join(__dirname_resolved, \"provider-catalog.json\");\n  const rawText = readFileSync(catalogPath, \"utf-8\");\n  let entries: Record<string, unknown>[] = JSON.parse(rawText);\n\n  if (opts?._testInjectMalformed) {\n    entries = [\n      ...entries,\n      { id: \"malformed-provider\", displayName: \"Bad\" } as Record<string, unknown>,\n    ];\n  }\n\n  const result: Record<string, CatalogEntry> = {};\n  for (const raw of entries) {\n    const validated = validateEntry(raw as Record<string, unknown>);\n    if (validated === null) {\n      diag(\n        `[theokit-sdk] WARN: Skipping malformed catalog entry: ${JSON.stringify(raw).slice(0, 100)}\\n`,\n      );\n      continue;\n    }\n    result[validated.id] = validated;\n  }\n  return result;\n}\n\nlet _capabilitiesCache: Record<string, ProviderCapabilities> | null = null;\n\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nexport function getCatalogCapabilities(providerId: string): ProviderCapabilities | undefined {\n  if (_capabilitiesCache === null) {\n    const catalog = loadProviderCatalog();\n    _capabilitiesCache = {};\n    for (const entry of Object.values(catalog)) {\n      _capabilitiesCache[entry.id] = entry.capabilities;\n      // M45 review L4 — alias keys too (e.g. entry `google-gemini` alias `google`), consistent with the\n      // model-info index's alias-keyed convention.\n      for (const alias of entry.aliases ?? []) {\n        if (_capabilitiesCache[alias] === undefined) _capabilitiesCache[alias] = entry.capabilities;\n      }\n    }\n  }\n  return _capabilitiesCache[providerId];\n}\n\nexport function registerCatalogProviders(opts?: LoadOptions): void {\n  const catalog = loadProviderCatalog(opts);\n  for (const entry of Object.values(catalog)) {\n    // Skip catalog entries that would overwrite first-party builtins.\n    // Builtins have richer env-var handling and are registered first.\n    // Also skip if any alias collides with an existing provider name.\n    if (getProviderProfile(entry.id) !== undefined) continue;\n    if (entry.aliases?.some((a) => getProviderProfile(a) !== undefined)) continue;\n\n    const profile: ProviderProfile = {\n      name: entry.id,\n      apiMode: entry.apiMode,\n      authType: entry.authType,\n      baseUrl: entry.baseUrl,\n      envVars: entry.envVars,\n      fallbackModels: entry.fallbackModels,\n      displayName: entry.displayName,\n      aliases: entry.aliases,\n      modelsUrl: entry.modelsUrl,\n      hostname: entry.hostname,\n      extraHeaders: entry.extraHeaders,\n    };\n    registerProvider(profile);\n  }\n}\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const ANTHROPIC: ProviderProfile = {\n  name: \"anthropic\",\n  apiMode: \"anthropic_messages\",\n  envVars: [\"ANTHROPIC_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://api.anthropic.com\",\n  modelsUrl: \"https://api.anthropic.com/v1/models\",\n  hostname: \"api.anthropic.com\",\n  fallbackModels: [\"claude-opus-4-7\", \"claude-sonnet-4-6\", \"claude-haiku-4-5-20251001\"],\n  // M45 — the Anthropic beta-features header (interleaved thinking + fine-grained tool streaming). An\n  // Anthropic API constant, adapted verbatim from OpenCode's anthropic plugin (MIT © 2025 opencode). The\n  // SANCTIONED behavior delta of M45 (ADR D4) — consumed by the anthropic transport's extraHeaders wiring.\n  extraHeaders: {\n    \"anthropic-beta\": \"interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14\",\n  },\n};\n","/**\n * AWS Bedrock profile (Adoption Roadmap #8; ADRs D286-D302).\n *\n * Bearer-only auth via `AWS_BEARER_TOKEN_BEDROCK` env (GA Sep 2025).\n * Optional `@aws/bedrock-token-generator` peer dep auto-refreshes short-term\n * tokens (D287). Transport via native `fetch`; no `@aws-sdk/*` dependency.\n *\n * Model IDs follow the `bedrock/{aws-id}` convention so the router can\n * infer the provider via prefix routing (D186). The client strips the\n * `bedrock/` prefix before building the URL.\n *\n * @internal\n */\n\nimport type { ProviderProfile } from \"../types.js\";\n\nexport const BEDROCK: ProviderProfile = {\n  name: \"bedrock\",\n  apiMode: \"bedrock_anthropic\",\n  envVars: [\"AWS_BEARER_TOKEN_BEDROCK\"],\n  authType: \"aws_bearer\",\n  baseUrl: \"https://bedrock-runtime.us-east-1.amazonaws.com\",\n  modelsUrl: undefined,\n  hostname: \"bedrock-runtime.amazonaws.com\",\n  fallbackModels: [\n    \"bedrock/us.anthropic.claude-sonnet-4-5-v1:0\",\n    \"bedrock/us.anthropic.claude-opus-4-7-v1:0\",\n    \"bedrock/global.anthropic.claude-haiku-4-5-v1:0\",\n  ],\n};\n\n/** Strip `\"bedrock/\"` prefix so the raw AWS model id is used in the URL. */\nexport function stripBedrockPrefix(modelId: string): string {\n  return modelId.replace(/^bedrock\\//, \"\");\n}\n\n/**\n * Infer AWS region from a Bedrock model id prefix (D290).\n *\n * `global.*` routes via `us-east-1` (AWS default entrypoint for global\n * inference profiles).\n */\nexport function inferRegionFromModelId(modelId: string): string | undefined {\n  const id = stripBedrockPrefix(modelId);\n  if (id.startsWith(\"global.\")) return \"us-east-1\";\n  if (id.startsWith(\"us.\")) return process.env.AWS_REGION ?? \"us-east-1\";\n  if (id.startsWith(\"eu.\")) return process.env.AWS_REGION ?? \"eu-west-1\";\n  if (id.startsWith(\"apac.\")) return process.env.AWS_REGION ?? \"ap-southeast-1\";\n  if (id.startsWith(\"jp.\")) return \"ap-northeast-1\";\n  return undefined;\n}\n\n/** Resolve baseUrl from model id; falls back to `AWS_REGION` env or `us-east-1`. */\nexport function resolveBedrockBaseUrl(modelId: string): string {\n  const region = inferRegionFromModelId(modelId) ?? process.env.AWS_REGION ?? \"us-east-1\";\n  return `https://bedrock-runtime.${region}.amazonaws.com`;\n}\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * M45 — the data-only base for OpenAI-compatible chat_completions providers. OpenCode's\n * `openai-compatible-profile` pattern (MIT © 2025 opencode — `packages/llm/src/providers/`) flattened to\n * theokit's data model: leaves declare name/baseUrl/envVars (+ overrides) in ~10 lines; the router's\n * URL-join rule (version-segment detection + `chatCompletionsPath` escape) derives the endpoint.\n *\n * @internal\n */\nexport function openAiCompatibleProfile(\n  p: { name: string; baseUrl: string; envVars: readonly string[] } & Partial<ProviderProfile>,\n): ProviderProfile {\n  return {\n    apiMode: \"chat_completions\",\n    authType: \"api_key\",\n    fallbackModels: [],\n    ...p,\n  };\n}\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Cerebras. Integration header adapted from OpenCode's `cerebras.ts` (MIT — value changed to\n * `theokit`, never `opencode`: the header attributes TRAFFIC). Models per models.dev (2026-07 snapshot).\n */\nexport const CEREBRAS = openAiCompatibleProfile({\n  name: \"cerebras\",\n  baseUrl: \"https://api.cerebras.ai/v1\",\n  envVars: [\"CEREBRAS_API_KEY\"],\n  fallbackModels: [\"gpt-oss-120b\", \"zai-glm-4.7\"],\n  extraHeaders: { \"X-Cerebras-3rd-Party-Integration\": \"theokit\" },\n  hostname: \"api.cerebras.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Cohere via its OpenAI-compatibility surface (`api.cohere.ai/compatibility/v1` — the native v2 API\n * is NOT chat_completions; the discovery flagged the old catalog baseUrl as doubly wrong). Models per\n * models.dev `cohere` (2026-07 snapshot). SOURCE NOTE (review L2): the compatibility endpoint + `CO_API_KEY`\n * come from Cohere's own docs/python-SDK convention (not vendored in this repo's references) — verify with a\n * live smoke when a key is available.\n */\nexport const COHERE = openAiCompatibleProfile({\n  name: \"cohere\",\n  baseUrl: \"https://api.cohere.ai/compatibility/v1\",\n  envVars: [\"COHERE_API_KEY\", \"CO_API_KEY\"],\n  fallbackModels: [\"command-a-03-2025\"],\n  hostname: \"api.cohere.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — DeepInfra. OpenAI-compat surface under /v1/openai (models.dev `deepinfra`, OpenCode profile map). */\nexport const DEEPINFRA = openAiCompatibleProfile({\n  name: \"deepinfra\",\n  baseUrl: \"https://api.deepinfra.com/v1/openai\",\n  envVars: [\"DEEPINFRA_API_KEY\"],\n  fallbackModels: [\"Qwen/Qwen3-32B\"],\n  hostname: \"api.deepinfra.com\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * Gemini via OpenRouter passthrough. Direct Gemini API uses a different\n * dialect (`generateContent`); SDK currently routes through OpenRouter's\n * OpenAI-compatible endpoint so the chat_completions transport works.\n *\n * A future plugin `@theokit-provider-gemini-direct` can override this with\n * `apiMode: \"gemini_generate_content\"` once that transport ships.\n */\nexport const GEMINI: ProviderProfile = {\n  name: \"gemini\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OPENROUTER_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://openrouter.ai/api\",\n  hostname: \"openrouter.ai\",\n  fallbackModels: [\"google/gemini-2.0-flash-001\"],\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Google Gemini via the DIRECT OpenAI-compat endpoint (a Google API key, not OpenRouter). Distinct\n * from the `gemini` builtin (an OpenRouter passthrough) by ADR D3 — two routes, two names. Endpoint + env\n * vars per Google's OpenAI-compatibility docs (mirrored by models.dev `google` + the M44 catalog entry).\n */\nexport const GOOGLE = openAiCompatibleProfile({\n  name: \"google\",\n  baseUrl: \"https://generativelanguage.googleapis.com/v1beta/openai\",\n  envVars: [\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\", \"GOOGLE_GENERATIVE_AI_API_KEY\"],\n  fallbackModels: [\"gemini-2.5-pro\", \"gemini-2.5-flash\"],\n  hostname: \"generativelanguage.googleapis.com\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Groq. Values per models.dev `groq` (2026-07 snapshot); OpenAI-compat surface under /openai/v1. */\nexport const GROQ = openAiCompatibleProfile({\n  name: \"groq\",\n  baseUrl: \"https://api.groq.com/openai/v1\",\n  envVars: [\"GROQ_API_KEY\"],\n  fallbackModels: [\"llama-3.3-70b-versatile\", \"llama-3.1-8b-instant\"],\n  hostname: \"api.groq.com\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * llama.cpp server provider profile (T7.2, ADR D189).\n *\n * llama.cpp ships a HTTP server binary (`./server` since b1500+) that\n * implements the OpenAI-compatible `/v1/chat/completions` endpoint on\n * `http://localhost:8080` by default. Inherits `authType: \"none\"` from\n * D182 — no API key required for local use.\n *\n * llama.cpp idiosyncrasies:\n *  - Server loads a single GGUF model at startup via `--model` CLI\n *    flag. The `model` field in the chat-completions request is\n *    cosmetic — any string works; the response comes from the loaded\n *    model regardless. This is documented in\n *    `.claude/knowledge-base/reviews/edge-case/ollama-integration-edge-cases-2026-05-21.md`\n *    as EC-O.\n *  - Tool calling support depends entirely on the underlying model.\n *\n * Override the default URL with `LLAMACPP_HOST`.\n *\n * @internal\n */\nexport const LLAMACPP: ProviderProfile = {\n  name: \"llamacpp\",\n  aliases: [\"llama-cpp\", \"llama.cpp\"],\n  apiMode: \"chat_completions\",\n  envVars: [\"LLAMACPP_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:8080\",\n  modelsUrl: \"http://localhost:8080/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"loaded-model\"],\n};\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * LM Studio provider profile (T7.1, ADR D188).\n *\n * LM Studio exposes an OpenAI-compatible `/v1/chat/completions` endpoint\n * on `http://localhost:1234` by default (configurable via the LM Studio\n * UI under \"Local Server\"). Inherits the `authType: \"none\"` primitive\n * from D182 — no API key required for local use.\n *\n * LM Studio idiosyncrasies:\n *  - Loads ONE model at a time via the desktop UI. The `model` field in\n *    the chat-completions request is informational only — LM Studio\n *    serves whatever model is currently loaded.\n *  - `/v1/models` returns a single entry pointing to the loaded model.\n *  - Tool calling depends on the underlying model.\n *\n * Override the default URL with `LMSTUDIO_HOST` (mirrors `OLLAMA_HOST`).\n *\n * @internal\n */\nexport const LMSTUDIO: ProviderProfile = {\n  name: \"lmstudio\",\n  aliases: [\"lm-studio\", \"lm_studio\"],\n  apiMode: \"chat_completions\",\n  envVars: [\"LMSTUDIO_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:1234\",\n  modelsUrl: \"http://localhost:1234/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"loaded-model\"],\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Mistral (La Plateforme). Values per models.dev `mistral` (2026-07 snapshot). */\nexport const MISTRAL = openAiCompatibleProfile({\n  name: \"mistral\",\n  baseUrl: \"https://api.mistral.ai/v1\",\n  envVars: [\"MISTRAL_API_KEY\"],\n  fallbackModels: [\"mistral-large-latest\", \"codestral-latest\"],\n  hostname: \"api.mistral.ai\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * Ollama — local-first LLM runtime (ADR D182).\n *\n * Ships as a builtin so `Agent.create({ model: \"ollama/llama3.2\" })` works\n * with zero configuration when `ollama serve` is running on the default\n * port. `authType: \"none\"` signals the router to skip env-key resolution\n * and use a placeholder credential (Ollama ignores Authorization headers\n * on local installs).\n *\n * Overrides:\n * - `OLLAMA_HOST` — replaces the default `http://localhost:11434` baseUrl\n *   (advanced users running Ollama on a remote machine).\n * - `OLLAMA_API_KEY` — replaces the placeholder when Ollama is behind a\n *   reverse-proxy with auth or when using Ollama Cloud (paid tier).\n */\nexport const OLLAMA: ProviderProfile = {\n  name: \"ollama\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OLLAMA_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:11434\",\n  modelsUrl: \"http://localhost:11434/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"llama3.2\", \"qwen2.5\", \"mistral\"],\n};\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const OPENAI: ProviderProfile = {\n  name: \"openai\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OPENAI_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://api.openai.com\",\n  modelsUrl: \"https://api.openai.com/v1/models\",\n  hostname: \"api.openai.com\",\n  fallbackModels: [\"gpt-4o\", \"gpt-4o-mini\"],\n};\n","import { homedir } from \"node:os\";\n\nimport type { CredentialStoreConfig, OAuthProviderConfig } from \"../../auth/auth-types.js\";\nimport { readStoredOAuth } from \"../../auth/credential-store.js\";\nimport { resolveCredential } from \"../../auth/resolve-credential.js\";\nimport type { ProviderProfile } from \"../types.js\";\n\n/**\n * M43 — the ChatGPT \"Codex\" backend as a first-class builtin `ProviderProfile`. Migrated from the\n * agent-builder M40 workaround; the SDK now owns the provider, so a consumer only selects\n * `openai-chatgpt/<model>` and logs in — ZERO provider logic in the consumer.\n *\n * Grounded 100% in OpenCode's provider-auth model (see the codex-provider-in-sdk blueprint):\n * - static profile + a `transform.fetch` that resolves the LIVE credential per HTTP request (fresh Bearer +\n *   dynamic `ChatGPT-Account-Id`), so a mid-turn expiry refreshes transparently with NO agent rebuild;\n * - the protocol values (endpoint, models, oauth config, `originator` header) are SDK-owned constants,\n *   adapted from OpenCode's `openai.ts` (MIT © 2025 opencode — see NOTICE).\n *\n * @internal\n */\n\n/**\n * The SDK-owned ambient credential store the transform reads. Defaults to `~/.theokit/auth.json`. A consumer\n * points it at its existing store dir via the DEDICATED `THEOKIT_AUTH_HOME` env var (NOT `THEOKIT_HOME` — that\n * is the SDK's whole home directory for personality/credential-pool/profiles; overloading it would redirect\n * the entire runtime). The OpenCode \"ambient credential Service\" analog.\n */\nconst DEFAULT_STORE: CredentialStoreConfig = {\n  home: homedir(),\n  dirName: \".theokit\",\n  fileName: \"auth.json\",\n  homeEnvVar: \"THEOKIT_AUTH_HOME\",\n};\n\n/**\n * The OpenAI OAuth config the transform resolves + refreshes against. `provider: \"openai\"` is the STORE\n * provider (what `/login` persists), deliberately distinct from this profile's routing name `openai-chatgpt`\n * — the two-namespace split (integration id vs routed provider) mirrors OpenCode. Endpoints/clientId/scopes\n * adapted from OpenCode `openai.ts`.\n */\nconst OPENAI_OAUTH_CONFIG: OAuthProviderConfig = {\n  provider: \"openai\",\n  authorizeEndpoint: \"https://auth.openai.com/oauth/authorize\",\n  tokenEndpoint: \"https://auth.openai.com/oauth/token\",\n  clientId: \"app_EMoamEEZ73f0CkXaXp7hrann\",\n  scopes: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n  redirectUri: \"https://auth.openai.com/deviceauth/callback\",\n};\n\n/**\n * Build the per-request fetch: resolve a FRESH (refreshed) Bearer + the LIVE account-id from the ambient\n * store, and inject them as headers. Re-resolves on EVERY call → mid-turn refresh with no rebuild. A\n * `Headers` object is used so `authorization` is set case-insensitively (never doubled). If no credential is\n * logged in, throw a clear error rather than putting the router's `__oauth_lazy_token__` placeholder on the\n * wire (fail-closed — the OpenCode `MissingCredentialError` semantics).\n */\nfunction codexFetch(): typeof fetch {\n  return (async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n    const env = process.env as Record<string, string | undefined>;\n    const resolved = await resolveCredential({\n      provider: \"openai\",\n      store: DEFAULT_STORE,\n      oauth: OPENAI_OAUTH_CONFIG,\n      env,\n    });\n    if (resolved === undefined) {\n      throw new Error(\n        'openai-chatgpt: no ChatGPT credential found — run the OpenAI device login (e.g. \"/login openai\") first.',\n      );\n    }\n    const accountId = readStoredOAuth(DEFAULT_STORE, env)?.account_id;\n    const headers = new Headers(init?.headers);\n    headers.set(\"authorization\", `Bearer ${resolved.apiKey}`);\n    if (accountId !== undefined) headers.set(\"ChatGPT-Account-Id\", accountId);\n    return fetch(input, { ...init, headers });\n  }) as typeof fetch;\n}\n\nexport const OPENAI_CHATGPT: ProviderProfile = {\n  name: \"openai-chatgpt\",\n  apiMode: \"responses_api\",\n  authType: \"oauth_device_code\",\n  baseUrl: \"https://chatgpt.com/backend-api/codex\",\n  envVars: [],\n  fallbackModels: [\n    \"openai-chatgpt/gpt-5.4\",\n    \"openai-chatgpt/gpt-5.4-mini\",\n    \"openai-chatgpt/gpt-5.5\",\n  ],\n  // #165 — this shipped as `codex_cli_rs`, which is the OFFICIAL Codex CLI's own value\n  // (`codex-rs/login/src/auth/default_client.rs`, `DEFAULT_ORIGINATOR`). Claiming to be a different\n  // vendor's client is a false statement of identity, and it diverged from the very prior art this\n  // file is adapted from: OpenCode sends `originator: \"opencode\"` — its own name — against this same\n  // endpoint, which also shows the route is not restricted to the official client.\n  extraHeaders: { originator: \"theokit\" },\n  transform: {\n    // Only `fetch` (async) can await the credential refresh; `headers` is sync and cannot.\n    fetch: () => codexFetch(),\n  },\n};\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const OPENROUTER: ProviderProfile = {\n  name: \"openrouter\",\n  apiMode: \"chat_completions\",\n  aliases: [\"or\"],\n  // Ordered fallback (EC-10): OPENROUTER_API_KEY preferred, OPENAI_API_KEY as compat.\n  envVars: [\"OPENROUTER_API_KEY\", \"OPENAI_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://openrouter.ai/api\",\n  modelsUrl: \"https://openrouter.ai/api/v1/models\",\n  hostname: \"openrouter.ai\",\n  // M45 — models refreshed (claude-3-haiku retired upstream).\n  fallbackModels: [\"openai/gpt-4o-mini\", \"anthropic/claude-haiku-4-5\"],\n  // M45 — OpenRouter app-attribution headers (mechanism from OpenCode's openrouter plugin, MIT; VALUES are\n  // theokit's own — copying another app's referer would misattribute traffic).\n  extraHeaders: { \"HTTP-Referer\": \"https://usetheo.dev\", \"X-Title\": \"theokit\" },\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Perplexity. Its endpoint is UNVERSIONED (`/chat/completions`) — the explicit `chatCompletionsPath`\n * escape expresses it (the sonar-online model family was retired; models per models.dev `perplexity`).\n */\nexport const PERPLEXITY = openAiCompatibleProfile({\n  name: \"perplexity\",\n  baseUrl: \"https://api.perplexity.ai\",\n  chatCompletionsPath: \"/chat/completions\",\n  envVars: [\"PERPLEXITY_API_KEY\"],\n  fallbackModels: [\"sonar-pro\", \"sonar\"],\n  hostname: \"api.perplexity.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Together AI (models.dev id `togetherai` — kept as an alias). Values per the 2026-07 snapshot. */\nexport const TOGETHER = openAiCompatibleProfile({\n  name: \"together\",\n  aliases: [\"togetherai\"],\n  baseUrl: \"https://api.together.xyz/v1\",\n  envVars: [\"TOGETHER_API_KEY\"],\n  fallbackModels: [\"Qwen/Qwen2.5-7B-Instruct-Turbo\"],\n  hostname: \"api.together.xyz\",\n});\n","/**\n * GCP Vertex AI profile (Adoption Roadmap #8; ADRs D286-D302).\n *\n * Required peer dep: `google-auth-library` (D288). Resolves access tokens\n * via ADC (env → gcloud → metadata server → WIF).\n *\n * Model IDs follow the convention `vertex/{dialect}/{model}`:\n *   - `vertex/google/gemini-2.0-flash-001` → OpenAI-compat endpoint (D291)\n *   - `vertex/anthropic/claude-sonnet-4-5@20250929` → :rawPredict (D292)\n *\n * @internal\n */\n\nimport type { ProviderProfile } from \"../types.js\";\n\nexport const VERTEX: ProviderProfile = {\n  name: \"vertex\",\n  apiMode: \"anthropic_messages\", // sub-dispatched in selectTransport by profile.name\n  envVars: [\"GOOGLE_APPLICATION_CREDENTIALS\"],\n  authType: \"gcp_oauth\",\n  baseUrl: \"https://us-central1-aiplatform.googleapis.com\",\n  modelsUrl: undefined,\n  hostname: \"aiplatform.googleapis.com\",\n  fallbackModels: [\n    \"vertex/anthropic/claude-sonnet-4-5@20250929\",\n    \"vertex/google/gemini-2.0-flash-001\",\n  ],\n};\n\n/**\n * D293 absorbed: when location === \"global\", use `aiplatform.googleapis.com`\n * (no `global-` prefix) — known bug `streamRawPredict` 404 at\n * `global-aiplatform.googleapis.com` (a peer#10287).\n */\nexport function resolveVertexBaseUrl(opts: {\n  projectId: string;\n  location: string;\n  modelDialect: \"anthropic\" | \"gemini\";\n}): string {\n  const host =\n    opts.location === \"global\"\n      ? \"aiplatform.googleapis.com\"\n      : `${opts.location}-aiplatform.googleapis.com`;\n  if (opts.modelDialect === \"gemini\") {\n    // OpenAI-compat endpoint (D291) — the client appends `/chat/completions`.\n    return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/endpoints/openapi`;\n  }\n  // Anthropic — base URL up to `/publishers/anthropic` (model id appended by client).\n  return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/publishers/anthropic`;\n}\n\n/** Detect dialect from a `vertex/{dialect}/{model}` id. Default: gemini. */\nexport function inferModelDialect(modelId: string): \"anthropic\" | \"gemini\" {\n  if (modelId.includes(\"/anthropic/\")) return \"anthropic\";\n  if (modelId.includes(\"/google/\")) return \"gemini\";\n  return \"gemini\";\n}\n\n/** Strip the `vertex/{dialect}/` prefix so the raw model id is used in the URL. */\nexport function stripVertexPrefix(modelId: string): string {\n  return modelId.replace(/^vertex\\/(anthropic|google)\\//, \"\");\n}\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — xAI (Grok). Values per models.dev `xai` (2026-07 snapshot; grok-2 retired). */\nexport const XAI = openAiCompatibleProfile({\n  name: \"xai\",\n  aliases: [\"grok\"],\n  baseUrl: \"https://api.x.ai/v1\",\n  envVars: [\"XAI_API_KEY\"],\n  fallbackModels: [\"grok-4.5\", \"grok-4.3\"],\n  hostname: \"api.x.ai\",\n});\n","/**\n * Eager registration of builtin providers (T3.3). Side-effect import:\n * importing this module registers the 4 builtins with the registry.\n *\n * Lazy user-plugin discovery is handled by `discovery.ts` (T3.4).\n *\n * @internal\n */\n\nimport { registerCatalogProviders } from \"../catalog-loader.js\";\nimport { registerProvider } from \"../registry.js\";\nimport { ANTHROPIC } from \"./anthropic.js\";\nimport { BEDROCK } from \"./bedrock.js\";\nimport { CEREBRAS } from \"./cerebras.js\";\nimport { COHERE } from \"./cohere.js\";\nimport { DEEPINFRA } from \"./deepinfra.js\";\nimport { GEMINI } from \"./gemini.js\";\nimport { GOOGLE } from \"./google.js\";\nimport { GROQ } from \"./groq.js\";\nimport { LLAMACPP } from \"./llamacpp.js\";\nimport { LMSTUDIO } from \"./lmstudio.js\";\nimport { MISTRAL } from \"./mistral.js\";\nimport { OLLAMA } from \"./ollama.js\";\nimport { OPENAI } from \"./openai.js\";\nimport { OPENAI_CHATGPT } from \"./openai-chatgpt.js\";\nimport { OPENROUTER } from \"./openrouter.js\";\nimport { PERPLEXITY } from \"./perplexity.js\";\nimport { TOGETHER } from \"./together.js\";\nimport { VERTEX } from \"./vertex.js\";\nimport { XAI } from \"./xai.js\";\n\n// M45 review M2 — the guard lives on globalThis like the registry itself (M44 B1): a process importing both\n// bundle copies (`@theokit/sdk` + `@theokit/sdk/models`) must not re-register 19 builtins with bogus\n// \"overridden by user plugin\" WARNs.\nconst _registeredState = ((): { done: boolean } => {\n  const g = globalThis as unknown as Record<symbol, { done: boolean }>;\n  const sym = Symbol.for(\"theokit-sdk.providers.builtins-registered\");\n  if (g[sym] === undefined) g[sym] = { done: false };\n  return g[sym];\n})();\n\nexport function registerBuiltins(): void {\n  if (_registeredState.done) return;\n  _registeredState.done = true;\n  // First-party builtins (take priority — registered first)\n  registerProvider(ANTHROPIC);\n  registerProvider(OPENAI);\n  registerProvider(OPENAI_CHATGPT);\n  registerProvider(OPENROUTER);\n  registerProvider(GEMINI);\n  registerProvider(OLLAMA);\n  registerProvider(LMSTUDIO);\n  registerProvider(LLAMACPP);\n  registerProvider(BEDROCK);\n  registerProvider(VERTEX);\n  // M45 — the data-provider fleet (one file each on the openai-compatible base).\n  registerProvider(GOOGLE);\n  registerProvider(MISTRAL);\n  registerProvider(GROQ);\n  registerProvider(COHERE);\n  registerProvider(DEEPINFRA);\n  registerProvider(TOGETHER);\n  registerProvider(XAI);\n  registerProvider(PERPLEXITY);\n  registerProvider(CEREBRAS);\n  // Dynamic catalog — 40+ providers from JSON (T10.1, ADR D447)\n  registerCatalogProviders();\n}\n\n/** Test-only reset. @internal */\nexport function _resetBuiltinsRegistered(): void {\n  _registeredState.done = false;\n}\n\nexport {\n  ANTHROPIC,\n  BEDROCK,\n  GEMINI,\n  LLAMACPP,\n  LMSTUDIO,\n  OLLAMA,\n  OPENAI,\n  OPENAI_CHATGPT,\n  OPENROUTER,\n  VERTEX,\n};\n"]}

package/dist/chunk-33L2NVTJ.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/auth/oauth-engine.ts","../src/internal/auth/resolve-credential.ts"],"names":["AuthCallbackError","writeCredential","authFilePath","readStoredOAuth","fresh","readAuthFile"],"mappings":";;;;;;AA8BA,IAAM,eAAA,GAAkB,GAAA;AAGxB,SAAS,kBAAA,CAAmB,MAAe,GAAA,EAA0B;AACnE,EAAA,MAAM,CAAA,GAAI,IAAA;AAMV,EAAA,IAAI,OAAO,CAAA,CAAE,YAAA,KAAiB,YAAY,CAAA,CAAE,YAAA,CAAa,WAAW,CAAA,EAAG;AACrE,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,OAAO,CAAA,CAAE,aAAA,KAAkB,YAAY,CAAA,CAAE,aAAA,CAAc,WAAW,CAAA,EAAG;AACvE,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,YAAY,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,UAAA,GAAa,IAAA;AACpE,EAAA,OAAO;AAAA,IACL,QAAQ,CAAA,CAAE,YAAA;AAAA,IACV,SAAS,CAAA,CAAE,aAAA;AAAA,IACX,OAAA,EAAS,MAAM,SAAA,GAAY,GAAA;AAAA,IAC3B,GAAI,OAAO,CAAA,CAAE,UAAA,KAAe,QAAA,GAAW,EAAE,SAAA,EAAW,CAAA,CAAE,UAAA,EAAW,GAAI;AAAC,GACxE;AACF;AAGA,eAAe,SAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACsB;AACtB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,aAAA,EAAe;AAAA,MAC3C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAqC,QAAQ,kBAAA,EAAmB;AAAA,MAC3F,IAAA,EAAM,IAAI,eAAA,CAAgB,IAAI,EAAE,QAAA;AAAS,KAC1C,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,+BAAA,EAAmC,IAAc,OAAO,CAAA;AAAA,KAC1D;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AAGX,IAAA,MAAM,IAAIA,mCAAA;AAAA,MACR,6BAAA;AAAA,MACA,CAAA,6BAAA,EAAgC,IAAI,MAAM,CAAA;AAAA,KAC5C;AAAA,EACF;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,MAAM,IAAI,IAAA,EAAK;AAAA,EACxB,CAAA,CAAA,MAAQ;AAGN,IAAA,MAAM,IAAIA,mCAAA,CAAkB,6BAAA,EAA+B,mCAAmC,CAAA;AAAA,EAChG;AACA,EAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,IAAA,CAAK,GAAA,EAAK,CAAA;AAC5C;AAGO,SAAS,YAAA,CACd,MAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA;AAAA,MACE,UAAA,EAAY,oBAAA;AAAA,MACZ,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,cAAc,MAAA,CAAO,WAAA;AAAA,MACrB,WAAW,MAAA,CAAO,QAAA;AAAA,MAClB,eAAe,KAAA,CAAM;AAAA,KACvB;AAAA,IACA;AAAA,GACF;AACF;AAGO,SAAS,kBAAA,CACd,MAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,OAAO,SAAA;AAAA,IACL,MAAA;AAAA,IACA,EAAE,UAAA,EAAY,eAAA,EAAiB,eAAe,OAAA,EAAS,SAAA,EAAW,OAAO,QAAA,EAAS;AAAA,IAClF;AAAA,GACF;AACF;AAGO,SAAS,mBACd,QAAA,EACA,MAAA,EACA,KAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,OAAOC,iCAAA;AAAA,IACL;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,QAAA;AAAA,MACA,QAAQ,MAAA,CAAO,MAAA;AAAA,MACf,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,GAAI,OAAO,SAAA,KAAc,MAAA,GAAY,EAAE,UAAA,EAAY,MAAA,CAAO,SAAA,EAAU,GAAI;AAAC,KAC3E;AAAA,IACA,KAAA;AAAA,IACA;AAAA,GACF;AACF;AAQA,IAAM,eAAA,uBAAsB,GAAA,EAAkC;AAQ9D,eAAsB,qBAAA,CACpB,QAAA,EACA,IAAA,EAKA,IAAA,EAC6B;AAC7B,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,OAAA,EAAS,OAAO,QAAA;AAEtC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,SAAS,SAAA,KAAc,MAAA,IAAa,QAAA,CAAS,SAAA,GAAY,MAAM,eAAA,EAAiB;AAClF,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,IAAA,GAAOC,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACzC,EAAA,IAAI,OAAA,GAAU,eAAA,CAAgB,GAAA,CAAI,IAAI,CAAA;AACtC,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,OAAA,GAAA,CAAW,YAAkC;AAC3C,MAAA,MAAM,MAAA,GAASC,iCAAA,CAAgB,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC9C,MAAA,IAAI,WAAW,MAAA,EAAW;AAExB,QAAA,MAAM,IAAIH,mCAAA;AAAA,UACR,6BAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,MAAMI,SAAQ,MAAM,kBAAA,CAAmB,KAAK,MAAA,EAAQ,MAAA,CAAO,SAAS,IAAI,CAAA;AAKxE,MAAA,MAAM,MAAA,GAAsB;AAAA,QAC1B,GAAGA,MAAAA;AAAA,QACH,SAAA,EAAWA,MAAAA,CAAM,SAAA,IAAa,MAAA,CAAO;AAAA,OACvC;AACA,MAAA,kBAAA,CAAmB,QAAA,CAAS,QAAA,EAAU,MAAA,EAAQ,IAAA,CAAK,OAAO,GAAG,CAAA;AAC7D,MAAA,OAAO,MAAA;AAAA,IACT,CAAA,GAAG;AACH,IAAA,eAAA,CAAgB,GAAA,CAAI,MAAM,OAAO,CAAA;AACjC,IAAA,OAAA,CAAQ,OAAA,CAAQ,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA,CAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EACpE;AAEA,EAAA,MAAM,QAAQ,MAAM,OAAA;AACpB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,KAAA,CAAM;AAAA,GACnB;AACF;;;ACpLA,eAAe,YAAA,CACb,MAAA,EACA,IAAA,EACA,IAAA,EACA,GAAA,EACyC;AACzC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,MAAM,IAAA,GAA2B;AAAA,IAC/B,IAAA,EAAM,OAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU,KAAA;AAAA,IACV,WAAW,MAAA,CAAO;AAAA,GACpB;AACA,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AACrC,EAAA,MAAM,IAAA,GAAiB;AAAA,IACrB,KAAA,EAAO,IAAA,CAAK,IAAA,EAAM,KAAA,IAAS,KAAA;AAAA,IAC3B,KAAK,IAAA,CAAK,IAAA,EAAM,GAAA,KAAQ,MAAM,KAAK,GAAA,EAAI;AAAA,GACzC;AACA,EAAA,OAAO,qBAAA,CAAsB,IAAA,EAAM,EAAE,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,GAAA,EAAI,EAAG,IAAI,CAAA;AACzF;AAEA,eAAsB,kBACpB,IAAA,EACyC;AACzC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,EAAC;AACzB,EAAA,MAAM,MAAA,GAASC,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAC3C,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AAEjC,EAAA,MAAM,IAAA,GAAOH,8BAAA,CAAa,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AAEzC,EAAA,IAAI,MAAA,CAAO,SAAS,OAAA,EAAS;AAC3B,IAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,GAAG,CAAA;AAAA,EAC7C;AAOA,EAAA,IAAI,MAAA,CAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACxC,EAAA,IAAI,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,EAAU,OAAO,MAAA;AAC9C,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,QAAQ,MAAA,CAAO,OAAA;AAAA,IACf,MAAA,EAAQ,IAAA;AAAA,IACR,QAAA,EAAU;AAAA,GACZ;AACF","file":"chunk-33L2NVTJ.cjs","sourcesContent":["/**\n * M42 — the SDK OAuth engine. Promoted DOWN from agent-builder's hardened `agents/lib/oauth.ts` +\n * `oauth-device.ts` (M37), generalized to `provider: string` + a caller-supplied {@link CredentialStoreConfig}\n * (no hardcoded client IDs — the caller declares its provider's endpoints). Ported VERBATIM (ADR D3): the\n * refresh coalescing lock, the no-token-in-error discipline, and the RFC 8628 device grant.\n *\n * Reuses the SDK's typed error taxonomy (`AuthCallbackError` from `server/auth`) for exchange/refresh\n * failures. All network I/O + clock + sleep are INJECTED so the flow is deterministic.\n *\n * ─── ADAPTED FROM OpenCode (MIT License, Copyright (c) 2025 opencode — https://github.com/sst/opencode) ───\n *   - the device-grant poll loop (device_code → authorization_pending / slow_down) is adapted from\n *     `packages/opencode/src/plugin/github-copilot/copilot.ts`;\n *   - the JWT-claim / account-id extraction + the OpenAI two-step headless flow are adapted from\n *     `packages/opencode/src/plugin/openai/codex.ts`.\n * The MIT license permits this reuse with attribution; this notice + the NOTICE file are that attribution.\n *\n * @internal\n */\nimport { AuthCallbackError } from \"../../server/auth/errors.js\";\n\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  OAuthTokens,\n  ResolvedCredential,\n} from \"./auth-types.js\";\nimport { authFilePath, readStoredOAuth, writeCredential } from \"./credential-store.js\";\n\n/** Refresh a token this many ms BEFORE it actually expires (avoid a last-second, mid-request expiry). */\nconst REFRESH_SKEW_MS = 60_000;\n\n/** Parse an OAuth token endpoint response into our token triple. Throws a typed error on a bad shape. */\nfunction parseTokenResponse(body: unknown, now: number): OAuthTokens {\n  const b = body as {\n    access_token?: unknown;\n    refresh_token?: unknown;\n    expires_in?: unknown;\n    account_id?: unknown;\n  };\n  if (typeof b.access_token !== \"string\" || b.access_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no access_token\",\n    );\n  }\n  if (typeof b.refresh_token !== \"string\" || b.refresh_token.length === 0) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      \"token response had no refresh_token\",\n    );\n  }\n  const expiresIn = typeof b.expires_in === \"number\" ? b.expires_in : 3600;\n  return {\n    access: b.access_token,\n    refresh: b.refresh_token,\n    expires: now + expiresIn * 1000,\n    ...(typeof b.account_id === \"string\" ? { accountId: b.account_id } : {}),\n  };\n}\n\n/** POST a form-encoded grant to the token endpoint; return the parsed JSON or throw a typed error. */\nasync function postGrant(\n  config: OAuthProviderConfig,\n  form: Record<string, string>,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  let res: Response;\n  try {\n    res = await deps.fetch(config.tokenEndpoint, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/x-www-form-urlencoded\", accept: \"application/json\" },\n      body: new URLSearchParams(form).toString(),\n    });\n  } catch (err) {\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint request failed: ${(err as Error).message}`,\n    );\n  }\n  if (!res.ok) {\n    // The body may carry an OAuth `error` code, but never echo it verbatim — it can contain a token in\n    // some providers' error payloads. Report the status only.\n    throw new AuthCallbackError(\n      \"oauth_token_exchange_failed\",\n      `token endpoint returned HTTP ${res.status}`,\n    );\n  }\n  let json: unknown;\n  try {\n    json = await res.json();\n  } catch {\n    // Do NOT echo the parser message — on a 200 non-JSON body it embeds a snippet of the response, which\n    // in a token context can contain access/refresh material.\n    throw new AuthCallbackError(\"oauth_token_exchange_failed\", \"token response was not valid JSON\");\n  }\n  return parseTokenResponse(json, deps.now());\n}\n\n/** Exchange an authorization `code` (+ PKCE verifier) for the token pair. */\nexport function exchangeCode(\n  config: OAuthProviderConfig,\n  input: { code: string; verifier: string },\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    {\n      grant_type: \"authorization_code\",\n      code: input.code,\n      redirect_uri: config.redirectUri,\n      client_id: config.clientId,\n      code_verifier: input.verifier,\n    },\n    deps,\n  );\n}\n\n/** Swap a refresh token for a fresh access (and possibly rotated refresh) token. */\nexport function refreshOAuthTokens(\n  config: OAuthProviderConfig,\n  refresh: string,\n  deps: HttpDeps,\n): Promise<OAuthTokens> {\n  return postGrant(\n    config,\n    { grant_type: \"refresh_token\", refresh_token: refresh, client_id: config.clientId },\n    deps,\n  );\n}\n\n/** Persist a token triple to the store's oauth variant through the hardened 0600 writer. */\nexport function persistOAuthTokens(\n  provider: string,\n  tokens: OAuthTokens,\n  store: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  return writeCredential(\n    {\n      type: \"oauth\",\n      provider,\n      access: tokens.access,\n      refresh: tokens.refresh,\n      expires: tokens.expires,\n      ...(tokens.accountId !== undefined ? { account_id: tokens.accountId } : {}),\n    },\n    store,\n    env,\n  );\n}\n\n/**\n * In-flight refreshes, keyed by the auth-file path. Refresh tokens ROTATE (single-use) on many providers,\n * so two concurrent turns must NOT both POST the same refresh token — the second would present an\n * already-consumed token and fail. This coalesces concurrent refreshes of the same store onto one promise.\n * Process-local — the single-credential store is per-user; a cross-process lock would be over-engineering.\n */\nconst inFlightRefresh = new Map<string, Promise<OAuthTokens>>();\n\n/**\n * Return a credential guaranteed fresh enough to use. An `api` credential passes through untouched. An\n * `oauth` credential still valid (beyond the skew window) passes through; an expired one is refreshed,\n * re-persisted 0600, and returned with the new access token. Concurrent refreshes of the same store are\n * coalesced (single-use refresh tokens); the rejected promise is evicted so a failure is not cached-poison.\n */\nexport async function ensureFreshCredential(\n  resolved: ResolvedCredential,\n  opts: {\n    config: OAuthProviderConfig;\n    store: CredentialStoreConfig;\n    env?: Record<string, string | undefined>;\n  },\n  deps: HttpDeps,\n): Promise<ResolvedCredential> {\n  if (resolved.kind !== \"oauth\") return resolved;\n\n  const now = deps.now();\n  if (resolved.expiresAt !== undefined && resolved.expiresAt > now + REFRESH_SKEW_MS) {\n    return resolved; // still valid — no network, no rewrite\n  }\n\n  const env = opts.env ?? {};\n  const path = authFilePath(opts.store, env);\n  let refresh = inFlightRefresh.get(path);\n  if (refresh === undefined) {\n    refresh = (async (): Promise<OAuthTokens> => {\n      const stored = readStoredOAuth(opts.store, env);\n      if (stored === undefined) {\n        // The resolved credential said oauth but the store no longer holds it — do not fabricate; surface it.\n        throw new AuthCallbackError(\n          \"oauth_token_exchange_failed\",\n          \"no stored oauth credential to refresh\",\n        );\n      }\n      const fresh = await refreshOAuthTokens(opts.config, stored.refresh, deps);\n      // M43 D4 fix #1 — the OAuth refresh response returns JWTs, not a top-level `account_id`, so\n      // `parseTokenResponse` leaves `fresh.accountId` undefined. Prefer a freshly-derived id, else PRESERVE\n      // the stored one (account_id is stable) — otherwise the Codex `ChatGPT-Account-Id` header empties after\n      // the first refresh and the backend 401/403s.\n      const merged: OAuthTokens = {\n        ...fresh,\n        accountId: fresh.accountId ?? stored.account_id,\n      };\n      persistOAuthTokens(resolved.provider, merged, opts.store, env);\n      return merged;\n    })();\n    inFlightRefresh.set(path, refresh);\n    refresh.finally(() => inFlightRefresh.delete(path)).catch(() => {});\n  }\n\n  const fresh = await refresh;\n  return {\n    kind: \"oauth\",\n    provider: resolved.provider,\n    apiKey: fresh.access,\n    source: resolved.source,\n    inferred: false,\n    expiresAt: fresh.expires,\n  };\n}\n","/**\n * M42 — `resolveCredential`: the public composition entrypoint over the credential store + oauth engine.\n * Given a provider name + a {@link CredentialStoreConfig} (and, for oauth, an {@link OAuthProviderConfig}),\n * read the store and return a FRESH `ResolvedCredential` — an api credential passes through by identity; an\n * oauth credential is transparently refreshed when its access token is within the skew window. Returns\n * `undefined` when the store holds no credential for `provider` (the caller then falls back to env / apiKeys).\n *\n * Mirrors agent-builder's `resolveFreshCredential` composition (store read → oauth → ensureFreshCredential),\n * defaulting `fetch`/`now` to globals. This is the async surface an oauth provider's M41 `transform.fetch`\n * calls at stream time, so a mid-turn token expiry refreshes without rebuilding the agent.\n *\n * @internal (re-exported from the package barrel as public)\n */\nimport type {\n  CredentialStoreConfig,\n  HttpDeps,\n  OAuthProviderConfig,\n  ResolvedCredential,\n} from \"./auth-types.js\";\nimport { authFilePath, readAuthFile } from \"./credential-store.js\";\nimport { ensureFreshCredential } from \"./oauth-engine.js\";\n\nexport interface ResolveCredentialOptions {\n  /** The provider whose stored credential to resolve. */\n  provider: string;\n  /** Where the credential store lives. */\n  store: CredentialStoreConfig;\n  /** Env for the store's optional `homeEnvVar` override. Never an ambient read. */\n  env?: Record<string, string | undefined>;\n  /** Required to refresh an oauth credential; omit for an api-only store. */\n  oauth?: OAuthProviderConfig;\n  /** Injected HTTP + clock for deterministic tests; default globals. */\n  deps?: { fetch?: typeof fetch; now?: () => number };\n}\n\n/**\n * Resolve a fresh credential for `provider` from the store, or `undefined` if the store holds none for it.\n * oauth credentials are auto-refreshed when `opts.oauth` is supplied; api credentials pass through.\n */\n/** Resolve (and, when a config is supplied, refresh) the oauth variant for the requested provider. */\nasync function resolveOAuth(\n  stored: { provider: string; access: string; expires: number },\n  path: string,\n  opts: ResolveCredentialOptions,\n  env: Record<string, string | undefined>,\n): Promise<ResolvedCredential | undefined> {\n  if (stored.provider !== opts.provider) return undefined;\n  const base: ResolvedCredential = {\n    kind: \"oauth\",\n    provider: opts.provider,\n    apiKey: stored.access,\n    source: path,\n    inferred: false,\n    expiresAt: stored.expires,\n  };\n  if (opts.oauth === undefined) return base; // no config to refresh with — return the stored access token\n  const deps: HttpDeps = {\n    fetch: opts.deps?.fetch ?? fetch,\n    now: opts.deps?.now ?? (() => Date.now()),\n  };\n  return ensureFreshCredential(base, { config: opts.oauth, store: opts.store, env }, deps);\n}\n\nexport async function resolveCredential(\n  opts: ResolveCredentialOptions,\n): Promise<ResolvedCredential | undefined> {\n  const env = opts.env ?? {};\n  const stored = readAuthFile(opts.store, env);\n  if (stored === undefined) return undefined;\n\n  const path = authFilePath(opts.store, env);\n\n  if (stored.type === \"oauth\") {\n    return resolveOAuth(stored, path, opts, env);\n  }\n\n  // api variant: require the stored `provider` to MATCH the requested provider (M42 review MEDIUM-2).\n  // The generic SDK cannot infer a provider from a key prefix (that was agent-builder app policy), so a\n  // provider-less or mismatched stored key is NOT attributed to the requested provider — otherwise a legacy\n  // `{api_key:\"sk-ant-…\"}` file could be POSTed to the wrong vendor's endpoint (cross-vendor key exposure).\n  // Fail-closed, mirroring OpenCode, whose credential resolution never attributes a key across providers.\n  if (stored.api_key.length === 0) return undefined;\n  if (stored.provider !== opts.provider) return undefined;\n  return {\n    kind: \"api\",\n    provider: opts.provider,\n    apiKey: stored.api_key,\n    source: path,\n    inferred: false,\n  };\n}\n"]}

package/dist/chunk-34XOCZJO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/context/context-loaders.ts","../src/internal/runtime/context/context-import-resolver.ts","../src/internal/runtime/context/context-glob.ts","../src/internal/runtime/context/context-yaml-lite.ts","../src/internal/runtime/context/context-rules-frontmatter.ts","../src/internal/runtime/context/context-mdc-parser.ts","../src/internal/runtime/context/context-discovery-runner.ts"],"names":["resolvePath","z","dirname","readFile"],"mappings":";;;;;;;AAaA,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,MAAA,GAAS,sCAAA;AAGR,IAAM,0BAAA,GAA6B;AAiCnC,SAAS,kBAAA,CAAmB,SAAiB,GAAA,EAA6B;AAC/E,EAAA,IAAI,OAAA,CAAQ,UAAU,GAAA,EAAK;AACzB,IAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,YAAA,EAAc,OAAA,EAAQ;AAAA,EACnD;AAEA,EAAA,IAAI,GAAA,IAAO,OAAO,MAAA,EAAQ;AACxB,IAAA,OAAO,EAAE,WAAW,IAAA,EAAM,YAAA,EAAc,QAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,EAAE;AAAA,EAChE;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA;AAC5B,EAAA,MAAM,YAAY,IAAA,CAAK,KAAA,CAAM,MAAA,IAAU,UAAA,IAAc,aAAa,UAAA,CAAA,CAAY,CAAA;AAC9E,EAAA,MAAM,YAAY,MAAA,GAAS,SAAA;AAC3B,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,IAAA;AAAA,IACX,YAAA,EAAc,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,SAAS,IAAI,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,CAAC,SAAS;AAAA,GAC/E;AACF;AAWA,eAAsB,iBAAA,CACpB,OAAA,EACA,IAAA,GAAqC,EAAC,EACH;AACnC,EAAA,MAAM,GAAA,GAAM,KAAK,eAAA,IAAmB,0BAAA;AACpC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAM,QAAA,CAAS,OAAA,EAAS,MAAM,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAa,GAAI,kBAAA,CAAmB,SAAS,GAAG,CAAA;AACnE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,qBAAA,CAAsB,OAAO,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,OAAA;AAAA,IACR,OAAA,EAAS,YAAA;AAAA,IACT,eAAe,OAAA,CAAQ,MAAA;AAAA,IACvB;AAAA,GACF;AACF;AAUA,SAAS,sBAAsB,MAAA,EAAsB;AAGnD,EAAA,MAAM,SACJ,UAAA,CACA,gBAAA;AACF,EAAA,IAAI,MAAA,EAAQ,QAAQ,MAAA,EAAW;AAC/B,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,GAAA,CAAI,yBAAA,EAA2B,EAAE,IAAA,EAAM,QAAQ,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;ACjGA,IAAM,SAAA,GAAY,eAAA;AAClB,IAAM,QAAA,GAAW,CAAA;AAwCjB,eAAsB,cAAA,CACpB,OAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,EAAA,IAAI,IAAA,CAAK,SAAS,QAAA,EAAU;AAC1B,IAAA,OAAO,GAAG,OAAO;;AAAA,2BAAA,EAA6B,QAAQ,CAAA;;AAAA,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,QAAQ,CAAA;AAChC,EAAA,OAAO,YAAA,CAAa,OAAA,EAAS,SAAA,EAAW,OAAO,GAAA,KAAQ;AACrD,IAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,GAAA,EAAK,OAAO,CAAA;AAK/C,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,IAAa,CAAC,WAAW,QAAA,EAAU,IAAA,CAAK,WAAW,CAAA,EAAG;AAC7E,MAAA,OAAO,+CAA+C,GAAG,CAAA,CAAA,CAAA;AAAA,IAC3D;AACA,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC9B,MAAA,OAAO,4BAA4B,GAAG,CAAA,CAAA,CAAA;AAAA,IACxC;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,QAAQ,CAAA;AACzB,IAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,QAAA,EAAU,EAAE,eAAA,EAAiB,IAAA,CAAK,iBAAiB,CAAA;AAC1F,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,uBAAuB,GAAG,CAAA,CAAA,CAAA;AAAA,IACnC;AAIA,IAAA,OAAO,cAAA,CAAe,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU;AAAA,MAC9C,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO,KAAK,KAAA,GAAQ,CAAA;AAAA,MACpB,iBAAiB,IAAA,CAAK,eAAA;AAAA,MACtB,GAAI,KAAK,WAAA,KAAgB,MAAA,GAAY,EAAC,GAAI,EAAE,WAAA,EAAa,IAAA,CAAK,WAAA;AAAY,KAC3E,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEA,SAAS,iBAAA,CAAkB,KAAa,OAAA,EAAyB;AAC/D,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACxB,IAAA,OAAOA,OAAA,CAAY,KAAK,OAAA,EAAQ,EAAG,IAAI,KAAA,CAAM,CAAC,CAAC,CAAC,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,UAAA,CAAW,GAAG,CAAA,EAAG;AACnB,IAAA,OAAOA,QAAY,GAAG,CAAA;AAAA,EACxB;AACA,EAAA,OAAOA,OAAA,CAAY,IAAA,CAAK,OAAA,EAAS,GAAG,CAAC,CAAA;AACvC;AAQA,eAAe,YAAA,CACb,OAAA,EACA,EAAA,EACA,QAAA,EACiB;AACjB,EAAA,MAAM,UAAgE,EAAC;AAEvE,EAAA,MAAM,UAAU,IAAI,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,GAAG,KAAK,CAAA;AAC9C,EAAA,IAAI,CAAA;AAEJ,EAAA,OAAA,CAAQ,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,OAAO,OAAO,IAAA,EAAM;AAC3C,IAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,EAAK,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA,EAAI,KAAA,EAAO,CAAA,CAAE,OAAO,CAAA;AAC7D,IAAA,IAAI,CAAA,CAAE,KAAA,KAAU,OAAA,CAAQ,SAAA,UAAmB,SAAA,IAAa,CAAA;AAAA,EAC1D;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AACjC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAA,IAAU,OAAA,CAAQ,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,KAAK,CAAA;AAC3C,IAAA,MAAA,IAAU,MAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAClC,IAAA,MAAA,GAAS,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,MAAA;AAAA,EACrC;AACA,EAAA,MAAA,IAAU,OAAA,CAAQ,MAAM,MAAM,CAAA;AAC9B,EAAA,OAAO,MAAA;AACT;;;ACpIO,SAAS,YAAY,IAAA,EAAsB;AAMhD,EAAA,MAAM,QAAA,GAAW,IAAA,CACd,OAAA,CAAQ,mBAAA,EAAqB,MAAM,CAAA,CACnC,OAAA,CAAQ,SAAA,EAAW,oBAAoB,CAAA,CACvC,OAAA,CAAQ,OAAA,EAAS,cAAc,CAAA,CAC/B,OAAA,CAAQ,KAAA,EAAO,OAAO,CAAA,CACtB,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CACrB,OAAA,CAAQ,qBAAA,EAAuB,UAAU,CAAA,CACzC,OAAA,CAAQ,eAAA,EAAiB,IAAI,CAAA;AAChC,EAAA,OAAO,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,CAAG,CAAA;AACnC;AAQO,SAAS,cAAA,CACd,UACA,KAAA,EACS;AACT,EAAA,IAAI,SAAS,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,WAAW,CAAA;AACpC,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,GAAA,CAAI,IAAA,CAAK,CAAC,EAAA,KAAO,EAAA,CAAG,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA;AACvD;;;ACpBA,IAAM,cAAA,GAAiB,yCAAA;AAehB,SAAS,iBAAiB,OAAA,EAAmC;AAClE,EAAA,MAAM,CAAA,GAAI,cAAA,CAAe,IAAA,CAAK,OAAO,CAAA;AACrC,EAAA,IAAI,MAAM,IAAA,EAAM,OAAO,EAAE,IAAA,EAAM,MAAA,EAAW,MAAM,OAAA,EAAQ;AACxD,EAAA,OAAO,EAAE,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,IAAK,IAAI,IAAA,EAAM,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA,EAAG;AAC9C;AAQO,SAAS,gBAAgB,IAAA,EAAuC;AACrE,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAChC,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,CAAA,GAAI,MAAM,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,CAAA,IAAK,CAAA;AACL,IAAA,IAAI,SAAS,MAAA,EAAW;AACxB,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,EAAK;AAC1B,IAAA,IAAI,OAAA,KAAY,EAAA,IAAM,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAI,UAAU,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,OAAO,CAAA,CAAE,CAAA;AACjE,IAAA,MAAM,MAAM,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,KAAK,EAAE,IAAA,EAAK;AACzC,IAAA,MAAM,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAA,GAAQ,CAAC,EAAE,IAAA,EAAK;AAC3C,IAAA,IAAI,SAAS,EAAA,EAAI;AAEf,MAAA,MAAM,QAAkB,EAAC;AACzB,MAAA,OAAO,CAAA,GAAI,MAAM,MAAA,EAAQ;AACvB,QAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,QAAA,IAAI,SAAS,MAAA,EAAW;AACxB,QAAA,MAAM,QAAA,GAAW,KAAK,IAAA,EAAK;AAC3B,QAAA,IAAI,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,EAAG;AAC7B,UAAA,KAAA,CAAM,IAAA,CAAK,YAAY,QAAA,CAAS,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAW,CAAA;AAC1D,UAAA,CAAA,IAAK,CAAA;AAAA,QACP,CAAA,MAAA,IAAW,aAAa,EAAA,EAAI;AAC1B,UAAA,CAAA,IAAK,CAAA;AAAA,QACP,CAAA,MAAO;AACL,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,IACb,CAAA,MAAA,IAAW,KAAK,UAAA,CAAW,GAAG,KAAK,IAAA,CAAK,QAAA,CAAS,GAAG,CAAA,EAAG;AAErD,MAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,EAAE,EAAE,IAAA,EAAK;AACrC,MAAA,GAAA,CAAI,GAAG,IACL,KAAA,KAAU,EAAA,GACN,EAAC,GACD,KAAA,CAAM,MAAM,GAAG,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,YAAY,CAAA,CAAE,IAAA,GAAO,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAC,CAAC,CAAA;AAAA,IACrF,CAAA,MAAO;AACL,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,WAAA,CAAY,IAAI,CAAA;AAAA,IAC7B;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAY,CAAA,EAAsC;AACzD,EAAA,IAAI,CAAA,KAAM,QAAQ,OAAO,IAAA;AACzB,EAAA,IAAI,CAAA,KAAM,SAAS,OAAO,KAAA;AAC1B,EAAA,IAAI,UAAU,IAAA,CAAK,CAAC,GAAG,OAAO,QAAA,CAAS,GAAG,EAAE,CAAA;AAE5C,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AACrC;;;ACnEO,IAAM,sBAAA,GAAyB,EAAE,MAAA,CAAO;AAAA,EAC7C,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,OAAO,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpC,OAAO,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpC,WAAA,EAAa,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAClC,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AACvB,CAAC,CAAA;AAeM,SAAS,WAAW,OAAA,EAA+C;AACxE,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,IAAI,SAAS,MAAA,EAAW;AACtB,IAAA,OAAO,EAAE,WAAA,EAAa,EAAE,aAAa,IAAA,EAAK,EAAG,MAAM,OAAA,EAAQ;AAAA,EAC7D;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,gBAAgB,IAAI,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,SAAA,CAAU,MAAM,CAAA;AACzD,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,OAAO,KAAA,CAAA;AAC/B,IAAA,OAAO,EAAE,WAAA,EAAa,SAAA,CAAU,IAAA,EAAM,IAAA,EAAK;AAAA,EAC7C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AASO,SAAS,kBAAA,CACd,IACA,YAAA,EACS;AACT,EAAA,IAAI,EAAA,CAAG,OAAA,KAAY,KAAA,EAAO,OAAO,KAAA;AACjC,EAAA,IAAI,EAAA,CAAG,WAAA,KAAgB,IAAA,EAAM,OAAO,IAAA;AACpC,EAAA,MAAM,QAAA,GAAW,CAAC,GAAI,EAAA,CAAG,KAAA,IAAS,EAAC,EAAI,GAAI,EAAA,CAAG,KAAA,IAAS,EAAG,CAAA;AAC1D,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,OAAO,cAAA,CAAe,UAAU,YAAY,CAAA;AAC9C;ACzDO,IAAM,oBAAA,GAAuBC,EAAE,MAAA,CAAO;AAAA,EAC3C,WAAA,EAAaA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,OAAOA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpC,WAAA,EAAaA,CAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAC3B,CAAC,CAAA;AAmBM,SAAS,SAAS,OAAA,EAA6C;AACpE,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,iBAAiB,OAAO,CAAA;AAC/C,EAAA,IAAI,SAAS,MAAA,EAAW;AAEtB,IAAA,OAAO,EAAE,WAAA,EAAa,EAAE,aAAa,IAAA,EAAK,EAAG,MAAM,OAAA,EAAQ;AAAA,EAC7D;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,gBAAgB,IAAI,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,SAAA,CAAU,MAAM,CAAA;AACvD,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,OAAO,KAAA,CAAA;AAC/B,IAAA,OAAO,EAAE,WAAA,EAAa,SAAA,CAAU,IAAA,EAAM,IAAA,EAAK;AAAA,EAC7C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AASO,SAAS,cAAA,CAAe,IAAoB,YAAA,EAA8C;AAC/F,EAAA,IAAI,EAAA,CAAG,WAAA,KAAgB,IAAA,EAAM,OAAO,IAAA;AACpC,EAAA,IAAI,GAAG,KAAA,KAAU,MAAA,IAAa,GAAG,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,KAAA;AAC5D,EAAA,OAAO,cAAA,CAAe,EAAA,CAAG,KAAA,EAAO,YAAY,CAAA;AAC9C;;;ACjBA,eAAsB,aAAa,IAAA,EAA2D;AAC5F,EAAA,MAAM,OAAA,GAAU,WAAA,CAAY,IAAA,CAAK,GAAG,CAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,IAAS,uBAAA;AAC5B,EAAA,MAAM,MAA0B,EAAC;AACjC,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,IAAA,CAAK,wBAAA,IAA4B,IAAA,CAAK,EAAA,KAAO,iBAAA,EAAmB;AACpE,IAAA,MAAM,QAAQ,MAAM,mBAAA,CAAoB,IAAA,EAAM,IAAA,CAAK,KAAK,OAAO,CAAA;AAC/D,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAG;AACxB,MAAA,QAAA,CAAS,IAAI,IAAI,CAAA;AACjB,MAAA,MAAM,SAAS,MAAM,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,MAAM,OAAO,CAAA;AAC5D,MAAA,IAAI,MAAA,KAAW,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AAAA,IAC3C;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,mBAAA,CACb,IAAA,EACA,GAAA,EACA,OAAA,EACmB;AACnB,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,EAAY;AAC7B,IAAA,OAAO,aAAA,CAAc,GAAA,EAAK,IAAA,CAAK,OAAA,EAAS,GAAG,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,IAAA,CAAK,UAAU,eAAA,EAAiB;AAClC,IAAA,OAAO,aAAA,CAAc,GAAA,EAAK,IAAA,CAAK,OAAA,EAAS,WAAW,GAAG,CAAA;AAAA,EACxD;AAEA,EAAA,OAAO,aAAA,CAAc,GAAA,EAAK,IAAA,CAAK,OAAO,CAAA;AACxC;AAEA,eAAe,aAAA,CACb,IAAA,EACA,IAAA,EACA,IAAA,EACA,OAAA,EACuC;AAKvC,EAAA,MAAM,UAAU,QAAA,CAAS,OAAA,IAAW,KAAK,GAAA,EAAKC,OAAAA,CAAQ,IAAI,CAAC,CAAA;AAC3D,EAAA,MAAM,cAAc,IAAA,CAAK,KAAA,KAAU,UAAA,IAAc,OAAA,KAAY,MAAM,OAAA,KAAY,GAAA;AAC/E,EAAA,MAAM,EAAA,GAAK,cAAc,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,CAAA,EAAI,OAAO,KAAK,IAAA,CAAK,EAAA;AAExD,EAAA,IAAI,IAAA,CAAK,WAAW,KAAA,EAAO;AACzB,IAAA,OAAO,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,EAAA,EAAI,IAAI,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,IAAA,CAAK,WAAW,mBAAA,EAAqB;AACvC,IAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,EAAA,EAAI,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,IAAA,CAAK,WAAW,iBAAA,EAAmB;AAIrC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,uBAAA,CAAwB,IAAA,EAAM,IAAA,EAAM,EAAA,EAAI,MAAM,OAAO,CAAA;AAC9D;AAQA,eAAe,gBAAA,CACb,IAAA,EACA,IAAA,EACA,EAAA,EACA,OACA,QAAA,EACuC;AACvC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMC,QAAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,GAAG,CAAA;AACxB,EAAA,IAAI,WAAW,MAAA,IAAa,CAAC,SAAS,MAAA,CAAO,WAAW,GAAG,OAAO,MAAA;AAClE,EAAA,OAAO,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAA,CAAO,IAAA,EAAM,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,SAAA,EAAW,KAAA,EAAM;AAC7F;AAEA,SAAS,aAAA,CACP,IAAA,EACA,IAAA,EACA,EAAA,EACA,IAAA,EACuC;AACvC,EAAA,OAAO,gBAAA;AAAA,IAAiB,IAAA;AAAA,IAAM,IAAA;AAAA,IAAM,EAAA;AAAA,IAAI,QAAA;AAAA,IAAU,CAAC,EAAA,KACjD,cAAA,CAAe,IAAI,IAAA,CAAK,YAAA,IAAgB,EAAE;AAAA,GAC5C;AACF;AAEA,SAAS,eAAA,CACP,IAAA,EACA,IAAA,EACA,EAAA,EACA,IAAA,EACuC;AACvC,EAAA,OAAO,gBAAA;AAAA,IAAiB,IAAA;AAAA,IAAM,IAAA;AAAA,IAAM,EAAA;AAAA,IAAI,UAAA;AAAA,IAAY,CAAC,EAAA,KACnD,kBAAA,CAAmB,IAAI,IAAA,CAAK,YAAA,IAAgB,EAAE;AAAA,GAChD;AACF;AAEA,eAAe,uBAAA,CACb,IAAA,EACA,IAAA,EACA,EAAA,EACA,MACA,OAAA,EACuC;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,IAAA,EAAM,EAAE,eAAA,EAAiB,IAAA,CAAK,iBAAiB,CAAA;AACtF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI,UAAU,MAAA,CAAO,OAAA;AACrB,EAAA,IAAI,KAAK,aAAA,EAAe;AACtB,IAAA,OAAA,GAAU,MAAM,cAAA,CAAe,OAAA,EAAS,IAAA,EAAM;AAAA,MAC5C,OAAA,kBAAS,IAAI,GAAA,CAAI,CAAC,IAAI,CAAC,CAAA;AAAA,MACvB,KAAA,EAAO,CAAA;AAAA,MACP,iBAAiB,IAAA,CAAK,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKtB,WAAA,EAAa,IAAA,CAAK,UAAA,IAAc,OAAA,IAAW,IAAA,CAAK;AAAA,KACjD,CAAA;AAAA,EACH;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,WAAW,MAAA,CAAO;AAAA,GACpB;AACF","file":"chunk-34XOCZJO.js","sourcesContent":["/**\n * Context file loaders + truncation (T1.2, ADRs D154 / D155 / D159).\n *\n * Reads context source files from disk, applies the per-file size cap\n * with 70%/20% head/tail truncation, and emits the\n * `context_files_truncated` telemetry counter when the cap fires.\n * Pure (no I/O) for `truncateWithMarker` — testable in isolation.\n *\n * @internal\n */\n\nimport { readFile } from \"node:fs/promises\";\n\nconst HEAD_RATIO = 0.7;\nconst TAIL_RATIO = 0.2;\nconst MARKER = \"\\n\\n…[truncated by theokit]\\n\\n\";\n\n/** Default per-file cap (40k chars ≈ 10k tokens). D155. */\nexport const DEFAULT_MAX_BYTES_PER_FILE = 40_000;\n\nexport interface LoadedSource {\n  /** Absolute path the content came from. */\n  readonly source: string;\n  readonly content: string;\n  readonly originalBytes: number;\n  readonly truncated: boolean;\n}\n\nexport interface TruncateResult {\n  readonly truncated: boolean;\n  readonly finalContent: string;\n}\n\n/**\n * Cap `content` at `max` characters with 70%/20% head/tail truncation\n * and an explicit marker. Pure — no I/O, no telemetry.\n *\n * EC-C: when `max <= MARKER.length`, skip the marker entirely and\n * return a head-only slice. Without this guard, `budget = max -\n * MARKER.length` would go negative and `content.slice(-tailBytes)`\n * would slice from the END of the string rather than truncating.\n *\n * EC-H: codepoint integrity — `String.slice()` operates on UTF-16\n * code units, which can split surrogate pairs. We accept that\n * trailing/leading replacement chars (U+FFFD) may appear at boundaries.\n * Modern LLMs tolerate them; byte-exact safety would require Buffer\n * slicing + TextDecoder with `fatal: true` retry, which adds complexity\n * without value.\n *\n * @public\n */\nexport function truncateWithMarker(content: string, max: number): TruncateResult {\n  if (content.length <= max) {\n    return { truncated: false, finalContent: content };\n  }\n  // EC-C: max too small to fit even the marker — return head-only slice.\n  if (max <= MARKER.length) {\n    return { truncated: true, finalContent: content.slice(0, max) };\n  }\n  const budget = max - MARKER.length;\n  const headBytes = Math.floor(budget * (HEAD_RATIO / (HEAD_RATIO + TAIL_RATIO)));\n  const tailBytes = budget - headBytes;\n  return {\n    truncated: true,\n    finalContent: content.slice(0, headBytes) + MARKER + content.slice(-tailBytes),\n  };\n}\n\n/**\n * Read a file from disk and apply the per-file cap. Emits telemetry\n * counter when truncation fires.\n *\n * EC-G: file deleted between discovery and read (FS race) → returns\n * `undefined`, never throws.\n *\n * @internal\n */\nexport async function loadPlainMarkdown(\n  absPath: string,\n  opts: { maxBytesPerFile?: number } = {},\n): Promise<LoadedSource | undefined> {\n  const max = opts.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE;\n  let content: string;\n  try {\n    content = await readFile(absPath, \"utf8\");\n  } catch {\n    // EC-G: ENOENT / EACCES / etc → caller treats as missing.\n    return undefined;\n  }\n  const { truncated, finalContent } = truncateWithMarker(content, max);\n  if (truncated) {\n    emitTruncationCounter(absPath);\n  }\n  return {\n    source: absPath,\n    content: finalContent,\n    originalBytes: content.length,\n    truncated,\n  };\n}\n\n/**\n * EC-L: telemetry no-op when OTel is not imported. We import the tracer\n * lazily and use `safeCall` so the lookup never throws and never pulls\n * OTel into the import graph for users without `@opentelemetry/api`\n * installed.\n *\n * @internal\n */\nfunction emitTruncationCounter(source: string): void {\n  // Lazy resolution via globalThis avoids static import of telemetry/tracer.\n  // Tests can spy via the same path; production users without OTel see no-op.\n  const tracer = (\n    globalThis as { __theokit_tracer?: { inc?: (k: string, attrs: unknown) => void } }\n  ).__theokit_tracer;\n  if (tracer?.inc === undefined) return;\n  try {\n    tracer.inc(\"context_files_truncated\", { file: source });\n  } catch {\n    // Telemetry must never break the loader.\n  }\n}\n","/**\n * `@path/to/file` import resolver (T2.1, ADR D156).\n *\n * Anthropic/Gemini convention: lines that are EXACTLY `@path` get\n * replaced with the imported file's content, recursively (5-hop cap),\n * with cycle detection. Inline `see @x.md, also @y.md` references are\n * NOT resolved (EC-Q — own-line only, mirrors Anthropic's actual\n * behavior).\n *\n * EC-D fix: every imported file is itself capped at `maxBytesPerFile`\n * via `loadPlainMarkdown` BEFORE concatenation. Prevents a CLAUDE.md\n * with 5 imports of 30k each from ballooning to 150k of imported\n * content before the outer cap fires.\n *\n * @internal\n */\n\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, join, resolve as resolvePath } from \"node:path\";\n\nimport { loadPlainMarkdown } from \"./context-loaders.js\";\nimport { insideRoot } from \"./path-containment.js\";\n\n/** EC-Q: line-anchored. `@path` must be alone on its line. */\nconst IMPORT_RE = /^@(\\S+)\\s*$/gm;\nconst MAX_HOPS = 5;\n\nexport interface ResolveImportsOptions {\n  /** Absolute paths already resolved (cycle detection). */\n  readonly visited: Set<string>;\n  /** Current recursion depth — caps at MAX_HOPS. */\n  readonly depth: number;\n  /** Per-import file cap (EC-D). Forwarded to loadPlainMarkdown. */\n  readonly maxBytesPerFile: number;\n  /**\n   * The directory an import may not escape. When set, a target resolving outside it is\n   * refused and replaced with a placeholder.\n   *\n   * The file carrying the import is REPOSITORY-CONTROLLED — `CLAUDE.md` and `GEMINI.md`\n   * are the two default specs with `followImports: true`, and both are found by\n   * `git-root-walk` inside the tree the agent was pointed at. Without a root, a cloned\n   * repository could name `@~/.ssh/id_rsa` or any absolute path and have its contents\n   * inlined into the system prompt, and from there sent to the model provider. The\n   * traversal guard that already existed (`isSafePattern`) guards the discovery PATTERN,\n   * not the import TARGET, so it never saw this.\n   *\n   * OPTIONAL, so a caller outside the discovery path keeps the previous behaviour rather\n   * than breaking on an upgrade. `runDiscovery` always supplies `gitRoot ?? cwd` — the\n   * same value it already uses to keep absolute paths out of `<source name=\"\">`.\n   */\n  readonly projectRoot?: string;\n}\n\n/**\n * Resolve `@path` directives in `content`. Each match is replaced with\n * the imported file content (already cap-truncated per EC-D), and\n * recursion continues on the resolved content until MAX_HOPS or cycle.\n *\n * Failure modes (placeholders, never throws):\n *  - file not found → `[@import not found: <path>]`\n *  - cycle detected → `[@import cycle detected: <path>]`\n *  - depth exceeded → trailing `\\n\\n…[@import depth limit 5 reached]\\n\\n`\n *\n * @internal\n */\nexport async function resolveImports(\n  content: string,\n  basePath: string,\n  opts: ResolveImportsOptions,\n): Promise<string> {\n  if (opts.depth >= MAX_HOPS) {\n    return `${content}\\n\\n…[@import depth limit ${MAX_HOPS} reached]\\n\\n`;\n  }\n  const baseDir = dirname(basePath);\n  return replaceAsync(content, IMPORT_RE, async (raw) => {\n    const absolute = resolveImportPath(raw, baseDir);\n    // Containment BEFORE the read. Reporting the refusal after loading the file would\n    // already have put the bytes in memory, and the placeholder names the path the author\n    // wrote rather than the resolved one — echoing `/home/<user>/.ssh/id_rsa` back into the\n    // prompt would leak the layout of the machine to the same untrusted document.\n    if (opts.projectRoot !== undefined && !insideRoot(absolute, opts.projectRoot)) {\n      return `[@import outside the project root, refused: ${raw}]`;\n    }\n    if (opts.visited.has(absolute)) {\n      return `[@import cycle detected: ${raw}]`;\n    }\n    opts.visited.add(absolute);\n    const loaded = await loadPlainMarkdown(absolute, { maxBytesPerFile: opts.maxBytesPerFile });\n    if (loaded === undefined) {\n      return `[@import not found: ${raw}]`;\n    }\n    // Recurse with same visited set + incremented depth. `projectRoot` is FORWARDED: an\n    // imported file is repository-controlled too, so a root that applied only at depth 0\n    // would be escapable in one extra hop.\n    return resolveImports(loaded.content, absolute, {\n      visited: opts.visited,\n      depth: opts.depth + 1,\n      maxBytesPerFile: opts.maxBytesPerFile,\n      ...(opts.projectRoot === undefined ? {} : { projectRoot: opts.projectRoot }),\n    });\n  });\n}\n\nfunction resolveImportPath(raw: string, baseDir: string): string {\n  if (raw.startsWith(\"~/\")) {\n    return resolvePath(join(homedir(), raw.slice(2)));\n  }\n  if (isAbsolute(raw)) {\n    return resolvePath(raw);\n  }\n  return resolvePath(join(baseDir, raw));\n}\n\n/**\n * Async equivalent of `String.prototype.replace` — sequential. Returns\n * `content` with every `re` match replaced by `await replacer(match)`.\n *\n * @internal\n */\nasync function replaceAsync(\n  content: string,\n  re: RegExp,\n  replacer: (raw: string) => Promise<string>,\n): Promise<string> {\n  const matches: Array<{ match: string; raw: string; index: number }> = [];\n  // Reset lastIndex; clone the regex to avoid stateful traps.\n  const localRe = new RegExp(re.source, re.flags);\n  let m: RegExpExecArray | null;\n  // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex loop\n  while ((m = localRe.exec(content)) !== null) {\n    matches.push({ match: m[0], raw: m[1] ?? \"\", index: m.index });\n    if (m.index === localRe.lastIndex) localRe.lastIndex += 1;\n  }\n  if (matches.length === 0) return content;\n  let result = \"\";\n  let cursor = 0;\n  for (const entry of matches) {\n    result += content.slice(cursor, entry.index);\n    result += await replacer(entry.raw);\n    cursor = entry.index + entry.match.length;\n  }\n  result += content.slice(cursor);\n  return result;\n}\n","/**\n * Shared glob → RegExp compiler for context discovery (extracted from the\n * MDC parser so the `.cursor/rules/*.mdc` and `.theokit/rules/*.md` parsers\n * share ONE implementation — DRY, no new dependency).\n *\n * Supports `**` (any depth), `*` (single path segment, no `/`), `?` (single\n * non-separator char). Sufficient for the patterns Cursor and Claude Code\n * themselves recommend.\n *\n * @internal\n */\nexport function globToRegex(glob: string): RegExp {\n  // Support **/ (zero-or-more path segments), ** (any depth), * (single\n  // segment), ? (single non-separator char). `**/` collapses so `src/**/*.ts`\n  // matches `src/foo.ts` AND `src/a/b/foo.ts` — the semantics Cursor and Claude\n  // Code document (\"src/**/* → all files under src/\"). `*` and `?` never cross a\n  // `/` (strict glob segment semantics). Escape other regex metas.\n  const compiled = glob\n    .replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\")\n    .replace(/\\*\\*\\//g, \"::GLOBSTAR_SLASH::\")\n    .replace(/\\*\\*/g, \"::GLOBSTAR::\")\n    .replace(/\\*/g, \"[^/]*\")\n    .replace(/\\?/g, \"[^/]\")\n    .replace(/::GLOBSTAR_SLASH::/g, \"(?:.*/)?\")\n    .replace(/::GLOBSTAR::/g, \".*\");\n  return new RegExp(`^${compiled}$`);\n}\n\n/**\n * True when any of `patterns` glob-matches any of `paths`. Central helper so\n * both rule parsers agree on activation semantics.\n *\n * @internal\n */\nexport function anyGlobMatches(\n  patterns: ReadonlyArray<string>,\n  paths: ReadonlyArray<string>,\n): boolean {\n  if (patterns.length === 0 || paths.length === 0) return false;\n  const res = patterns.map(globToRegex);\n  return paths.some((p) => res.some((re) => re.test(p)));\n}\n","/**\n * Minimal YAML-subset frontmatter parsing shared by the `.cursor/rules/*.mdc`\n * and `.theokit/rules/*.md` parsers (extracted for DRY — one parser, one set\n * of edge-case behaviours, no new dependency).\n *\n * Handles `key: value` lines (string scalars, booleans, integers) and `key:`\n * followed by indented `- item` arrays or inline `[a, b]` arrays. Sufficient\n * for the small, fixed frontmatter field sets these rule files use. Throws on\n * a truly malformed line (no colon).\n *\n * NOTE — distinct from the sibling `yaml-frontmatter.ts` `parseSimpleYaml` on\n * purpose: that one parses INLINE arrays only (`key: [a, b]`), whereas rule\n * files (`.cursor/rules/*.mdc`, `.theokit/rules/*.md`) use MULTI-LINE `- item`\n * lists (`paths:` / `globs:`), which this parser adds. Unifying onto the inline\n * parser would drop multi-line list support; unifying the other way would touch\n * the skills/subagents/persistence loaders that depend on the inline one. The\n * two intentionally coexist until a shared parser handles both shapes.\n *\n * @internal\n */\n\nconst FRONTMATTER_RE = /^---\\s*\\n([\\s\\S]*?)\\n---\\s*\\n([\\s\\S]*)$/;\n\nexport interface FrontmatterSplit {\n  /** Raw YAML block between the `---` fences, or undefined when absent. */\n  readonly yaml: string | undefined;\n  /** The markdown body after the frontmatter (or the whole content). */\n  readonly body: string;\n}\n\n/**\n * Split `---`-fenced frontmatter from the body. When no frontmatter fence is\n * present, `yaml` is undefined and `body` is the whole content.\n *\n * @internal\n */\nexport function splitFrontmatter(content: string): FrontmatterSplit {\n  const m = FRONTMATTER_RE.exec(content);\n  if (m === null) return { yaml: undefined, body: content };\n  return { yaml: m[1] ?? \"\", body: m[2] ?? \"\" };\n}\n\n/**\n * Parse the minimal YAML subset. Throws on a line without a colon (malformed).\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: YAML-subset parser handles scalars + multi-line arrays + inline arrays in a single pass; extracting helpers fragments the line-state machine.\nexport function parseSimpleYaml(yaml: string): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  const lines = yaml.split(/\\r?\\n/);\n  let i = 0;\n  while (i < lines.length) {\n    const line = lines[i];\n    i += 1;\n    if (line === undefined) continue;\n    const trimmed = line.trim();\n    if (trimmed === \"\" || trimmed.startsWith(\"#\")) continue;\n    const colon = trimmed.indexOf(\":\");\n    if (colon === -1) throw new Error(`Invalid YAML line: ${trimmed}`);\n    const key = trimmed.slice(0, colon).trim();\n    const rest = trimmed.slice(colon + 1).trim();\n    if (rest === \"\") {\n      // Possible array; collect indented `- item` lines.\n      const items: string[] = [];\n      while (i < lines.length) {\n        const next = lines[i];\n        if (next === undefined) break;\n        const nextTrim = next.trim();\n        if (nextTrim.startsWith(\"- \")) {\n          items.push(parseScalar(nextTrim.slice(2).trim()) as string);\n          i += 1;\n        } else if (nextTrim === \"\") {\n          i += 1;\n        } else {\n          break;\n        }\n      }\n      out[key] = items;\n    } else if (rest.startsWith(\"[\") && rest.endsWith(\"]\")) {\n      // Inline array `globs: [\"**/*.ts\", \"**/*.tsx\"]`\n      const inner = rest.slice(1, -1).trim();\n      out[key] =\n        inner === \"\"\n          ? []\n          : inner.split(\",\").map((s) => parseScalar(s.trim().replace(/^[\"']|[\"']$/g, \"\")));\n    } else {\n      out[key] = parseScalar(rest);\n    }\n  }\n  return out;\n}\n\nfunction parseScalar(s: string): string | boolean | number {\n  if (s === \"true\") return true;\n  if (s === \"false\") return false;\n  if (/^-?\\d+$/.test(s)) return parseInt(s, 10);\n  // Strip surrounding quotes if present.\n  return s.replace(/^[\"']|[\"']$/g, \"\");\n}\n","/**\n * Parser for `.theokit/rules/*.md` — theokit-native path-scoped rules,\n * mirroring Claude Code's `.claude/rules/`.\n *\n * Frontmatter fields:\n *  - `paths` — glob-pattern array (Claude Code parity: `.claude/rules` uses `paths:`).\n *  - `globs` — glob-pattern array (Cursor-compatible alias; unioned with `paths`).\n *  - `alwaysApply` — activate unconditionally (no scope needed).\n *  - `enabled` — set `false` to disable the rule entirely (wins over everything).\n *  - `description` — human note; not used for activation in v1.\n *\n * Activation (`shouldActivateRule`):\n *  - `enabled: false` → never activates.\n *  - `alwaysApply: true` → always activates.\n *  - otherwise → activates iff a `paths`/`globs` pattern matches an in-scope\n *    file (the caller's `agent.send(..., { contextPaths })`). With no in-scope\n *    files, a scoped rule stays dormant (parity with Cursor `.mdc`).\n *\n * A file with no `---` frontmatter is treated as an unconditional rule\n * (`alwaysApply: true`). Malformed YAML → `undefined` (caller drops + counts).\n *\n * Glob + YAML subset are shared with the MDC parser (DRY, no new dependency).\n *\n * @internal\n */\n\nimport { z } from \"zod\";\n\nimport { anyGlobMatches } from \"./context-glob.js\";\nimport { parseSimpleYaml, splitFrontmatter } from \"./context-yaml-lite.js\";\n\n/** YAML frontmatter schema for `.theokit/rules/*.md` files. @internal */\nexport const RulesFrontmatterSchema = z.object({\n  description: z.string().optional(),\n  paths: z.array(z.string()).optional(),\n  globs: z.array(z.string()).optional(),\n  alwaysApply: z.boolean().optional(),\n  enabled: z.boolean().optional(),\n});\n\nexport type RulesFrontmatter = z.infer<typeof RulesFrontmatterSchema>;\n\nexport interface RulesParseResult {\n  readonly frontmatter: RulesFrontmatter;\n  readonly body: string;\n}\n\n/**\n * Parse `.theokit/rules/*.md` content into frontmatter + body. No frontmatter\n * fence → unconditional rule. Malformed YAML → `undefined`.\n *\n * @internal\n */\nexport function parseRules(content: string): RulesParseResult | undefined {\n  const { yaml, body } = splitFrontmatter(content);\n  if (yaml === undefined) {\n    return { frontmatter: { alwaysApply: true }, body: content };\n  }\n  try {\n    const parsed = parseSimpleYaml(yaml);\n    const validated = RulesFrontmatterSchema.safeParse(parsed);\n    if (!validated.success) return undefined;\n    return { frontmatter: validated.data, body };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Decide whether a rule activates given the in-scope files. `paths` and\n * `globs` are unioned; both are glob patterns matched against the caller's\n * declared scope.\n *\n * @internal\n */\nexport function shouldActivateRule(\n  fm: RulesFrontmatter,\n  inScopePaths: ReadonlyArray<string>,\n): boolean {\n  if (fm.enabled === false) return false;\n  if (fm.alwaysApply === true) return true;\n  const patterns = [...(fm.paths ?? []), ...(fm.globs ?? [])];\n  if (patterns.length === 0) return false;\n  return anyGlobMatches(patterns, inScopePaths);\n}\n","/**\n * MDC (Markdown Cursor) parser for `.cursor/rules/*.mdc` (T3.1, ADR D154).\n *\n * Parses YAML frontmatter with `description` / `globs` / `alwaysApply`\n * fields. Honors activation per Cursor's docs:\n *  - `alwaysApply: true` → activates unconditionally.\n *  - `alwaysApply: false` + matching glob in `touchedFiles` → activates.\n *  - `alwaysApply: false` + no glob match → skipped.\n *\n * **EC-I (v1 semantic):** at `agent.send()` time, `touchedFiles` is empty\n * UNLESS the caller passes `contextPaths` (the in-scope file set). When\n * `contextPaths` is provided, per-glob activation fires; otherwise only\n * `alwaysApply: true` rules activate. Description-based \"agent requested\"\n * classification is out of scope.\n *\n * Glob matching + the YAML subset are shared with the `.theokit/rules/*.md`\n * parser via `context-glob.ts` / `context-yaml-lite.ts` (DRY, no new dep).\n *\n * @internal\n */\n\nimport { z } from \"zod\";\n\nimport { anyGlobMatches } from \"./context-glob.js\";\nimport { parseSimpleYaml, splitFrontmatter } from \"./context-yaml-lite.js\";\n\n/** YAML frontmatter schema for MDC files. @internal */\nexport const McdFrontmatterSchema = z.object({\n  description: z.string().optional(),\n  globs: z.array(z.string()).optional(),\n  alwaysApply: z.boolean().optional(),\n});\n\nexport type McdFrontmatter = z.infer<typeof McdFrontmatterSchema>;\n\nexport interface McdParseResult {\n  readonly frontmatter: McdFrontmatter;\n  readonly body: string;\n}\n\n/**\n * Parse `.mdc` content. Returns frontmatter + body. EC-18: when the\n * file has no `---` frontmatter, returns `frontmatter: {alwaysApply:\n * true}` so the body is treated as an unconditional rule.\n *\n * On YAML parse error, returns `undefined` and the caller emits a\n * telemetry counter (EC-21).\n *\n * @internal\n */\nexport function parseMdc(content: string): McdParseResult | undefined {\n  const { yaml, body } = splitFrontmatter(content);\n  if (yaml === undefined) {\n    // EC-18: no frontmatter — treat as alwaysApply\n    return { frontmatter: { alwaysApply: true }, body: content };\n  }\n  try {\n    const parsed = parseSimpleYaml(yaml);\n    const validated = McdFrontmatterSchema.safeParse(parsed);\n    if (!validated.success) return undefined;\n    return { frontmatter: validated.data, body };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Decide whether an MDC rule activates given the currently-touched\n * files. EC-I: empty `touchedFiles` → only `alwaysApply: true`\n * activates.\n *\n * @internal\n */\nexport function shouldActivate(fm: McdFrontmatter, touchedFiles: ReadonlyArray<string>): boolean {\n  if (fm.alwaysApply === true) return true;\n  if (fm.globs === undefined || fm.globs.length === 0) return false;\n  return anyGlobMatches(fm.globs, touchedFiles);\n}\n","/**\n * Multi-format context discovery runner (T5.1, ADRs D150-D156).\n *\n * Walks `DEFAULT_DISCOVERY_SPECS` (or caller override), loads each\n * spec via the appropriate parser, applies `@import` resolution where\n * declared, and returns a flat list of `AggregatorSource[]` ready for\n * the aggregate cap.\n *\n * **EC-E privacy fix:** source disambiguation uses\n * `relative(gitRoot ?? cwd, ...)` — NEVER absolute paths in\n * `<source name=\"\">`.\n *\n * @internal\n */\n\nimport { readFile } from \"node:fs/promises\";\nimport { dirname, relative } from \"node:path\";\n\nimport type { AggregatorSource } from \"./context-aggregator.js\";\nimport {\n  DEFAULT_DISCOVERY_SPECS,\n  type DiscoverySpec,\n  findGitRoot,\n  walkUpForFile,\n  walkUpForGlob,\n} from \"./context-discovery.js\";\nimport { resolveImports } from \"./context-import-resolver.js\";\nimport { loadPlainMarkdown } from \"./context-loaders.js\";\nimport { parseMdc, shouldActivate } from \"./context-mdc-parser.js\";\nimport { parseRules, shouldActivateRule } from \"./context-rules-frontmatter.js\";\n\nexport interface DiscoveryRunnerOptions {\n  /** Workspace root passed to all discovery scopes. */\n  readonly cwd: string;\n  /** Per-file truncation cap (D155). */\n  readonly maxBytesPerFile: number;\n  /** Optional override of the default registry. */\n  readonly specs?: ReadonlyArray<DiscoverySpec>;\n  /** Cursor MDC: file paths the LLM has touched this turn (EC-I: empty at send-time). */\n  readonly touchedFiles?: ReadonlyArray<string>;\n  /** When true, skip `theokit-context` spec — caller already handles the legacy path. */\n  readonly skipLegacyTheokitContext?: boolean;\n  /**\n   * The root an `@import` may not escape. Defaults to `gitRoot ?? cwd` — the same value\n   * this runner already uses to keep absolute paths out of `<source name=\"\">`.\n   *\n   * Present so an embedder with a trust boundary narrower than the repository can declare\n   * it. Absent, the repository IS the boundary, which is the honest default for a document\n   * discovered by walking the repository.\n   */\n  readonly importRoot?: string;\n}\n\n/**\n * Run discovery + loading across all specs. Returns sources ready for\n * the aggregator (priority + content fields populated).\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: per-spec dispatch ladder + cross-spec dedup is a flat orchestrator; splitting would obscure the priority-merge invariant.\nexport async function runDiscovery(opts: DiscoveryRunnerOptions): Promise<AggregatorSource[]> {\n  const gitRoot = findGitRoot(opts.cwd);\n  const specs = opts.specs ?? DEFAULT_DISCOVERY_SPECS;\n  const out: AggregatorSource[] = [];\n  const seenReal = new Set<string>();\n\n  for (const spec of specs) {\n    if (opts.skipLegacyTheokitContext && spec.id === \"theokit-context\") continue;\n    const paths = await resolvePathsForSpec(spec, opts.cwd, gitRoot);\n    for (const path of paths) {\n      if (seenReal.has(path)) continue;\n      seenReal.add(path);\n      const source = await loadOneSource(spec, path, opts, gitRoot);\n      if (source !== undefined) out.push(source);\n    }\n  }\n  return out;\n}\n\nasync function resolvePathsForSpec(\n  spec: DiscoverySpec,\n  cwd: string,\n  gitRoot: string | undefined,\n): Promise<string[]> {\n  if (spec.scope === \"cwd-only\") {\n    return walkUpForFile(cwd, spec.pattern, cwd);\n  }\n  if (spec.scope === \"git-root-walk\") {\n    return walkUpForFile(cwd, spec.pattern, gitRoot ?? cwd);\n  }\n  // globbed\n  return walkUpForGlob(cwd, spec.pattern);\n}\n\nasync function loadOneSource(\n  spec: DiscoverySpec,\n  path: string,\n  opts: DiscoveryRunnerOptions,\n  gitRoot: string | undefined,\n): Promise<AggregatorSource | undefined> {\n  // EC-E privacy: name uses relative-to-git-root for disambiguation;\n  // NEVER absolute paths in the public `<source name=\"\">` attribute.\n  // For cwd-only specs (THEO.md), no disambiguation is needed because\n  // the scope can only ever match a single file.\n  const relPath = relative(gitRoot ?? opts.cwd, dirname(path));\n  const needsSuffix = spec.scope !== \"cwd-only\" && relPath !== \"\" && relPath !== \".\";\n  const id = needsSuffix ? `${spec.id}@${relPath}` : spec.id;\n\n  if (spec.parser === \"mdc\") {\n    return loadMdcSource(spec, path, id, opts);\n  }\n  if (spec.parser === \"rules-frontmatter\") {\n    return loadRulesSource(spec, path, id, opts);\n  }\n  if (spec.parser === \"frontmatter-zod\") {\n    // Legacy `.theokit/context/*.md` — handled by `loadContextConfig` in\n    // `context-manager.ts` for backward compat. We skip here unless caller\n    // explicitly wants us to load it (currently always skipped).\n    return undefined;\n  }\n  // plain-markdown\n  return loadPlainMarkdownSource(spec, path, id, opts, gitRoot);\n}\n\n/**\n * Shared read → parse → activation-gate → source pipeline for the frontmatter\n * discovery parsers (mdc, rules). Binds the parser + the activation predicate so\n * the mdc and rules loaders differ only in those two, not in the surrounding\n * read/guard/shape boilerplate (DRY).\n */\nasync function loadParsedSource<F>(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  parse: (raw: string) => { frontmatter: F; body: string } | undefined,\n  isActive: (frontmatter: F) => boolean,\n): Promise<AggregatorSource | undefined> {\n  let raw: string;\n  try {\n    raw = await readFile(path, \"utf8\");\n  } catch {\n    return undefined;\n  }\n  const parsed = parse(raw);\n  if (parsed === undefined || !isActive(parsed.frontmatter)) return undefined;\n  return { id, source: path, content: parsed.body, priority: spec.priority, truncated: false };\n}\n\nfunction loadMdcSource(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  opts: DiscoveryRunnerOptions,\n): Promise<AggregatorSource | undefined> {\n  return loadParsedSource(spec, path, id, parseMdc, (fm) =>\n    shouldActivate(fm, opts.touchedFiles ?? []),\n  );\n}\n\nfunction loadRulesSource(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  opts: DiscoveryRunnerOptions,\n): Promise<AggregatorSource | undefined> {\n  return loadParsedSource(spec, path, id, parseRules, (fm) =>\n    shouldActivateRule(fm, opts.touchedFiles ?? []),\n  );\n}\n\nasync function loadPlainMarkdownSource(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  opts: DiscoveryRunnerOptions,\n  gitRoot: string | undefined,\n): Promise<AggregatorSource | undefined> {\n  const loaded = await loadPlainMarkdown(path, { maxBytesPerFile: opts.maxBytesPerFile });\n  if (loaded === undefined) return undefined;\n  let content = loaded.content;\n  if (spec.followImports) {\n    content = await resolveImports(content, path, {\n      visited: new Set([path]),\n      depth: 0,\n      maxBytesPerFile: opts.maxBytesPerFile,\n      // The document carrying the import is repository-controlled, so the repository is the\n      // boundary it may not cross. Without this, `CLAUDE.md` / `GEMINI.md` — the two specs\n      // with `followImports: true` — could name any absolute or `~/` path and have it\n      // inlined into the system prompt.\n      projectRoot: opts.importRoot ?? gitRoot ?? opts.cwd,\n    });\n  }\n  return {\n    id,\n    source: path,\n    content,\n    priority: spec.priority,\n    truncated: loaded.truncated,\n  };\n}\n"]}

package/dist/chunk-3SHW7XKK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/cron/run-job.ts","../src/internal/cron/fire-handler.ts","../src/internal/cron/store.ts","../src/internal/cron/scheduler.ts","../src/internal/cron/validate.ts","../src/cron.ts"],"names":["Croner"],"mappings":";;;;;;;AAoBA,eAAsB,WAAW,GAAA,EAA0C;AAIzE,EAAA,IAAI,GAAA,CAAI,aAAa,MAAA,EAAW,OAAO,IAAI,QAAA,CAAS,GAAA,CAAI,IAAI,SAAS,CAAA;AACrE,EAAA,IAAI,GAAA,CAAI,UAAU,MAAA,EAAW,OAAO,sBAAsB,GAAA,CAAI,KAAA,EAAO,cAAA,CAAe,GAAG,CAAC,CAAA;AACxF,EAAA,IAAI,GAAA,CAAI,YAAY,MAAA,EAAW,OAAO,qBAAqB,GAAA,CAAI,OAAA,EAAS,cAAA,CAAe,GAAG,CAAC,CAAA;AAC3F,EAAA,MAAM,IAAI,kBAAA;AAAA,IACR,CAAA,SAAA,EAAY,IAAI,EAAE,CAAA,+DAAA,CAAA;AAAA,IAClB,EAAE,MAAM,gBAAA;AAAiB,GAC3B;AACF;AAOO,SAAS,WAAW,OAAA,EAA4C;AACrE,EAAA,OAAO,OAAQ,QAAgB,IAAA,KAAS,UAAA;AAC1C;AAGA,SAAS,eAAe,GAAA,EAAuC;AAC7D,EAAA,IAAI,GAAA,CAAI,YAAY,MAAA,EAAW;AAC7B,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,SAAA,EAAY,GAAA,CAAI,EAAE,CAAA,uCAAA,CAAA,EAA2C;AAAA,MACxF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA,CAAI,OAAA;AACb;AAEA,eAAe,oBAAA,CACb,SACA,OAAA,EACc;AACd,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,EAAe,CAC/B,IAAI,OAAO,CAAA,CACX,KAAA,CAAM,MAAM,MAAS,CAAA;AACxB,EAAA,IAAI,SAAS,MAAA,EAAW;AACtB,IAAA,MAAM,IAAI,iBAAA;AAAA,MACR,gCAAgC,OAAO,CAAA,mIAAA,CAAA;AAAA,MACvC,EAAE,MAAM,sBAAA;AAAuB,KACjC;AAAA,EACF;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe,CAAE,OAAO,OAAO,CAAA;AACnD,EAAA,OAAO,KAAA,CAAM,KAAK,OAAO,CAAA;AAC3B;AAEA,eAAe,qBAAA,CACb,aACA,OAAA,EACc;AACd,EAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,EAAe,CAAE,OAAO,WAAW,CAAA;AACvD,EAAA,OAAO,KAAA,CAAM,KAAK,OAAO,CAAA;AAC3B;;;AC3DA,eAAsB,kBAAkB,GAAA,EAA6B;AAEnE,EAAA,MAAM,MAAA,GAAS,KAAK,GAAA,EAAI;AACxB,EAAA,MAAM,MAAA,GAAS,CAAA,KAAA,EAAQ,GAAA,CAAI,EAAE,IAAI,MAAM,CAAA,CAAA;AACvC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,CAAmB;AAAA,MACvB,IAAA,EAAM,MAAA;AAAA,MACN,EAAA,EAAI,MAAA;AAAA,MACJ,mBAAA,EAAqB,IAAA;AAAA,MACrB,IAAA,EAAM,EAAE,KAAA,EAAO,GAAA,CAAI,EAAA,EAAI,OAAA,EAAS,GAAA,CAAI,IAAA,EAAM,QAAA,EAAU,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,MAAA,EAAO;AAAA,MAC9E,IAAA,EAAM,OAAO,GAAA,KAAQ;AACnB,QAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,GAAG,CAAA;AACpC,QAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAEvB,UAAA,GAAA,CAAI,MAAA,CAAO,iBAAiB,OAAA,EAAS,MAAM,KAAK,OAAA,CAAQ,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,UAAC,CAAC,CAAA,EAAG;AAAA,YAChF,IAAA,EAAM;AAAA,WACP,CAAA;AACD,UAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,EAAK;AAClC,UAAA,GAAA,CAAI,IAAA,CAAK,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAQ,KAAA,EAAO,OAAA,CAAQ,IAAI,CAAA;AACrD,UAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAQ,KAAA,EAAO,QAAQ,EAAA,EAAG;AAAA,QACpD;AAEA,QAAA,GAAA,CAAI,IAAA,CAAK,EAAE,MAAA,EAAQ,OAAA,CAAQ,QAAQ,KAAA,EAAO,OAAA,CAAQ,IAAI,CAAA;AACtD,QAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAQ,KAAA,EAAO,QAAQ,EAAA,EAAG;AAAA,MACrD;AAAA,KACD,CAAA;AAAA,EACH,CAAA,CAAA,MAAQ;AAMN,IAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,GAAG,CAAA;AACpC,IAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG,MAAM,QAAQ,IAAA,EAAK;AAAA,EAC9C;AACF;;;AC1CA,IAAM,IAAA,uBAAW,GAAA,EAAqB;AAG/B,SAAS,QAAA,GAAsB;AACpC,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,MAAA,EAAQ,CAAA;AACjC;AAGO,SAAS,QAAA,GAAmB;AACjC,EAAA,OAAO,IAAA,CAAK,IAAA;AACd;AAGO,SAAS,OAAO,KAAA,EAAoC;AACzD,EAAA,OAAO,IAAA,CAAK,IAAI,KAAK,CAAA;AACvB;AAGO,SAAS,UAAU,GAAA,EAAoB;AAC5C,EAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,GAAG,CAAA;AACtB;AAGO,SAAS,UAAU,KAAA,EAAwB;AAChD,EAAA,OAAO,IAAA,CAAK,OAAO,KAAK,CAAA;AAC1B;;;ACXA,IAAM,QAAwB,EAAE,OAAA,EAAS,OAAO,MAAA,kBAAQ,IAAI,KAAI,EAAE;AAS3D,SAAS,mBAAmB,OAAA,EAA4C;AAC7E,EAAA,KAAA,CAAM,WAAA,GAAc,OAAA;AACtB;AAGO,SAAS,eAAe,GAAA,EAAoB;AACjD,EAAA,KAAA,CAAM,OAAA,GAAU,IAAA;AAChB,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,KAAA,CAAM,GAAA,GAAM,GAAA;AACnC,EAAA,KAAA,MAAW,GAAA,IAAO,UAAS,EAAG;AAC5B,IAAA,IAAI,IAAI,OAAA,KAAY,OAAA,IAAW,IAAI,OAAA,KAAY,KAAA,cAAmB,GAAG,CAAA;AAAA,EACvE;AACF;AAGO,SAAS,aAAA,GAAsB;AACpC,EAAA,KAAA,CAAM,OAAA,GAAU,KAAA;AAChB,EAAA,KAAA,MAAW,SAAS,KAAA,CAAM,MAAA,CAAO,MAAA,EAAO,QAAS,IAAA,EAAK;AACtD,EAAA,KAAA,CAAM,OAAO,KAAA,EAAM;AACrB;AAGO,SAAS,YAAY,GAAA,EAAoB;AAC9C,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AACpB,EAAA,aAAA,CAAc,IAAI,EAAE,CAAA;AACpB,EAAA,MAAM,UAAA,GAAa,mBAAA,CAAoB,GAAA,CAAI,IAAI,CAAA;AAC/C,EAAA,MAAM,QAAQ,IAAIA,MAAA;AAAA,IAChB,UAAA;AAAA,IACA,EAAE,UAAU,GAAA,CAAI,QAAA,EAAU,MAAM,GAAA,CAAI,EAAA,EAAI,SAAS,IAAA,EAAK;AAAA,IACtD,MAAM;AACJ,MAAA,KAAK,OAAA,CAAQ,IAAI,EAAE,CAAA;AAAA,IACrB;AAAA,GACF;AACA,EAAA,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,KAAK,CAAA;AAC9B,EAAA,gBAAA,CAAiB,GAAA,CAAI,IAAI,KAAK,CAAA;AAChC;AAGO,SAAS,cAAc,KAAA,EAAwB;AACpD,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AACpC,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,KAAA;AAChC,EAAA,KAAA,CAAM,IAAA,EAAK;AACX,EAAA,KAAA,CAAM,MAAA,CAAO,OAAO,KAAK,CAAA;AACzB,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,iBAAA,GAAwD;AACtE,EAAA,MAAM,MAAA,GAA6C,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAQ;AAC5E,EAAA,IAAI,KAAA,CAAM,GAAA,KAAQ,MAAA,EAAW,MAAA,CAAO,MAAM,KAAA,CAAM,GAAA;AAChD,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,QAAQ,KAAA,EAA8B;AACnD,EAAA,MAAM,KAAA,GAAQ,UAAS,CAAE,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,CAAM,OAAO,KAAK,CAAA;AAC3D,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,OAAA,KAAY,KAAA,EAAO;AACpD,EAAA,MAAM,UAAU,KAAA,CAAM,WAAA;AACtB,EAAA,SAAA,CAAU,EAAE,GAAG,KAAA,EAAO,WAAW,IAAA,CAAK,GAAA,IAAO,CAAA;AAC7C,EAAA,IAAI,YAAY,MAAA,EAAW;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,KAAK,CAAA;AAAA,EACrB,CAAA,CAAA,MAAQ;AAAA,EAGR;AACF;AAEA,SAAS,gBAAA,CAAiB,OAAe,KAAA,EAAqB;AAC5D,EAAA,MAAM,IAAA,GAAO,MAAM,OAAA,EAAQ;AAC3B,EAAA,IAAI,SAAS,IAAA,EAAM;AACnB,EAAA,MAAM,QAAA,GAAW,UAAS,CAAE,IAAA,CAAK,CAAC,KAAA,KAAU,KAAA,CAAM,OAAO,KAAK,CAAA;AAC9D,EAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,EAAA,SAAA,CAAU,EAAE,GAAG,QAAA,EAAU,WAAW,IAAA,CAAK,OAAA,IAAW,CAAA;AACtD;AAEA,SAAS,oBAAoB,IAAA,EAAsB;AACjD,EAAA,QAAQ,IAAA;AAAM,IACZ,KAAK,SAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT,KAAK,QAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT,KAAK,UAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT,KAAK,SAAA;AACH,MAAA,OAAO,WAAA;AAAA,IACT;AACE,MAAA,OAAO,IAAA;AAAA;AAEb;;;AChHA,IAAM,UAAA,uBAAiB,GAAA,CAAI,CAAC,WAAW,QAAA,EAAU,SAAA,EAAW,UAAA,EAAY,SAAS,CAAC,CAAA;AAOlF,IAAM,YAAA,GAAsC;AAAA,EAC1C,EAAE,GAAA,EAAK,CAAA,EAAG,GAAA,EAAK,EAAA,EAAG;AAAA;AAAA,EAClB,EAAE,GAAA,EAAK,CAAA,EAAG,GAAA,EAAK,EAAA,EAAG;AAAA;AAAA,EAClB,EAAE,GAAA,EAAK,CAAA,EAAG,GAAA,EAAK,EAAA,EAAG;AAAA;AAAA,EAClB,EAAE,GAAA,EAAK,CAAA,EAAG,GAAA,EAAK,EAAA,EAAG;AAAA;AAAA,EAClB,EAAE,GAAA,EAAK,CAAA,EAAG,GAAA,EAAK,CAAA;AAAE;AACnB,CAAA;AASO,SAAS,uBAAuB,IAAA,EAAoB;AACzD,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,CAAK,WAAW,CAAA,EAAG;AACjD,IAAA,MAAM,IAAI,mBAAmB,gCAAA,EAAkC;AAAA,MAC7D,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACxB,IAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,2CAAA,EAA8C,IAAI,CAAA,CAAA,EAAI;AAAA,QACjF,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAK,CAAE,MAAM,KAAK,CAAA;AACtC,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,CAAA,yBAAA,EAA4B,IAAI,CAAA,yBAAA,EAA4B,MAAA,CAAO,MAAM,CAAA,CAAA,CAAA;AAAA,MACzE,EAAE,MAAM,cAAA;AAAe,KACzB;AAAA,EACF;AACA,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,CAAA,IAAK,MAAA,CAAO,SAAQ,EAAG;AAC7C,IAAA,oBAAA,CAAqB,KAAA,EAAO,OAAO,IAAI,CAAA;AAAA,EACzC;AACF;AAEA,SAAS,oBAAA,CAAqB,KAAA,EAAe,KAAA,EAAe,IAAA,EAAoB;AAC9E,EAAA,MAAM,KAAA,GAAQ,aAAa,KAAK,CAAA;AAChC,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,yBAAA,EAA4B,IAAI,CAAA,QAAA,EAAW,KAAA,GAAQ,CAAC,CAAA,CAAA,CAAA,EAAK;AAAA,MACpF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,KAAA,EAAO,KAAK,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,yBAAA,EAA4B,IAAI,CAAA,QAAA,EAAW,KAAA,GAAQ,CAAC,CAAA,CAAA,CAAA,EAAK;AAAA,MACpF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAEA,SAAS,gBAAA,CAAiB,OAAe,KAAA,EAA4B;AACnE,EAAA,IAAI,KAAA,KAAU,KAAK,OAAO,IAAA;AAC1B,EAAA,IAAI,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,YAAY,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,EAAG,KAAK,CAAA;AACpE,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA,CAAE,KAAA,CAAM,CAAC,IAAA,KAAS,gBAAA,CAAiB,IAAA,EAAM,KAAK,CAAC,CAAA;AAAA,EACvE;AACA,EAAA,IAAI,MAAM,QAAA,CAAS,GAAG,GAAG,OAAO,YAAA,CAAa,OAAO,KAAK,CAAA;AACzD,EAAA,OAAO,cAAA,CAAe,OAAO,KAAK,CAAA;AACpC;AAEA,SAAS,WAAA,CAAY,SAAiB,KAAA,EAA4B;AAChE,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,QAAA,CAAS,OAAA,EAAS,EAAE,CAAA;AACxC,EAAA,OAAO,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,IAAK,MAAA,CAAO,IAAI,CAAA,KAAM,OAAA,IAAW,IAAA,GAAO,CAAA,IAAK,IAAA,IAAQ,KAAA,CAAM,GAAA;AACzF;AAEA,SAAS,YAAA,CAAa,OAAe,KAAA,EAA4B;AAC/D,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAC/B,EAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAI,KAAA;AAC3B,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,KAAA;AAC3D,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,QAAA,CAAS,QAAA,EAAU,EAAE,CAAA;AAC1C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA;AACtC,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAK,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA,CAAU,GAAG,CAAA,EAAG,OAAO,KAAA;AAC/D,EAAA,OAAO,SAAS,KAAA,CAAM,GAAA,IAAO,GAAA,IAAO,KAAA,CAAM,OAAO,KAAA,IAAS,GAAA;AAC5D;AAEA,SAAS,cAAA,CAAe,OAAe,KAAA,EAA4B;AACjE,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AACnC,EAAA,OAAO,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA,IAAK,MAAA,CAAO,CAAC,CAAA,KAAM,KAAA,IAAS,CAAA,IAAK,KAAA,CAAM,GAAA,IAAO,CAAA,IAAK,KAAA,CAAM,GAAA;AACpF;AAQO,SAAS,iBAAiB,QAAA,EAAwB;AACvD,EAAA,IAAI;AACF,IAAA,IAAI,KAAK,cAAA,CAAe,OAAA,EAAS,EAAE,QAAA,EAAU,UAAU,CAAA;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,uBAAA,EAA0B,QAAQ,CAAA,CAAA,EAAI;AAAA,MACjE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AASO,SAAS,iBAAA,CAAkB,OAAe,SAAA,EAA2B;AAC1E,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,EAAA,GAAK,EAAA,GAAK,GAAA;AAChC;;;ACnFO,IAAM,OAAN,MAAW;AAAA,EACR,WAAA,GAAc;AAAA,EAEtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,OAAO,OAAA,EAA8C;AAChE,IAAA,MAAM,GAAA,GAAM,MAAM,aAAA,CAAc,OAAO,CAAA;AACvC,IAAA,IAAI,IAAI,OAAA,KAAY,OAAA,IAAW,IAAI,OAAA,KAAY,KAAA,cAAmB,GAAG,CAAA;AACrE,IAAA,OAAO,GAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,IAAA,CAAK,OAAA,GAA2B,EAAC,EAAiC;AACvE,IAAA,MAAM,gBAAgB,OAAA,CAAQ,OAAA;AAC9B,IAAA,MAAM,KAAA,GAAQ,UAAS,CAAE,MAAA;AAAA,MAAO,CAAC,GAAA,KAC/B,aAAA,KAAkB,MAAA,GAAY,IAAA,GAAO,IAAI,OAAA,KAAY;AAAA,KACvD;AACA,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,KAAA,EAAO,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,GAAA,CAAI,KAAA,EAAe,QAAA,GAA2B,EAAC,EAAqB;AACzE,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,QACb,IAAI,kBAAkB,CAAA,SAAA,EAAY,KAAK,cAAc,EAAE,IAAA,EAAM,oBAAoB;AAAA,OACnF;AAAA,IACF;AACA,IAAA,OAAO,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,MAAA,CAAO,KAAA,EAAe,QAAA,GAAiC,EAAC,EAAkB;AAC/E,IAAA,aAAA,CAAc,KAAK,CAAA;AACnB,IAAA,SAAA,CAAU,KAAK,CAAA;AACf,IAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,MAAA,CAAO,KAAA,EAAe,QAAA,GAAiC,EAAC,EAAqB;AACxF,IAAA,OAAO,eAAA,CAAgB,OAAO,IAAI,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,OAAA,CAAQ,KAAA,EAAe,QAAA,GAAiC,EAAC,EAAqB;AACzF,IAAA,OAAO,eAAA,CAAgB,OAAO,KAAK,CAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAa,GAAA,CACX,KAAA,EACA,QAAA,GAA2B,EAAC,EAC8B;AAC1D,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,MAAA,MAAM,IAAI,kBAAkB,CAAA,SAAA,EAAY,KAAK,cAAc,EAAE,IAAA,EAAM,oBAAoB,CAAA;AAAA,IACzF;AACA,IAAA,OAAO,WAAW,GAAG,CAAA;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,KAAA,CAAM,OAAA,GAA4B,EAAC,EAAkB;AAK1D,IAAA,kBAAA,CAAmB,iBAAiB,CAAA;AACpC,IAAA,cAAA,CAAe,QAAQ,GAAG,CAAA;AAC1B,IAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,IAAA,GAAsB;AAC3B,IAAA,aAAA,EAAc;AACd,IAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,MAAA,CAAO,QAAA,GAA6B,EAAC,EAAiC;AAC3E,IAAA,MAAM,YAAY,iBAAA,EAAkB;AACpC,IAAA,OAAO,OAAA,CAAQ,QAAQ,EAAE,OAAA,EAAS,UAAU,OAAA,EAAS,QAAA,EAAU,QAAA,EAAS,EAAG,CAAA;AAAA,EAC7E;AACF;AAEA,eAAe,cAAc,OAAA,EAA8C;AACzE,EAAA,kBAAA,CAAmB,OAAO,CAAA;AAE1B,EAAA,sBAAA,CAAuB,QAAQ,IAAI,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,KAAA;AACrC,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AAGzB,EAAA,aAAA,CAAc,QAAQ,MAAM,CAAA;AAE5B,EAAA,MAAM,OAAA,GAAU,cAAc,OAAO,CAAA;AACrC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,MAAM,GAAA,GAAe;AAAA,IACnB,IAAI,cAAA,EAAe;AAAA,IACnB,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,QAAA;AAAA,IACA,OAAA,EAAS,QAAQ,OAAA,IAAW,IAAA;AAAA,IAC5B,MAAA,EAAQ,OAAA,CAAQ,OAAA,KAAY,KAAA,GAAQ,QAAA,GAAW,WAAA;AAAA,IAC/C,OAAA;AAAA,IACA,SAAA,EAAW,GAAA;AAAA,IACX,SAAA,EAAW,iBAAA,CAAkB,OAAA,CAAQ,IAAc,CAAA;AAAA,IACnD,GAAI,QAAQ,IAAA,KAAS,MAAA,GAAY,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAA,EAAK,GAAI,EAAC;AAAA,IAC3D,GAAI,QAAQ,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC;AAAA,IACpE,GAAI,QAAQ,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,IAC9D,GAAI,QAAQ,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAAI,EAAC;AAAA,IACpE,GAAI,QAAQ,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAS,GAAI,EAAC;AAAA,IACvE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI;AAAC,GAC5E;AACA,EAAA,SAAA,CAAU,GAAG,CAAA;AACb,EAAA,OAAO,GAAA;AACT;AAOA,SAAS,mBAAmB,OAAA,EAAkC;AAC5D,EAAA,MAAM,OAAA,GAAU,CAAC,OAAA,CAAQ,KAAA,EAAO,QAAQ,OAAA,EAAS,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA;AAAA,IACjE,CAAC,MAAM,CAAA,KAAM;AAAA,GACf,CAAE,MAAA;AACF,EAAA,IAAI,UAAU,CAAA,EAAG;AACf,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,qFAAA;AAAA,MACA,EAAE,MAAM,uBAAA;AAAwB,KAClC;AAAA,EACF;AACA,EAAA,IAAI,YAAY,CAAA,EAAG;AACjB,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,oEAAA;AAAA,MACA,EAAE,MAAM,gBAAA;AAAiB,KAC3B;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,IAAa,OAAA,CAAQ,YAAY,MAAA,EAAW;AACnE,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,gFAAA;AAAA,MACA,EAAE,MAAM,uBAAA;AAAwB,KAClC;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,IAAa,OAAA,CAAQ,YAAY,MAAA,EAAW;AACnE,IAAA,MAAM,IAAI,mBAAmB,0CAAA,EAA4C;AAAA,MACvE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAEA,SAAS,cAAc,OAAA,EAAyC;AAI9D,EAAA,IAAI,OAAA,CAAQ,QAAA,KAAa,MAAA,EAAW,OAAO,OAAA;AAC3C,EAAA,IAAI,OAAA,CAAQ,YAAY,MAAA,EAAW;AACjC,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,UAAA,CAAW,KAAK,IAAI,OAAA,GAAU,OAAA;AAAA,EACvD;AACA,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA;AACtB,EAAA,IAAI,KAAA,EAAO,KAAA,KAAU,MAAA,EAAW,OAAO,OAAA;AACvC,EAAA,OAAO,OAAA;AACT;AAEA,eAAe,eAAA,CAAgB,OAAe,OAAA,EAAoC;AAChF,EAAA,MAAM,QAAA,GAAW,OAAO,KAAK,CAAA;AAC7B,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,kBAAkB,CAAA,SAAA,EAAY,KAAK,cAAc,EAAE,IAAA,EAAM,oBAAoB,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,OAAA,GAAmB;AAAA,IACvB,GAAG,QAAA;AAAA,IACH,OAAA;AAAA,IACA,MAAA,EAAQ,UAAU,WAAA,GAAc;AAAA,GAClC;AACA,EAAA,SAAA,CAAU,OAAO,CAAA;AACjB,EAAA,IAAI,OAAA,CAAQ,YAAY,OAAA,EAAS;AAC/B,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,WAAA,CAAY,OAAO,CAAA;AAAA,IACrB,CAAA,MAAO;AACL,MAAA,aAAA,CAAc,QAAQ,EAAE,CAAA;AAAA,IAC1B;AAAA,EACF;AACA,EAAA,OAAO,OAAA;AACT","file":"chunk-3SHW7XKK.js","sourcesContent":["import { ConfigurationError, UnknownAgentError } from \"../../errors.js\";\nimport type { AgentOptions } from \"../../types/agent.js\";\nimport type { CronJob } from \"../../types/cron.js\";\nimport type { Run, SDKUserMessage } from \"../../types/run.js\";\nimport type { WorkflowRun } from \"../../types/workflow.js\";\nimport { getAgentFacade } from \"../runtime/registry/agent-factory-registry.js\";\n\n/**\n * Execute a cron job. Dispatches to one of three targets:\n *   - `workflow` (SE35) → `workflow.run(inputData)` on the held instance (the\n *     instance carries its own `.run`, so this module never imports `workflow.ts`),\n *     returning the already-terminal {@link WorkflowRun}.\n *   - `agent` → an ephemeral agent per fire; `agent.send(message)` → {@link Run}.\n *   - `agentId` → reuse an existing agent; `agent.send(message)` → {@link Run}.\n *\n * Used by both `Cron.run(jobId)` (manual off-schedule fire) and the scheduler's\n * default fire handler. ADR 0014.\n *\n * @internal\n */\nexport async function runCronJob(job: CronJob): Promise<Run | WorkflowRun> {\n  // `Workflow.run()` resolves only on a TERMINAL run (completed/failed/suspended/\n  // cancelled — the executor never returns `status: \"running\"`), so the fire\n  // handler treats the returned WorkflowRun as terminal (no `.wait()`).\n  if (job.workflow !== undefined) return job.workflow.run(job.inputData);\n  if (job.agent !== undefined) return runWithEphemeralAgent(job.agent, requireMessage(job));\n  if (job.agentId !== undefined) return runWithExistingAgent(job.agentId, requireMessage(job));\n  throw new ConfigurationError(\n    `Cron job ${job.id} has no target (agent, agentId, or workflow) — cannot run.`,\n    { code: \"cron_no_target\" },\n  );\n}\n\n/**\n * Discriminate the {@link runCronJob} union: an agent `Run` is deferred (carries\n * `.wait()`/`.cancel()`); a {@link WorkflowRun} is already terminal (no `.wait()`).\n * @internal\n */\nexport function isAgentRun(outcome: Run | WorkflowRun): outcome is Run {\n  return typeof (outcome as Run).wait === \"function\";\n}\n\n/** Agent targets require a message; fail-loud if one somehow reached a fire without it. */\nfunction requireMessage(job: CronJob): string | SDKUserMessage {\n  if (job.message === undefined) {\n    throw new ConfigurationError(`Cron job ${job.id} is an agent target but has no message.`, {\n      code: \"cron_missing_message\",\n    });\n  }\n  return job.message;\n}\n\nasync function runWithExistingAgent(\n  agentId: string,\n  message: string | SDKUserMessage,\n): Promise<Run> {\n  const info = await getAgentFacade()\n    .get(agentId)\n    .catch(() => undefined);\n  if (info === undefined) {\n    throw new UnknownAgentError(\n      `Cron job references agentId \"${agentId}\" but no such agent is registered. The agent may have been disposed or the process restarted without persisting the agent registry.`,\n      { code: \"agent_not_registered\" },\n    );\n  }\n  const agent = await getAgentFacade().resume(agentId);\n  return agent.send(message);\n}\n\nasync function runWithEphemeralAgent(\n  baseOptions: AgentOptions,\n  message: string | SDKUserMessage,\n): Promise<Run> {\n  const agent = await getAgentFacade().create(baseOptions);\n  return agent.send(message);\n}\n","/**\n * Default cron fire handler (extracted from `Cron.start` for testability + G8).\n *\n * Every fire registers as a Task (ADRs D363/D374) so callers observe it via\n * `Task.list` / `Task.subscribe`. SE35 (ADR 0014): the fire target may be an\n * agent (a deferred {@link Run} — abort-wire + `wait()`) OR a workflow (an\n * already-terminal {@link WorkflowRun} — no `wait()`); `isAgentRun` discriminates\n * so the handler records the correct terminal status/runId for each shape.\n *\n * @internal\n */\n\nimport type { CronJob } from \"../../types/cron.js\";\nimport { submit as taskRegistrySubmit } from \"../task/registry.js\";\nimport { isAgentRun, runCronJob } from \"./run-job.js\";\n\nexport async function fireCronJobAsTask(job: CronJob): Promise<void> {\n  // The task id namespace `cron-{jobId}-{fireEpochMs}` honors D368/EC-5.\n  const fireTs = Date.now();\n  const taskId = `cron-${job.id}-${fireTs}`;\n  try {\n    await taskRegistrySubmit({\n      kind: \"cron\",\n      id: taskId,\n      allowReservedPrefix: true,\n      meta: { jobId: job.id, jobName: job.name, schedule: job.cron, firedAt: fireTs },\n      work: async (ctx) => {\n        const outcome = await runCronJob(job);\n        if (isAgentRun(outcome)) {\n          // Agent target — the Run is deferred: abort-wire + await terminal.\n          ctx.signal.addEventListener(\"abort\", () => void outcome.cancel().catch(() => {}), {\n            once: true,\n          });\n          const result = await outcome.wait();\n          ctx.emit({ status: result.status, runId: outcome.id });\n          return { status: result.status, runId: outcome.id };\n        }\n        // SE35 workflow target — the WorkflowRun is ALREADY terminal (no wait()).\n        ctx.emit({ status: outcome.status, runId: outcome.id });\n        return { status: outcome.status, runId: outcome.id };\n      },\n    });\n  } catch {\n    // Task registry must not break cron — fall through to a direct run. No\n    // double-execution: `taskRegistrySubmit` runs `work` (which calls\n    // `runCronJob`) fire-and-forget, so a throw here means the SUBMIT itself\n    // failed (id/registry setup) BEFORE `work` started — the job never ran, and\n    // this is its first + only execution.\n    const outcome = await runCronJob(job);\n    if (isAgentRun(outcome)) await outcome.wait();\n  }\n}\n","import type { CronJob } from \"../../types/cron.js\";\n\n/**\n * Process-wide cron job store. In Phase 1 we keep all jobs in memory\n * (across local + cloud runtimes). Local-runtime persistence to\n * `.theokit/cron/jobs.json` lands when the local runtime adapter is wired.\n *\n * @internal\n */\nconst jobs = new Map<string, CronJob>();\n\n/** Snapshot of every known cron job. @internal */\nexport function listJobs(): CronJob[] {\n  return Array.from(jobs.values());\n}\n\n/** Total job count across runtimes. @internal */\nexport function jobCount(): number {\n  return jobs.size;\n}\n\n/** Fetch a single job by id, or `undefined` if it does not exist. @internal */\nexport function getJob(jobId: string): CronJob | undefined {\n  return jobs.get(jobId);\n}\n\n/** Insert or replace a job. @internal */\nexport function upsertJob(job: CronJob): void {\n  jobs.set(job.id, job);\n}\n\n/** Delete a job. Returns `true` if a job was removed. @internal */\nexport function deleteJob(jobId: string): boolean {\n  return jobs.delete(jobId);\n}\n\n/** Test-only: drop every job. @internal */\nexport function clearJobs(): void {\n  jobs.clear();\n}\n","import { Cron as Croner } from \"croner\";\n\nimport type { CronJob } from \"../../types/cron.js\";\nimport { listJobs, upsertJob } from \"./store.js\";\n\n/**\n * Real local cron scheduler. When `Cron.start()` is called the scheduler\n * installs a Croner timer per enabled local job; on fire the registered\n * fire handler runs the underlying agent. `Cron.stop()` tears every timer\n * down but keeps the jobs in the store.\n *\n * @internal\n */\n\nexport type CronFireHandler = (job: CronJob) => Promise<void> | void;\n\ninterface SchedulerState {\n  running: boolean;\n  cwd?: string;\n  timers: Map<string, Croner>;\n  fireHandler?: CronFireHandler;\n}\n\nconst state: SchedulerState = { running: false, timers: new Map() };\n\n/**\n * Register the callback invoked when a job fires. The runtime adapter\n * supplies a handler that actually executes the agent; fixture-mode tests\n * leave it unset so timers tick without side effects.\n *\n * @internal\n */\nexport function setCronFireHandler(handler: CronFireHandler | undefined): void {\n  state.fireHandler = handler;\n}\n\n/** Activate the scheduler and install timers for every enabled local job. @internal */\nexport function startScheduler(cwd?: string): void {\n  state.running = true;\n  if (cwd !== undefined) state.cwd = cwd;\n  for (const job of listJobs()) {\n    if (job.runtime === \"local\" && job.enabled !== false) scheduleJob(job);\n  }\n}\n\n/** Deactivate the scheduler. Stops every timer; jobs remain in the store. @internal */\nexport function stopScheduler(): void {\n  state.running = false;\n  for (const timer of state.timers.values()) timer.stop();\n  state.timers.clear();\n}\n\n/** Schedule a single job. No-op if the scheduler is not running. @internal */\nexport function scheduleJob(job: CronJob): void {\n  if (!state.running) return;\n  unscheduleJob(job.id);\n  const expression = normalizeExpression(job.cron);\n  const timer = new Croner(\n    expression,\n    { timezone: job.timezone, name: job.id, protect: true },\n    () => {\n      void fireJob(job.id);\n    },\n  );\n  state.timers.set(job.id, timer);\n  refreshNextRunAt(job.id, timer);\n}\n\n/** Tear down the timer for a single job. @internal */\nexport function unscheduleJob(jobId: string): boolean {\n  const timer = state.timers.get(jobId);\n  if (timer === undefined) return false;\n  timer.stop();\n  state.timers.delete(jobId);\n  return true;\n}\n\n/** Snapshot of the scheduler's running flag and configured workspace. @internal */\nexport function getSchedulerState(): { running: boolean; cwd?: string } {\n  const result: { running: boolean; cwd?: string } = { running: state.running };\n  if (state.cwd !== undefined) result.cwd = state.cwd;\n  return result;\n}\n\nasync function fireJob(jobId: string): Promise<void> {\n  const fresh = listJobs().find((entry) => entry.id === jobId);\n  if (fresh === undefined || fresh.enabled === false) return;\n  const handler = state.fireHandler;\n  upsertJob({ ...fresh, lastRunAt: Date.now() });\n  if (handler === undefined) return;\n  try {\n    await handler(fresh);\n  } catch {\n    // Swallow handler errors — the scheduler must keep ticking. Real\n    // surface for run failures lives on the Run.wait() result itself.\n  }\n}\n\nfunction refreshNextRunAt(jobId: string, timer: Croner): void {\n  const next = timer.nextRun();\n  if (next === null) return;\n  const existing = listJobs().find((entry) => entry.id === jobId);\n  if (existing === undefined) return;\n  upsertJob({ ...existing, nextRunAt: next.getTime() });\n}\n\nfunction normalizeExpression(cron: string): string {\n  switch (cron) {\n    case \"@hourly\":\n      return \"0 * * * *\";\n    case \"@daily\":\n      return \"0 0 * * *\";\n    case \"@weekly\":\n      return \"0 0 * * 0\";\n    case \"@monthly\":\n      return \"0 0 1 * *\";\n    case \"@yearly\":\n      return \"0 0 1 1 *\";\n    default:\n      return cron;\n  }\n}\n","import { ConfigurationError } from \"../../errors.js\";\n\n/**\n * POSIX-cron + shorthand validators used by `Cron.create()`. Throws\n * `ConfigurationError` with a stable message and code on invalid input.\n *\n * @internal\n */\n\nconst SHORTHANDS = new Set([\"@hourly\", \"@daily\", \"@weekly\", \"@monthly\", \"@yearly\"]);\n\ninterface FieldRange {\n  min: number;\n  max: number;\n}\n\nconst FIELD_RANGES: readonly FieldRange[] = [\n  { min: 0, max: 59 }, // minute\n  { min: 0, max: 23 }, // hour\n  { min: 1, max: 31 }, // day-of-month\n  { min: 1, max: 12 }, // month\n  { min: 0, max: 6 }, // day-of-week\n];\n\n/**\n * Validate a cron expression. Accepts shorthand (`@hourly`, ..., `@yearly`)\n * or 5-field POSIX cron with star, literals, star/N step, N-M range, and\n * N,M,P list.\n *\n * @internal\n */\nexport function validateCronExpression(cron: string): void {\n  if (typeof cron !== \"string\" || cron.length === 0) {\n    throw new ConfigurationError(\"Invalid cron expression: empty\", {\n      code: \"invalid_cron\",\n    });\n  }\n  if (cron.startsWith(\"@\")) {\n    if (!SHORTHANDS.has(cron)) {\n      throw new ConfigurationError(`Invalid cron expression: unknown shorthand ${cron}`, {\n        code: \"invalid_cron\",\n      });\n    }\n    return;\n  }\n\n  const fields = cron.trim().split(/\\s+/);\n  if (fields.length !== 5) {\n    throw new ConfigurationError(\n      `Invalid cron expression: ${cron} (expected 5 fields, got ${fields.length})`,\n      { code: \"invalid_cron\" },\n    );\n  }\n  for (const [index, field] of fields.entries()) {\n    validateFieldOrThrow(field, index, cron);\n  }\n}\n\nfunction validateFieldOrThrow(field: string, index: number, cron: string): void {\n  const range = FIELD_RANGES[index];\n  if (range === undefined) {\n    throw new ConfigurationError(`Invalid cron expression: ${cron} (field ${index + 1})`, {\n      code: \"invalid_cron\",\n    });\n  }\n  if (!isValidCronField(field, range)) {\n    throw new ConfigurationError(`Invalid cron expression: ${cron} (field ${index + 1})`, {\n      code: \"invalid_cron\",\n    });\n  }\n}\n\nfunction isValidCronField(field: string, range: FieldRange): boolean {\n  if (field === \"*\") return true;\n  if (field.startsWith(\"*/\")) return isValidStep(field.slice(2), range);\n  if (field.includes(\",\")) {\n    return field.split(\",\").every((part) => isValidCronField(part, range));\n  }\n  if (field.includes(\"-\")) return isValidRange(field, range);\n  return isValidLiteral(field, range);\n}\n\nfunction isValidStep(stepStr: string, range: FieldRange): boolean {\n  const step = Number.parseInt(stepStr, 10);\n  return Number.isInteger(step) && String(step) === stepStr && step > 0 && step <= range.max;\n}\n\nfunction isValidRange(field: string, range: FieldRange): boolean {\n  const parts = field.split(\"-\");\n  if (parts.length !== 2) return false;\n  const [startStr, endStr] = parts;\n  if (startStr === undefined || endStr === undefined) return false;\n  const start = Number.parseInt(startStr, 10);\n  const end = Number.parseInt(endStr, 10);\n  if (!Number.isInteger(start) || !Number.isInteger(end)) return false;\n  return start >= range.min && end <= range.max && start <= end;\n}\n\nfunction isValidLiteral(field: string, range: FieldRange): boolean {\n  const n = Number.parseInt(field, 10);\n  return Number.isInteger(n) && String(n) === field && n >= range.min && n <= range.max;\n}\n\n/**\n * Validate an IANA timezone. Uses `Intl.DateTimeFormat`'s strict timezone\n * lookup; invalid values raise `RangeError` which we wrap.\n *\n * @internal\n */\nexport function validateTimezone(timezone: string): void {\n  try {\n    new Intl.DateTimeFormat(\"en-US\", { timeZone: timezone });\n  } catch {\n    throw new ConfigurationError(`Invalid IANA timezone: ${timezone}`, {\n      code: \"invalid_timezone\",\n    });\n  }\n}\n\n/**\n * Heuristic next-fire-at estimator for fixture mode. Returns a timestamp\n * one hour in the future for shorthand/POSIX inputs. Real scheduling uses\n * a proper evaluator wired in by the local scheduler.\n *\n * @internal\n */\nexport function estimateNextRunAt(_cron: string, _timezone: string): number {\n  return Date.now() + 60 * 60 * 1000;\n}\n","// Bootstrap import: loading this facade must register the public Agent facade\n// into the agent-factory-registry seam, because `internal/cron/run-job.ts`\n// resolves it via `getAgentFacade()` at runtime instead of importing `agent.ts`\n// directly (which would invert the public-api -> internal dependency\n// direction). The `@theokit/sdk/cron` sub-path entry would otherwise throw\n// \"Agent facade not registered\" at runtime.\nimport \"./agent.js\";\nimport { ConfigurationError, UnknownAgentError } from \"./errors.js\";\nimport { fireCronJobAsTask } from \"./internal/cron/fire-handler.js\";\nimport { runCronJob } from \"./internal/cron/run-job.js\";\nimport {\n  getSchedulerState,\n  scheduleJob,\n  setCronFireHandler,\n  startScheduler,\n  stopScheduler,\n  unscheduleJob,\n} from \"./internal/cron/scheduler.js\";\nimport { deleteJob, getJob, jobCount, listJobs, upsertJob } from \"./internal/cron/store.js\";\nimport {\n  estimateNextRunAt,\n  validateCronExpression,\n  validateTimezone,\n} from \"./internal/cron/validate.js\";\nimport { resolveApiKey } from \"./internal/env.js\";\nimport { generateCronId } from \"./internal/ids.js\";\nimport type { AgentOptions, ListResult } from \"./types/agent.js\";\nimport type {\n  CronCreateOptions,\n  CronGetOptions,\n  CronJob,\n  CronListOptions,\n  CronOperationOptions,\n  CronRunOptions,\n  CronRuntime,\n  CronSchedulerStatus,\n  CronStartOptions,\n} from \"./types/cron.js\";\nimport type { Run } from \"./types/run.js\";\n\n/**\n * Static façade for scheduling Theo agent runs on a cron expression.\n *\n * @public\n */\nexport class Cron {\n  private constructor() {\n    // Static-only façade.\n  }\n\n  /**\n   * Create and persist a cron job.\n   *\n   * @public\n   */\n  static async create(options: CronCreateOptions): Promise<CronJob> {\n    const job = await createCronJob(options);\n    if (job.runtime === \"local\" && job.enabled !== false) scheduleJob(job);\n    return job;\n  }\n\n  /**\n   * List cron jobs (local, cloud, or both).\n   *\n   * @public\n   */\n  static list(options: CronListOptions = {}): Promise<ListResult<CronJob>> {\n    const runtimeFilter = options.runtime;\n    const items = listJobs().filter((job) =>\n      runtimeFilter === undefined ? true : job.runtime === runtimeFilter,\n    );\n    return Promise.resolve({ items });\n  }\n\n  /**\n   * Get a single cron job by ID.\n   *\n   * @public\n   */\n  static get(jobId: string, _options: CronGetOptions = {}): Promise<CronJob> {\n    const job = getJob(jobId);\n    if (job === undefined) {\n      return Promise.reject(\n        new UnknownAgentError(`Cron job ${jobId} not found`, { code: \"unknown_cron_job\" }),\n      );\n    }\n    return Promise.resolve(job);\n  }\n\n  /**\n   * Delete a cron job permanently.\n   *\n   * @public\n   */\n  static delete(jobId: string, _options: CronOperationOptions = {}): Promise<void> {\n    unscheduleJob(jobId);\n    deleteJob(jobId);\n    return Promise.resolve();\n  }\n\n  /**\n   * Re-enable a paused cron job.\n   *\n   * @public\n   */\n  static async enable(jobId: string, _options: CronOperationOptions = {}): Promise<CronJob> {\n    return updateJobStatus(jobId, true);\n  }\n\n  /**\n   * Pause a cron job without deleting it.\n   *\n   * @public\n   */\n  static async disable(jobId: string, _options: CronOperationOptions = {}): Promise<CronJob> {\n    return updateJobStatus(jobId, false);\n  }\n\n  /**\n   * Manually trigger a cron job off-schedule. Returns the resulting `Run`\n   * (agent target) or `WorkflowRun` (workflow target — SE35).\n   *\n   * @public\n   */\n  static async run(\n    jobId: string,\n    _options: CronRunOptions = {},\n  ): Promise<Run | import(\"./types/workflow.js\").WorkflowRun> {\n    const job = getJob(jobId);\n    if (job === undefined) {\n      throw new UnknownAgentError(`Cron job ${jobId} not found`, { code: \"unknown_cron_job\" });\n    }\n    return runCronJob(job);\n  }\n\n  /**\n   * Activate the in-process scheduler for local cron jobs.\n   *\n   * @public\n   */\n  static start(options: CronStartOptions = {}): Promise<void> {\n    // Install the default fire handler so timer ticks actually drive a real\n    // agent/workflow run. Users can override via `setCronFireHandler` from\n    // `@theokit/sdk/internal` (test-mode hook). Handler body lives in\n    // `internal/cron/fire-handler.ts` (testable + G8).\n    setCronFireHandler(fireCronJobAsTask);\n    startScheduler(options.cwd);\n    return Promise.resolve();\n  }\n\n  /**\n   * Stop the in-process scheduler. Jobs are preserved.\n   *\n   * @public\n   */\n  static stop(): Promise<void> {\n    stopScheduler();\n    return Promise.resolve();\n  }\n\n  /**\n   * Snapshot of the local scheduler.\n   *\n   * @public\n   */\n  static status(_options: CronStartOptions = {}): Promise<CronSchedulerStatus> {\n    const scheduler = getSchedulerState();\n    return Promise.resolve({ running: scheduler.running, jobCount: jobCount() });\n  }\n}\n\nasync function createCronJob(options: CronCreateOptions): Promise<CronJob> {\n  validateCronTarget(options);\n\n  validateCronExpression(options.cron);\n  const timezone = options.timezone ?? \"UTC\";\n  validateTimezone(timezone);\n\n  // apiKey is accepted but not required for cron-create in fixture mode.\n  resolveApiKey(options.apiKey);\n\n  const runtime = detectRuntime(options);\n  const now = Date.now();\n  const job: CronJob = {\n    id: generateCronId(),\n    cron: options.cron,\n    timezone,\n    enabled: options.enabled ?? true,\n    status: options.enabled === false ? \"paused\" : \"scheduled\",\n    runtime,\n    createdAt: now,\n    nextRunAt: estimateNextRunAt(options.cron, timezone),\n    ...(options.name !== undefined ? { name: options.name } : {}),\n    ...(options.message !== undefined ? { message: options.message } : {}),\n    ...(options.agent !== undefined ? { agent: options.agent } : {}),\n    ...(options.agentId !== undefined ? { agentId: options.agentId } : {}),\n    ...(options.workflow !== undefined ? { workflow: options.workflow } : {}),\n    ...(options.inputData !== undefined ? { inputData: options.inputData } : {}),\n  };\n  upsertJob(job);\n  return job;\n}\n\n/**\n * SE35 (ADR 0014) — exactly ONE target (`agent` | `agentId` | `workflow`).\n * Agent targets require `message`; a workflow target takes `inputData` and MUST\n * NOT set `message`.\n */\nfunction validateCronTarget(options: CronCreateOptions): void {\n  const targets = [options.agent, options.agentId, options.workflow].filter(\n    (t) => t !== undefined,\n  ).length;\n  if (targets > 1) {\n    throw new ConfigurationError(\n      \"agent, agentId, and workflow are mutually exclusive — pass exactly one target.\",\n      { code: \"cron_ambiguous_target\" },\n    );\n  }\n  if (targets === 0) {\n    throw new ConfigurationError(\n      \"Cron job requires exactly one target: agent, agentId, or workflow.\",\n      { code: \"cron_no_target\" },\n    );\n  }\n  if (options.workflow !== undefined && options.message !== undefined) {\n    throw new ConfigurationError(\n      \"A workflow cron target takes inputData, not a message — remove `message`.\",\n      { code: \"cron_workflow_message\" },\n    );\n  }\n  if (options.workflow === undefined && options.message === undefined) {\n    throw new ConfigurationError(\"An agent cron target requires a message.\", {\n      code: \"cron_missing_message\",\n    });\n  }\n}\n\nfunction detectRuntime(options: CronCreateOptions): CronRuntime {\n  // SE35 — a workflow target is a held in-memory instance; it can only run in\n  // the local (in-process) scheduler. A workflow instance cannot cross the\n  // cloud process boundary (ADR 0014).\n  if (options.workflow !== undefined) return \"local\";\n  if (options.agentId !== undefined) {\n    return options.agentId.startsWith(\"bc-\") ? \"cloud\" : \"local\";\n  }\n  const agent = options.agent as AgentOptions | undefined;\n  if (agent?.cloud !== undefined) return \"cloud\";\n  return \"local\";\n}\n\nasync function updateJobStatus(jobId: string, enabled: boolean): Promise<CronJob> {\n  const existing = getJob(jobId);\n  if (existing === undefined) {\n    throw new UnknownAgentError(`Cron job ${jobId} not found`, { code: \"unknown_cron_job\" });\n  }\n  const updated: CronJob = {\n    ...existing,\n    enabled,\n    status: enabled ? \"scheduled\" : \"paused\",\n  };\n  upsertJob(updated);\n  if (updated.runtime === \"local\") {\n    if (enabled) {\n      scheduleJob(updated);\n    } else {\n      unscheduleJob(updated.id);\n    }\n  }\n  return updated;\n}\n"]}

package/dist/chunk-4NAKHID5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/context/context-discovery.ts"],"names":[],"mappings":";;;;;AAsDO,IAAM,uBAAA,GAAwD;AAAA,EACnE;AAAA,IACE,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,WAAA;AAAA,IACT,KAAA,EAAO,eAAA;AAAA,IACP,MAAA,EAAQ,gBAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,QAAA,EAAU;AAAA,GACZ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,WAAA;AAAA,IACT,KAAA,EAAO,eAAA;AAAA,IACP,MAAA,EAAQ,gBAAA;AAAA,IACR,aAAA,EAAe,IAAA;AAAA,IACf,QAAA,EAAU;AAAA,GACZ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,WAAA;AAAA,IACJ,OAAA,EAAS,WAAA;AAAA,IACT,KAAA,EAAO,eAAA;AAAA,IACP,MAAA,EAAQ,gBAAA;AAAA,IACR,aAAA,EAAe,IAAA;AAAA,IACf,QAAA,EAAU;AAAA,GACZ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,cAAA;AAAA,IACJ,OAAA,EAAS,qBAAA;AAAA,IACT,KAAA,EAAO,SAAA;AAAA,IACP,MAAA,EAAQ,KAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,QAAA,EAAU;AAAA,GACZ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,eAAA;AAAA,IACJ,OAAA,EAAS,qBAAA;AAAA,IACT,KAAA,EAAO,SAAA;AAAA,IACP,MAAA,EAAQ,mBAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,QAAA,EAAU;AAAA,GACZ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,iBAAA;AAAA,IACJ,OAAA,EAAS,uBAAA;AAAA,IACT,KAAA,EAAO,SAAA;AAAA,IACP,MAAA,EAAQ,iBAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,QAAA,EAAU;AAAA,GACZ;AAAA,EACA;AAAA,IACE,EAAA,EAAI,SAAA;AAAA,IACJ,OAAA,EAAS,kBAAA;AAAA,IACT,KAAA,EAAO,UAAA;AAAA,IACP,MAAA,EAAQ,gBAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,QAAA,EAAU;AAAA;AAEd;AAEA,IAAM,aAAA,GAAgB,sBAAA;AACtB,IAAM,YAAA,GAAe,kBAAA;AAQd,SAAS,cAAc,OAAA,EAA0B;AACtD,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,MAAA,KAAW,GAAG,OAAO,KAAA;AAChE,EAAA,IAAI,YAAA,CAAa,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,KAAA;AACvC,EAAA,IAAI,UAAA,CAAW,OAAO,CAAA,EAAG,OAAO,KAAA;AAChC,EAAA,OAAO,aAAA,CAAc,KAAK,OAAO,CAAA;AACnC;AAUO,SAAS,YAAY,GAAA,EAAiC;AAC3D,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,MAAA;AACxD,EAAA,IAAI,OAAA,GAAU,QAAQ,GAAG,CAAA;AAEzB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,KAAK,CAAA,EAAG;AAC9B,IAAA,IAAI,WAAW,IAAA,CAAK,OAAA,EAAS,MAAM,CAAC,GAAG,OAAO,OAAA;AAC9C,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAO,CAAA;AAC9B,IAAA,IAAI,MAAA,KAAW,SAAS,OAAO,MAAA;AAC/B,IAAA,OAAA,GAAU,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAA;AACT;AAcO,SAAS,aAAA,CACd,GAAA,EACA,QAAA,EACA,OAAA,EACU;AACV,EAAA,IAAI,CAAC,aAAA,CAAc,QAAQ,CAAA,EAAG;AAC5B,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,KAAA,GAAQ,QAAQ,GAAG,CAAA;AACzB,EAAA,MAAM,IAAA,GAAO,OAAA,KAAY,MAAA,GAAY,OAAA,CAAQ,OAAO,CAAA,GAAI,MAAA;AACxD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AACjC,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,EAAA,EAAI,KAAK,CAAA,EAAG;AAC9B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACxC,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,IAAI,IAAA;AACJ,MAAA,IAAI;AACF,QAAA,IAAA,GAAO,aAAa,SAAS,CAAA;AAAA,MAC/B,CAAA,CAAA,MAAQ;AAEN,QAAA,IAAA,GAAO,SAAA;AAAA,MACT;AACA,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAG;AACvB,QAAA,QAAA,CAAS,IAAI,IAAI,CAAA;AACjB,QAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,MACjB;AAAA,IACF;AACA,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,OAAA,KAAY,IAAA,EAAM;AAC5C,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAO,CAAA;AAC9B,IAAA,IAAI,WAAW,OAAA,EAAS;AACxB,IAAA,OAAA,GAAU,MAAA;AAAA,EACZ;AACA,EAAA,OAAO,KAAA;AACT;AAoCA,eAAsB,aAAA,CAAc,KAAa,OAAA,EAAoC;AACnF,EAAA,IAAI,CAAC,aAAA,CAAc,OAAO,CAAA,SAAU,EAAC;AACrC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI;AACF,IAAA,WAAA,MAAiB,SAAS,IAAA,CAAK,OAAA,EAAS,EAAE,GAAA,EAAK,CAAA,EAAG;AAChD,MAAA,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAC,CAAA;AAAA,IAChC;AAAA,EACF,CAAA,CAAA,MAAQ;AAGN,IAAA,OAAO,EAAC;AAAA,EACV;AAQA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAO,CAAA,GAAI,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,CAAE,CAAA;AAC1D","file":"chunk-4NAKHID5.js","sourcesContent":["/**\n * Context file discovery (T1.1, ADRs D150 / D151).\n *\n * Discovers context files via three scopes:\n *  - `cwd-only` — single dir, single path lookup\n *  - `git-root-walk` — walk cwd → git-root, collect every directory's match\n *    (nearest-first ordering)\n *  - `globbed` — glob pattern relative to cwd (e.g. `.cursor/rules/*.mdc`)\n *\n * Pure `existsSync` checks — **no `.gitignore` parsing** (EC-A, KISS) and\n * **no invented `.theokitignore`** (EC-B). Paths normalized via\n * `realpath` to dedup symlink chains pointing to the same physical file\n * (EC-F). Git worktrees work transparently because `.git` exists as a\n * file in that case (EC-N).\n *\n * @internal\n */\n\nimport { existsSync, realpathSync } from \"node:fs\";\nimport { glob } from \"node:fs/promises\";\nimport { dirname, isAbsolute, join, resolve } from \"node:path\";\n\n/** Single filename (\"AGENTS.md\") or relative glob (\".cursor/rules/*.mdc\"). */\nexport type DiscoveryScope = \"cwd-only\" | \"git-root-walk\" | \"globbed\";\n\n/** Parser to apply once file is read. */\nexport type DiscoveryParser = \"plain-markdown\" | \"mdc\" | \"frontmatter-zod\" | \"rules-frontmatter\";\n\n/**\n * Specification for one discoverable context source. The default registry\n * `DEFAULT_DISCOVERY_SPECS` covers the 2026 industry-standard set.\n *\n * @internal\n */\nexport interface DiscoverySpec {\n  /** Stable identifier — used as `<source name=\"\">` and telemetry key. */\n  readonly id: string;\n  /** Priority for merge (lower = earlier in prompt). */\n  readonly priority: number;\n  /** Filename (cwd-only/git-root-walk) or glob (globbed). */\n  readonly pattern: string;\n  readonly scope: DiscoveryScope;\n  readonly parser: DiscoveryParser;\n  /** Whether to follow `@path` import directives (CLAUDE.md / GEMINI.md). */\n  readonly followImports: boolean;\n}\n\n/**\n * 2026 industry-standard context file registry. Sorted by priority\n * ascending — earlier in prompt = more general, last-writer-wins on\n * conflict (D152 concat-by-priority).\n *\n * @internal\n */\nexport const DEFAULT_DISCOVERY_SPECS: ReadonlyArray<DiscoverySpec> = [\n  {\n    id: \"AGENTS.md\",\n    pattern: \"AGENTS.md\",\n    scope: \"git-root-walk\",\n    parser: \"plain-markdown\",\n    followImports: false,\n    priority: 10,\n  },\n  {\n    id: \"GEMINI.md\",\n    pattern: \"GEMINI.md\",\n    scope: \"git-root-walk\",\n    parser: \"plain-markdown\",\n    followImports: true,\n    priority: 20,\n  },\n  {\n    id: \"CLAUDE.md\",\n    pattern: \"CLAUDE.md\",\n    scope: \"git-root-walk\",\n    parser: \"plain-markdown\",\n    followImports: true,\n    priority: 30,\n  },\n  {\n    id: \"cursor-rules\",\n    pattern: \".cursor/rules/*.mdc\",\n    scope: \"globbed\",\n    parser: \"mdc\",\n    followImports: false,\n    priority: 40,\n  },\n  {\n    id: \"theokit-rules\",\n    pattern: \".theokit/rules/*.md\",\n    scope: \"globbed\",\n    parser: \"rules-frontmatter\",\n    followImports: false,\n    priority: 45,\n  },\n  {\n    id: \"theokit-context\",\n    pattern: \".theokit/context/*.md\",\n    scope: \"globbed\",\n    parser: \"frontmatter-zod\",\n    followImports: false,\n    priority: 50,\n  },\n  {\n    id: \"THEO.md\",\n    pattern: \".theokit/THEO.md\",\n    scope: \"cwd-only\",\n    parser: \"plain-markdown\",\n    followImports: false,\n    priority: 60,\n  },\n];\n\nconst SAFE_FILENAME = /^[a-zA-Z0-9_.\\-/*]+$/;\nconst TRAVERSAL_RE = /(^|\\/)\\.\\.(\\/|$)/;\n\n/**\n * Reject patterns that contain path traversal (`..`) or non-allowed\n * characters (D81 parity, EC-4).\n *\n * @internal\n */\nexport function isSafePattern(pattern: string): boolean {\n  if (typeof pattern !== \"string\" || pattern.length === 0) return false;\n  if (TRAVERSAL_RE.test(pattern)) return false;\n  if (isAbsolute(pattern)) return false;\n  return SAFE_FILENAME.test(pattern);\n}\n\n/**\n * Walk upward from `cwd` looking for the closest directory containing\n * a `.git` entry (file OR directory — worktrees use a `.git` FILE,\n * EC-N). Returns the absolute path of that directory, or `undefined`\n * when no git root exists at or above `cwd`.\n *\n * @internal\n */\nexport function findGitRoot(cwd: string): string | undefined {\n  if (typeof cwd !== \"string\" || cwd.length === 0) return undefined;\n  let current = resolve(cwd);\n  // Guard against infinite loops on weird filesystems.\n  for (let i = 0; i < 64; i += 1) {\n    if (existsSync(join(current, \".git\"))) return current;\n    const parent = dirname(current);\n    if (parent === current) return undefined;\n    current = parent;\n  }\n  return undefined;\n}\n\n/**\n * Walk `cwd` upward to `stopDir` (inclusive) collecting every existing\n * occurrence of `filename`. Returns absolute, realpath-deduped paths in\n * nearest-first order (innermost dir first).\n *\n * No `.gitignore` parsing (EC-A). Realpath collapses symlink chains\n * pointing to the same physical file (EC-F). Filesystem races (file\n * deleted mid-walk) are skipped silently (EC-5).\n *\n * @internal\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: walk-up loop combines validation + realpath dedup + FS-race handling + stopDir guard in a single bounded loop; splitting fragments the dedup invariant.\nexport function walkUpForFile(\n  cwd: string,\n  filename: string,\n  stopDir: string | undefined,\n): string[] {\n  if (!isSafePattern(filename)) {\n    return [];\n  }\n  const start = resolve(cwd);\n  const stop = stopDir !== undefined ? resolve(stopDir) : undefined;\n  const found: string[] = [];\n  const seenReal = new Set<string>();\n  let current = start;\n  // 64-level depth cap.\n  for (let i = 0; i < 64; i += 1) {\n    const candidate = join(current, filename);\n    if (existsSync(candidate)) {\n      let real: string;\n      try {\n        real = realpathSync(candidate);\n      } catch {\n        // FS race (deleted mid-walk) — skip.\n        real = candidate;\n      }\n      if (!seenReal.has(real)) {\n        seenReal.add(real);\n        found.push(real);\n      }\n    }\n    if (stop !== undefined && current === stop) break;\n    const parent = dirname(current);\n    if (parent === current) break;\n    current = parent;\n  }\n  return found;\n}\n\n/**\n * Glob-style discovery under `cwd` (e.g. `.cursor/rules/*.mdc`, `.theokit/rules/**\\/*.md`).\n * Returns absolute, lex-sorted paths.\n *\n * `*` matches within one path segment and `**` spans any depth, including zero — so\n * `.theokit/rules/**\\/*.md` finds `rules/top.md` as well as `rules/deep/nested/inner.md`, while\n * `.theokit/rules/*.md` keeps its flat meaning and finds only the first. That distinction is the\n * compatibility contract: every existing spec uses a single `*`, and widening it would silently\n * start absorbing nested files nobody chose to expose.\n *\n * ## Why this used to be flat, and what changed (B-119)\n *\n * The previous implementation split the pattern at its LAST `/`, treated the prefix as a literal\n * directory and did one `readdir` — documented as \"nested directories deferred to v2\" (EC-R). The\n * deferral was deliberate; what made it a defect was measured from a consumer. TheoCode's own rule\n * loader descends recursively, so migrating it onto the `theokit-rules` spec would have silently\n * dropped every nested rule — on the path that decides whether a repository's hooks execute. And a\n * pattern written to say so, `.theokit/rules/**\\/*.md`, resolved its directory part to a literal\n * `**` and matched NOTHING, not even the top-level file it matched before the globstar was added.\n *\n * ## Why the stdlib rather than a walker\n *\n * `fs.promises.glob` (Node ≥ 22, and this package requires ≥ 22.12) implements exactly these\n * semantics, verified against a fixture before adoption: `**\\/*.md` returns all three depths,\n * `*.md` returns one, and it emits no experimental warning. Writing a recursive walker here would\n * have been a third implementation of matching inside one package — the same duplication that let\n * the enumerator and the compiler in `context-glob.ts` disagree in the first place. `globToRegex`\n * stays where it belongs: deciding whether a rule APPLIES to a set of paths, which is a different\n * question from which files exist.\n *\n * `isSafePattern` still runs first and is unchanged, so `..` is refused before any I/O.\n *\n * @internal\n */\nexport async function walkUpForGlob(cwd: string, pattern: string): Promise<string[]> {\n  if (!isSafePattern(pattern)) return [];\n  const found: string[] = [];\n  try {\n    for await (const entry of glob(pattern, { cwd })) {\n      found.push(resolve(cwd, entry));\n    }\n  } catch {\n    // A pattern whose directory does not exist is the ordinary case — most projects have no\n    // `.cursor/rules/`. Same outcome as matching nothing.\n    return [];\n  }\n  // Sorted, because discovery order becomes prompt order and must not vary with the filesystem.\n  //\n  // The comparator is explicit and deliberately NOT `localeCompare`, which is the usual suggestion\n  // for a bare `.sort()`. `localeCompare` orders by the machine's locale, so the same tree would\n  // assemble a different prompt on a differently-configured machine — trading one source of\n  // non-determinism for a subtler one. Code-unit ordering is what a bare `.sort()` already does for\n  // strings; writing it out states the intent and keeps the result machine-independent.\n  return found.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n}\n"]}

package/dist/chunk-4X3SBHPK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/diagnostics.ts","../src/internal/security/redact.ts"],"names":[],"mappings":";AAoEA,IAAM,SAAA,mBAAY,MAAA,CAAO,GAAA,CAAI,iCAAiC,CAAA;AAI9D,SAAS,WAAA,GAA2C;AAClD,EAAA,OAAQ,WAAqC,SAAS,CAAA;AACxD;AASO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAC,UAAA,CAAqC,SAAS,CAAA,GAAI,IAAA;AACrD;AAQO,SAAS,KAAK,OAAA,EAAuB;AAG1C,EAAA,MAAM,OAAO,WAAA,EAAY;AACzB,EAAA,IAAI,SAAS,MAAA,EAAW;AACxB,EAAA,IAAI;AACF,IAAA,IAAA,CAAK,OAAO,CAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;AC/EA,IAAI,iBAA0B,WAAA,EAAY;AAE1C,SAAS,WAAA,GAAuB;AAC9B,EAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,CAAI,sBAAA;AACxB,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,IAAA;AAC9B,EAAA,OAAO,CAAC,KAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,CAAA;AAC9D;AAGA,IAAI,YAAA,GAAe,KAAA;AACnB,IAAI,CAAC,cAAA,IAAkB,CAAC,YAAA,EAAc;AACpC,EAAA,IAAA;AAAA,IACE;AAAA,GAEF;AACA,EAAA,YAAA,GAAe,IAAA;AACjB;AASA,IAAM,gBAAA,GAAsC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,iJAAA;AAAA;AAAA;AAAA,EAGA,gEAAA;AAAA;AAAA,EAEA,mCAAA;AAAA;AAAA,EAEA,oCAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA;AAAA,EAEA,6BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA;AAAA,EAEA,wBAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,8BAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,yBAAA;AAAA;AAAA,EACA,+BAAA;AAAA;AAAA;AAAA,EAEA,sBAAA;AAAA;AAAA,EACA,2CAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,2DAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAKA,IAAM,cAAA,GAAiB,wCAAA;AAoBvB,IAAM,aAAA,GACJ,4NAAA;AAEF,IAAM,iBAA2B,EAAC;AAS3B,SAAS,WAAW,EAAA,EAAkB;AAC3C,EAAA,IAAI,CAAC,GAAG,MAAA,EAAQ;AACd,IAAA,MAAM,IAAI,MAAM,wEAAwE,CAAA;AAAA,EAC1F;AACA,EAAA,cAAA,CAAe,KAAK,EAAE,CAAA;AACxB;AAYO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,EAAA,EAAI,OAAO,KAAA;AAC9B,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAClD;AAKA,IAAM,UAAA,GAAa,mBAAA;AAoBnB,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AAClD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAC9B,MAAA,OAAO,CAAA,KAAM,SAAY,IAAA,GAAO,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,0BAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAEO,SAAS,aAAA,CAAc,MAAe,IAAA,EAAuC;AAClF,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,IAAI,OAAA,KAAY,MAAM,OAAO,EAAA;AAC7B,EAAA,IAAI,CAAC,gBAAgB,OAAO,OAAA;AAE5B,EAAA,IAAI,CAAA,GAAI,OAAA;AACR,EAAA,KAAA,MAAW,MAAM,gBAAA,EAAkB;AACjC,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,EAAA,EAAI,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,KAAA,MAAW,MAAM,cAAA,EAAgB;AAC/B,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,EAAA,EAAI,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,CAAC,MAAM,QAAA,EAAU;AAInB,IAAA,CAAA,GAAI,CAAA,CAAE,QAAQ,cAAA,EAAgB,CAAC,GAAG,MAAA,KAAmB,CAAA,EAAG,MAAM,CAAA,GAAA,CAAK,CAAA;AAInE,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,aAAA,EAAe,CAAC,KAAA,EAAO,QAAgB,KAAA,KAAkB;AAOrE,MAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AACnC,MAAA,OAAO,GAAG,MAAM,CAAA,GAAA,CAAA;AAAA,IAClB,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,CAAA;AACT","file":"chunk-4X3SBHPK.js","sourcesContent":["/**\n * The library's single diagnostics channel — silent by default (#147).\n *\n * ## The problem\n *\n * The SDK wrote diagnostics straight to `process.stderr` from hot paths — 92 sites across 51\n * files under `internal/`. In a TUI host (Ink, alternate screen), those writes interleave with the\n * render and **corrupt the frame**. And the host had no way to intercept them: there was no\n * injectable logger. One consumer went as far as installing `proper-lockfile` just to silence ONE\n * of them.\n *\n * A library cannot assume `stdout`/`stderr` are free sinks. The application owns the terminal, not\n * the dependency.\n *\n * ## The contract\n *\n * - **`setDiagnosticsSink(fn)`** hands the messages to the application, which decides where to put\n *   them (a status line, a file, a panel). It is what was missing for a TUI to coexist with the SDK.\n * - **With no sink, nothing is emitted.** A library does not own the host's terminal.\n *\n * ## Silent by default, and how 36 suites survived the flip\n *\n * The default WAS `stderr`, and 36 test files spy on `process.stderr.write` to assert a given\n * warning is emitted. That contract is real and had to survive; migrating all 36 by hand, across\n * four different spy styles, is how you weaken 36 suites in one commit.\n *\n * So the flip happened at the default, and `vitest.setup.ts` installs a sink that FORWARDS to\n * `stderr` for the duration of every test. Those assertions still test what they always tested —\n * \"this condition emits a diagnostic\" — through the channel a host would use, while production\n * emits nothing unless asked.\n *\n * The cost is stated rather than hidden: no test observes the production default by accident, so\n * `tests/diagnostics-public-entry.test.ts` pins it explicitly by clearing the sink first.\n *\n * ## Coverage is the whole guarantee\n *\n * The first sweep migrated the 92 sites under `internal/` and left `src/`'s own modules —\n * `event-bus.ts`, `batch.ts`, `compaction.ts`, `internal/workflow/step-branch.ts`. A host could\n * therefore install a sink and still have its frame corrupted by a batch run, which is the reported\n * defect with a smaller blast radius. Those are routed here too, and\n * `tests/lint/no-direct-terminal-write.test.ts` is what keeps the next hot path from\n * reintroducing one. \"Mostly interceptable\" is not interceptable.\n *\n * The remaining direct writers are allowlisted there with a reason, and every one of them is a seam\n * whose destination the CALLER already chooses (`opts.warn`, `opts.logger`, the Workflow logger).\n *\n * ## What this is NOT\n *\n * It is not a logger with levels, formatting or multiple destinations. It is the minimum that\n * resolves the reported blocker; a full logger here would be inventing a requirement nobody asked\n * for.\n */\n\n/** Receives each diagnostic message already formatted, with the trailing `\\n`. */\nexport type DiagnosticsSink = (message: string) => void;\n\n/**\n * The registry lives on `globalThis`, not in a module-level `let` (theokit#173).\n *\n * A module-level binding is a per-INSTANCE singleton, and a package manager will install two\n * physical copies of the same version whenever two dependents resolve different peer sets. Measured:\n * `@theokit/sdk@4.39.1` existed under two pnpm store hashes in the theokit workspace, so a sink\n * installed through `@theokit/agents` landed in a different registry than the emitter writes to.\n *\n * The failure mode is the quiet one — the re-export resolves, the function is callable, nothing\n * throws, and no diagnostic ever arrives. `Symbol.for` gives every copy in the process the same\n * slot; the `v1` suffix leaves room to change the shape without colliding with an older copy.\n */\nconst SINK_SLOT = Symbol.for(\"theokit.sdk.diagnostics.sink.v1\");\n\ntype SinkHolder = Record<symbol, DiagnosticsSink | undefined>;\n\nfunction currentSink(): DiagnosticsSink | undefined {\n  return (globalThis as unknown as SinkHolder)[SINK_SLOT];\n}\n\n/**\n * Installs (or removes, by passing `undefined`) the diagnostics destination.\n *\n * When a sink is present it is the ONLY destination — `stderr` gets no copy. Duplicating\n * destinations would hand the problem back to the TUI that installed the sink precisely to get the\n * messages out of the terminal.\n */\nexport function setDiagnosticsSink(next: DiagnosticsSink | undefined): void {\n  (globalThis as unknown as SinkHolder)[SINK_SLOT] = next;\n}\n\n/**\n * Emits a library diagnostic message.\n *\n * Replaces `process.stderr.write` on internal paths. Never throws: a faulty sink must not\n * must not take down the run it merely observes.\n */\nexport function diag(message: string): void {\n  // Silent by default (#147): with no sink installed the message is dropped. A library must not\n  // assume the host's stdout/stderr are free-form log sinks — in a TUI they are the render surface.\n  const sink = currentSink();\n  if (sink === undefined) return;\n  try {\n    sink(message);\n  } catch {\n    // Observability never breaks the run — same principle as `emitRunEvent`.\n  }\n}\n\n/**\n * Emits a diagnostic that reports a USER-VISIBLE FAILURE, and is never silently dropped.\n *\n * `diag` is silent with no sink installed, and that is right for chatter: a library must not assume\n * the host's stderr is a free-form log, because in a TUI it is the render surface. A failure is a\n * different message. `theokit-sdk#189` is the record of the difference — an MCP server failed to\n * start, the only report went to `diag()`, the embedding UI never read it, and the user saw an\n * agent with missing tools and no reason given.\n *\n * The two failure modes are not symmetric, which is the whole decision: a corrupted frame is\n * visible and recoverable, while a silently dropped failure is neither. So this falls back to\n * stderr rather than to silence.\n *\n * A sink still takes precedence — the host installed it precisely to keep these off the terminal —\n * EXCEPT when the sink throws. A broken sink swallowing the one report of a failure is the same\n * defect one layer further in.\n *\n * @internal\n */\nexport function diagFailure(message: string): void {\n  const sink = currentSink();\n  if (sink !== undefined) {\n    try {\n      sink(message);\n      return;\n    } catch {\n      // Fall through: the sink is broken, and this message is too important to drop with it.\n    }\n  }\n  try {\n    process.stderr.write(`${message}\\n`);\n  } catch {\n    // Nothing left to try. Observability never breaks the run.\n  }\n}\n","import { diag } from \"../diagnostics.js\";\n\n/**\n * Canonical secret redaction module (ADRs D68-D73).\n *\n * Single source of truth for credential pattern masking across the SDK.\n * Wired at output boundaries: `ErrorMetadata.raw` (mappers/shared.ts),\n * telemetry span attributes (telemetry/tracer.ts), transcript JSONL\n * appends (agent-session-store.ts), migration logger output\n * (memory/migrate-sqlite-to-lance.ts).\n *\n * - D68: central module, single source of truth (replaces 2 duplicates)\n * - D69: env snapshot at module init (prompt-injection defense)\n * - D70: ON by default, warn on opt-out\n * - D71: two-bucket masking — short fully masked, long preserves prefix+suffix\n * - D72: `codeFile` opt-out for legitimate prefix-shaped content\n * - D73: redact at OUTPUT boundaries, not at storage\n *\n * @internal\n */\n\n// D69: env snapshot captured at module load. Subsequent mutations of\n// process.env.THEOKIT_REDACT_SECRETS are ignored — defends against\n// prompt injection that tries to disable redaction mid-run.\nlet REDACT_ENABLED: boolean = readEnvOnce();\n\nfunction readEnvOnce(): boolean {\n  const raw = process.env.THEOKIT_REDACT_SECRETS;\n  if (raw === undefined) return true; // D70: default ON\n  return [\"1\", \"true\", \"yes\", \"on\"].includes(raw.toLowerCase());\n}\n\n// D70: warn once on opt-out so the user knows they're vulnerable.\nlet warnedOptOut = false;\nif (!REDACT_ENABLED && !warnedOptOut) {\n  diag(\n    \"[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. \" +\n      \"Credentials may leak into errors, telemetry, logs, transcripts.\\n\",\n  );\n  warnedOptOut = true;\n}\n\n/**\n * Built-in credential patterns. Order matters — more specific prefixes\n * must come before generic ones (e.g., `sk-ant-` before `sk-`). Quantifiers\n * are all bounded `{n,m}` or applied to char classes — linear time, no ReDoS.\n *\n * @internal\n */\nconst BUILTIN_PATTERNS: readonly RegExp[] = [\n  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more\n  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before\n  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its\n  // multi-line span runs before any per-line patterns can fire.\n  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\\s\\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,\n  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per\n  // segment matches the minimum legal payload while skipping `a.b.c` noise.\n  /eyJ[A-Za-z0-9_-]{4,}\\.eyJ[A-Za-z0-9_-]{4,}\\.[A-Za-z0-9_-]{4,}/g,\n  // Azure Storage SAS — match the sig= component (URL-encoded base64).\n  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,\n  // Anthropic\n  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g, //   Anthropic admin keys (must precede sk-ant-)\n  /sk-ant-[A-Za-z0-9_-]{10,}/g, //           Anthropic regular\n  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)\n  /sk-proj-[A-Za-z0-9_-]{10,}/g, //  OpenAI project key (must precede sk- generic)\n  /sk-[A-Za-z0-9_-]{10,}/g, //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek\n  // Provider prefixes (alphabetized for maintainability)\n  /AIza[A-Za-z0-9_-]{35}/g, //       Google API key\n  /AKIA[A-Z0-9]{16}/g, //            AWS access key\n  /fw_[A-Za-z0-9]{20,}/g, //         Fireworks\n  /glpat-[A-Za-z0-9_-]{20}/g, //     GitLab PAT\n  /ghp_[A-Za-z0-9]{36}/g, //         GitHub PAT classic\n  /github_pat_[A-Za-z0-9_]{82}/g, // GitHub PAT fine-grained\n  /gsk_[A-Za-z0-9]{20,}/g, //        Groq\n  /hf_[A-Za-z0-9]{20,}/g, //         HuggingFace\n  /\\bpa-[A-Za-z0-9_-]{20,}/g, //     Voyage AI (word-boundary to skip CSS / kebab IDs)\n  /pcsk_[A-Za-z0-9_-]{20,}/g, //     Pinecone\n  /pplx-[A-Za-z0-9_-]{20,}/g, //     Perplexity\n  /r8_[A-Za-z0-9_-]{20,}/g, //       Replicate\n  /rk_live_[A-Za-z0-9]{20,}/g, //    Stripe restricted\n  /sk_live_[A-Za-z0-9]{20,}/g, //    Stripe secret\n  /sntrys_[A-Za-z0-9]{40,}/g, //     Sentry user auth\n  /xai-[A-Za-z0-9_-]{20,}/g, //      xAI (Grok)\n  /xox[bpasr]-[A-Za-z0-9-]{10,}/g, //Slack tokens\n  // Additional unique-prefix tokens with low false-positive risk\n  /npm_[A-Za-z0-9]{36}/g, //         npm access token\n  /SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}/g, // SendGrid\n  /\\bSK[A-Za-z0-9]{32}\\b/g, //       Twilio API SID (word-boundary to skip CSS class noise)\n  /\\bkey-[a-f0-9]{32}\\b/g, //        Mailgun (hex-only narrows false positives)\n  /MT[A-Za-z0-9_-]{23}\\.[A-Za-z0-9_-]{6}\\.[A-Za-z0-9_-]{27}/g, // Discord bot\n  /\\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\\b/g, // LaunchDarkly\n];\n\n// `Bearer <token>` matched as its own first-class pattern so PARAM_PATTERN\n// doesn't have to handle the unusual `Authorization: Bearer xxx` shape\n// (no `:` or `=` between \"Bearer\" and the value — bare whitespace).\nconst BEARER_PATTERN = /\\b(Bearer\\s+)([A-Za-z0-9_\\-.+/=]{8,})/g;\n\n// Parametric: matches `key=value` and `key: value` (with optional quote\n// between the key and the separator, to handle JSON: `\"api_key\": \"...\"`)\n// in URLs, query strings, JSON-like bodies, HTTP headers. Captures the\n// prefix so we keep it visible while masking the value.\n//\n// `authorization` deliberately excluded — BEARER_PATTERN handles the\n// common `Authorization: Bearer xxx` shape. Including it here causes\n// double-masking (\"Authorization: *** ***\") after Bearer fires.\n// T5.4: keyword set expanded from 6 → 16 to cover the OAuth / JWT / generic\n// credential vocabulary surfaced by DR6 finding #4. `authorization`,\n// `auth`, `bearer` stay excluded — BEARER_PATTERN handles the\n// `Authorization: Bearer xxx` shape and including these here would\n// re-catch the post-BUILTIN-masked form (D71 prefix-preservation\n// contract) and double-mask to `***`.\n//\n// Value class includes `.` so JWT / `.env` / dotted base64url values\n// match; the callback skips already-masked values (containing the\n// `...` D71 separator) to preserve the BUILTIN prefix-mask result.\nconst PARAM_PATTERN =\n  /(\\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\\b[\"']?\\s*[:=]\\s*[\"']?)([A-Za-z0-9_\\-.+/]+)/gi;\n\nconst _extraPatterns: RegExp[] = [];\n\n/**\n * Add a user-defined redaction pattern. Additive — never removes builtins.\n * Throws if the regex lacks the `/g` flag (without `/g`, `.replace` only\n * substitutes the first match and the rest leaks).\n *\n * @internal — exposed publicly via `Security.addPattern` in `src/security.ts`.\n */\nexport function addPattern(re: RegExp): void {\n  if (!re.global) {\n    throw new Error(\"Security.addPattern: regex must have /g flag for replace-all semantics\");\n  }\n  _extraPatterns.push(re);\n}\n\n/**\n * Two-bucket masking (D71):\n *   - tokens shorter than 18 chars → fully masked as `***`\n *   - tokens >= 18 chars → keep first 6 + `...` + last 4\n *\n * Rationale: long tokens are unique per-account; prefix+suffix preserves\n * debuggability without revealing the secret middle.\n *\n * @internal\n */\nexport function maskToken(token: string): string {\n  if (token.length < 18) return \"***\";\n  return `${token.slice(0, 6)}...${token.slice(-4)}`;\n}\n\n// issue #117 — the EXACT shape of a `maskToken` output (`slice(0,6)+\"...\"+slice(-4)`\n// = 6 chars, literal `...`, 4 chars). Used to detect a value PARAM_PATTERN would\n// otherwise re-mask, WITHOUT skipping a raw secret that merely contains `...`.\nconst MASK_SHAPE = /^.{6}\\.\\.\\..{4}$/s;\n\n/**\n * Redact known credential patterns from `text`. Default behavior masks\n * builtins + extras + parametric `key=value` sinks.\n *\n * With `{ codeFile: true }` (D72), skips PARAM_PATTERN to avoid mangling\n * `.env.example`, schema JSON, or test fixtures that legitimately contain\n * prefix-like strings.\n *\n * Returns the redacted string. Coerces non-strings via JSON.stringify;\n * EC-7 fix (edge-case review): wraps in try/catch so circular references\n * never propagate — returns sentinel `\"[unredactable: circular]\"`.\n *\n * @internal\n */\n// Coerce arbitrary input to a string for redaction. Returns `null`\n// sentinel when the value is null/undefined/non-stringifiable, so the\n// caller can short-circuit with `\"\"`. EC-7 fix: circular refs go through\n// the try/catch and produce the sentinel marker, never throwing.\nfunction coerceToString(value: unknown): string | null {\n  if (typeof value === \"string\") return value;\n  if (value === null || value === undefined) return null;\n  if (typeof value === \"object\") {\n    try {\n      const s = JSON.stringify(value);\n      return s === undefined ? null : s;\n    } catch {\n      return \"[unredactable: circular]\";\n    }\n  }\n  return String(value);\n}\n\nexport function redactSecrets(text: unknown, opts?: { codeFile?: boolean }): string {\n  const coerced = coerceToString(text);\n  if (coerced === null) return \"\";\n  if (!REDACT_ENABLED) return coerced;\n\n  let s = coerced;\n  for (const re of BUILTIN_PATTERNS) {\n    s = s.replace(re, (m) => maskToken(m));\n  }\n  for (const re of _extraPatterns) {\n    s = s.replace(re, (m) => maskToken(m));\n  }\n  if (!opts?.codeFile) {\n    // Bearer first (preserves \"Bearer \" prefix, masks the token after).\n    // Must run before PARAM_PATTERN so the bare-whitespace shape doesn't\n    // get mis-handled as a value.\n    s = s.replace(BEARER_PATTERN, (_, prefix: string) => `${prefix}***`);\n    // T5.4: skip if value already contains the D71 bucket-mask separator\n    // (`...`) — BUILTIN ran first and produced a prefix-preserved mask;\n    // re-masking would lose the prefix and degrade debuggability.\n    s = s.replace(PARAM_PATTERN, (whole, prefix: string, value: string) => {\n      // issue #117 — skip ONLY when the value is already a mask that a BUILTIN\n      // pattern produced (maskToken's exact `6chars...4chars` shape), so we don't\n      // re-mask and lose the prefix. The old `value.includes(\"...\")` was too broad:\n      // a REAL secret that happens to contain `...` (e.g. `L_-cxw-.2UI_..._`) was\n      // skipped and LEAKED. The mask shape is exact (maskToken: slice(0,6)+\"...\"+\n      // slice(-4)), so a raw secret with `...` elsewhere is now masked.\n      if (MASK_SHAPE.test(value)) return whole;\n      return `${prefix}***`;\n    });\n  }\n  return s;\n}\n\n/**\n * Test-only helper exported for `_test-reset.ts`. NOT included in the\n * `index.ts` barrel — vitest setup imports the dedicated module via\n * explicit path to discourage production callers.\n *\n * @internal\n */\nexport function _resetForTests(opts: { enabled?: boolean; clearExtras?: boolean }): void {\n  if (opts.enabled !== undefined) REDACT_ENABLED = opts.enabled;\n  if (opts.clearExtras === true) _extraPatterns.length = 0;\n}\n\n/**\n * T5.4 — Test-only count of BUILTIN_PATTERNS. Exposed so the count-floor\n * assertion can run without re-deriving the array shape in test land.\n * NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__BUILTIN_PATTERN_COUNT(): number {\n  return BUILTIN_PATTERNS.length;\n}\n"]}

package/dist/chunk-5NBUH3NO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/auth/errors.ts"],"names":[],"mappings":";AAUO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EACvB,IAAA,GAAO,iBAAA;AAAA,EAChB,IAAA;AAAA,EAET,WAAA,CAAY,MAAc,OAAA,EAAiB;AACzC,IAAA,KAAA,CAAM,CAAA,CAAA,EAAI,IAAI,CAAA,EAAA,EAAK,OAAO,CAAA,CAAE,CAAA;AAC5B,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAMO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACjC,IAAA,GAAO,2BAAA;AAAA,EAChB,YAAA;AAAA,EAET,YAAY,YAAA,EAAsB;AAChC,IAAA,KAAA;AAAA,MACE,6BAA6B,YAAY,CAAA,mDAAA;AAAA,KAC3C;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,YAAA;AAAA,EACtB;AACF;AAcO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EACzB,IAAA,GAAe,mBAAA;AAAA,EACxB,IAAA;AAAA,EAET,WAAA,CAAY,MAAc,OAAA,EAAkB;AAC1C,IAAA,KAAA,CAAM,OAAA,IAAW,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAE,CAAA;AAChD,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAUO,IAAM,kBAAA,GAAN,cAAiC,iBAAA,CAAkB;AAAA,EACtC,IAAA,GAAe,oBAAA;AAAA,EACxB,gBAAA;AAAA,EAET,YAAY,gBAAA,EAA2B;AACrC,IAAA,KAAA,CAAM,uBAAA,EAAyB,oBAAoB,mCAAmC,CAAA;AACtF,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAAA,EAC1B;AACF","file":"chunk-5NBUH3NO.js","sourcesContent":["/**\n * @theokit/sdk/server/auth — typed error classes\n *\n * Plan T1.2 + v1.1 EC-1 (AuthCancelledError for OAuth provider error response RFC 6749 §4.1.2.1).\n */\n\n/**\n * Thrown at `defineAuth()` time when configuration is invalid\n * (e.g., duplicate provider name, invalid email shape per EC-V1-12).\n */\nexport class AuthConfigError extends Error {\n  override readonly name = \"AuthConfigError\";\n  readonly code: string;\n\n  constructor(code: string, message: string) {\n    super(`[${code}] ${message}`);\n    this.code = code;\n  }\n}\n\n/**\n * Thrown at `startSignIn(providerName, ...)` or `finishSignIn(providerName, ...)`\n * when the named provider is not registered in `providers[]`.\n */\nexport class AuthProviderNotFoundError extends Error {\n  override readonly name = \"AuthProviderNotFoundError\";\n  readonly providerName: string;\n\n  constructor(providerName: string) {\n    super(\n      `Auth provider not found: '${providerName}'. Register it in defineAuth({ providers: [...] }).`,\n    );\n    this.providerName = providerName;\n  }\n}\n\n/**\n * Thrown during OAuth callback handling for state mismatches, expired\n * transactions, missing query params, or provider 4xx/5xx errors.\n *\n * Typed `code` field lets consumers branch on cause:\n *   - 'oauth_transaction_expired' — cookie tx > 10min old (per ADR D5)\n *   - 'oauth_state_mismatch' — query state ≠ cookie state (CSRF defense per RFC 6749 §10.12)\n *   - 'oauth_provider_error' — non-access_denied error in callback URL\n *   - 'oauth_token_exchange_failed' — provider rejected code-for-tokens swap\n *   - 'oauth_userinfo_failed' — userinfo endpoint returned error\n *   - 'oauth_missing_code_or_state' — required query params absent\n */\nexport class AuthCallbackError extends Error {\n  override readonly name: string = \"AuthCallbackError\";\n  readonly code: string;\n\n  constructor(code: string, message?: string) {\n    super(message ?? `OAuth callback error: ${code}`);\n    this.code = code;\n  }\n}\n\n/**\n * Per v1.1 EC-1 MUST FIX — typed subclass of AuthCallbackError for the\n * specific case where user declined consent at provider screen.\n *\n * OAuth 2.0 RFC 6749 §4.1.2.1: provider redirects with `?error=access_denied`.\n * Apps can catch this distinctly from network/server errors to render\n * \"Login cancelled — try again\" UX instead of opaque \"callback failed\".\n */\nexport class AuthCancelledError extends AuthCallbackError {\n  override readonly name: string = \"AuthCancelledError\";\n  readonly errorDescription?: string;\n\n  constructor(errorDescription?: string) {\n    super(\"user_declined_consent\", errorDescription ?? \"User declined consent at provider\");\n    this.errorDescription = errorDescription;\n  }\n}\n"]}