@theokit/sdk 4.63.3 → 5.0.0-next.1

package/dist/server/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/auth/validate-return-to.ts","../../../src/server/auth/orchestrator.ts"],"names":[],"mappings":";;;;;;;AA0BO,SAAS,gBAAA,CAAiB,UAA8B,OAAA,EAAsB;AACnF,EAAA,IAAI,CAAC,YAAY,OAAO,QAAA,KAAa,YAAY,QAAA,CAAS,IAAA,OAAW,EAAA,EAAI;AACvE,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,SAAS,IAAA,EAAK;AAG9B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAA,EAAG;AAC5B,IAAA,OAAO,GAAA;AAAA,EACT;AAGA,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,OAAO,CAAA,EAAG;AACzB,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,OAAO,CAAA;AAC9B,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,EAAQ;AAEpC,MAAA,OAAO,MAAA,CAAO,QAAA,GAAW,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,IAAA;AAAA,IAClD;AAEA,IAAA,OAAO,GAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,IAAA,OAAO,OAAA;AAAA,EACT;AAGA,EAAA,OAAO,GAAA;AACT;;;ACrCA,IAAM,gBAAA,GAAmB,mBAAA;AAEzB,SAAS,WAAA,GAAsB;AAC7B,EAAA,MAAM,QAAQ,SAAA,CAAU,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC1D,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAChD;AAUA,SAAS,oBAAA,GAA+B;AACtC,EAAA,MAAM,QAAQ,SAAA,CAAU,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC1D,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAChD;AAEA,SAAS,eAAyB,IAAA,EAA2C;AAK3E,EAAA,MAAM,OAAO,IAAA,CAAK,OAAA;AAClB,EAAA,IAAI,KAAK,MAAA,EAAQ;AACf,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,MAAM,CAAA,EAAG;AAC9B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA;AAC3B,MAAA,IAAI,OAAO,OAAO,KAAA;AAAA,IACpB,CAAA,MAAO;AACL,MAAA,OAAO,IAAA,CAAK,MAAA;AAAA,IACd;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,uBAAA;AAC5B,EAAA,IAAI,SAAS,OAAO,OAAA;AAepB,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KAGF;AAAA,EACF;AACA,EAAA,OAAO,mDAAA;AACT;AAEA,SAAS,WAAqB,IAAA,EAA+D;AAE3F,EAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,IAAA,MAAM,IAAI,eAAA,CAAgB,iBAAA,EAAmB,qCAAqC,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAA2C;AACpE,EAAA,KAAA,MAAW,QAAA,IAAY,IAAA,CAAK,SAAA,IAAa,EAAC,EAAG;AAC3C,IAAA,IAAI,CAAC,SAAS,IAAA,IAAQ,CAAC,iBAAiB,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3D,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,uBAAA;AAAA,QACA,CAAA,yBAAA,EAA4B,gBAAgB,CAAA,QAAA,EAAW,QAAA,CAAS,IAAI,CAAA,EAAA;AAAA,OACtE;AAAA,IACF;AACA,IAAA,IAAI,YAAA,CAAa,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,yBAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,SAAS,IAAI,CAAA,CAAA;AAAA,OAC5C;AAAA,IACF;AACA,IAAA,YAAA,CAAa,GAAA,CAAI,QAAA,CAAS,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,QAAA,GAAW,eAAe,IAAI,CAAA;AAEpC,EAAA,SAAS,gBAAgB,IAAA,EAA6C;AACpE,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,0BAA0B,IAAI,CAAA;AAChD,IAAA,OAAO,CAAA;AAAA,EACT;AAEA,EAAA,eAAe,WAAA,CACb,YAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,IAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAG7C,IAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAE,CAAA;AACpF,IAAA,MAAM,YAAA,GAAe,gBAAA,CAAiB,SAAA,EAAW,QAAA,EAAU,OAAO,CAAA;AAMlE,IAAA,MAAM,QAAQ,WAAA,EAAY;AAC1B,IAAA,MAAM,eAAe,oBAAA,EAAqB;AAC1C,IAAA,MAAM,KAAK,cAAA,CAAe;AAAA,MACxB,KAAA;AAAA,MACA,YAAA;AAAA,MACA,QAAA,EAAU,YAAA,KAAiB,GAAA,GAAM,MAAA,GAAY;AAAA,KAC9C,CAAA;AAGD,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,sBAAA,CAAuB,EAAE,CAAA;AAGxD,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC1C,IAAA,MAAM,EAAE,iBAAA,EAAmB,WAAA,EAAY,GAAI,MAAM,OAAO,2CAA8B,CAAA;AACtF,IAAA,MAAM,SAAA,GAAY,MAAM,iBAAA,CAAkB,EAAA,EAAI,QAAQ,CAAA;AAMtD,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,YAAA;AAAA,MACA,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,qDAAA;AAAA,KAC7B;AAEA,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,CAAA;AAAA,EACpD;AAGA,EAAA,eAAe,YAAA,CACb,YAAA,EACA,GAAA,EACA,GAAA,EACmD;AACnD,IAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAG7C,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAE,CAAA;AAChF,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAC/C,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,gBAAA,GAAmB,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACtE,MAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,QAAA,MAAM,IAAI,mBAAmB,gBAAgB,CAAA;AAAA,MAC/C;AACA,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,sBAAA;AAAA,QACA,4BAA4B,UAAU,CAAA,EAAG,mBAAmB,CAAA,EAAA,EAAK,gBAAgB,MAAM,EAAE,CAAA;AAAA,OAC3F;AAAA,IACF;AAGA,IAAA,MAAM,EAAA,GAAK,MAAM,cAAA,CAAe,GAAA,EAAK,QAAQ,CAAA;AAC7C,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAC/C,IAAA,IAAI,CAAC,UAAA,IAAc,UAAA,KAAe,EAAA,CAAG,KAAA,EAAO;AAC1C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,cAAA,CAAe,KAAK,EAAE,CAAA;AAGpD,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,QAAA,EAAU,MAAA,CAAO,YAAA,EAAc,CAAA;AAAA,IAC9F,CAAA,MAAO;AAEL,MAAA,WAAA,GAAc,MAAA,CAAO,OAAA;AAAA,IACvB;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,GAAG,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AAAA,IAER;AAGA,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,WAAW,CAAA;AAGjD,IAAA,gBAAA,CAAiB,GAAG,CAAA;AAEpB,IAAA,OAAO,EAAE,OAAA,EAAS,WAAA,EAAa,QAAA,EAAU,GAAG,QAAA,EAAS;AAAA,EACvD;AAEA,EAAA,eAAe,MAAA,CACb,OAAA,EACA,YAAA,EACA,GAAA,EACA,GAAA,EACmB;AAEnB,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,EAAE,OAAA,EAAS,QAAA,EAAU,cAAc,CAAA;AAAA,IACvE,CAAA,MAAO;AACL,MAAA,WAAA,GAAc,OAAA;AAAA,IAChB;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,GAAG,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,WAAW,CAAA;AACjD,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,eAAe,QAAQ,GAAA,EAAoC;AAEzD,IAAA,IAAI,WAAA,GAA+B,IAAA;AACnC,IAAA,IAAI,KAAK,SAAA,EAAW;AAIlB,MAAA,WAAA,GAAc,IAAA;AAAA,IAChB;AAEA,IAAA,IAAA,CAAK,OAAA,CAAQ,eAAe,GAAG,CAAA;AAE/B,IAAA,IAAI,KAAK,SAAA,EAAW;AAClB,MAAA,MAAM,IAAA,CAAK,UAAU,WAAW,CAAA;AAAA,IAClC;AAAA,EACF;AAEA,EAAA,eAAe,WAAW,GAAA,EAAgD;AACxE,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA;AAAA,EACpC;AAEA,EAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,MAAA,EAAQ,SAAS,UAAA,EAAW;AAClE;AAGO,IAAM,OAAN,MAAW;AAAA,EACR,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,OAAiB,IAAA,EAA+D;AACrF,IAAA,OAAO,WAAW,IAAI,CAAA;AAAA,EACxB;AACF","file":"index.js","sourcesContent":["/**\n * Clamp a caller-supplied `returnTo` to a same-origin destination, falling back\n * to `'/'` for anything else. This is the open-redirect guard for a post-login\n * redirect (`@theokit/sdk/server/auth`; OWASP A01:2021, v1.1 EC-2). Without it,\n * `/login?returnTo=https://evil.com` would send the freshly authenticated session\n * to an attacker's domain.\n *\n *   validateReturnTo(req.query.returnTo, new URL(\"https://app.example.com\"));\n *\n * Pure and synchronous. It never throws and always returns a string:\n *   - undefined / empty / whitespace-only `returnTo` -> `'/'`\n *   - protocol-relative `//evil.com` -> `'/'` (a browser would resolve it against\n *     the current protocol)\n *   - absolute URL whose origin differs from `baseUrl.origin` -> `'/'`\n *   - absolute URL on `baseUrl.origin` -> its `pathname + search + hash`, with\n *     the origin dropped\n *   - relative path starting with `'/'` -> kept verbatim\n *   - anything else, including `javascript:` and `data:` -> `'/'`\n *\n * `baseUrl` is compared by ORIGIN only (scheme + host + port); its path is\n * ignored, so an app mounted under a sub-path gets no extra containment from it.\n *\n * Trap: this defends the origin, not the route. A same-origin relative path is\n * returned unchanged — `..` segments included, and with no notion of whether the\n * user is allowed there. Authorise the destination separately.\n */\nexport function validateReturnTo(returnTo: string | undefined, baseUrl: URL): string {\n  if (!returnTo || typeof returnTo !== \"string\" || returnTo.trim() === \"\") {\n    return \"/\";\n  }\n\n  const trimmed = returnTo.trim();\n\n  // Protocol-relative URLs (//evil.com) are dangerous — browser would resolve to current protocol\n  if (trimmed.startsWith(\"//\")) {\n    return \"/\";\n  }\n\n  // Try absolute URL parsing first\n  if (URL.canParse(trimmed)) {\n    const parsed = new URL(trimmed);\n    if (parsed.origin === baseUrl.origin) {\n      // Same-origin absolute URL — return the pathname+search+hash portion (drop origin)\n      return parsed.pathname + parsed.search + parsed.hash;\n    }\n    // Cross-origin — reject\n    return \"/\";\n  }\n\n  // Not parseable as absolute. Must start with '/' to be a valid relative path\n  if (trimmed.startsWith(\"/\")) {\n    return trimmed;\n  }\n\n  // Anything else (e.g., \"javascript:alert\", \"data:...\" that wasn't parseable, or bare strings) → default\n  return \"/\";\n}\n","/**\n * DefineAuth orchestrator runtime (Path C Hybrid) — `@theokit/sdk/server/auth`.\n *\n * Plan T1.2 implementation per blueprint Q5 § Path C signatures.\n * Composes existing primitives + the v1.1 EC-1/EC-2/EC-10 fixes.\n */\n\nimport { webcrypto } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport {\n  AuthCallbackError,\n  AuthCancelledError,\n  AuthConfigError,\n  AuthProviderNotFoundError,\n} from \"./errors.js\";\nimport { clearTransaction, getTransaction, newTransaction } from \"./oauth-transaction-store.js\";\nimport type { AuthOrchestrator, AuthProvider, DefineAuthOptions } from \"./types.js\";\nimport { validateReturnTo } from \"./validate-return-to.js\";\n\nconst PROVIDER_NAME_RE = /^[a-z0-9-]{1,32}$/;\n\nfunction randomState(): string {\n  const bytes = webcrypto.getRandomValues(new Uint8Array(24));\n  return Buffer.from(bytes).toString(\"base64url\");\n}\n\n/**\n * Generate a PKCE code_verifier per RFC 7636 §4.1 — 43..128 chars from the\n * unreserved set [A-Z][a-z][0-9]-._~ (base64url is a strict subset).\n *\n * 32 random bytes → 43 base64url chars satisfies the minimum. Provided by\n * the orchestrator so every transaction carries one; PKCE-aware providers\n * (Google) consume it; PKCE-ignorant providers (GitHub) discard it.\n */\nfunction generatePkceVerifier(): string {\n  const bytes = webcrypto.getRandomValues(new Uint8Array(32));\n  return Buffer.from(bytes).toString(\"base64url\");\n}\n\nfunction txCookieSecret<TSession>(opts: DefineAuthOptions<TSession>): string {\n  // For T1.2 minimal impl, derive a per-session-manager secret from the\n  // SessionManager identity. Production T2+ may refactor to share the\n  // SessionManager's actual secret rotation chain via a `getCookieSecret()` method.\n  // Falls back to TX_FALLBACK_SECRET when not available — apps should override.\n  const sess = opts.session as unknown as { secret?: string | string[] };\n  if (sess.secret) {\n    if (Array.isArray(sess.secret)) {\n      const first = sess.secret[0];\n      if (first) return first;\n    } else {\n      return sess.secret;\n    }\n  }\n  const fromEnv = process.env.THEOKIT_OAUTH_TX_SECRET;\n  if (fromEnv) return fromEnv;\n\n  // The comment that used to sit here said this fallback \"will fail in production scrutiny —\n  // flagged by future audit\". This is that audit, and the fallback is now refused where it matters.\n  //\n  // The cookie this secret encrypts carries `state` and `pkceVerifier` — the two values that make\n  // an authorization-code flow safe against CSRF and code interception. Encrypting them with a\n  // constant published inside the package protects nothing from anyone who can read npm.\n  //\n  // `AuthSecretTooShortError` never caught it: the constant is 48 characters, and that guard checks\n  // LENGTH, not provenance.\n  //\n  // Refused in production only. Blocking it everywhere would break every `pnpm dev`, and the risk\n  // is a deployed app rather than a laptop. The branch above (`opts.session.secret`) stays for\n  // callers who wire one, though `SessionManager` declares no such field today.\n  if (process.env.NODE_ENV === \"production\") {\n    throw new AuthConfigError(\n      \"missing_tx_secret\",\n      \"No OAuth transaction secret is configured. Set THEOKIT_OAUTH_TX_SECRET to a 32+ character \" +\n        \"random value — e.g. `openssl rand -hex 32`. Refusing to encrypt the transaction cookie \" +\n        \"with the development fallback, which ships inside this package and protects nothing.\",\n    );\n  }\n  return \"DEV_ONLY_INSECURE_OAUTH_TX_SECRET_REPLACE_IN_PROD\";\n}\n\nfunction defineAuth<TSession>(opts: DefineAuthOptions<TSession>): AuthOrchestrator<TSession> {\n  // Validate config at define-time (per blueprint Q5 invariants)\n  if (!opts.session) {\n    throw new AuthConfigError(\"missing_session\", \"defineAuth({ session }) is required\");\n  }\n\n  const providersMap = new Map<string, AuthProvider<unknown, string>>();\n  for (const provider of opts.providers ?? []) {\n    if (!provider.name || !PROVIDER_NAME_RE.test(provider.name)) {\n      throw new AuthConfigError(\n        \"invalid_provider_name\",\n        `Provider name must match ${PROVIDER_NAME_RE} (got: '${provider.name}')`,\n      );\n    }\n    if (providersMap.has(provider.name)) {\n      throw new AuthConfigError(\n        \"duplicate_provider_name\",\n        `Duplicate provider name: '${provider.name}'`,\n      );\n    }\n    providersMap.set(provider.name, provider);\n  }\n\n  const txSecret = txCookieSecret(opts);\n\n  function requireProvider(name: string): AuthProvider<unknown, string> {\n    const p = providersMap.get(name);\n    if (!p) throw new AuthProviderNotFoundError(name);\n    return p;\n  }\n\n  async function startSignIn(\n    providerName: string,\n    req: IncomingMessage,\n    startOpts?: { returnTo?: string },\n  ): Promise<Response> {\n    const provider = requireProvider(providerName);\n\n    // EC-2 (v1.1) — validate returnTo same-origin\n    const baseUrl = new URL(`http://${req.headers.host ?? \"localhost\"}${req.url ?? \"/\"}`);\n    const safeReturnTo = validateReturnTo(startOpts?.returnTo, baseUrl);\n\n    // Generate transaction. Always include a PKCE verifier — PKCE-aware\n    // providers (Google OIDC) consume it; PKCE-ignorant providers (GitHub\n    // OAuth 2.0) discard it. Generating unconditionally simplifies the\n    // provider contract: every tx is PKCE-ready.\n    const state = randomState();\n    const pkceVerifier = generatePkceVerifier();\n    const tx = newTransaction({\n      state,\n      pkceVerifier,\n      returnTo: safeReturnTo === \"/\" ? undefined : safeReturnTo,\n    });\n\n    // Persist transaction cookie via headers (since we return Response, need Set-Cookie header manually)\n    const authUrl = await provider.createAuthorizationURL(tx);\n\n    // Build response with Set-Cookie + redirect\n    const headers = new Headers();\n    headers.set(\"Location\", authUrl.toString());\n    const { encodeTransaction, COOKIE_NAME } = await import(\"./oauth-transaction-store.js\");\n    const encodedTx = await encodeTransaction(tx, txSecret);\n    // COOKIE_NAME, never a literal: this header used to be written by hand as `theo_oauth_tx=`,\n    // while the store reads the `__Host-` prefixed name — so `finishSignIn` never found the cookie\n    // and every sign-in failed at the callback. One constant, one name.\n    //\n    // The `__Host-` prefix requires exactly what is set below: `Secure`, `Path=/`, and NO `Domain`.\n    headers.set(\n      \"Set-Cookie\",\n      `${COOKIE_NAME}=${encodedTx}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=600`,\n    );\n\n    return new Response(null, { status: 302, headers });\n  }\n\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OAuth callback handler must validate 6 distinct error conditions sequentially (provider error / state / tx fetch / PKCE / code exchange / session) — extracting helpers fragments the linear control flow without clarifying intent (per EC-1 v1.1 absorbed)\n  async function finishSignIn(\n    providerName: string,\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): Promise<{ session: TSession; returnTo?: string }> {\n    const provider = requireProvider(providerName);\n\n    // EC-1 (v1.1) — OAuth provider error response (user declined consent) check BEFORE code-exchange\n    const url = new URL(`http://${req.headers.host ?? \"localhost\"}${req.url ?? \"/\"}`);\n    const errorParam = url.searchParams.get(\"error\");\n    if (errorParam) {\n      const errorDescription = url.searchParams.get(\"error_description\") ?? undefined;\n      if (errorParam === \"access_denied\") {\n        throw new AuthCancelledError(errorDescription);\n      }\n      throw new AuthCallbackError(\n        \"oauth_provider_error\",\n        `Provider returned error: ${errorParam}${errorDescription ? ` (${errorDescription})` : \"\"}`,\n      );\n    }\n\n    // Read + validate transaction cookie\n    const tx = await getTransaction(req, txSecret);\n    if (!tx) {\n      throw new AuthCallbackError(\n        \"oauth_transaction_expired\",\n        \"OAuth transaction cookie missing or expired (>10min). Please retry sign-in.\",\n      );\n    }\n\n    // Verify state matches query param (CSRF defense per RFC 6749 §10.12)\n    const queryState = url.searchParams.get(\"state\");\n    if (!queryState || queryState !== tx.state) {\n      throw new AuthCallbackError(\n        \"oauth_state_mismatch\",\n        \"OAuth state mismatch. Possible CSRF attempt or stale callback.\",\n      );\n    }\n\n    // Provider-specific callback handling (token exchange + userinfo fetch)\n    const result = await provider.handleCallback(req, tx);\n\n    // Invoke onSignIn callback if defined to derive session shape\n    let sessionData: TSession;\n    if (opts.onSignIn) {\n      sessionData = await opts.onSignIn({ profile: result.profile, provider: result.providerName });\n    } else {\n      // No onSignIn — pass the raw profile as session (consumers must type their own TSession)\n      sessionData = result.profile as unknown as TSession;\n    }\n\n    // EC-10 (v1.1) — OWASP A07:2021 session fixation mitigation: rotate session ID BEFORE creating new session\n    try {\n      await opts.session.rotateSession(req, res);\n    } catch {\n      // rotateSession may no-op if no pre-existing session — non-fatal\n    }\n\n    // Create session cookie\n    await opts.session.createSession(res, sessionData);\n\n    // Clear transaction cookie\n    clearTransaction(res);\n\n    return { session: sessionData, returnTo: tx.returnTo };\n  }\n\n  async function signIn<TProfile>(\n    profile: TProfile,\n    providerName: string,\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): Promise<TSession> {\n    // Path A escape hatch — skip OAuth flow, directly derive + persist session\n    let sessionData: TSession;\n    if (opts.onSignIn) {\n      sessionData = await opts.onSignIn({ profile, provider: providerName });\n    } else {\n      sessionData = profile as unknown as TSession;\n    }\n\n    try {\n      await opts.session.rotateSession(req, res);\n    } catch {\n      /* no-op if no pre-existing session */\n    }\n\n    await opts.session.createSession(res, sessionData);\n    return sessionData;\n  }\n\n  async function signOut(res: ServerResponse): Promise<void> {\n    // Read current session before destroying (so onSignOut can see it)\n    let sessionData: TSession | null = null;\n    if (opts.onSignOut) {\n      // We don't have req here per AuthOrchestrator contract; onSignOut receives null\n      // when no pre-existing session is available. Apps that need session-aware\n      // signOut should use the manual session.destroySession + custom logic.\n      sessionData = null;\n    }\n\n    opts.session.destroySession(res);\n\n    if (opts.onSignOut) {\n      await opts.onSignOut(sessionData);\n    }\n  }\n\n  async function getSession(req: IncomingMessage): Promise<TSession | null> {\n    return opts.session.getSession(req);\n  }\n\n  return { startSignIn, finishSignIn, signIn, signOut, getSession };\n}\n\n/** SE36 — `Auth.create` replaces `defineAuth` (ADR 0015). @public */\nexport class Auth {\n  private constructor() {}\n  static create<TSession>(opts: DefineAuthOptions<TSession>): AuthOrchestrator<TSession> {\n    return defineAuth(opts);\n  }\n}\n"]}
+{"version":3,"sources":["../../../src/server/auth/validate-return-to.ts","../../../src/server/auth/orchestrator.ts"],"names":[],"mappings":";;;;;;;;;AA0BO,SAAS,gBAAA,CAAiB,UAA8B,OAAA,EAAsB;AACnF,EAAA,IAAI,CAAC,YAAY,OAAO,QAAA,KAAa,YAAY,QAAA,CAAS,IAAA,OAAW,EAAA,EAAI;AACvE,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,SAAS,IAAA,EAAK;AAG9B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAA,EAAG;AAC5B,IAAA,OAAO,GAAA;AAAA,EACT;AAGA,EAAA,IAAI,GAAA,CAAI,QAAA,CAAS,OAAO,CAAA,EAAG;AACzB,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,OAAO,CAAA;AAC9B,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,CAAQ,MAAA,EAAQ;AAEpC,MAAA,OAAO,MAAA,CAAO,QAAA,GAAW,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,IAAA;AAAA,IAClD;AAEA,IAAA,OAAO,GAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG;AAC3B,IAAA,OAAO,OAAA;AAAA,EACT;AAGA,EAAA,OAAO,GAAA;AACT;;;ACrCA,IAAM,gBAAA,GAAmB,mBAAA;AAEzB,SAAS,WAAA,GAAsB;AAC7B,EAAA,MAAM,QAAQ,SAAA,CAAU,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC1D,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAChD;AAUA,SAAS,oBAAA,GAA+B;AACtC,EAAA,MAAM,QAAQ,SAAA,CAAU,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC1D,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,WAAW,CAAA;AAChD;AAEA,SAAS,eAAyB,IAAA,EAA2C;AAQ3E,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,CAAQ,eAAA,IAAkB;AACnD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,EAAG;AAE9B,IAAA,MAAM,KAAA,GAAQ,YAAY,CAAC,CAAA;AAC3B,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,EAAA,EAAI,OAAO,KAAA;AAAA,EAClD,CAAA,MAAA,IAAW,WAAA,KAAgB,MAAA,IAAa,WAAA,KAAgB,EAAA,EAAI;AAC1D,IAAA,OAAO,WAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,uBAAA;AAC5B,EAAA,IAAI,SAAS,OAAO,OAAA;AAepB,EAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA,EAAc;AACzC,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,mBAAA;AAAA,MACA;AAAA,KAGF;AAAA,EACF;AACA,EAAA,OAAO,mDAAA;AACT;AAEA,SAAS,WAAqB,IAAA,EAA+D;AAE3F,EAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,IAAA,MAAM,IAAI,eAAA,CAAgB,iBAAA,EAAmB,qCAAqC,CAAA;AAAA,EACpF;AAEA,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAA2C;AACpE,EAAA,KAAA,MAAW,QAAA,IAAY,IAAA,CAAK,SAAA,IAAa,EAAC,EAAG;AAC3C,IAAA,IAAI,CAAC,SAAS,IAAA,IAAQ,CAAC,iBAAiB,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3D,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,uBAAA;AAAA,QACA,CAAA,yBAAA,EAA4B,gBAAgB,CAAA,QAAA,EAAW,QAAA,CAAS,IAAI,CAAA,EAAA;AAAA,OACtE;AAAA,IACF;AACA,IAAA,IAAI,YAAA,CAAa,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA,EAAG;AACnC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,yBAAA;AAAA,QACA,CAAA,0BAAA,EAA6B,SAAS,IAAI,CAAA,CAAA;AAAA,OAC5C;AAAA,IACF;AACA,IAAA,YAAA,CAAa,GAAA,CAAI,QAAA,CAAS,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC1C;AAEA,EAAA,MAAM,QAAA,GAAW,eAAe,IAAI,CAAA;AAEpC,EAAA,SAAS,gBAAgB,IAAA,EAA6C;AACpE,IAAA,MAAM,CAAA,GAAI,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,CAAC,CAAA,EAAG,MAAM,IAAI,0BAA0B,IAAI,CAAA;AAChD,IAAA,OAAO,CAAA;AAAA,EACT;AAEA,EAAA,eAAe,WAAA,CACb,YAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,IAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAG7C,IAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAE,CAAA;AACpF,IAAA,MAAM,YAAA,GAAe,gBAAA,CAAiB,SAAA,EAAW,QAAA,EAAU,OAAO,CAAA;AAMlE,IAAA,MAAM,QAAQ,WAAA,EAAY;AAC1B,IAAA,MAAM,eAAe,oBAAA,EAAqB;AAC1C,IAAA,MAAM,KAAK,cAAA,CAAe;AAAA,MACxB,KAAA;AAAA,MACA,YAAA;AAAA,MACA,QAAA,EAAU,YAAA,KAAiB,GAAA,GAAM,MAAA,GAAY;AAAA,KAC9C,CAAA;AAGD,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,sBAAA,CAAuB,EAAE,CAAA;AAGxD,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC1C,IAAA,MAAM,EAAE,iBAAA,EAAmB,WAAA,EAAY,GAAI,MAAM,OAAO,2CAA8B,CAAA;AACtF,IAAA,MAAM,SAAA,GAAY,MAAM,iBAAA,CAAkB,EAAA,EAAI,QAAQ,CAAA;AAMtD,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,YAAA;AAAA,MACA,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,qDAAA;AAAA,KAC7B;AAEA,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,CAAA;AAAA,EACpD;AAGA,EAAA,eAAe,YAAA,CACb,YAAA,EACA,GAAA,EACA,GAAA,EACmD;AACnD,IAAA,MAAM,QAAA,GAAW,gBAAgB,YAAY,CAAA;AAG7C,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA,EAAG,GAAA,CAAI,GAAA,IAAO,GAAG,CAAA,CAAE,CAAA;AAChF,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAC/C,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,gBAAA,GAAmB,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,mBAAmB,CAAA,IAAK,MAAA;AACtE,MAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,QAAA,MAAM,IAAI,mBAAmB,gBAAgB,CAAA;AAAA,MAC/C;AACA,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,sBAAA;AAAA,QACA,4BAA4B,UAAU,CAAA,EAAG,mBAAmB,CAAA,EAAA,EAAK,gBAAgB,MAAM,EAAE,CAAA;AAAA,OAC3F;AAAA,IACF;AAGA,IAAA,MAAM,EAAA,GAAK,MAAM,cAAA,CAAe,GAAA,EAAK,QAAQ,CAAA;AAC7C,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,2BAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAC/C,IAAA,IAAI,CAAC,UAAA,IAAc,UAAA,KAAe,EAAA,CAAG,KAAA,EAAO;AAC1C,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,sBAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,cAAA,CAAe,KAAK,EAAE,CAAA;AAGpD,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,QAAA,EAAU,MAAA,CAAO,YAAA,EAAc,CAAA;AAAA,IAC9F,CAAA,MAAO;AAEL,MAAA,WAAA,GAAc,MAAA,CAAO,OAAA;AAAA,IACvB;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,GAAG,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AAAA,IAER;AAGA,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,WAAW,CAAA;AAGjD,IAAA,gBAAA,CAAiB,GAAG,CAAA;AAEpB,IAAA,OAAO,EAAE,OAAA,EAAS,WAAA,EAAa,QAAA,EAAU,GAAG,QAAA,EAAS;AAAA,EACvD;AAEA,EAAA,eAAe,MAAA,CACb,OAAA,EACA,YAAA,EACA,GAAA,EACA,GAAA,EACmB;AAEnB,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,EAAE,OAAA,EAAS,QAAA,EAAU,cAAc,CAAA;AAAA,IACvE,CAAA,MAAO;AACL,MAAA,WAAA,GAAc,OAAA;AAAA,IAChB;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,GAAG,CAAA;AAAA,IAC3C,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,GAAA,EAAK,WAAW,CAAA;AACjD,IAAA,OAAO,WAAA;AAAA,EACT;AAEA,EAAA,eAAe,QAAQ,GAAA,EAAoC;AAEzD,IAAA,IAAI,WAAA,GAA+B,IAAA;AACnC,IAAA,IAAI,KAAK,SAAA,EAAW;AAIlB,MAAA,WAAA,GAAc,IAAA;AAAA,IAChB;AAEA,IAAA,IAAA,CAAK,OAAA,CAAQ,eAAe,GAAG,CAAA;AAE/B,IAAA,IAAI,KAAK,SAAA,EAAW;AAClB,MAAA,MAAM,IAAA,CAAK,UAAU,WAAW,CAAA;AAAA,IAClC;AAAA,EACF;AAEA,EAAA,eAAe,WAAW,GAAA,EAAgD;AACxE,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA;AAAA,EACpC;AAEA,EAAA,OAAO,EAAE,WAAA,EAAa,YAAA,EAAc,MAAA,EAAQ,SAAS,UAAA,EAAW;AAClE;AAMO,IAAM,OAAN,MAAW;AAAA,EACR,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,OAAiB,IAAA,EAA+D;AACrF,IAAA,OAAO,WAAW,IAAI,CAAA;AAAA,EACxB;AACF","file":"index.js","sourcesContent":["/**\n * Clamp a caller-supplied `returnTo` to a same-origin destination, falling back\n * to `'/'` for anything else. This is the open-redirect guard for a post-login\n * redirect (`@theokit/sdk/server/auth`; OWASP A01:2021, v1.1 EC-2). Without it,\n * `/login?returnTo=https://evil.com` would send the freshly authenticated session\n * to an attacker's domain.\n *\n *   validateReturnTo(req.query.returnTo, new URL(\"https://app.example.com\"));\n *\n * Pure and synchronous. It never throws and always returns a string:\n *   - undefined / empty / whitespace-only `returnTo` -> `'/'`\n *   - protocol-relative `//evil.com` -> `'/'` (a browser would resolve it against\n *     the current protocol)\n *   - absolute URL whose origin differs from `baseUrl.origin` -> `'/'`\n *   - absolute URL on `baseUrl.origin` -> its `pathname + search + hash`, with\n *     the origin dropped\n *   - relative path starting with `'/'` -> kept verbatim\n *   - anything else, including `javascript:` and `data:` -> `'/'`\n *\n * `baseUrl` is compared by ORIGIN only (scheme + host + port); its path is\n * ignored, so an app mounted under a sub-path gets no extra containment from it.\n *\n * Trap: this defends the origin, not the route. A same-origin relative path is\n * returned unchanged — `..` segments included, and with no notion of whether the\n * user is allowed there. Authorise the destination separately.\n */\nexport function validateReturnTo(returnTo: string | undefined, baseUrl: URL): string {\n  if (!returnTo || typeof returnTo !== \"string\" || returnTo.trim() === \"\") {\n    return \"/\";\n  }\n\n  const trimmed = returnTo.trim();\n\n  // Protocol-relative URLs (//evil.com) are dangerous — browser would resolve to current protocol\n  if (trimmed.startsWith(\"//\")) {\n    return \"/\";\n  }\n\n  // Try absolute URL parsing first\n  if (URL.canParse(trimmed)) {\n    const parsed = new URL(trimmed);\n    if (parsed.origin === baseUrl.origin) {\n      // Same-origin absolute URL — return the pathname+search+hash portion (drop origin)\n      return parsed.pathname + parsed.search + parsed.hash;\n    }\n    // Cross-origin — reject\n    return \"/\";\n  }\n\n  // Not parseable as absolute. Must start with '/' to be a valid relative path\n  if (trimmed.startsWith(\"/\")) {\n    return trimmed;\n  }\n\n  // Anything else (e.g., \"javascript:alert\", \"data:...\" that wasn't parseable, or bare strings) → default\n  return \"/\";\n}\n","/**\n * DefineAuth orchestrator runtime (Path C Hybrid) — `@theokit/sdk/server/auth`.\n *\n * Plan T1.2 implementation per blueprint Q5 § Path C signatures.\n * Composes existing primitives + the v1.1 EC-1/EC-2/EC-10 fixes.\n */\n\nimport { webcrypto } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport {\n  AuthCallbackError,\n  AuthCancelledError,\n  AuthConfigError,\n  AuthProviderNotFoundError,\n} from \"./errors.js\";\nimport { clearTransaction, getTransaction, newTransaction } from \"./oauth-transaction-store.js\";\nimport type { AuthOrchestrator, AuthProvider, DefineAuthOptions } from \"./types.js\";\nimport { validateReturnTo } from \"./validate-return-to.js\";\n\nconst PROVIDER_NAME_RE = /^[a-z0-9-]{1,32}$/;\n\nfunction randomState(): string {\n  const bytes = webcrypto.getRandomValues(new Uint8Array(24));\n  return Buffer.from(bytes).toString(\"base64url\");\n}\n\n/**\n * Generate a PKCE code_verifier per RFC 7636 §4.1 — 43..128 chars from the\n * unreserved set [A-Z][a-z][0-9]-._~ (base64url is a strict subset).\n *\n * 32 random bytes → 43 base64url chars satisfies the minimum. Provided by\n * the orchestrator so every transaction carries one; PKCE-aware providers\n * (Google) consume it; PKCE-ignorant providers (GitHub) discard it.\n */\nfunction generatePkceVerifier(): string {\n  const bytes = webcrypto.getRandomValues(new Uint8Array(32));\n  return Buffer.from(bytes).toString(\"base64url\");\n}\n\nfunction txCookieSecret<TSession>(opts: DefineAuthOptions<TSession>): string {\n  // Read through the PORT. This was `opts.session as unknown as { secret?: string | string[] }` —\n  // and `as unknown as` is the tell: TypeScript would have refused the property access, so the code\n  // asserted a shape `SessionManager` does not offer. No conforming caller could reach the branch,\n  // nothing in src/ supplied the field, and it was green only because a test double carried one. The\n  // comment that stood here said this code WANTED a `getCookieSecret()` method; `SessionManager` now\n  // declares it, optional and additive, so the branch is reachable through the contract and the\n  // double conforms rather than the code conforming to the double.\n  const fromManager = opts.session.getCookieSecret?.();\n  if (Array.isArray(fromManager)) {\n    // First entry encrypts; the rest exist to verify cookies written before the last rotation.\n    const first = fromManager[0];\n    if (first !== undefined && first !== \"\") return first;\n  } else if (fromManager !== undefined && fromManager !== \"\") {\n    return fromManager;\n  }\n  const fromEnv = process.env.THEOKIT_OAUTH_TX_SECRET;\n  if (fromEnv) return fromEnv;\n\n  // The comment that used to sit here said this fallback \"will fail in production scrutiny —\n  // flagged by future audit\". This is that audit, and the fallback is now refused where it matters.\n  //\n  // The cookie this secret encrypts carries `state` and `pkceVerifier` — the two values that make\n  // an authorization-code flow safe against CSRF and code interception. Encrypting them with a\n  // constant published inside the package protects nothing from anyone who can read npm.\n  //\n  // `AuthSecretTooShortError` never caught it: the constant is 48 characters, and that guard checks\n  // LENGTH, not provenance.\n  //\n  // Refused in production only. Blocking it everywhere would break every `pnpm dev`, and the risk\n  // is a deployed app rather than a laptop. The branch above (`opts.session.secret`) stays for\n  // callers who wire one, though `SessionManager` declares no such field today.\n  if (process.env.NODE_ENV === \"production\") {\n    throw new AuthConfigError(\n      \"missing_tx_secret\",\n      \"No OAuth transaction secret is configured. Set THEOKIT_OAUTH_TX_SECRET to a 32+ character \" +\n        \"random value — e.g. `openssl rand -hex 32`. Refusing to encrypt the transaction cookie \" +\n        \"with the development fallback, which ships inside this package and protects nothing.\",\n    );\n  }\n  return \"DEV_ONLY_INSECURE_OAUTH_TX_SECRET_REPLACE_IN_PROD\";\n}\n\nfunction defineAuth<TSession>(opts: DefineAuthOptions<TSession>): AuthOrchestrator<TSession> {\n  // Validate config at define-time (per blueprint Q5 invariants)\n  if (!opts.session) {\n    throw new AuthConfigError(\"missing_session\", \"defineAuth({ session }) is required\");\n  }\n\n  const providersMap = new Map<string, AuthProvider<unknown, string>>();\n  for (const provider of opts.providers ?? []) {\n    if (!provider.name || !PROVIDER_NAME_RE.test(provider.name)) {\n      throw new AuthConfigError(\n        \"invalid_provider_name\",\n        `Provider name must match ${PROVIDER_NAME_RE} (got: '${provider.name}')`,\n      );\n    }\n    if (providersMap.has(provider.name)) {\n      throw new AuthConfigError(\n        \"duplicate_provider_name\",\n        `Duplicate provider name: '${provider.name}'`,\n      );\n    }\n    providersMap.set(provider.name, provider);\n  }\n\n  const txSecret = txCookieSecret(opts);\n\n  function requireProvider(name: string): AuthProvider<unknown, string> {\n    const p = providersMap.get(name);\n    if (!p) throw new AuthProviderNotFoundError(name);\n    return p;\n  }\n\n  async function startSignIn(\n    providerName: string,\n    req: IncomingMessage,\n    startOpts?: { returnTo?: string },\n  ): Promise<Response> {\n    const provider = requireProvider(providerName);\n\n    // EC-2 (v1.1) — validate returnTo same-origin\n    const baseUrl = new URL(`http://${req.headers.host ?? \"localhost\"}${req.url ?? \"/\"}`);\n    const safeReturnTo = validateReturnTo(startOpts?.returnTo, baseUrl);\n\n    // Generate transaction. Always include a PKCE verifier — PKCE-aware\n    // providers (Google OIDC) consume it; PKCE-ignorant providers (GitHub\n    // OAuth 2.0) discard it. Generating unconditionally simplifies the\n    // provider contract: every tx is PKCE-ready.\n    const state = randomState();\n    const pkceVerifier = generatePkceVerifier();\n    const tx = newTransaction({\n      state,\n      pkceVerifier,\n      returnTo: safeReturnTo === \"/\" ? undefined : safeReturnTo,\n    });\n\n    // Persist transaction cookie via headers (since we return Response, need Set-Cookie header manually)\n    const authUrl = await provider.createAuthorizationURL(tx);\n\n    // Build response with Set-Cookie + redirect\n    const headers = new Headers();\n    headers.set(\"Location\", authUrl.toString());\n    const { encodeTransaction, COOKIE_NAME } = await import(\"./oauth-transaction-store.js\");\n    const encodedTx = await encodeTransaction(tx, txSecret);\n    // COOKIE_NAME, never a literal: this header used to be written by hand as `theo_oauth_tx=`,\n    // while the store reads the `__Host-` prefixed name — so `finishSignIn` never found the cookie\n    // and every sign-in failed at the callback. One constant, one name.\n    //\n    // The `__Host-` prefix requires exactly what is set below: `Secure`, `Path=/`, and NO `Domain`.\n    headers.set(\n      \"Set-Cookie\",\n      `${COOKIE_NAME}=${encodedTx}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=600`,\n    );\n\n    return new Response(null, { status: 302, headers });\n  }\n\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: OAuth callback handler must validate 6 distinct error conditions sequentially (provider error / state / tx fetch / PKCE / code exchange / session) — extracting helpers fragments the linear control flow without clarifying intent (per EC-1 v1.1 absorbed)\n  async function finishSignIn(\n    providerName: string,\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): Promise<{ session: TSession; returnTo?: string }> {\n    const provider = requireProvider(providerName);\n\n    // EC-1 (v1.1) — OAuth provider error response (user declined consent) check BEFORE code-exchange\n    const url = new URL(`http://${req.headers.host ?? \"localhost\"}${req.url ?? \"/\"}`);\n    const errorParam = url.searchParams.get(\"error\");\n    if (errorParam) {\n      const errorDescription = url.searchParams.get(\"error_description\") ?? undefined;\n      if (errorParam === \"access_denied\") {\n        throw new AuthCancelledError(errorDescription);\n      }\n      throw new AuthCallbackError(\n        \"oauth_provider_error\",\n        `Provider returned error: ${errorParam}${errorDescription ? ` (${errorDescription})` : \"\"}`,\n      );\n    }\n\n    // Read + validate transaction cookie\n    const tx = await getTransaction(req, txSecret);\n    if (!tx) {\n      throw new AuthCallbackError(\n        \"oauth_transaction_expired\",\n        \"OAuth transaction cookie missing or expired (>10min). Please retry sign-in.\",\n      );\n    }\n\n    // Verify state matches query param (CSRF defense per RFC 6749 §10.12)\n    const queryState = url.searchParams.get(\"state\");\n    if (!queryState || queryState !== tx.state) {\n      throw new AuthCallbackError(\n        \"oauth_state_mismatch\",\n        \"OAuth state mismatch. Possible CSRF attempt or stale callback.\",\n      );\n    }\n\n    // Provider-specific callback handling (token exchange + userinfo fetch)\n    const result = await provider.handleCallback(req, tx);\n\n    // Invoke onSignIn callback if defined to derive session shape\n    let sessionData: TSession;\n    if (opts.onSignIn) {\n      sessionData = await opts.onSignIn({ profile: result.profile, provider: result.providerName });\n    } else {\n      // No onSignIn — pass the raw profile as session (consumers must type their own TSession)\n      sessionData = result.profile as unknown as TSession;\n    }\n\n    // EC-10 (v1.1) — OWASP A07:2021 session fixation mitigation: rotate session ID BEFORE creating new session\n    try {\n      await opts.session.rotateSession(req, res);\n    } catch {\n      // rotateSession may no-op if no pre-existing session — non-fatal\n    }\n\n    // Create session cookie\n    await opts.session.createSession(res, sessionData);\n\n    // Clear transaction cookie\n    clearTransaction(res);\n\n    return { session: sessionData, returnTo: tx.returnTo };\n  }\n\n  async function signIn<TProfile>(\n    profile: TProfile,\n    providerName: string,\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): Promise<TSession> {\n    // Path A escape hatch — skip OAuth flow, directly derive + persist session\n    let sessionData: TSession;\n    if (opts.onSignIn) {\n      sessionData = await opts.onSignIn({ profile, provider: providerName });\n    } else {\n      sessionData = profile as unknown as TSession;\n    }\n\n    try {\n      await opts.session.rotateSession(req, res);\n    } catch {\n      /* no-op if no pre-existing session */\n    }\n\n    await opts.session.createSession(res, sessionData);\n    return sessionData;\n  }\n\n  async function signOut(res: ServerResponse): Promise<void> {\n    // Read current session before destroying (so onSignOut can see it)\n    let sessionData: TSession | null = null;\n    if (opts.onSignOut) {\n      // We don't have req here per AuthOrchestrator contract; onSignOut receives null\n      // when no pre-existing session is available. Apps that need session-aware\n      // signOut should use the manual session.destroySession + custom logic.\n      sessionData = null;\n    }\n\n    opts.session.destroySession(res);\n\n    if (opts.onSignOut) {\n      await opts.onSignOut(sessionData);\n    }\n  }\n\n  async function getSession(req: IncomingMessage): Promise<TSession | null> {\n    return opts.session.getSession(req);\n  }\n\n  return { startSignIn, finishSignIn, signIn, signOut, getSession };\n}\n\n/** SE36 — `Auth.create` replaces `defineAuth` (ADR 0015). @public  *\n * `Auth.create` returns an **`AuthOrchestrator<TSession>`**, not an `Auth`. The class is\n * the namespace; the orchestrator is the product.\n */\nexport class Auth {\n  private constructor() {}\n  static create<TSession>(opts: DefineAuthOptions<TSession>): AuthOrchestrator<TSession> {\n    return defineAuth(opts);\n  }\n}\n\n/**\n * Test seam over {@link txCookieSecret}.\n *\n * Exported so the resolution order can be exercised through a CONFORMING `SessionManager` — the\n * point of the change that introduced `getCookieSecret`. Without a seam the only way to reach it is\n * a full `defineAuth` round trip, which is what let the previous version go untested through the\n * port and tested only through a cast.\n *\n * @internal\n */\nexport function _txCookieSecretForTests<TSession>(\n  opts: Pick<DefineAuthOptions<TSession>, \"session\">,\n): string {\n  return txCookieSecret(opts as DefineAuthOptions<TSession>);\n}\n"]}

package/dist/server/auth/oauth-transaction-store.d.cts

@@ -17,6 +17,7 @@
  * refactor to share SessionManager's encrypt path.
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { TheokitAgentError } from "../../errors.js";
 import type { OAuthTransaction } from "./types.js";
 /**
  * The transaction cookie's name. EXPORTED so the orchestrator uses this and not a second literal.
@@ -37,7 +38,7 @@ export declare const COOKIE_NAME = "__Host-theo_oauth_tx";
  *
  * @public
  */
-export declare class AuthSecretTooShortError extends Error {
+export declare class AuthSecretTooShortError extends TheokitAgentError {
     readonly name = "AuthSecretTooShortError";
     constructor(actualBytes: number);
 }

package/dist/server/auth/oauth-transaction-store.d.ts

@@ -17,6 +17,7 @@
  * refactor to share SessionManager's encrypt path.
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { TheokitAgentError } from "../../errors.js";
 import type { OAuthTransaction } from "./types.js";
 /**
  * The transaction cookie's name. EXPORTED so the orchestrator uses this and not a second literal.
@@ -37,7 +38,7 @@ export declare const COOKIE_NAME = "__Host-theo_oauth_tx";
  *
  * @public
  */
-export declare class AuthSecretTooShortError extends Error {
+export declare class AuthSecretTooShortError extends TheokitAgentError {
     readonly name = "AuthSecretTooShortError";
     constructor(actualBytes: number);
 }

package/dist/server/auth/orchestrator.d.cts

@@ -5,7 +5,10 @@
  * Composes existing primitives + the v1.1 EC-1/EC-2/EC-10 fixes.
  */
 import type { AuthOrchestrator, DefineAuthOptions } from "./types.js";
-/** SE36 — `Auth.create` replaces `defineAuth` (ADR 0015). @public */
+/** SE36 — `Auth.create` replaces `defineAuth` (ADR 0015). @public  *
+ * `Auth.create` returns an **`AuthOrchestrator<TSession>`**, not an `Auth`. The class is
+ * the namespace; the orchestrator is the product.
+ */
 export declare class Auth {
     private constructor();
     static create<TSession>(opts: DefineAuthOptions<TSession>): AuthOrchestrator<TSession>;

package/dist/server/auth/orchestrator.d.ts

@@ -5,7 +5,10 @@
  * Composes existing primitives + the v1.1 EC-1/EC-2/EC-10 fixes.
  */
 import type { AuthOrchestrator, DefineAuthOptions } from "./types.js";
-/** SE36 — `Auth.create` replaces `defineAuth` (ADR 0015). @public */
+/** SE36 — `Auth.create` replaces `defineAuth` (ADR 0015). @public  *
+ * `Auth.create` returns an **`AuthOrchestrator<TSession>`**, not an `Auth`. The class is
+ * the namespace; the orchestrator is the product.
+ */
 export declare class Auth {
     private constructor();
     static create<TSession>(opts: DefineAuthOptions<TSession>): AuthOrchestrator<TSession>;

package/dist/server/auth/types.d.cts

@@ -17,6 +17,24 @@ export interface SessionManager<TSession> {
     createSession(res: ServerResponse, data: TSession): Promise<void>;
     destroySession(res: ServerResponse): void;
     rotateSession(req: IncomingMessage, res: ServerResponse): Promise<TSession | null>;
+    /**
+     * The secret used to encrypt the OAuth transaction cookie, when this manager has one to share.
+     *
+     * OPTIONAL and additive: a manager without it makes `defineAuth` fall back to
+     * `THEOKIT_OAUTH_TX_SECRET`, which is the behaviour that already existed.
+     *
+     * It exists because the orchestrator was reading `session.secret` through
+     * `as unknown as { secret?: string | string[] }` — asserting a shape this contract did not offer,
+     * so no conforming caller could reach the branch and nothing in `src/` supplied it. The branch was
+     * green only because a test double carried the field. `orchestrator.ts` said in a comment that it
+     * WANTED this member ("may refactor to share the SessionManager's actual secret rotation chain via
+     * a `getCookieSecret()` method"); declaring it is what makes the branch reachable through the port
+     * and the double conform instead of the reverse.
+     *
+     * An array is accepted for rotation: the first entry encrypts, and the rest are for verifying
+     * cookies written before the last rotation.
+     */
+    getCookieSecret?(): string | string[] | undefined;
 }
 /**
  * Per ADR D5 — OAuth transaction state stored in encrypted HttpOnly cookie

package/dist/server/auth/types.d.ts

@@ -17,6 +17,24 @@ export interface SessionManager<TSession> {
     createSession(res: ServerResponse, data: TSession): Promise<void>;
     destroySession(res: ServerResponse): void;
     rotateSession(req: IncomingMessage, res: ServerResponse): Promise<TSession | null>;
+    /**
+     * The secret used to encrypt the OAuth transaction cookie, when this manager has one to share.
+     *
+     * OPTIONAL and additive: a manager without it makes `defineAuth` fall back to
+     * `THEOKIT_OAUTH_TX_SECRET`, which is the behaviour that already existed.
+     *
+     * It exists because the orchestrator was reading `session.secret` through
+     * `as unknown as { secret?: string | string[] }` — asserting a shape this contract did not offer,
+     * so no conforming caller could reach the branch and nothing in `src/` supplied it. The branch was
+     * green only because a test double carried the field. `orchestrator.ts` said in a comment that it
+     * WANTED this member ("may refactor to share the SessionManager's actual secret rotation chain via
+     * a `getCookieSecret()` method"); declaring it is what makes the branch reachable through the port
+     * and the double conform instead of the reverse.
+     *
+     * An array is accepted for rotation: the first entry encrypts, and the rest are for verifying
+     * cookies written before the last rotation.
+     */
+    getCookieSecret?(): string | string[] | undefined;
 }
 /**
  * Per ADR D5 — OAuth transaction state stored in encrypted HttpOnly cookie

package/dist/server/errors-envelope.cjs

@@ -1,8 +1,7 @@
 'use strict';
 
-var chunk4ZHTIJNE_cjs = require('../chunk-4ZHTIJNE.cjs');
-require('../chunk-XL7Q7HB2.cjs');
-require('../chunk-EG4QM7ZJ.cjs');
+var chunkJ7J7J2GN_cjs = require('../chunk-J7J7J2GN.cjs');
+require('../chunk-6LHQPOMI.cjs');
 
 // src/server/errors-envelope.ts
 var NAME_TO_CODE = /* @__PURE__ */ new Map([
@@ -38,7 +37,7 @@ function toEnvelope(value) {
 }
 function buildMeta(name, err) {
   const meta = { sdkErrorName: name };
-  if (err instanceof chunk4ZHTIJNE_cjs.TheokitAgentError && err.metadata !== void 0) {
+  if (err instanceof chunkJ7J7J2GN_cjs.TheokitAgentError && err.metadata !== void 0) {
     meta.provider = err.metadata.provider;
     meta.endpoint = err.metadata.endpoint;
     if (err.metadata.statusCode !== void 0) {
@@ -48,13 +47,13 @@ function buildMeta(name, err) {
   return meta;
 }
 function buildExt(err) {
-  if (err instanceof chunk4ZHTIJNE_cjs.RateLimitError && err.metadata?.retryAfter !== void 0) {
+  if (err instanceof chunkJ7J7J2GN_cjs.RateLimitError && err.metadata?.retryAfter !== void 0) {
     return {
       retryable: true,
       retryAfterMs: err.metadata.retryAfter * 1e3
     };
   }
-  if (err instanceof chunk4ZHTIJNE_cjs.CredentialPoolExhaustedError && err.nextRetryAt !== void 0) {
+  if (err instanceof chunkJ7J7J2GN_cjs.CredentialPoolExhaustedError && err.nextRetryAt !== void 0) {
     const delayMs = Math.max(0, err.nextRetryAt - Date.now());
     return {
       retryable: true,
@@ -64,22 +63,22 @@ function buildExt(err) {
   return void 0;
 }
 var CODE_TO_RECONSTRUCTOR = /* @__PURE__ */ new Map([
-  ["UNAUTHORIZED", (env) => new chunk4ZHTIJNE_cjs.AuthenticationError(env.message)],
+  ["UNAUTHORIZED", (env) => new chunkJ7J7J2GN_cjs.AuthenticationError(env.message)],
   [
     "RATE_LIMITED",
-    (env) => new chunk4ZHTIJNE_cjs.RateLimitError(env.message, env.cause !== void 0 ? { cause: env.cause } : {})
+    (env) => new chunkJ7J7J2GN_cjs.RateLimitError(env.message, env.cause !== void 0 ? { cause: env.cause } : {})
   ],
-  ["PROVIDER_KEY_MISSING", (env) => new chunk4ZHTIJNE_cjs.ConfigurationError(env.message)],
-  ["SERVICE_UNAVAILABLE", (env) => new chunk4ZHTIJNE_cjs.NetworkError(env.message)],
-  ["GATEWAY_TIMEOUT", (env) => new chunk4ZHTIJNE_cjs.NetworkError(env.message)],
+  ["PROVIDER_KEY_MISSING", (env) => new chunkJ7J7J2GN_cjs.ConfigurationError(env.message)],
+  ["SERVICE_UNAVAILABLE", (env) => new chunkJ7J7J2GN_cjs.NetworkError(env.message)],
+  ["GATEWAY_TIMEOUT", (env) => new chunkJ7J7J2GN_cjs.NetworkError(env.message)],
   [
     "AGENT_RUN_ERROR",
-    (env) => new chunk4ZHTIJNE_cjs.AgentRunError(env.message, {
+    (env) => new chunkJ7J7J2GN_cjs.AgentRunError(env.message, {
       code: "unknown",
       ...env.cause !== void 0 ? { cause: env.cause } : {}
     })
   ],
-  ["INTERNAL_SERVER_ERROR", (env) => new chunk4ZHTIJNE_cjs.UnknownAgentError(env.message)]
+  ["INTERNAL_SERVER_ERROR", (env) => new chunkJ7J7J2GN_cjs.UnknownAgentError(env.message)]
   // BUDGET_EXCEEDED + CREDENTIAL_POOL_EXHAUSTED reconstructors require
   // domain-specific args (budgetName, provider) that the envelope doesn't
   // always carry. Fall back to UnknownAgentError when those fields are
@@ -89,12 +88,12 @@ var CODE_TO_RECONSTRUCTOR = /* @__PURE__ */ new Map([
 function fromEnvelope(env) {
   const reconstructor = CODE_TO_RECONSTRUCTOR.get(env.code);
   if (reconstructor) return reconstructor(env);
-  return new chunk4ZHTIJNE_cjs.UnknownAgentError(env.message);
+  return new chunkJ7J7J2GN_cjs.UnknownAgentError(env.message);
 }
 
 Object.defineProperty(exports, "MemoryAdapterError", {
   enumerable: true,
-  get: function () { return chunk4ZHTIJNE_cjs.MemoryAdapterError; }
+  get: function () { return chunkJ7J7J2GN_cjs.MemoryAdapterError; }
 });
 exports.fromEnvelope = fromEnvelope;
 exports.toEnvelope = toEnvelope;

package/dist/server/errors-envelope.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/errors-envelope.ts"],"names":["TheokitAgentError","RateLimitError","CredentialPoolExhaustedError","AuthenticationError","ConfigurationError","NetworkError","AgentRunError","UnknownAgentError"],"mappings":";;;;;;;AAoEA,IAAM,YAAA,uBAA0D,GAAA,CAA8B;AAAA,EAC5F,CAAC,uBAAuB,cAAc,CAAA;AAAA,EACtC,CAAC,kBAAkB,cAAc,CAAA;AAAA,EACjC,CAAC,sBAAsB,sBAAsB,CAAA;AAAA,EAC7C,CAAC,gCAAgC,sBAAsB,CAAA;AAAA,EACvD,CAAC,gBAAgB,qBAAqB,CAAA;AAAA,EACtC,CAAC,iBAAiB,iBAAiB,CAAA;AAAA,EACnC,CAAC,uBAAuB,iBAAiB,CAAA;AAAA,EACzC,CAAC,gCAAgC,2BAA2B,CAAA;AAAA,EAC5D,CAAC,qBAAqB,uBAAuB,CAAA;AAAA,EAC7C,CAAC,sBAAsB,uBAAuB;AAChD,CAAC,CAAA;AAiBM,SAAS,WAAW,KAAA,EAAsC;AAC/D,EAAA,IAAI,EAAE,iBAAiB,KAAA,CAAA,EAAQ;AAC7B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA,IAAK,uBAAA;AACvC,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA;AAClC,EAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAC1B,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAQ,KAAA,CAAsC,KAAA;AAAA,IAC9C,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqC;AACpE,EAAA,MAAM,IAAA,GAAgC,EAAE,YAAA,EAAc,IAAA,EAAK;AAC3D,EAAA,IAAI,GAAA,YAAeA,mCAAA,IAAqB,GAAA,CAAI,QAAA,KAAa,MAAA,EAAW;AAClE,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAI,GAAA,CAAI,QAAA,CAAS,UAAA,KAAe,MAAA,EAAW;AACzC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAI,QAAA,CAAS,UAAA;AAAA,IACjC;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAS,GAAA,EAAqB;AACrC,EAAA,IAAI,GAAA,YAAeC,gCAAA,IAAkB,GAAA,CAAI,QAAA,EAAU,eAAe,MAAA,EAAW;AAC3E,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc,GAAA,CAAI,QAAA,CAAS,UAAA,GAAa;AAAA,KAC1C;AAAA,EACF;AACA,EAAA,IAAI,GAAA,YAAeC,8CAAA,IAAgC,GAAA,CAAI,WAAA,KAAgB,MAAA,EAAW;AAChF,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,CAAA,EAAG,IAAI,WAAA,GAAc,IAAA,CAAK,KAAK,CAAA;AACxD,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAUA,IAAM,qBAAA,uBAGE,GAAA,CAAwE;AAAA,EAC9E,CAAC,gBAAgB,CAAC,GAAA,KAAQ,IAAIC,qCAAA,CAAoB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D;AAAA,IACE,cAAA;AAAA,IACA,CAAC,GAAA,KAAQ,IAAIF,gCAAA,CAAe,IAAI,OAAA,EAAS,GAAA,CAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAE;AAAA,GAC9F;AAAA,EACA,CAAC,wBAAwB,CAAC,GAAA,KAAQ,IAAIG,oCAAA,CAAmB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACrE,CAAC,uBAAuB,CAAC,GAAA,KAAQ,IAAIC,8BAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D,CAAC,mBAAmB,CAAC,GAAA,KAAQ,IAAIA,8BAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC1D;AAAA,IACE,iBAAA;AAAA,IACA,CAAC,GAAA,KACC,IAAIC,+BAAA,CAAc,IAAI,OAAA,EAAS;AAAA,MAC7B,IAAA,EAAM,SAAA;AAAA,MACN,GAAI,IAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI;AAAC,KACvD;AAAA,GACL;AAAA,EACA,CAAC,yBAAyB,CAAC,GAAA,KAAQ,IAAIC,mCAAA,CAAkB,GAAA,CAAI,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMvE,CAAC,CAAA;AASM,SAAS,aAAa,GAAA,EAA8C;AACzE,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA;AACxD,EAAA,IAAI,aAAA,EAAe,OAAO,aAAA,CAAc,GAAG,CAAA;AAI3C,EAAA,OAAO,IAAIA,mCAAA,CAAkB,GAAA,CAAI,OAAO,CAAA;AAC1C","file":"errors-envelope.cjs","sourcesContent":["/**\n * G5 T2.2 boundary translation — `@theokit/sdk/server/errors-envelope`.\n *\n * Per plan g5-error-envelope-cross-layer v1.0 § Phase 2 / T2.2.\n * Blueprint ADR D3 — SDK keeps the 15+ Error class hierarchy internally;\n * `toEnvelope(err)` translates outward at the Agent.send -> RunResult egress\n * edge, `fromEnvelope(env)` reconstructs class identity on the inbound edge\n * (so consumer code can keep using `instanceof RateLimitError` patterns).\n *\n * Structurally-compatible envelope shape: identical fields to theokit/server\n * `TheoErrorEnvelope`. Re-declared locally to keep `@theokit/sdk` free of any\n * dependency on `theokit`. Consumer code that uses both packages gets the\n * same shape via duck-typing.\n */\n\nimport {\n  AgentRunError,\n  AuthenticationError,\n  ConfigurationError,\n  CredentialPoolExhaustedError,\n  MemoryAdapterError,\n  NetworkError,\n  RateLimitError,\n  TheokitAgentError,\n  UnknownAgentError,\n} from \"../errors.js\";\n\n/**\n * Canonical envelope code union for cross-layer SDK boundary. Subset of the\n * full `TheoErrorCode` (theokit/server) covering codes the SDK actually emits.\n * Other layers (theokit/server, theokit/client, theokit/ui) handle the broader\n * union; the SDK never needs the HTTP-only codes (PRECONDITION_FAILED, etc.).\n *\n * @public\n */\nexport type TheokitErrorCode =\n  | \"UNAUTHORIZED\"\n  | \"RATE_LIMITED\"\n  | \"INTERNAL_SERVER_ERROR\"\n  | \"SERVICE_UNAVAILABLE\"\n  | \"GATEWAY_TIMEOUT\"\n  // SDK / agent-domain\n  | \"AGENT_RUN_ERROR\"\n  | \"PROVIDER_KEY_MISSING\"\n  | \"BUDGET_EXCEEDED\"\n  | \"CREDENTIAL_POOL_EXHAUSTED\";\n\n/**\n * Envelope shape — structurally identical to theokit/server `TheoErrorEnvelope`.\n *\n * @public\n */\nexport interface TheokitErrorEnvelope<TExt = unknown> {\n  readonly code: TheokitErrorCode;\n  readonly message: string;\n  readonly cause?: unknown;\n  readonly meta?: Record<string, unknown>;\n  readonly ext?: TExt;\n}\n\n/**\n * Class-name -> envelope code mapping. Indexed by `Error.name` string so\n * subclasses inherit the mapping unless they override their `name` field.\n *\n * `IntegrationNotConnectedError` (subclass of `ConfigurationError`) takes\n * its own row because its `name` is `IntegrationNotConnectedError` and the\n * map is name-exact, not prototype-walked.\n */\nconst NAME_TO_CODE: ReadonlyMap<string, TheokitErrorCode> = new Map<string, TheokitErrorCode>([\n  [\"AuthenticationError\", \"UNAUTHORIZED\"],\n  [\"RateLimitError\", \"RATE_LIMITED\"],\n  [\"ConfigurationError\", \"PROVIDER_KEY_MISSING\"],\n  [\"IntegrationNotConnectedError\", \"PROVIDER_KEY_MISSING\"],\n  [\"NetworkError\", \"SERVICE_UNAVAILABLE\"],\n  [\"AgentRunError\", \"AGENT_RUN_ERROR\"],\n  [\"BudgetExceededError\", \"BUDGET_EXCEEDED\"],\n  [\"CredentialPoolExhaustedError\", \"CREDENTIAL_POOL_EXHAUSTED\"],\n  [\"UnknownAgentError\", \"INTERNAL_SERVER_ERROR\"],\n  [\"MemoryAdapterError\", \"INTERNAL_SERVER_ERROR\"],\n]);\n\n/**\n * Translate any SDK error (or arbitrary thrown value) into the canonical\n * envelope shape at the wire boundary.\n *\n * - `TheokitAgentError` family → mapped by `Error.name` string.\n * - Plain `Error` → INTERNAL_SERVER_ERROR.\n * - Non-Error values → INTERNAL_SERVER_ERROR with synthetic message.\n *\n * Meta carries `sdkErrorName` for telemetry; provider metadata (when present\n * via SDK's `ErrorMetadata`) flows through `meta.provider` / `meta.endpoint`\n * / `meta.statusCode` for diagnostics. `RateLimitError` populates a\n * `RetryableExt`-shaped ext when `metadata.retryAfter` (seconds) is set.\n *\n * @public\n */\nexport function toEnvelope(value: unknown): TheokitErrorEnvelope {\n  if (!(value instanceof Error)) {\n    return {\n      code: \"INTERNAL_SERVER_ERROR\",\n      message: typeof value === \"string\" ? value : \"Unknown error\",\n    };\n  }\n  const name = value.name;\n  const code = NAME_TO_CODE.get(name) ?? \"INTERNAL_SERVER_ERROR\";\n  const meta = buildMeta(name, value);\n  const ext = buildExt(value);\n  return {\n    code,\n    message: value.message,\n    cause: (value as Error & { cause?: unknown }).cause,\n    meta,\n    ext,\n  };\n}\n\nfunction buildMeta(name: string, err: Error): Record<string, unknown> {\n  const meta: Record<string, unknown> = { sdkErrorName: name };\n  if (err instanceof TheokitAgentError && err.metadata !== undefined) {\n    meta.provider = err.metadata.provider;\n    meta.endpoint = err.metadata.endpoint;\n    if (err.metadata.statusCode !== undefined) {\n      meta.statusCode = err.metadata.statusCode;\n    }\n  }\n  return meta;\n}\n\nfunction buildExt(err: Error): unknown {\n  if (err instanceof RateLimitError && err.metadata?.retryAfter !== undefined) {\n    return {\n      retryable: true as const,\n      retryAfterMs: err.metadata.retryAfter * 1000,\n    };\n  }\n  if (err instanceof CredentialPoolExhaustedError && err.nextRetryAt !== undefined) {\n    const delayMs = Math.max(0, err.nextRetryAt - Date.now());\n    return {\n      retryable: true as const,\n      retryAfterMs: delayMs,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Code -> reconstructor mapping. Each entry returns a fresh instance of the\n * SDK class hierarchy from an envelope, preserving message and (where the\n * constructor supports it) cause/ext context.\n *\n * Unmapped codes fall through to `UnknownAgentError` so consumer code that\n * relies on `err instanceof TheokitAgentError` still works.\n */\nconst CODE_TO_RECONSTRUCTOR: ReadonlyMap<\n  TheokitErrorCode,\n  (env: TheokitErrorEnvelope) => TheokitAgentError\n> = new Map<TheokitErrorCode, (env: TheokitErrorEnvelope) => TheokitAgentError>([\n  [\"UNAUTHORIZED\", (env) => new AuthenticationError(env.message)],\n  [\n    \"RATE_LIMITED\",\n    (env) => new RateLimitError(env.message, env.cause !== undefined ? { cause: env.cause } : {}),\n  ],\n  [\"PROVIDER_KEY_MISSING\", (env) => new ConfigurationError(env.message)],\n  [\"SERVICE_UNAVAILABLE\", (env) => new NetworkError(env.message)],\n  [\"GATEWAY_TIMEOUT\", (env) => new NetworkError(env.message)],\n  [\n    \"AGENT_RUN_ERROR\",\n    (env) =>\n      new AgentRunError(env.message, {\n        code: \"unknown\",\n        ...(env.cause !== undefined ? { cause: env.cause } : {}),\n      }),\n  ],\n  [\"INTERNAL_SERVER_ERROR\", (env) => new UnknownAgentError(env.message)],\n  // BUDGET_EXCEEDED + CREDENTIAL_POOL_EXHAUSTED reconstructors require\n  // domain-specific args (budgetName, provider) that the envelope doesn't\n  // always carry. Fall back to UnknownAgentError when those fields are\n  // missing; consumer code that needs the typed class should call the\n  // constructor directly.\n]);\n\n/**\n * Hydrate an envelope back into the SDK class hierarchy. Use at the inbound\n * boundary (e.g., on a worker process receiving an envelope from the main\n * process via IPC, or on a client deserializing a `RunResult.error`).\n *\n * @public\n */\nexport function fromEnvelope(env: TheokitErrorEnvelope): TheokitAgentError {\n  const reconstructor = CODE_TO_RECONSTRUCTOR.get(env.code);\n  if (reconstructor) return reconstructor(env);\n  // Round-trip preservation: if the envelope's meta.sdkErrorName matches a\n  // class without a generic reconstructor (e.g., BudgetExceededError), we\n  // can't rebuild without domain args. Fall back to UnknownAgentError.\n  return new UnknownAgentError(env.message);\n}\n\n// Re-export for ergonomic consumption alongside fromEnvelope.\nexport { MemoryAdapterError };\n"]}
+{"version":3,"sources":["../../src/server/errors-envelope.ts"],"names":["TheokitAgentError","RateLimitError","CredentialPoolExhaustedError","AuthenticationError","ConfigurationError","NetworkError","AgentRunError","UnknownAgentError"],"mappings":";;;;;;AAoEA,IAAM,YAAA,uBAA0D,GAAA,CAA8B;AAAA,EAC5F,CAAC,uBAAuB,cAAc,CAAA;AAAA,EACtC,CAAC,kBAAkB,cAAc,CAAA;AAAA,EACjC,CAAC,sBAAsB,sBAAsB,CAAA;AAAA,EAC7C,CAAC,gCAAgC,sBAAsB,CAAA;AAAA,EACvD,CAAC,gBAAgB,qBAAqB,CAAA;AAAA,EACtC,CAAC,iBAAiB,iBAAiB,CAAA;AAAA,EACnC,CAAC,uBAAuB,iBAAiB,CAAA;AAAA,EACzC,CAAC,gCAAgC,2BAA2B,CAAA;AAAA,EAC5D,CAAC,qBAAqB,uBAAuB,CAAA;AAAA,EAC7C,CAAC,sBAAsB,uBAAuB;AAChD,CAAC,CAAA;AAiBM,SAAS,WAAW,KAAA,EAAsC;AAC/D,EAAA,IAAI,EAAE,iBAAiB,KAAA,CAAA,EAAQ;AAC7B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA,IAAK,uBAAA;AACvC,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA;AAClC,EAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAC1B,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAQ,KAAA,CAAsC,KAAA;AAAA,IAC9C,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqC;AACpE,EAAA,MAAM,IAAA,GAAgC,EAAE,YAAA,EAAc,IAAA,EAAK;AAC3D,EAAA,IAAI,GAAA,YAAeA,mCAAA,IAAqB,GAAA,CAAI,QAAA,KAAa,MAAA,EAAW;AAClE,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAI,GAAA,CAAI,QAAA,CAAS,UAAA,KAAe,MAAA,EAAW;AACzC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAI,QAAA,CAAS,UAAA;AAAA,IACjC;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAS,GAAA,EAAqB;AACrC,EAAA,IAAI,GAAA,YAAeC,gCAAA,IAAkB,GAAA,CAAI,QAAA,EAAU,eAAe,MAAA,EAAW;AAC3E,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc,GAAA,CAAI,QAAA,CAAS,UAAA,GAAa;AAAA,KAC1C;AAAA,EACF;AACA,EAAA,IAAI,GAAA,YAAeC,8CAAA,IAAgC,GAAA,CAAI,WAAA,KAAgB,MAAA,EAAW;AAChF,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,CAAA,EAAG,IAAI,WAAA,GAAc,IAAA,CAAK,KAAK,CAAA;AACxD,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAUA,IAAM,qBAAA,uBAGE,GAAA,CAAwE;AAAA,EAC9E,CAAC,gBAAgB,CAAC,GAAA,KAAQ,IAAIC,qCAAA,CAAoB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D;AAAA,IACE,cAAA;AAAA,IACA,CAAC,GAAA,KAAQ,IAAIF,gCAAA,CAAe,IAAI,OAAA,EAAS,GAAA,CAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAE;AAAA,GAC9F;AAAA,EACA,CAAC,wBAAwB,CAAC,GAAA,KAAQ,IAAIG,oCAAA,CAAmB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACrE,CAAC,uBAAuB,CAAC,GAAA,KAAQ,IAAIC,8BAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D,CAAC,mBAAmB,CAAC,GAAA,KAAQ,IAAIA,8BAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC1D;AAAA,IACE,iBAAA;AAAA,IACA,CAAC,GAAA,KACC,IAAIC,+BAAA,CAAc,IAAI,OAAA,EAAS;AAAA,MAC7B,IAAA,EAAM,SAAA;AAAA,MACN,GAAI,IAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI;AAAC,KACvD;AAAA,GACL;AAAA,EACA,CAAC,yBAAyB,CAAC,GAAA,KAAQ,IAAIC,mCAAA,CAAkB,GAAA,CAAI,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMvE,CAAC,CAAA;AASM,SAAS,aAAa,GAAA,EAA8C;AACzE,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA;AACxD,EAAA,IAAI,aAAA,EAAe,OAAO,aAAA,CAAc,GAAG,CAAA;AAI3C,EAAA,OAAO,IAAIA,mCAAA,CAAkB,GAAA,CAAI,OAAO,CAAA;AAC1C","file":"errors-envelope.cjs","sourcesContent":["/**\n * G5 T2.2 boundary translation — `@theokit/sdk/server/errors-envelope`.\n *\n * Per plan g5-error-envelope-cross-layer v1.0 § Phase 2 / T2.2.\n * Blueprint ADR D3 — SDK keeps the 15+ Error class hierarchy internally;\n * `toEnvelope(err)` translates outward at the Agent.send -> RunResult egress\n * edge, `fromEnvelope(env)` reconstructs class identity on the inbound edge\n * (so consumer code can keep using `instanceof RateLimitError` patterns).\n *\n * Structurally-compatible envelope shape: identical fields to theokit/server\n * `TheoErrorEnvelope`. Re-declared locally to keep `@theokit/sdk` free of any\n * dependency on `theokit`. Consumer code that uses both packages gets the\n * same shape via duck-typing.\n */\n\nimport {\n  AgentRunError,\n  AuthenticationError,\n  ConfigurationError,\n  CredentialPoolExhaustedError,\n  MemoryAdapterError,\n  NetworkError,\n  RateLimitError,\n  TheokitAgentError,\n  UnknownAgentError,\n} from \"../errors.js\";\n\n/**\n * Canonical envelope code union for cross-layer SDK boundary. Subset of the\n * full `TheoErrorCode` (theokit/server) covering codes the SDK actually emits.\n * Other layers (theokit/server, theokit/client, theokit/ui) handle the broader\n * union; the SDK never needs the HTTP-only codes (PRECONDITION_FAILED, etc.).\n *\n * @public\n */\nexport type TheokitErrorCode =\n  | \"UNAUTHORIZED\"\n  | \"RATE_LIMITED\"\n  | \"INTERNAL_SERVER_ERROR\"\n  | \"SERVICE_UNAVAILABLE\"\n  | \"GATEWAY_TIMEOUT\"\n  // SDK / agent-domain\n  | \"AGENT_RUN_ERROR\"\n  | \"PROVIDER_KEY_MISSING\"\n  | \"BUDGET_EXCEEDED\"\n  | \"CREDENTIAL_POOL_EXHAUSTED\";\n\n/**\n * Envelope shape — structurally identical to theokit/server `TheoErrorEnvelope`.\n *\n * @public\n */\nexport interface TheokitErrorEnvelope<TExt = unknown> {\n  readonly code: TheokitErrorCode;\n  readonly message: string;\n  readonly cause?: unknown;\n  readonly meta?: Record<string, unknown>;\n  readonly ext?: TExt;\n}\n\n/**\n * Class-name -> envelope code mapping. Indexed by `Error.name` string so\n * subclasses inherit the mapping unless they override their `name` field.\n *\n * `IntegrationNotConnectedError` (subclass of `ConfigurationError`) takes\n * its own row because its `name` is `IntegrationNotConnectedError` and the\n * map is name-exact, not prototype-walked.\n */\nconst NAME_TO_CODE: ReadonlyMap<string, TheokitErrorCode> = new Map<string, TheokitErrorCode>([\n  [\"AuthenticationError\", \"UNAUTHORIZED\"],\n  [\"RateLimitError\", \"RATE_LIMITED\"],\n  [\"ConfigurationError\", \"PROVIDER_KEY_MISSING\"],\n  [\"IntegrationNotConnectedError\", \"PROVIDER_KEY_MISSING\"],\n  [\"NetworkError\", \"SERVICE_UNAVAILABLE\"],\n  [\"AgentRunError\", \"AGENT_RUN_ERROR\"],\n  [\"BudgetExceededError\", \"BUDGET_EXCEEDED\"],\n  [\"CredentialPoolExhaustedError\", \"CREDENTIAL_POOL_EXHAUSTED\"],\n  [\"UnknownAgentError\", \"INTERNAL_SERVER_ERROR\"],\n  [\"MemoryAdapterError\", \"INTERNAL_SERVER_ERROR\"],\n]);\n\n/**\n * Translate any SDK error (or arbitrary thrown value) into the canonical\n * envelope shape at the wire boundary.\n *\n * - `TheokitAgentError` family → mapped by `Error.name` string.\n * - Plain `Error` → INTERNAL_SERVER_ERROR.\n * - Non-Error values → INTERNAL_SERVER_ERROR with synthetic message.\n *\n * Meta carries `sdkErrorName` for telemetry; provider metadata (when present\n * via SDK's `ErrorMetadata`) flows through `meta.provider` / `meta.endpoint`\n * / `meta.statusCode` for diagnostics. `RateLimitError` populates a\n * `RetryableExt`-shaped ext when `metadata.retryAfter` (seconds) is set.\n *\n * @public\n */\nexport function toEnvelope(value: unknown): TheokitErrorEnvelope {\n  if (!(value instanceof Error)) {\n    return {\n      code: \"INTERNAL_SERVER_ERROR\",\n      message: typeof value === \"string\" ? value : \"Unknown error\",\n    };\n  }\n  const name = value.name;\n  const code = NAME_TO_CODE.get(name) ?? \"INTERNAL_SERVER_ERROR\";\n  const meta = buildMeta(name, value);\n  const ext = buildExt(value);\n  return {\n    code,\n    message: value.message,\n    cause: (value as Error & { cause?: unknown }).cause,\n    meta,\n    ext,\n  };\n}\n\nfunction buildMeta(name: string, err: Error): Record<string, unknown> {\n  const meta: Record<string, unknown> = { sdkErrorName: name };\n  if (err instanceof TheokitAgentError && err.metadata !== undefined) {\n    meta.provider = err.metadata.provider;\n    meta.endpoint = err.metadata.endpoint;\n    if (err.metadata.statusCode !== undefined) {\n      meta.statusCode = err.metadata.statusCode;\n    }\n  }\n  return meta;\n}\n\nfunction buildExt(err: Error): unknown {\n  if (err instanceof RateLimitError && err.metadata?.retryAfter !== undefined) {\n    return {\n      retryable: true as const,\n      retryAfterMs: err.metadata.retryAfter * 1000,\n    };\n  }\n  if (err instanceof CredentialPoolExhaustedError && err.nextRetryAt !== undefined) {\n    const delayMs = Math.max(0, err.nextRetryAt - Date.now());\n    return {\n      retryable: true as const,\n      retryAfterMs: delayMs,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Code -> reconstructor mapping. Each entry returns a fresh instance of the\n * SDK class hierarchy from an envelope, preserving message and (where the\n * constructor supports it) cause/ext context.\n *\n * Unmapped codes fall through to `UnknownAgentError` so consumer code that\n * relies on `err instanceof TheokitAgentError` still works.\n */\nconst CODE_TO_RECONSTRUCTOR: ReadonlyMap<\n  TheokitErrorCode,\n  (env: TheokitErrorEnvelope) => TheokitAgentError\n> = new Map<TheokitErrorCode, (env: TheokitErrorEnvelope) => TheokitAgentError>([\n  [\"UNAUTHORIZED\", (env) => new AuthenticationError(env.message)],\n  [\n    \"RATE_LIMITED\",\n    (env) => new RateLimitError(env.message, env.cause !== undefined ? { cause: env.cause } : {}),\n  ],\n  [\"PROVIDER_KEY_MISSING\", (env) => new ConfigurationError(env.message)],\n  [\"SERVICE_UNAVAILABLE\", (env) => new NetworkError(env.message)],\n  [\"GATEWAY_TIMEOUT\", (env) => new NetworkError(env.message)],\n  [\n    \"AGENT_RUN_ERROR\",\n    (env) =>\n      new AgentRunError(env.message, {\n        code: \"unknown\",\n        ...(env.cause !== undefined ? { cause: env.cause } : {}),\n      }),\n  ],\n  [\"INTERNAL_SERVER_ERROR\", (env) => new UnknownAgentError(env.message)],\n  // BUDGET_EXCEEDED + CREDENTIAL_POOL_EXHAUSTED reconstructors require\n  // domain-specific args (budgetName, provider) that the envelope doesn't\n  // always carry. Fall back to UnknownAgentError when those fields are\n  // missing; consumer code that needs the typed class should call the\n  // constructor directly.\n]);\n\n/**\n * Hydrate an envelope back into the SDK class hierarchy. Use at the inbound\n * boundary (e.g., on a worker process receiving an envelope from the main\n * process via IPC, or on a client deserializing a `RunResult.error`).\n *\n * @public\n */\nexport function fromEnvelope(env: TheokitErrorEnvelope): TheokitAgentError {\n  const reconstructor = CODE_TO_RECONSTRUCTOR.get(env.code);\n  if (reconstructor) return reconstructor(env);\n  // Round-trip preservation: if the envelope's meta.sdkErrorName matches a\n  // class without a generic reconstructor (e.g., BudgetExceededError), we\n  // can't rebuild without domain args. Fall back to UnknownAgentError.\n  return new UnknownAgentError(env.message);\n}\n\n// Re-export for ergonomic consumption alongside fromEnvelope.\nexport { MemoryAdapterError };\n"]}

package/dist/server/errors-envelope.d.cts

@@ -1,6 +1,6 @@
-import { T as TheokitAgentError } from '../errors-BgJH9PHi.cjs';
-export { M as MemoryAdapterError } from '../errors-BgJH9PHi.cjs';
-import '../run-BYSHf58D.cjs';
+export { M as MemoryAdapterError } from '../errors-DrDEgyz1.cjs';
+import { T as TheokitAgentError } from '../errors-base-B5g01neU.cjs';
+import '../run-CTAdRU3U.cjs';
 import 'zod';
 
 /**

package/dist/server/errors-envelope.d.ts

@@ -1,6 +1,6 @@
-import { T as TheokitAgentError } from '../errors-C5fJUqLk.js';
-export { M as MemoryAdapterError } from '../errors-C5fJUqLk.js';
-import '../run-BYSHf58D.js';
+export { M as MemoryAdapterError } from '../errors-CLOAyuiv.js';
+import { T as TheokitAgentError } from '../errors-base-B5g01neU.js';
+import '../run-CTAdRU3U.js';
 import 'zod';
 
 /**

package/dist/server/errors-envelope.js

@@ -1,7 +1,6 @@
-import { TheokitAgentError, RateLimitError, CredentialPoolExhaustedError, UnknownAgentError, AuthenticationError, ConfigurationError, NetworkError, AgentRunError } from '../chunk-ZZMZWBR6.js';
-export { MemoryAdapterError } from '../chunk-ZZMZWBR6.js';
-import '../chunk-D4CUGAKZ.js';
-import '../chunk-XEQ3TM66.js';
+import { TheokitAgentError, RateLimitError, CredentialPoolExhaustedError, UnknownAgentError, AuthenticationError, ConfigurationError, NetworkError, AgentRunError } from '../chunk-ALUN2B4W.js';
+export { MemoryAdapterError } from '../chunk-ALUN2B4W.js';
+import '../chunk-CZJ6Q7CW.js';
 
 // src/server/errors-envelope.ts
 var NAME_TO_CODE = /* @__PURE__ */ new Map([

package/dist/server/errors-envelope.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/errors-envelope.ts"],"names":[],"mappings":";;;;;;AAoEA,IAAM,YAAA,uBAA0D,GAAA,CAA8B;AAAA,EAC5F,CAAC,uBAAuB,cAAc,CAAA;AAAA,EACtC,CAAC,kBAAkB,cAAc,CAAA;AAAA,EACjC,CAAC,sBAAsB,sBAAsB,CAAA;AAAA,EAC7C,CAAC,gCAAgC,sBAAsB,CAAA;AAAA,EACvD,CAAC,gBAAgB,qBAAqB,CAAA;AAAA,EACtC,CAAC,iBAAiB,iBAAiB,CAAA;AAAA,EACnC,CAAC,uBAAuB,iBAAiB,CAAA;AAAA,EACzC,CAAC,gCAAgC,2BAA2B,CAAA;AAAA,EAC5D,CAAC,qBAAqB,uBAAuB,CAAA;AAAA,EAC7C,CAAC,sBAAsB,uBAAuB;AAChD,CAAC,CAAA;AAiBM,SAAS,WAAW,KAAA,EAAsC;AAC/D,EAAA,IAAI,EAAE,iBAAiB,KAAA,CAAA,EAAQ;AAC7B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA,IAAK,uBAAA;AACvC,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA;AAClC,EAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAC1B,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAQ,KAAA,CAAsC,KAAA;AAAA,IAC9C,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqC;AACpE,EAAA,MAAM,IAAA,GAAgC,EAAE,YAAA,EAAc,IAAA,EAAK;AAC3D,EAAA,IAAI,GAAA,YAAe,iBAAA,IAAqB,GAAA,CAAI,QAAA,KAAa,MAAA,EAAW;AAClE,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAI,GAAA,CAAI,QAAA,CAAS,UAAA,KAAe,MAAA,EAAW;AACzC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAI,QAAA,CAAS,UAAA;AAAA,IACjC;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAS,GAAA,EAAqB;AACrC,EAAA,IAAI,GAAA,YAAe,cAAA,IAAkB,GAAA,CAAI,QAAA,EAAU,eAAe,MAAA,EAAW;AAC3E,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc,GAAA,CAAI,QAAA,CAAS,UAAA,GAAa;AAAA,KAC1C;AAAA,EACF;AACA,EAAA,IAAI,GAAA,YAAe,4BAAA,IAAgC,GAAA,CAAI,WAAA,KAAgB,MAAA,EAAW;AAChF,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,CAAA,EAAG,IAAI,WAAA,GAAc,IAAA,CAAK,KAAK,CAAA;AACxD,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAUA,IAAM,qBAAA,uBAGE,GAAA,CAAwE;AAAA,EAC9E,CAAC,gBAAgB,CAAC,GAAA,KAAQ,IAAI,mBAAA,CAAoB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D;AAAA,IACE,cAAA;AAAA,IACA,CAAC,GAAA,KAAQ,IAAI,cAAA,CAAe,IAAI,OAAA,EAAS,GAAA,CAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAE;AAAA,GAC9F;AAAA,EACA,CAAC,wBAAwB,CAAC,GAAA,KAAQ,IAAI,kBAAA,CAAmB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACrE,CAAC,uBAAuB,CAAC,GAAA,KAAQ,IAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D,CAAC,mBAAmB,CAAC,GAAA,KAAQ,IAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC1D;AAAA,IACE,iBAAA;AAAA,IACA,CAAC,GAAA,KACC,IAAI,aAAA,CAAc,IAAI,OAAA,EAAS;AAAA,MAC7B,IAAA,EAAM,SAAA;AAAA,MACN,GAAI,IAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI;AAAC,KACvD;AAAA,GACL;AAAA,EACA,CAAC,yBAAyB,CAAC,GAAA,KAAQ,IAAI,iBAAA,CAAkB,GAAA,CAAI,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMvE,CAAC,CAAA;AASM,SAAS,aAAa,GAAA,EAA8C;AACzE,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA;AACxD,EAAA,IAAI,aAAA,EAAe,OAAO,aAAA,CAAc,GAAG,CAAA;AAI3C,EAAA,OAAO,IAAI,iBAAA,CAAkB,GAAA,CAAI,OAAO,CAAA;AAC1C","file":"errors-envelope.js","sourcesContent":["/**\n * G5 T2.2 boundary translation — `@theokit/sdk/server/errors-envelope`.\n *\n * Per plan g5-error-envelope-cross-layer v1.0 § Phase 2 / T2.2.\n * Blueprint ADR D3 — SDK keeps the 15+ Error class hierarchy internally;\n * `toEnvelope(err)` translates outward at the Agent.send -> RunResult egress\n * edge, `fromEnvelope(env)` reconstructs class identity on the inbound edge\n * (so consumer code can keep using `instanceof RateLimitError` patterns).\n *\n * Structurally-compatible envelope shape: identical fields to theokit/server\n * `TheoErrorEnvelope`. Re-declared locally to keep `@theokit/sdk` free of any\n * dependency on `theokit`. Consumer code that uses both packages gets the\n * same shape via duck-typing.\n */\n\nimport {\n  AgentRunError,\n  AuthenticationError,\n  ConfigurationError,\n  CredentialPoolExhaustedError,\n  MemoryAdapterError,\n  NetworkError,\n  RateLimitError,\n  TheokitAgentError,\n  UnknownAgentError,\n} from \"../errors.js\";\n\n/**\n * Canonical envelope code union for cross-layer SDK boundary. Subset of the\n * full `TheoErrorCode` (theokit/server) covering codes the SDK actually emits.\n * Other layers (theokit/server, theokit/client, theokit/ui) handle the broader\n * union; the SDK never needs the HTTP-only codes (PRECONDITION_FAILED, etc.).\n *\n * @public\n */\nexport type TheokitErrorCode =\n  | \"UNAUTHORIZED\"\n  | \"RATE_LIMITED\"\n  | \"INTERNAL_SERVER_ERROR\"\n  | \"SERVICE_UNAVAILABLE\"\n  | \"GATEWAY_TIMEOUT\"\n  // SDK / agent-domain\n  | \"AGENT_RUN_ERROR\"\n  | \"PROVIDER_KEY_MISSING\"\n  | \"BUDGET_EXCEEDED\"\n  | \"CREDENTIAL_POOL_EXHAUSTED\";\n\n/**\n * Envelope shape — structurally identical to theokit/server `TheoErrorEnvelope`.\n *\n * @public\n */\nexport interface TheokitErrorEnvelope<TExt = unknown> {\n  readonly code: TheokitErrorCode;\n  readonly message: string;\n  readonly cause?: unknown;\n  readonly meta?: Record<string, unknown>;\n  readonly ext?: TExt;\n}\n\n/**\n * Class-name -> envelope code mapping. Indexed by `Error.name` string so\n * subclasses inherit the mapping unless they override their `name` field.\n *\n * `IntegrationNotConnectedError` (subclass of `ConfigurationError`) takes\n * its own row because its `name` is `IntegrationNotConnectedError` and the\n * map is name-exact, not prototype-walked.\n */\nconst NAME_TO_CODE: ReadonlyMap<string, TheokitErrorCode> = new Map<string, TheokitErrorCode>([\n  [\"AuthenticationError\", \"UNAUTHORIZED\"],\n  [\"RateLimitError\", \"RATE_LIMITED\"],\n  [\"ConfigurationError\", \"PROVIDER_KEY_MISSING\"],\n  [\"IntegrationNotConnectedError\", \"PROVIDER_KEY_MISSING\"],\n  [\"NetworkError\", \"SERVICE_UNAVAILABLE\"],\n  [\"AgentRunError\", \"AGENT_RUN_ERROR\"],\n  [\"BudgetExceededError\", \"BUDGET_EXCEEDED\"],\n  [\"CredentialPoolExhaustedError\", \"CREDENTIAL_POOL_EXHAUSTED\"],\n  [\"UnknownAgentError\", \"INTERNAL_SERVER_ERROR\"],\n  [\"MemoryAdapterError\", \"INTERNAL_SERVER_ERROR\"],\n]);\n\n/**\n * Translate any SDK error (or arbitrary thrown value) into the canonical\n * envelope shape at the wire boundary.\n *\n * - `TheokitAgentError` family → mapped by `Error.name` string.\n * - Plain `Error` → INTERNAL_SERVER_ERROR.\n * - Non-Error values → INTERNAL_SERVER_ERROR with synthetic message.\n *\n * Meta carries `sdkErrorName` for telemetry; provider metadata (when present\n * via SDK's `ErrorMetadata`) flows through `meta.provider` / `meta.endpoint`\n * / `meta.statusCode` for diagnostics. `RateLimitError` populates a\n * `RetryableExt`-shaped ext when `metadata.retryAfter` (seconds) is set.\n *\n * @public\n */\nexport function toEnvelope(value: unknown): TheokitErrorEnvelope {\n  if (!(value instanceof Error)) {\n    return {\n      code: \"INTERNAL_SERVER_ERROR\",\n      message: typeof value === \"string\" ? value : \"Unknown error\",\n    };\n  }\n  const name = value.name;\n  const code = NAME_TO_CODE.get(name) ?? \"INTERNAL_SERVER_ERROR\";\n  const meta = buildMeta(name, value);\n  const ext = buildExt(value);\n  return {\n    code,\n    message: value.message,\n    cause: (value as Error & { cause?: unknown }).cause,\n    meta,\n    ext,\n  };\n}\n\nfunction buildMeta(name: string, err: Error): Record<string, unknown> {\n  const meta: Record<string, unknown> = { sdkErrorName: name };\n  if (err instanceof TheokitAgentError && err.metadata !== undefined) {\n    meta.provider = err.metadata.provider;\n    meta.endpoint = err.metadata.endpoint;\n    if (err.metadata.statusCode !== undefined) {\n      meta.statusCode = err.metadata.statusCode;\n    }\n  }\n  return meta;\n}\n\nfunction buildExt(err: Error): unknown {\n  if (err instanceof RateLimitError && err.metadata?.retryAfter !== undefined) {\n    return {\n      retryable: true as const,\n      retryAfterMs: err.metadata.retryAfter * 1000,\n    };\n  }\n  if (err instanceof CredentialPoolExhaustedError && err.nextRetryAt !== undefined) {\n    const delayMs = Math.max(0, err.nextRetryAt - Date.now());\n    return {\n      retryable: true as const,\n      retryAfterMs: delayMs,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Code -> reconstructor mapping. Each entry returns a fresh instance of the\n * SDK class hierarchy from an envelope, preserving message and (where the\n * constructor supports it) cause/ext context.\n *\n * Unmapped codes fall through to `UnknownAgentError` so consumer code that\n * relies on `err instanceof TheokitAgentError` still works.\n */\nconst CODE_TO_RECONSTRUCTOR: ReadonlyMap<\n  TheokitErrorCode,\n  (env: TheokitErrorEnvelope) => TheokitAgentError\n> = new Map<TheokitErrorCode, (env: TheokitErrorEnvelope) => TheokitAgentError>([\n  [\"UNAUTHORIZED\", (env) => new AuthenticationError(env.message)],\n  [\n    \"RATE_LIMITED\",\n    (env) => new RateLimitError(env.message, env.cause !== undefined ? { cause: env.cause } : {}),\n  ],\n  [\"PROVIDER_KEY_MISSING\", (env) => new ConfigurationError(env.message)],\n  [\"SERVICE_UNAVAILABLE\", (env) => new NetworkError(env.message)],\n  [\"GATEWAY_TIMEOUT\", (env) => new NetworkError(env.message)],\n  [\n    \"AGENT_RUN_ERROR\",\n    (env) =>\n      new AgentRunError(env.message, {\n        code: \"unknown\",\n        ...(env.cause !== undefined ? { cause: env.cause } : {}),\n      }),\n  ],\n  [\"INTERNAL_SERVER_ERROR\", (env) => new UnknownAgentError(env.message)],\n  // BUDGET_EXCEEDED + CREDENTIAL_POOL_EXHAUSTED reconstructors require\n  // domain-specific args (budgetName, provider) that the envelope doesn't\n  // always carry. Fall back to UnknownAgentError when those fields are\n  // missing; consumer code that needs the typed class should call the\n  // constructor directly.\n]);\n\n/**\n * Hydrate an envelope back into the SDK class hierarchy. Use at the inbound\n * boundary (e.g., on a worker process receiving an envelope from the main\n * process via IPC, or on a client deserializing a `RunResult.error`).\n *\n * @public\n */\nexport function fromEnvelope(env: TheokitErrorEnvelope): TheokitAgentError {\n  const reconstructor = CODE_TO_RECONSTRUCTOR.get(env.code);\n  if (reconstructor) return reconstructor(env);\n  // Round-trip preservation: if the envelope's meta.sdkErrorName matches a\n  // class without a generic reconstructor (e.g., BudgetExceededError), we\n  // can't rebuild without domain args. Fall back to UnknownAgentError.\n  return new UnknownAgentError(env.message);\n}\n\n// Re-export for ergonomic consumption alongside fromEnvelope.\nexport { MemoryAdapterError };\n"]}
+{"version":3,"sources":["../../src/server/errors-envelope.ts"],"names":[],"mappings":";;;;;AAoEA,IAAM,YAAA,uBAA0D,GAAA,CAA8B;AAAA,EAC5F,CAAC,uBAAuB,cAAc,CAAA;AAAA,EACtC,CAAC,kBAAkB,cAAc,CAAA;AAAA,EACjC,CAAC,sBAAsB,sBAAsB,CAAA;AAAA,EAC7C,CAAC,gCAAgC,sBAAsB,CAAA;AAAA,EACvD,CAAC,gBAAgB,qBAAqB,CAAA;AAAA,EACtC,CAAC,iBAAiB,iBAAiB,CAAA;AAAA,EACnC,CAAC,uBAAuB,iBAAiB,CAAA;AAAA,EACzC,CAAC,gCAAgC,2BAA2B,CAAA;AAAA,EAC5D,CAAC,qBAAqB,uBAAuB,CAAA;AAAA,EAC7C,CAAC,sBAAsB,uBAAuB;AAChD,CAAC,CAAA;AAiBM,SAAS,WAAW,KAAA,EAAsC;AAC/D,EAAA,IAAI,EAAE,iBAAiB,KAAA,CAAA,EAAQ;AAC7B,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,uBAAA;AAAA,MACN,OAAA,EAAS,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ;AAAA,KAC/C;AAAA,EACF;AACA,EAAA,MAAM,OAAO,KAAA,CAAM,IAAA;AACnB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA,IAAK,uBAAA;AACvC,EAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,EAAM,KAAK,CAAA;AAClC,EAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAC1B,EAAA,OAAO;AAAA,IACL,IAAA;AAAA,IACA,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAQ,KAAA,CAAsC,KAAA;AAAA,IAC9C,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,SAAA,CAAU,MAAc,GAAA,EAAqC;AACpE,EAAA,MAAM,IAAA,GAAgC,EAAE,YAAA,EAAc,IAAA,EAAK;AAC3D,EAAA,IAAI,GAAA,YAAe,iBAAA,IAAqB,GAAA,CAAI,QAAA,KAAa,MAAA,EAAW;AAClE,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,QAAA;AAC7B,IAAA,IAAI,GAAA,CAAI,QAAA,CAAS,UAAA,KAAe,MAAA,EAAW;AACzC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAI,QAAA,CAAS,UAAA;AAAA,IACjC;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAS,GAAA,EAAqB;AACrC,EAAA,IAAI,GAAA,YAAe,cAAA,IAAkB,GAAA,CAAI,QAAA,EAAU,eAAe,MAAA,EAAW;AAC3E,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc,GAAA,CAAI,QAAA,CAAS,UAAA,GAAa;AAAA,KAC1C;AAAA,EACF;AACA,EAAA,IAAI,GAAA,YAAe,4BAAA,IAAgC,GAAA,CAAI,WAAA,KAAgB,MAAA,EAAW;AAChF,IAAA,MAAM,OAAA,GAAU,KAAK,GAAA,CAAI,CAAA,EAAG,IAAI,WAAA,GAAc,IAAA,CAAK,KAAK,CAAA;AACxD,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,IAAA;AAAA,MACX,YAAA,EAAc;AAAA,KAChB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAUA,IAAM,qBAAA,uBAGE,GAAA,CAAwE;AAAA,EAC9E,CAAC,gBAAgB,CAAC,GAAA,KAAQ,IAAI,mBAAA,CAAoB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D;AAAA,IACE,cAAA;AAAA,IACA,CAAC,GAAA,KAAQ,IAAI,cAAA,CAAe,IAAI,OAAA,EAAS,GAAA,CAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI,EAAE;AAAA,GAC9F;AAAA,EACA,CAAC,wBAAwB,CAAC,GAAA,KAAQ,IAAI,kBAAA,CAAmB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACrE,CAAC,uBAAuB,CAAC,GAAA,KAAQ,IAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC9D,CAAC,mBAAmB,CAAC,GAAA,KAAQ,IAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EAC1D;AAAA,IACE,iBAAA;AAAA,IACA,CAAC,GAAA,KACC,IAAI,aAAA,CAAc,IAAI,OAAA,EAAS;AAAA,MAC7B,IAAA,EAAM,SAAA;AAAA,MACN,GAAI,IAAI,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM,GAAI;AAAC,KACvD;AAAA,GACL;AAAA,EACA,CAAC,yBAAyB,CAAC,GAAA,KAAQ,IAAI,iBAAA,CAAkB,GAAA,CAAI,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAMvE,CAAC,CAAA;AASM,SAAS,aAAa,GAAA,EAA8C;AACzE,EAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA;AACxD,EAAA,IAAI,aAAA,EAAe,OAAO,aAAA,CAAc,GAAG,CAAA;AAI3C,EAAA,OAAO,IAAI,iBAAA,CAAkB,GAAA,CAAI,OAAO,CAAA;AAC1C","file":"errors-envelope.js","sourcesContent":["/**\n * G5 T2.2 boundary translation — `@theokit/sdk/server/errors-envelope`.\n *\n * Per plan g5-error-envelope-cross-layer v1.0 § Phase 2 / T2.2.\n * Blueprint ADR D3 — SDK keeps the 15+ Error class hierarchy internally;\n * `toEnvelope(err)` translates outward at the Agent.send -> RunResult egress\n * edge, `fromEnvelope(env)` reconstructs class identity on the inbound edge\n * (so consumer code can keep using `instanceof RateLimitError` patterns).\n *\n * Structurally-compatible envelope shape: identical fields to theokit/server\n * `TheoErrorEnvelope`. Re-declared locally to keep `@theokit/sdk` free of any\n * dependency on `theokit`. Consumer code that uses both packages gets the\n * same shape via duck-typing.\n */\n\nimport {\n  AgentRunError,\n  AuthenticationError,\n  ConfigurationError,\n  CredentialPoolExhaustedError,\n  MemoryAdapterError,\n  NetworkError,\n  RateLimitError,\n  TheokitAgentError,\n  UnknownAgentError,\n} from \"../errors.js\";\n\n/**\n * Canonical envelope code union for cross-layer SDK boundary. Subset of the\n * full `TheoErrorCode` (theokit/server) covering codes the SDK actually emits.\n * Other layers (theokit/server, theokit/client, theokit/ui) handle the broader\n * union; the SDK never needs the HTTP-only codes (PRECONDITION_FAILED, etc.).\n *\n * @public\n */\nexport type TheokitErrorCode =\n  | \"UNAUTHORIZED\"\n  | \"RATE_LIMITED\"\n  | \"INTERNAL_SERVER_ERROR\"\n  | \"SERVICE_UNAVAILABLE\"\n  | \"GATEWAY_TIMEOUT\"\n  // SDK / agent-domain\n  | \"AGENT_RUN_ERROR\"\n  | \"PROVIDER_KEY_MISSING\"\n  | \"BUDGET_EXCEEDED\"\n  | \"CREDENTIAL_POOL_EXHAUSTED\";\n\n/**\n * Envelope shape — structurally identical to theokit/server `TheoErrorEnvelope`.\n *\n * @public\n */\nexport interface TheokitErrorEnvelope<TExt = unknown> {\n  readonly code: TheokitErrorCode;\n  readonly message: string;\n  readonly cause?: unknown;\n  readonly meta?: Record<string, unknown>;\n  readonly ext?: TExt;\n}\n\n/**\n * Class-name -> envelope code mapping. Indexed by `Error.name` string so\n * subclasses inherit the mapping unless they override their `name` field.\n *\n * `IntegrationNotConnectedError` (subclass of `ConfigurationError`) takes\n * its own row because its `name` is `IntegrationNotConnectedError` and the\n * map is name-exact, not prototype-walked.\n */\nconst NAME_TO_CODE: ReadonlyMap<string, TheokitErrorCode> = new Map<string, TheokitErrorCode>([\n  [\"AuthenticationError\", \"UNAUTHORIZED\"],\n  [\"RateLimitError\", \"RATE_LIMITED\"],\n  [\"ConfigurationError\", \"PROVIDER_KEY_MISSING\"],\n  [\"IntegrationNotConnectedError\", \"PROVIDER_KEY_MISSING\"],\n  [\"NetworkError\", \"SERVICE_UNAVAILABLE\"],\n  [\"AgentRunError\", \"AGENT_RUN_ERROR\"],\n  [\"BudgetExceededError\", \"BUDGET_EXCEEDED\"],\n  [\"CredentialPoolExhaustedError\", \"CREDENTIAL_POOL_EXHAUSTED\"],\n  [\"UnknownAgentError\", \"INTERNAL_SERVER_ERROR\"],\n  [\"MemoryAdapterError\", \"INTERNAL_SERVER_ERROR\"],\n]);\n\n/**\n * Translate any SDK error (or arbitrary thrown value) into the canonical\n * envelope shape at the wire boundary.\n *\n * - `TheokitAgentError` family → mapped by `Error.name` string.\n * - Plain `Error` → INTERNAL_SERVER_ERROR.\n * - Non-Error values → INTERNAL_SERVER_ERROR with synthetic message.\n *\n * Meta carries `sdkErrorName` for telemetry; provider metadata (when present\n * via SDK's `ErrorMetadata`) flows through `meta.provider` / `meta.endpoint`\n * / `meta.statusCode` for diagnostics. `RateLimitError` populates a\n * `RetryableExt`-shaped ext when `metadata.retryAfter` (seconds) is set.\n *\n * @public\n */\nexport function toEnvelope(value: unknown): TheokitErrorEnvelope {\n  if (!(value instanceof Error)) {\n    return {\n      code: \"INTERNAL_SERVER_ERROR\",\n      message: typeof value === \"string\" ? value : \"Unknown error\",\n    };\n  }\n  const name = value.name;\n  const code = NAME_TO_CODE.get(name) ?? \"INTERNAL_SERVER_ERROR\";\n  const meta = buildMeta(name, value);\n  const ext = buildExt(value);\n  return {\n    code,\n    message: value.message,\n    cause: (value as Error & { cause?: unknown }).cause,\n    meta,\n    ext,\n  };\n}\n\nfunction buildMeta(name: string, err: Error): Record<string, unknown> {\n  const meta: Record<string, unknown> = { sdkErrorName: name };\n  if (err instanceof TheokitAgentError && err.metadata !== undefined) {\n    meta.provider = err.metadata.provider;\n    meta.endpoint = err.metadata.endpoint;\n    if (err.metadata.statusCode !== undefined) {\n      meta.statusCode = err.metadata.statusCode;\n    }\n  }\n  return meta;\n}\n\nfunction buildExt(err: Error): unknown {\n  if (err instanceof RateLimitError && err.metadata?.retryAfter !== undefined) {\n    return {\n      retryable: true as const,\n      retryAfterMs: err.metadata.retryAfter * 1000,\n    };\n  }\n  if (err instanceof CredentialPoolExhaustedError && err.nextRetryAt !== undefined) {\n    const delayMs = Math.max(0, err.nextRetryAt - Date.now());\n    return {\n      retryable: true as const,\n      retryAfterMs: delayMs,\n    };\n  }\n  return undefined;\n}\n\n/**\n * Code -> reconstructor mapping. Each entry returns a fresh instance of the\n * SDK class hierarchy from an envelope, preserving message and (where the\n * constructor supports it) cause/ext context.\n *\n * Unmapped codes fall through to `UnknownAgentError` so consumer code that\n * relies on `err instanceof TheokitAgentError` still works.\n */\nconst CODE_TO_RECONSTRUCTOR: ReadonlyMap<\n  TheokitErrorCode,\n  (env: TheokitErrorEnvelope) => TheokitAgentError\n> = new Map<TheokitErrorCode, (env: TheokitErrorEnvelope) => TheokitAgentError>([\n  [\"UNAUTHORIZED\", (env) => new AuthenticationError(env.message)],\n  [\n    \"RATE_LIMITED\",\n    (env) => new RateLimitError(env.message, env.cause !== undefined ? { cause: env.cause } : {}),\n  ],\n  [\"PROVIDER_KEY_MISSING\", (env) => new ConfigurationError(env.message)],\n  [\"SERVICE_UNAVAILABLE\", (env) => new NetworkError(env.message)],\n  [\"GATEWAY_TIMEOUT\", (env) => new NetworkError(env.message)],\n  [\n    \"AGENT_RUN_ERROR\",\n    (env) =>\n      new AgentRunError(env.message, {\n        code: \"unknown\",\n        ...(env.cause !== undefined ? { cause: env.cause } : {}),\n      }),\n  ],\n  [\"INTERNAL_SERVER_ERROR\", (env) => new UnknownAgentError(env.message)],\n  // BUDGET_EXCEEDED + CREDENTIAL_POOL_EXHAUSTED reconstructors require\n  // domain-specific args (budgetName, provider) that the envelope doesn't\n  // always carry. Fall back to UnknownAgentError when those fields are\n  // missing; consumer code that needs the typed class should call the\n  // constructor directly.\n]);\n\n/**\n * Hydrate an envelope back into the SDK class hierarchy. Use at the inbound\n * boundary (e.g., on a worker process receiving an envelope from the main\n * process via IPC, or on a client deserializing a `RunResult.error`).\n *\n * @public\n */\nexport function fromEnvelope(env: TheokitErrorEnvelope): TheokitAgentError {\n  const reconstructor = CODE_TO_RECONSTRUCTOR.get(env.code);\n  if (reconstructor) return reconstructor(env);\n  // Round-trip preservation: if the envelope's meta.sdkErrorName matches a\n  // class without a generic reconstructor (e.g., BudgetExceededError), we\n  // can't rebuild without domain args. Fall back to UnknownAgentError.\n  return new UnknownAgentError(env.message);\n}\n\n// Re-export for ergonomic consumption alongside fromEnvelope.\nexport { MemoryAdapterError };\n"]}

package/dist/session-transcript-LGHSNVY5.cjs

@@ -0,0 +1,62 @@
+'use strict';
+
+var chunkGZV6AVRL_cjs = require('./chunk-GZV6AVRL.cjs');
+require('./chunk-JLRLCBJ4.cjs');
+require('./chunk-6LHQPOMI.cjs');
+
+
+
+Object.defineProperty(exports, "SessionTranscript", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.SessionTranscript; }
+});
+Object.defineProperty(exports, "defaultBaseDir", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.defaultBaseDir; }
+});
+Object.defineProperty(exports, "encodeProjectDir", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.encodeProjectDir; }
+});
+Object.defineProperty(exports, "expandTilde", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.expandTilde; }
+});
+Object.defineProperty(exports, "isSessionUuid", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.isSessionUuid; }
+});
+Object.defineProperty(exports, "legacyTranscriptPath", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.legacyTranscriptPath; }
+});
+Object.defineProperty(exports, "readTranscript", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.readTranscript; }
+});
+Object.defineProperty(exports, "reconstructMessages", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.reconstructMessages; }
+});
+Object.defineProperty(exports, "safeSessionId", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.safeSessionId; }
+});
+Object.defineProperty(exports, "sessionUuidFor", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.sessionUuidFor; }
+});
+Object.defineProperty(exports, "transcriptPath", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.transcriptPath; }
+});
+Object.defineProperty(exports, "transcriptRoot", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.transcriptRoot; }
+});
+Object.defineProperty(exports, "writeTranscript", {
+  enumerable: true,
+  get: function () { return chunkGZV6AVRL_cjs.writeTranscript; }
+});
+//# sourceMappingURL=session-transcript-LGHSNVY5.cjs.map
+//# sourceMappingURL=session-transcript-LGHSNVY5.cjs.map

package/dist/{session-transcript-6WNITKRE.cjs.map → session-transcript-LGHSNVY5.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-6WNITKRE.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-LGHSNVY5.cjs"}

package/dist/session-transcript-VTBTCGQX.js

@@ -0,0 +1,5 @@
+export { SessionTranscript, defaultBaseDir, encodeProjectDir, expandTilde, isSessionUuid, legacyTranscriptPath, readTranscript, reconstructMessages, safeSessionId, sessionUuidFor, transcriptPath, transcriptRoot, writeTranscript } from './chunk-JOFVLOFY.js';
+import './chunk-3JHIFQ4I.js';
+import './chunk-CZJ6Q7CW.js';
+//# sourceMappingURL=session-transcript-VTBTCGQX.js.map
+//# sourceMappingURL=session-transcript-VTBTCGQX.js.map

package/dist/{session-transcript-XAEKW6P7.js.map → session-transcript-VTBTCGQX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-XAEKW6P7.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"session-transcript-VTBTCGQX.js"}

package/dist/skills.cjs

@@ -1,22 +1,21 @@
 'use strict';
 
-var chunkOHLDPWTA_cjs = require('./chunk-OHLDPWTA.cjs');
-require('./chunk-V2BOS4WF.cjs');
-require('./chunk-VKJ7V7EB.cjs');
-require('./chunk-4CLOXP6H.cjs');
-require('./chunk-4ZHTIJNE.cjs');
-require('./chunk-XL7Q7HB2.cjs');
-require('./chunk-EG4QM7ZJ.cjs');
+var chunkUGRS7ZA7_cjs = require('./chunk-UGRS7ZA7.cjs');
+require('./chunk-7A6535RA.cjs');
+require('./chunk-SA6K24NB.cjs');
+require('./chunk-HW7SEELD.cjs');
+require('./chunk-J7J7J2GN.cjs');
+require('./chunk-6LHQPOMI.cjs');
 
 
 
 Object.defineProperty(exports, "buildSkillsBlock", {
   enumerable: true,
-  get: function () { return chunkOHLDPWTA_cjs.buildSkillsBlock; }
+  get: function () { return chunkUGRS7ZA7_cjs.buildSkillsBlock; }
 });
 Object.defineProperty(exports, "discoverSkills", {
   enumerable: true,
-  get: function () { return chunkOHLDPWTA_cjs.discoverSkills; }
+  get: function () { return chunkUGRS7ZA7_cjs.discoverSkills; }
 });
 //# sourceMappingURL=skills.cjs.map
 //# sourceMappingURL=skills.cjs.map

package/dist/skills.js

@@ -1,9 +1,8 @@
-export { buildSkillsBlock, discoverSkills } from './chunk-O73J46PV.js';
-import './chunk-HS7AVXTF.js';
-import './chunk-RIAM53CP.js';
-import './chunk-LXQ6HKPS.js';
-import './chunk-ZZMZWBR6.js';
-import './chunk-D4CUGAKZ.js';
-import './chunk-XEQ3TM66.js';
+export { buildSkillsBlock, discoverSkills } from './chunk-XDANGA2C.js';
+import './chunk-EH6XD3FY.js';
+import './chunk-UKMBRMGT.js';
+import './chunk-JNAA4G4H.js';
+import './chunk-ALUN2B4W.js';
+import './chunk-CZJ6Q7CW.js';
 //# sourceMappingURL=skills.js.map
 //# sourceMappingURL=skills.js.map

package/dist/stream-object-HBFMIZLD.js

@@ -0,0 +1,7 @@
+export { StreamObjectError, streamObjectImpl } from './chunk-5WKQDIGO.js';
+import './chunk-47TF32NQ.js';
+import './chunk-7I5Z3UBJ.js';
+import './chunk-ALUN2B4W.js';
+import './chunk-CZJ6Q7CW.js';
+//# sourceMappingURL=stream-object-HBFMIZLD.js.map
+//# sourceMappingURL=stream-object-HBFMIZLD.js.map

package/dist/{stream-object-UF4QRQRU.js.map → stream-object-HBFMIZLD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-UF4QRQRU.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-HBFMIZLD.js"}

package/dist/stream-object-QSKHISDJ.cjs

@@ -0,0 +1,20 @@
+'use strict';
+
+var chunkTFG5IBZS_cjs = require('./chunk-TFG5IBZS.cjs');
+require('./chunk-7JJ3A6AT.cjs');
+require('./chunk-AA27GEYS.cjs');
+require('./chunk-J7J7J2GN.cjs');
+require('./chunk-6LHQPOMI.cjs');
+
+
+
+Object.defineProperty(exports, "StreamObjectError", {
+  enumerable: true,
+  get: function () { return chunkTFG5IBZS_cjs.StreamObjectError; }
+});
+Object.defineProperty(exports, "streamObjectImpl", {
+  enumerable: true,
+  get: function () { return chunkTFG5IBZS_cjs.streamObjectImpl; }
+});
+//# sourceMappingURL=stream-object-QSKHISDJ.cjs.map
+//# sourceMappingURL=stream-object-QSKHISDJ.cjs.map

package/dist/{stream-object-ZJTQNKY3.cjs.map → stream-object-QSKHISDJ.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-ZJTQNKY3.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"stream-object-QSKHISDJ.cjs"}