@theokit/sdk 4.63.4 → 5.0.0-next.2

package/dist/internal/runtime/{plugins → plugin-loader}/plugin-bundles.d.ts

@@ -6,6 +6,7 @@
  *
  * @internal
  */
+import type { CompatSourceDeclaration } from "../compat/foreign-config-sources.js";
 /**
  * Every plugin folder under the project's plugin roots.
  *
@@ -16,4 +17,6 @@
  * A missing root is not an error: most projects carry no plugins, and treating their absence as a
  * failure would make "none installed" indistinguishable from "the directory could not be read".
  */
-export declare function pluginBundleDirs(cwd: string): Promise<string[]>;
+export declare function pluginBundleDirs(cwd: string, 
+/** Declared foreign dialects (#524). Empty reads `.theokit/plugins` only. */
+compatSources?: readonly CompatSourceDeclaration[]): Promise<string[]>;

package/dist/internal/runtime/processors/wrap-output-run.d.ts

@@ -9,7 +9,7 @@
  * @internal
  */
 import type { Run } from "../../../types/run.js";
-import { type RunEventSink } from "../../../types/run-events.js";
+import type { RunEventSink } from "../../../types/run-events.js";
 export declare function wrapRunWithOutputProcessors(args: {
     run: Run;
     processors: readonly Processor[];

package/dist/internal/runtime/registry/live-agent-registry.d.ts

@@ -120,5 +120,13 @@ export declare class LiveAgentRegistry {
     /** Ids of cached agents, newest first (by lastUsedAt). */
     ids(): readonly string[];
 }
-/** Process-wide singleton (ADR D310). */
+/**
+ * Process-wide singleton (ADR D310).
+ *
+ * Through `globalSingleton`, not a bare module-level `const`. A module-level const is a singleton per
+ * MODULE INSTANCE, and a package can be loaded more than once in a process — two copies in
+ * `node_modules`, ESM and CJS side by side, a monorepo with distinct versions. This is the PUBLIC one
+ * of the package's module-level singleton states, so two copies of it mean two views of which agents
+ * are live, and a caller reading the wrong one sees none.
+ */
 export declare const liveAgentRegistry: LiveAgentRegistry;

package/dist/internal/runtime/system-prompt/local-assembly.d.ts

@@ -1 +1,2 @@
-export {};
+import type { SystemPromptAssemblyContext } from "./types.js";
+export declare function buildAssemblyContext({ inputs, userText, baseSystemPrompt, memoryFacts, activeMemorySummary, contextPaths, }: AssemblyRequest): Promise<SystemPromptAssemblyContext>;

package/dist/internal/scorers/llm-judge.d.ts

@@ -23,6 +23,18 @@ export interface LlmJudgeOptions {
     readonly rubric?: "continuous" | "discrete";
     readonly providers?: ProviderRoutingSettings;
 }
+/**
+ * The parser, exposed for tests. NOT re-exported from any barrel — `_...ForTests` is this repo's
+ * convention for a seam that exists so a test can call production code instead of copying it
+ * (`_redactAttrValueForTests`, `__resetSnapshotStoresForTests`).
+ *
+ * It exists because the alternative was measured and was worse: the judge's only test file declared
+ * its own copy of `SCORE_REGEX` under the comment "Mirror the one in llm-judge.ts", and six of its
+ * eight cases exercised the copy. Byte-identical today, which is exactly why the drift would have
+ * been invisible — changing the production regex broke nothing there. Testing a mirror tests the
+ * mirror.
+ */
+export declare function _parseScoreForTests(text: string, rubric: "continuous" | "discrete"): Score;
 export declare function llmJudgeScore(options: LlmJudgeOptions & {
     output: string;
     expected?: unknown;

package/dist/internal/security/index.cjs

@@ -1,53 +1,52 @@
 'use strict';
 
 require('../../chunk-MUUQ2WFJ.cjs');
-var chunkV2BOS4WF_cjs = require('../../chunk-V2BOS4WF.cjs');
-require('../../chunk-VKJ7V7EB.cjs');
-require('../../chunk-4ZHTIJNE.cjs');
-var chunkXL7Q7HB2_cjs = require('../../chunk-XL7Q7HB2.cjs');
-require('../../chunk-EG4QM7ZJ.cjs');
+var chunk7A6535RA_cjs = require('../../chunk-7A6535RA.cjs');
+require('../../chunk-SA6K24NB.cjs');
+require('../../chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('../../chunk-6LHQPOMI.cjs');
 
 
 
 Object.defineProperty(exports, "ForbiddenPathError", {
   enumerable: true,
-  get: function () { return chunkV2BOS4WF_cjs.ForbiddenPathError; }
+  get: function () { return chunk7A6535RA_cjs.ForbiddenPathError; }
 });
 Object.defineProperty(exports, "PathTraversalError", {
   enumerable: true,
-  get: function () { return chunkV2BOS4WF_cjs.PathTraversalError; }
+  get: function () { return chunk7A6535RA_cjs.PathTraversalError; }
 });
 Object.defineProperty(exports, "assertNoSymlinkEscape", {
   enumerable: true,
-  get: function () { return chunkV2BOS4WF_cjs.assertNoSymlinkEscape; }
+  get: function () { return chunk7A6535RA_cjs.assertNoSymlinkEscape; }
 });
 Object.defineProperty(exports, "isForbiddenPath", {
   enumerable: true,
-  get: function () { return chunkV2BOS4WF_cjs.isForbiddenPath; }
+  get: function () { return chunk7A6535RA_cjs.isForbiddenPath; }
 });
 Object.defineProperty(exports, "safePathJoin", {
   enumerable: true,
-  get: function () { return chunkV2BOS4WF_cjs.safePathJoin; }
+  get: function () { return chunk7A6535RA_cjs.safePathJoin; }
 });
 Object.defineProperty(exports, "sanitizeIdentifier", {
   enumerable: true,
-  get: function () { return chunkV2BOS4WF_cjs.sanitizeIdentifier; }
+  get: function () { return chunk7A6535RA_cjs.sanitizeIdentifier; }
 });
 Object.defineProperty(exports, "validateArtifactPath", {
   enumerable: true,
-  get: function () { return chunkV2BOS4WF_cjs.validateArtifactPath; }
+  get: function () { return chunk7A6535RA_cjs.validateArtifactPath; }
 });
 Object.defineProperty(exports, "addPattern", {
   enumerable: true,
-  get: function () { return chunkXL7Q7HB2_cjs.addPattern; }
+  get: function () { return chunk6LHQPOMI_cjs.addPattern; }
 });
 Object.defineProperty(exports, "maskToken", {
   enumerable: true,
-  get: function () { return chunkXL7Q7HB2_cjs.maskToken; }
+  get: function () { return chunk6LHQPOMI_cjs.maskToken; }
 });
 Object.defineProperty(exports, "redactSecrets", {
   enumerable: true,
-  get: function () { return chunkXL7Q7HB2_cjs.redactSecrets; }
+  get: function () { return chunk6LHQPOMI_cjs.redactSecrets; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/internal/security/index.d.cts

@@ -3,9 +3,14 @@
  *
  * Consumers across the SDK output boundaries import from here:
  * `internal/error-mappers/shared.ts`, `internal/telemetry/tracer.ts`,
- * `internal/runtime/agent-session-store.ts`,
+ * `internal/runtime/fixtures/fixture-responder.ts`,
  * `internal/memory/migrate-sqlite-to-lance.ts`.
  *
+ * Every arrow runs DOWNWARD into this folder, which is the direction the tree is meant to have and
+ * did not always: `path-guard.ts` used to reach UP into `internal/runtime/context/` for the
+ * containment primitive. That primitive lives here now, so `security/` imports node builtins and
+ * `../../errors.js` and nothing else.
+ *
  * Semver-exempt: the `@theokit/sdk/internal/security` sub-path exists for packages extracted out of
  * this one and is NOT covered by the package's semver contract. It IS declared in `package.json`
  * `exports`, so every name below must survive into the published declarations.

package/dist/internal/security/index.d.ts

@@ -3,9 +3,14 @@
  *
  * Consumers across the SDK output boundaries import from here:
  * `internal/error-mappers/shared.ts`, `internal/telemetry/tracer.ts`,
- * `internal/runtime/agent-session-store.ts`,
+ * `internal/runtime/fixtures/fixture-responder.ts`,
  * `internal/memory/migrate-sqlite-to-lance.ts`.
  *
+ * Every arrow runs DOWNWARD into this folder, which is the direction the tree is meant to have and
+ * did not always: `path-guard.ts` used to reach UP into `internal/runtime/context/` for the
+ * containment primitive. That primitive lives here now, so `security/` imports node builtins and
+ * `../../errors.js` and nothing else.
+ *
  * Semver-exempt: the `@theokit/sdk/internal/security` sub-path exists for packages extracted out of
  * this one and is NOT covered by the package's semver contract. It IS declared in `package.json`
  * `exports`, so every name below must survive into the published declarations.

package/dist/internal/security/index.js

@@ -1,8 +1,7 @@
 import '../../chunk-FD2UT76F.js';
-export { ForbiddenPathError, PathTraversalError, assertNoSymlinkEscape, isForbiddenPath, safePathJoin, sanitizeIdentifier, validateArtifactPath } from '../../chunk-HS7AVXTF.js';
-import '../../chunk-RIAM53CP.js';
-import '../../chunk-ZZMZWBR6.js';
-export { addPattern, maskToken, redactSecrets } from '../../chunk-D4CUGAKZ.js';
-import '../../chunk-XEQ3TM66.js';
+export { ForbiddenPathError, PathTraversalError, assertNoSymlinkEscape, isForbiddenPath, safePathJoin, sanitizeIdentifier, validateArtifactPath } from '../../chunk-EH6XD3FY.js';
+import '../../chunk-UKMBRMGT.js';
+import '../../chunk-ALUN2B4W.js';
+export { addPattern, maskToken, redactSecrets } from '../../chunk-CZJ6Q7CW.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/internal/security/path-containment.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The one rule for "is this resolved path inside that root".
+ *
+ * Extracted because the package held it twice, at different strengths, for the same question. The
+ * correct version lived as a private function in `context-import-resolver.ts`, written for the
+ * 4.41.1 patch; the context manager had its own `absolute.startsWith(resolvePath(cwd))`, which
+ * admits two escapes:
+ *
+ *   - **No separator boundary.** With `root = /home/user/proj`, the path `/home/user/proj-evil/x`
+ *     starts with the root string and is NOT inside it. A sibling directory whose name merely
+ *     extends the project's is enough; no `..` past the parent is needed.
+ *   - **Lexical, not real.** A symlink whose name sits inside the root and whose target does not
+ *     passes any comparison made before symlink resolution.
+ *
+ * The obvious escapes (`../../etc/passwd`, an absolute path) ARE refused by a prefix test, which is
+ * why the weaker version survived review: it looks like it works on the inputs a reader tries.
+ *
+ * Both readers of repository-supplied paths now share this module. That is DRY about the RULE
+ * rather than about line count — one piece of knowledge, one representation, so the two cannot
+ * drift apart again.
+ *
+ * @internal
+ */
+export {};

package/dist/internal/session/agent-session-store.d.ts

@@ -13,7 +13,7 @@
  */
 import type { ConversationTurn } from "../../types/conversation.js";
 import type { SessionStore } from "../../types/session-store.js";
-import type { SessionMessage } from "./session-types.js";
+import type { SessionMessage } from "./types.js";
 /** The turn to persist: the user's text plus the rich per-turn conversation view. */
 export interface PersistTurnInput {
     userText: string;

package/dist/internal/session/agent-session.d.ts

@@ -1,4 +1,4 @@
-import type { SessionMessage } from "./session-types.js";
+import type { SessionMessage } from "./types.js";
 export { hydratedKeys, invalidateSessionCache, sessions, transcriptKey, } from "./session-cache.js";
 /**
  * Ceiling on sessions kept in memory.

package/dist/internal/session/index.d.ts

@@ -4,4 +4,4 @@
  */
 export * from "./agent-session.js";
 export * from "./agent-session-store.js";
-export * from "./session-types.js";
+export * from "./types.js";

package/dist/internal/session/session-cache.d.ts

@@ -1,4 +1,4 @@
-import type { SessionMessage } from "./session-types.js";
+import type { SessionMessage } from "./types.js";
 /**
  * The in-memory session cache — in a LEAF module, on purpose.
  *
@@ -10,8 +10,14 @@ import type { SessionMessage } from "./session-types.js";
  *
  * This state's natural owner was never `agent-session.ts`: they are two process-wide maps that both
  * modules read. Extracting them into a leaf removes the cycle under ANY detector, with no tool
- * policy and without changing a line of behavior — the same `Map`/`Set` instances remain
- * the only ones in the process, because an ES module is a singleton.
+ * policy and without changing a line of behavior.
+ *
+ * THE CLAIM THAT USED TO CLOSE THIS PARAGRAPH WAS FALSE. It said the same `Map`/`Set` instances
+ * remain the only ones in the process "because an ES module is a singleton". A module is a singleton
+ * per MODULE INSTANCE, and `internal/global-singleton.ts` exists in this repository, in writing, to
+ * refute exactly that: a package loaded twice — two copies in `node_modules`, ESM and CJS side by
+ * side, a monorepo with distinct versions — evaluates the module twice and produces two Maps that
+ * cannot see each other. Both now go through the helper, which keys on the global symbol registry.
  */
 export declare const sessions: Map<string, SessionMessage[]>;
 export declare const hydratedKeys: Set<string>;

package/dist/internal/task/registry.d.ts

@@ -21,7 +21,7 @@
  *
  * @internal
  */
-import { type TaskCancelResult, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskStoreOptions } from "../../types/task.js";
+import type { TaskCancelResult, TaskEvent, TaskFilter, TaskHandle, TaskKind, TaskStoreOptions } from "../../types/task.js";
 export interface TaskRegistryOptions {
     readonly store?: TaskStoreOptions;
     readonly maxConcurrent?: number;

package/dist/internal/task/store.d.ts

@@ -21,7 +21,7 @@
  *
  * @internal
  */
-import { type TaskFilter, type TaskHandle, type TaskStoreOptions } from "../../types/task.js";
+import type { TaskFilter, TaskHandle, TaskStoreOptions } from "../../types/task.js";
 /** Storage interface used by `TaskRegistry`. */
 export interface TaskStore {
     insert(handle: TaskHandle): Promise<void>;

package/dist/internal/task/subscribe.d.ts

@@ -5,7 +5,7 @@
  *
  * @internal
  */
-import { type TaskEvent } from "../../types/task.js";
+import type { TaskEvent } from "../../types/task.js";
 import type { RingBuffer } from "./ring-buffer.js";
 export interface SubscribeDeps {
     getBuffer(id: string): RingBuffer<TaskEvent> | undefined;

package/dist/internal/task/task-id.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Task-id grammar (D368) — runtime, deliberately NOT in `types/`.
+ *
+ * It lived in `types/task.ts`, which `types/index.ts` re-exports with `export type *`. That star
+ * cannot carry a value, so the only reason `isValidTaskId` ever reached a consumer is that the DTS
+ * rollup hoists the declaration while the runtime bundle emits nothing — exactly the shape of #279,
+ * where the import typechecked and was `undefined` at the call site. `src/index.ts` re-exports both
+ * names from here, so the public API is unchanged.
+ *
+ * @internal
+ */
+/**
+ * Validates a task ID against the public grammar + reserved prefixes.
+ * Throws `InvalidTaskIdError` from `../errors.js` on rejection.
+ *
+ * Adapter callers (workflow/batch/cron) MUST set `allowReserved: true`
+ * to register their own IDs; user-facing surfaces (`Task.submit`,
+ * `agent.send({ task: { id } })`) leave it false.
+ */
+export declare function isValidTaskId(id: string, allowReserved: boolean): boolean;
+/** Re-exported for adapter implementations + tests. */
+export declare const TASK_RESERVED_PREFIXES: readonly string[];

package/dist/internal/telemetry/adapter-registry.d.ts

@@ -1,2 +1,12 @@
-import type { TelemetryAdapter } from "./safe-require.js";
-export type { TelemetryAdapter };
+/**
+ * Auto-instrumentation adapter registry (ADR D42).
+ *
+ * Each adapter feature-detects a vendor lib (`@langfuse/node`, `@sentry/node`,
+ * `posthog-node`) via `createRequire` and wires it into the active OTel
+ * tracer provider. Errors in any adapter are caught — they never propagate
+ * to `agent.send`.
+ *
+ * @internal
+ */
+import type { TelemetryAdapter, TelemetryWiring } from "./safe-require.js";
+export type { TelemetryAdapter, TelemetryWiring };

package/dist/internal/telemetry/adapters/braintrust.d.ts

@@ -1,2 +1,7 @@
-import { type TelemetryAdapter } from "../safe-require.js";
+/**
+ * Braintrust adapter (T10.2, ADR D449). Detects `braintrust` and
+ * configures its eval tracing.
+ *
+ * @internal
+ */
 export declare const braintrustAdapter: TelemetryAdapter;

package/dist/internal/telemetry/adapters/langsmith.d.ts

@@ -1,2 +1,7 @@
-import { type TelemetryAdapter } from "../safe-require.js";
+/**
+ * LangSmith adapter (T10.2, ADR D449). Detects `langsmith` and
+ * configures its tracing client for span export.
+ *
+ * @internal
+ */
 export declare const langsmithAdapter: TelemetryAdapter;

package/dist/internal/workflow/executor.d.ts

@@ -7,9 +7,10 @@
  *
  * @internal
  */
+import type { StepExecution } from "./step-execution.js";
 export declare function executeWorkflow<TInput, TOutput>(options: WorkflowOptions, steps: ReadonlyArray<Step>, input: TInput, runOpts?: WorkflowRunOptions): Promise<WorkflowRun<TOutput>>;
 /**
  * Dispatch single step to the right handler. Exhaustive over `step.kind`.
  */
-export declare function dispatchStep(step: Step, input: unknown, ctx: StepContext, options: WorkflowOptions, prevStepResults: ReadonlyArray<StepResult>): Promise<StepResult>;
+export declare function dispatchStep(step: Step, input: unknown, exec: StepExecution): Promise<StepResult>;
 export declare function resumeWorkflow<TO>(opts: WorkflowResumeOptions): Promise<WorkflowRun<TO>>;

package/dist/internal/workflow/snapshot-store.d.ts

@@ -7,7 +7,7 @@
  *
  * @internal
  */
-import { type WorkflowOptions, type WorkflowSnapshot } from "../../types/workflow.js";
+import type { WorkflowOptions, WorkflowSnapshot } from "../../types/workflow.js";
 export interface WorkflowSnapshotStore {
     save(snapshot: WorkflowSnapshot): Promise<void>;
     load(runId: string): Promise<WorkflowSnapshot | undefined>;

package/dist/internal/workflow/step-branch.d.ts

@@ -6,5 +6,5 @@
  *
  * @internal
  */
-import type { DispatchFn } from "./step-parallel.js";
-export declare function runBranchStep(step: BranchStep, input: unknown, ctx: StepContext, options: WorkflowOptions, prevStepResults: ReadonlyArray<StepResult>, dispatch: DispatchFn): Promise<StepResult>;
+import type { StepExecution } from "./step-execution.js";
+export declare function runBranchStep(step: BranchStep, input: unknown, exec: StepExecution): Promise<StepResult>;

package/dist/internal/workflow/step-dowhile.d.ts

@@ -4,5 +4,5 @@
  *
  * @internal
  */
-import type { DispatchFn } from "./step-parallel.js";
-export declare function runDowhileStep(step: DowhileStep, input: unknown, ctx: StepContext, options: WorkflowOptions, prevStepResults: ReadonlyArray<StepResult>, dispatch: DispatchFn): Promise<StepResult>;
+import type { StepExecution } from "./step-execution.js";
+export declare function runDowhileStep(step: DowhileStep, input: unknown, exec: StepExecution): Promise<StepResult>;

package/dist/internal/workflow/step-execution.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The state every composite step runner threads to the next one.
+ *
+ * Nine runners in this directory declared the SAME list as positional parameters —
+ * `(step, input, ctx, options, prevStepResults, dispatch)` — six or seven wide against the
+ * consensus ceiling of four (Clean Code ch. 3). That is not nine style nits: it is one context
+ * object that was never named, re-declared once per step kind, so adding a field to the execution
+ * state means touching every arm and any two adjacent slots of compatible type transpose silently.
+ *
+ * `prevStepResults` is part of it and still varies per call — a nested sequence dispatches its inner
+ * steps with an EMPTY list, because "previous steps" means the enclosing sequence's, not the outer
+ * workflow's. That override is now written as `{ ...exec, prevStepResults: [] }`, which says what it
+ * does, where before it was a bare `[]` in the fifth position.
+ *
+ * @internal
+ */
+export interface StepExecution {
+    readonly ctx: StepContext;
+    readonly options: WorkflowOptions;
+    /** Results of the steps already finished in THIS sequence — `[]` inside a nested one. */
+    readonly prevStepResults: ReadonlyArray<StepResult>;
+    readonly dispatch: DispatchFn;
+}
+/** Runs one step of any kind. Recursive: composite steps dispatch their children through it. */
+export type DispatchFn = (step: Step, input: unknown, exec: StepExecution) => Promise<StepResult>;

package/dist/internal/workflow/step-foreach.d.ts

@@ -7,5 +7,5 @@
  *
  * @internal
  */
-import type { DispatchFn } from "./step-parallel.js";
-export declare function runForeachStep(step: ForeachStep, _input: unknown, ctx: StepContext, options: WorkflowOptions, prevStepResults: ReadonlyArray<StepResult>, dispatch: DispatchFn): Promise<StepResult>;
+import type { StepExecution } from "./step-execution.js";
+export declare function runForeachStep(step: ForeachStep, _input: unknown, exec: StepExecution): Promise<StepResult>;

package/dist/internal/workflow/step-parallel.d.ts

@@ -13,5 +13,5 @@
  *
  * @internal
  */
-export type DispatchFn = (step: Step, input: unknown, ctx: StepContext, options: WorkflowOptions, prevStepResults: ReadonlyArray<StepResult>) => Promise<StepResult>;
-export declare function runParallelStep(step: ParallelStep, input: unknown, ctx: StepContext, options: WorkflowOptions, _prevStepResults: ReadonlyArray<StepResult>, dispatch: DispatchFn): Promise<StepResult>;
+import type { StepExecution } from "./step-execution.js";
+export declare function runParallelStep(step: ParallelStep, input: unknown, exec: StepExecution): Promise<StepResult>;

package/dist/judge-call-6MVARKU2.js

@@ -0,0 +1,5 @@
+export { JudgeCredentialError, composeJudgePrompt, judgeCallImpl } from './chunk-UFPUHJWS.js';
+import './chunk-ALUN2B4W.js';
+import './chunk-CZJ6Q7CW.js';
+//# sourceMappingURL=judge-call-6MVARKU2.js.map
+//# sourceMappingURL=judge-call-6MVARKU2.js.map

package/dist/{judge-call-LVXABPS3.js.map → judge-call-6MVARKU2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-LVXABPS3.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-6MVARKU2.js"}

package/dist/judge-call-I3P4D5QR.cjs

@@ -0,0 +1,22 @@
+'use strict';
+
+var chunkDRL7URI4_cjs = require('./chunk-DRL7URI4.cjs');
+require('./chunk-J7J7J2GN.cjs');
+require('./chunk-6LHQPOMI.cjs');
+
+
+
+Object.defineProperty(exports, "JudgeCredentialError", {
+  enumerable: true,
+  get: function () { return chunkDRL7URI4_cjs.JudgeCredentialError; }
+});
+Object.defineProperty(exports, "composeJudgePrompt", {
+  enumerable: true,
+  get: function () { return chunkDRL7URI4_cjs.composeJudgePrompt; }
+});
+Object.defineProperty(exports, "judgeCallImpl", {
+  enumerable: true,
+  get: function () { return chunkDRL7URI4_cjs.judgeCallImpl; }
+});
+//# sourceMappingURL=judge-call-I3P4D5QR.cjs.map
+//# sourceMappingURL=judge-call-I3P4D5QR.cjs.map

package/dist/{judge-call-LAHMBJ57.cjs.map → judge-call-I3P4D5QR.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-LAHMBJ57.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-I3P4D5QR.cjs"}

package/dist/mcp-auth.cjs

@@ -1,10 +1,9 @@
 'use strict';
 
-var chunkUALX2J2Q_cjs = require('./chunk-UALX2J2Q.cjs');
-var chunkXJCXEKMD_cjs = require('./chunk-XJCXEKMD.cjs');
-var chunk4ZHTIJNE_cjs = require('./chunk-4ZHTIJNE.cjs');
-require('./chunk-XL7Q7HB2.cjs');
-var chunkEG4QM7ZJ_cjs = require('./chunk-EG4QM7ZJ.cjs');
+var chunkJLRLCBJ4_cjs = require('./chunk-JLRLCBJ4.cjs');
+var chunkEXTRW7GW_cjs = require('./chunk-EXTRW7GW.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
 var crypto = require('crypto');
 var http = require('http');
 var promises = require('readline/promises');
@@ -44,7 +43,7 @@ function tryRequireKeytar() {
     cachedKeytar = r("keytar");
   } catch {
     if (!keytarWarned) {
-      chunkEG4QM7ZJ_cjs.diag(
+      chunk6LHQPOMI_cjs.diag(
         `[theokit-sdk] keytar not installed; MCP OAuth tokens will be stored in ${storeFilePath()} (chmod 600 where POSIX). Install \`keytar\` for OS keychain storage.
 `
       );
@@ -74,7 +73,7 @@ async function setTokens(serverName, tokens) {
     }
   }
   allTokens[serverName] = tokens;
-  await chunkUALX2J2Q_cjs.atomicWriteJson(filePath, allTokens);
+  await chunkJLRLCBJ4_cjs.atomicWriteJson(filePath, allTokens);
   try {
     fs.chmodSync(filePath, 384);
   } catch {
@@ -93,7 +92,7 @@ async function getTokens(serverName) {
   }
   const filePath = storeFilePath();
   if (!fs.existsSync(filePath)) return void 0;
-  chunkXJCXEKMD_cjs.assertSecureModes(path.dirname(filePath), filePath);
+  chunkEXTRW7GW_cjs.assertSecureModes(path.dirname(filePath), filePath);
   try {
     const all = JSON.parse(fs.readFileSync(filePath, "utf8"));
     return all[serverName];
@@ -134,7 +133,7 @@ async function refreshAccessToken(serverName, clientId, refreshToken, oauth) {
     body: body.toString()
   });
   if (!response.ok) {
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(`OAuth refresh failed: HTTP ${response.status}`, {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(`OAuth refresh failed: HTTP ${response.status}`, {
       code: "oauth_refresh_failed"
     });
   }
@@ -180,7 +179,7 @@ async function runPkceFlow(serverName, clientId, scopes, oauth) {
     authUrl.searchParams.set("code_challenge", challenge);
     authUrl.searchParams.set("code_challenge_method", "S256");
     authUrl.searchParams.set("state", state);
-    chunkEG4QM7ZJ_cjs.diag(
+    chunk6LHQPOMI_cjs.diag(
       `
 [theokit-sdk] OAuth required for MCP server "${serverName}".
 Open this URL to authenticate:
@@ -190,7 +189,7 @@ Open this URL to authenticate:
     );
     const { code, state: returnedState } = await codeWaiter;
     if (returnedState !== state) {
-      throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
         "OAuth state mismatch \u2014 possible CSRF attempt; aborting token exchange.",
         { code: "oauth_state_mismatch" }
       );
@@ -209,7 +208,7 @@ Open this URL to authenticate:
     });
     if (!response.ok) {
       const errText = await response.text();
-      throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+      throw new chunkJ7J7J2GN_cjs.ConfigurationError(
         `OAuth token exchange failed: HTTP ${response.status}: ${errText.slice(0, 200)}`,
         { code: "oauth_token_exchange_failed" }
       );
@@ -255,7 +254,7 @@ async function openLocalhostCallback(expectedState, timeoutMs) {
   });
   server.listen(0, "127.0.0.1");
   const timeoutHandle = setTimeout(() => {
-    rejectCode?.(new chunk4ZHTIJNE_cjs.ConfigurationError("OAuth flow timed out", { code: "oauth_timeout" }));
+    rejectCode?.(new chunkJ7J7J2GN_cjs.ConfigurationError("OAuth flow timed out", { code: "oauth_timeout" }));
   }, timeoutMs);
   await new Promise((r) => {
     if (server.listening) r();
@@ -264,7 +263,7 @@ async function openLocalhostCallback(expectedState, timeoutMs) {
   const address = server.address();
   if (typeof address !== "object" || address === null) {
     server.close();
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError("OAuth localhost callback failed to bind", {
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError("OAuth localhost callback failed to bind", {
       code: "oauth_bind_failed"
     });
   }
@@ -300,7 +299,7 @@ async function readCodeFromStdin(expectedState, timeoutMs) {
     }).catch(reject);
     setTimeout(() => {
       rl.close();
-      reject(new chunk4ZHTIJNE_cjs.ConfigurationError("OAuth manual input timed out", { code: "oauth_timeout" }));
+      reject(new chunkJ7J7J2GN_cjs.ConfigurationError("OAuth manual input timed out", { code: "oauth_timeout" }));
     }, timeoutMs);
   });
   return promise;