@theokit/sdk 5.13.0 → 5.15.0

package/dist/chunk-PPU2D4FZ.js

@@ -0,0 +1,19 @@
+// src/internal/persistence/cwd-mutex.ts
+var tails = /* @__PURE__ */ new Map();
+function withCwdMutex(key, fn) {
+  const prev = tails.get(key) ?? Promise.resolve();
+  const next = prev.then(fn, fn);
+  const tail = next.then(
+    () => void 0,
+    () => void 0
+  );
+  tails.set(key, tail);
+  void tail.then(() => {
+    if (tails.get(key) === tail) tails.delete(key);
+  });
+  return next;
+}
+
+export { withCwdMutex };
+//# sourceMappingURL=chunk-PPU2D4FZ.js.map
+//# sourceMappingURL=chunk-PPU2D4FZ.js.map

package/dist/chunk-PPU2D4FZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/persistence/cwd-mutex.ts"],"names":[],"mappings":";AAGA,IAAM,KAAA,uBAAY,GAAA,EAA8B;AAoCzC,SAAS,YAAA,CAAgB,KAAa,EAAA,EAAkC;AAC7E,EAAA,MAAM,OAAO,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA,IAAK,QAAQ,OAAA,EAAQ;AAC/C,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,EAAA,EAAI,EAAE,CAAA;AAI7B,EAAA,MAAM,OAAyB,IAAA,CAAK,IAAA;AAAA,IAClC,MAAM,MAAA;AAAA,IACN,MAAM;AAAA,GACR;AACA,EAAA,KAAA,CAAM,GAAA,CAAI,KAAK,IAAI,CAAA;AACnB,EAAA,KAAK,IAAA,CAAK,KAAK,MAAM;AACnB,IAAA,IAAI,MAAM,GAAA,CAAI,GAAG,MAAM,IAAA,EAAM,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,EAC/C,CAAC,CAAA;AACD,EAAA,OAAO,IAAA;AACT","file":"chunk-PPU2D4FZ.js","sourcesContent":["// Tail of the queue per key. Module-scoped on purpose — see `withCwdMutex` below, which is where\n// the contract is documented. An entry is removed once its key has no call pending, so the Map\n// holds only keys with work in flight, however many distinct keys were ever used.\nconst tails = new Map<string, Promise<unknown>>();\n\n/**\n * Run `fn` after every earlier `withCwdMutex` call for the same `key` has settled, and return\n * what `fn` returns.\n *\n * Calls with the same key run strictly in the order they were made — FIFO, never concurrent.\n * Calls with different keys never wait on each other. The key is an opaque string: two callers\n * serialize against each other exactly when they pass equal keys, so a shared key IS the\n * contract, and a mismatched one silently buys no protection at all.\n *\n * A rejection does not poison the queue. The next waiter runs whether the previous `fn` fulfilled\n * or rejected, and the rejection is delivered only to the caller whose `fn` threw. This function\n * neither retries nor swallows: the returned promise rejects with whatever `fn` rejected with.\n *\n * There is no timeout and no cancellation. An `fn` that never settles blocks that key for the\n * lifetime of the process.\n *\n * **Scope — this is an in-process lock only.** State is a module-scoped Map, so it serializes\n * callers that share one module instance and nothing else. Two processes, two worker threads, or\n * two copies of the SDK resolved into the same tree do not see each other's queue. When the\n * resource is a file that other processes can also write, use `withFileLock` from\n * `./file-lock.ts` instead — it takes an OS-level lock and layers this mutex underneath, so it\n * gives both guarantees. Reach for `withCwdMutex` directly when the shared state is in memory, or\n * when the file is one only this process touches.\n *\n * Extracted packages (`@theokit/sdk-budget`, `@theokit/sdk-memory`) import this from\n * `@theokit/sdk` rather than reimplementing it, precisely so the Map is the same one: a per-package\n * copy would give each package its own queue and let their writes race.\n *\n * The Map is module-scoped, so nothing survives a process restart or a fresh module instance.\n * An entry is dropped as soon as its key has no call pending.\n * Signature and semantics will not change before sdk-core v3.0.\n *\n * @public\n */\nexport function withCwdMutex<T>(key: string, fn: () => Promise<T>): Promise<T> {\n  const prev = tails.get(key) ?? Promise.resolve();\n  const next = prev.then(fn, fn); // run fn whether prev fulfilled or rejected\n  // Save the new tail. It swallows the result so a failure here doesn't poison subsequent\n  // waiters, and it removes the key once it is still the newest tail (no call is queued behind\n  // it), so the Map holds entries only for keys with a call pending.\n  const tail: Promise<unknown> = next.then(\n    () => undefined,\n    () => undefined,\n  );\n  tails.set(key, tail);\n  void tail.then(() => {\n    if (tails.get(key) === tail) tails.delete(key);\n  });\n  return next;\n}\n\n/** Number of keys with a call pending. Test-only observation of the queue map. */\nexport function pendingCwdMutexKeyCount(): number {\n  return tails.size;\n}\n"]}

package/dist/{chunk-MS3TQSXU.js → chunk-QD6B6W6I.js}

@@ -28,7 +28,8 @@ var oauthFileSchema = z.object({
   access: z.string().min(1),
   refresh: z.string().min(1),
   expires: z.number(),
-  account_id: z.string().optional()
+  account_id: z.string().optional(),
+  id_token: z.string().min(1).optional()
 }).strict();
 var fileSchema = z.union([oauthFileSchema, apiFileSchema]);
 function assertSecureModes(dirPath, path) {
@@ -106,7 +107,8 @@ function buildStorePayload(cred) {
       access: cred.access,
       refresh: cred.refresh,
       expires: cred.expires,
-      ...cred.account_id !== void 0 ? { account_id: cred.account_id } : {}
+      ...cred.account_id !== void 0 ? { account_id: cred.account_id } : {},
+      ...cred.id_token !== void 0 ? { id_token: cred.id_token } : {}
     };
   }
   if (typeof cred.apiKey !== "string" || cred.apiKey.length === 0) {
@@ -143,5 +145,5 @@ function writeCredential(cred, config, env = {}) {
 }
 
 export { CredentialError, assertSecureModes, authFilePath, credentialHome, readAuthFile, readStoredOAuth, writeCredential };
-//# sourceMappingURL=chunk-MS3TQSXU.js.map
-//# sourceMappingURL=chunk-MS3TQSXU.js.map
+//# sourceMappingURL=chunk-QD6B6W6I.js.map
+//# sourceMappingURL=chunk-QD6B6W6I.js.map

package/dist/chunk-QD6B6W6I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/auth/credential-store.ts"],"names":[],"mappings":";;;;;;AA0CO,SAAS,cAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,MAAM,QAAA,GAAW,OAAO,UAAA,KAAe,MAAA,GAAY,IAAI,MAAA,CAAO,UAAU,CAAA,EAAG,IAAA,EAAK,GAAI,MAAA;AACpF,EAAA,OAAO,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,GAC/C,WACA,IAAA,CAAK,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,OAAO,CAAA;AACtC;AAGO,SAAS,YAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,OAAO,KAAK,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA,EAAG,OAAO,QAAQ,CAAA;AAC1D;AAmBO,IAAM,eAAA,GAAN,cAA8B,mBAAA,CAAoB;AAAA;AAAA;AAAA;AAAA,EAIrC,IAAA,GAAe,iBAAA;AACnC;AAOA,IAAM,aAAA,GAAgB,EACnB,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,KAAK,EAAE,QAAA,EAAS;AAAA,EAChC,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,OAAA,EAAS,EAAE,MAAA;AACb,CAAC,EACA,MAAA,EAAO;AAEV,IAAM,eAAA,GAAkB,EACrB,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,EACvB,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACxB,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,OAAA,EAAS,EAAE,MAAA,EAAO;AAAA,EAClB,UAAA,EAAY,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA;AAC9B,CAAC,EACA,MAAA,EAAO;AAGV,IAAM,aAAa,CAAA,CAAE,KAAA,CAAM,CAAC,eAAA,EAAiB,aAAa,CAAC,CAAA;AAQpD,SAAS,iBAAA,CAAkB,SAAiB,IAAA,EAAoB;AAMrE,EAAA,IAAI,OAAA,CAAQ,aAAa,OAAA,EAAS;AAElC,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,OAAO,CAAA,CAAE,IAAA,GAAO,GAAA;AACzC,EAAA,IAAA,CAAK,OAAA,GAAU,QAAW,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,EAAG,OAAO,CAAA,kCAAA,EAAqC,OAAA,CAAQ,SAAS,CAAC,CAAC,gFACV,OAAO,CAAA;AAAA,KACjE;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,IAAI,CAAA,CAAE,IAAA,GAAO,GAAA;AACnC,EAAA,IAAA,CAAK,IAAA,GAAO,QAAW,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,EAAG,IAAI,CAAA,kCAAA,EAAqC,IAAA,CAAK,SAAS,CAAC,CAAC,6DACA,IAAI,CAAA;AAAA,KAClE;AAAA,EACF;AACF;AAMA,SAAS,kBAAA,CAAmB,MAAA,EAAiB,GAAA,EAAc,IAAA,EAA+B;AACxF,EAAA,MAAM,aACJ,OAAO,MAAA,KAAW,YAClB,MAAA,KAAW,IAAA,IACV,OAA8B,IAAA,KAAS,OAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,aAAa,eAAA,CAAgB,SAAA,CAAU,MAAM,CAAA,GAAI,aAAA,CAAc,UAAU,MAAM,CAAA;AAChG,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,CAAC,SAAS,OAAA,EAAS;AACrB,IAAA,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA;AAAA,EACjC,CAAA,MAAA,IAAW,GAAA,YAAe,CAAA,CAAE,QAAA,EAAU;AACpC,IAAA,KAAA,GAAQ,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACtB;AACA,EAAA,OAAO,IAAI,eAAA;AAAA,IACT,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAA,EAAO,WAAW,MAAA,CAAO,GAAG,CAAC,CAAA,EAAA,EAAK,KAAA,EAAO,IAAA,CAAK,IAAA,CAAK,GAAG,KAAK,MAAM,CAAA,CAAA;AAAA,GAC/E;AACF;AAGA,SAAS,eAAA,CAAgB,KAAa,IAAA,EAAgC;AACpE,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AAGN,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,GAAG,IAAI,CAAA,uEAAA;AAAA,KACT;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,UAAA,CAAW,MAAM,MAAM,CAAA;AAAA,EAChC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,kBAAA,CAAmB,MAAA,EAAQ,GAAA,EAAK,IAAI,CAAA;AAAA,EAC5C;AACF;AAQO,SAAS,YAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACb;AAC9B,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AAErC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,YAAA,CAAa,MAAM,MAAM,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,MAAA;AAC7D,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,YAAA,EAAe,IAAI,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,iBAAA,CAAkB,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA,EAAG,IAAI,CAAA;AACnD,EAAA,OAAO,eAAA,CAAgB,KAAK,IAAI,CAAA;AAClC;AAOO,SAAS,eAAA,CACd,MAAA,EACA,GAAA,GAA0C,EAAC,EACR;AACnC,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AACvC,EAAA,OAAO,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,IAAA,KAAS,UAAU,MAAA,GAAS,MAAA;AACpE;AAGA,SAAS,aACP,CAAA,EAC4B;AAC5B,EAAA,OAAO,MAAA,IAAU,CAAA,IAAK,CAAA,CAAE,IAAA,KAAS,OAAA;AACnC;AAGA,SAAS,kBACP,IAAA,EACyB;AACzB,EAAA,IAAI,YAAA,CAAa,IAAI,CAAA,EAAG;AACtB,IAAA,IAAI,KAAK,MAAA,CAAO,MAAA,KAAW,KAAK,IAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG;AACzD,MAAA,MAAM,IAAI,eAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,OAAA;AAAA,MACN,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,GAAI,KAAK,UAAA,KAAe,MAAA,GAAY,EAAE,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW,GAAI,EAAC;AAAA,MACvE,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAS,GAAI;AAAC,KACnE;AAAA,EACF;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,MAAA,KAAW,YAAY,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAI,gBAAgB,oCAAoC,CAAA;AAAA,EAChE;AACA,EAAA,OAAO,EAAE,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,OAAA,EAAS,KAAK,MAAA,EAAO;AACzD;AASO,SAAS,eAAA,CACd,IAAA,EACA,MAAA,EACA,GAAA,GAA0C,EAAC,EACnC;AACR,EAAA,MAAM,OAAA,GAAU,kBAAkB,IAAI,CAAA;AAEtC,EAAA,MAAM,GAAA,GAAM,cAAA,CAAe,MAAA,EAAQ,GAAG,CAAA;AACtC,EAAA,SAAA,CAAU,KAAK,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAC/C,EAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AAEpB,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,MAAA,EAAQ,GAAG,CAAA;AAIrC,EAAA,MAAM,GAAA,GAAM,GAAG,IAAI,CAAA,KAAA,EAAQ,YAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAC,CAAA,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,EAAA,GAAK,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,GAAK,CAAA;AACpC,IAAA,IAAI;AACF,MAAA,aAAA,CAAc,IAAI,CAAA,EAAG,IAAA,CAAK,UAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAC;AAAA,CAAI,CAAA;AACzD,MAAA,SAAA,CAAU,EAAE,CAAA;AAAA,IACd,CAAA,SAAE;AACA,MAAA,SAAA,CAAU,EAAE,CAAA;AAAA,IACd;AACA,IAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACpB,IAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EACtB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI;AACF,MAAA,UAAA,CAAW,GAAG,CAAA;AAAA,IAChB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,aAAA,EAAgB,IAAI,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA,CAAE,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-QD6B6W6I.js","sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport {\n  chmodSync,\n  closeSync,\n  fsyncSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { z } from \"zod\";\n\nimport { AuthenticationError } from \"../../errors.js\";\n\n/**\n * M42 — the SDK credential store. Promoted DOWN from agent-builder's hardened `agents/lib/credentials.ts`\n * (M37), generalized from a closed `openrouter|anthropic|openai` union to an open `provider: string` and\n * driven by a caller-supplied {@link CredentialStoreConfig} (no hardcoded `.agent-builder`/`auth.json` /\n * `AGENT_BUILDER_HOME`). The security-critical file mechanics are ported VERBATIM (ADR D3 of the M42 plan):\n * atomic O_EXCL + rename + fsync write, 0700/0600 mode gates, `env` is always a PARAMETER (never an ambient\n * `process.env` read).\n *\n * The env-precedence + key-prefix-inference + declared-provider rungs of the agent-builder resolver are\n * APP POLICY and deliberately stay UP in the consumer; this module owns only the on-disk store + the\n * `api|oauth` discriminated union. See {@link resolveCredential} (SDK) for the store-read + refresh path.\n *\n * Re-exported from `@theokit/sdk/auth`, and therefore PUBLIC, under semver.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\nimport type { CredentialStoreConfig, StoredCredential, StoredOAuthCredential } from \"./types.js\";\n\n/** The store directory, honoring an optional `homeEnvVar` override. */\nexport function credentialHome(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  const override = config.homeEnvVar !== undefined ? env[config.homeEnvVar]?.trim() : undefined;\n  return override !== undefined && override.length > 0\n    ? override\n    : join(config.home, config.dirName);\n}\n\n/** The credential file path inside the (possibly overridden) store directory. */\nexport function authFilePath(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  return join(credentialHome(config, env), config.fileName);\n}\n\n/**\n * A credential problem the caller can act on. Never carries the key value.\n *\n * M78 — this used to extend bare `Error`, which quietly disabled classification for the entire auth\n * path: `isTransientError` is `err instanceof TheokitAgentError && err.isRetryable === true`\n * (`errors.ts:443`), so a credential failure could never be judged transient OR permanent. The\n * predicate was not \"forgotten\" downstream — it was unusable there by construction.\n *\n * Extending `AuthenticationError` is ADDITIVE: the class still exists, still reports\n * `name: \"CredentialError\"`, and every existing `instanceof CredentialError` stays true. It only\n * gains ancestors. `AuthenticationError` pins `isRetryable: false`, so gaining the ability to be\n * classified does NOT turn a revoked credential into a retry loop.\n *\n * The single reference does the same thing with one root type: Codex routes every domain failure\n * through `CodexErr` with `is_retryable()` as a method (`protocol/src/error.rs:176`), rather than\n * parallel classes extending the language's `Error`.\n */\nexport class CredentialError extends AuthenticationError {\n  // Field, not an assignment in the constructor: `AuthenticationError.name` is `override readonly`\n  // (`errors.ts:174`), so `this.name = …` does not compile. Caught by `tsc`, not by vitest — the\n  // suite was green with the broken assignment because the transpiler strips the type.\n  override readonly name: string = \"CredentialError\";\n}\n\n/**\n * The on-disk store — a discriminated union on `type`. A legacy file with NO\n * `type` (or `type: 'api'`) is the API-key variant — read unchanged, no migration. The `oauth` variant\n * carries the token pair + expiry.\n */\nconst apiFileSchema = z\n  .object({\n    type: z.literal(\"api\").optional(),\n    provider: z.string().min(1).optional(),\n    api_key: z.string(),\n  })\n  .strict();\n\nconst oauthFileSchema = z\n  .object({\n    type: z.literal(\"oauth\"),\n    provider: z.string().min(1),\n    access: z.string().min(1),\n    refresh: z.string().min(1),\n    expires: z.number(),\n    account_id: z.string().optional(),\n    id_token: z.string().min(1).optional(),\n  })\n  .strict();\n\n// oauth first (it requires `type: 'oauth'`); a legacy `{provider?, api_key}` falls through to api.\nconst fileSchema = z.union([oauthFileSchema, apiFileSchema]);\n\n/**\n * The 0700-dir / 0600-file mode gates (ported verbatim). The DIRECTORY matters as much as the file:\n * `mkdirSync(mode)` applies only at creation, so a pre-existing store dir keeps whatever mode it had, and a\n * writable dir lets an attacker replace the credential file with a symlink to their own 0600 file — the\n * agent then runs on THEIR account.\n */\nexport function assertSecureModes(dirPath: string, path: string): void {\n  // Windows has no POSIX mode bits. `statSync().mode` there is SYNTHETIC — 0666 for any writable\n  // entry, whatever the ACLs actually say — so `mode & 0o022` was non-zero for every valid store and\n  // this gate refused all of them, which made the credential path unreadable on that platform\n  // rather than protected. A check that cannot observe the real permission system must not report a\n  // verdict about it; ACL enforcement is a separate mechanism and not one this function can fake.\n  if (process.platform === \"win32\") return;\n\n  const dirMode = statSync(dirPath).mode & 0o777;\n  if ((dirMode & 0o022) !== 0) {\n    throw new CredentialError(\n      `${dirPath} is writable by other users (mode ${dirMode.toString(8)}), so the credential file ` +\n        `inside it can be replaced. Fix it with:  chmod 700 ${dirPath}`,\n    );\n  }\n  const mode = statSync(path).mode & 0o777;\n  if ((mode & 0o077) !== 0) {\n    throw new CredentialError(\n      `${path} is readable by other users (mode ${mode.toString(8)}). ` +\n        `A credential file must not be. Fix it with:  chmod 600 ${path}`,\n    );\n  }\n}\n\n/**\n * A `z.union` reports a generic \"Invalid input\" at the root, hiding WHAT is wrong. Pick the sub-schema the\n * file was CLEARLY aiming at (by its `type` discriminant) and surface that schema's specific issue.\n */\nfunction describeUnionError(parsed: unknown, err: unknown, path: string): CredentialError {\n  const looksOAuth =\n    typeof parsed === \"object\" &&\n    parsed !== null &&\n    (parsed as { type?: unknown }).type === \"oauth\";\n  const specific = looksOAuth ? oauthFileSchema.safeParse(parsed) : apiFileSchema.safeParse(parsed);\n  let issue: z.ZodIssue | undefined;\n  if (!specific.success) {\n    issue = specific.error.issues[0];\n  } else if (err instanceof z.ZodError) {\n    issue = err.issues[0];\n  }\n  return new CredentialError(\n    `${path}: ${issue?.message ?? String(err)} [${issue?.path.join(\".\") || \"root\"}]`,\n  );\n}\n\n/** Parse the raw file into the store union, surfacing the SPECIFIC sub-schema issue (not a generic union error). */\nfunction parseStoredFile(raw: string, path: string): StoredCredential {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    // The parser's message embeds a snippet of the INPUT — up to the raw key when a user pastes the bare\n    // key instead of JSON. The position is not actionable anyway, so the expected shape is more useful.\n    throw new CredentialError(\n      `${path} is not valid JSON. Expected:  {\"provider\": \"<name>\", \"api_key\": \"...\"}`,\n    );\n  }\n  try {\n    return fileSchema.parse(parsed);\n  } catch (err) {\n    throw describeUnionError(parsed, err, path);\n  }\n}\n\n/**\n * Read the credential file. Absent ⇒ `undefined` (the normal case). Present-but-wrong is a typed error\n * naming the file: a malformed credential store must not surface as a raw parse crash. Enforces the\n * 0700 dir / 0600 file mode gates (ported verbatim — a writable dir lets an attacker swap the file for a\n * symlink to their own account).\n */\nexport function readAuthFile(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): StoredCredential | undefined {\n  const path = authFilePath(config, env);\n\n  let raw: string;\n  try {\n    raw = readFileSync(path, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw new CredentialError(`cannot read ${path}: ${(err as Error).message}`);\n  }\n\n  assertSecureModes(credentialHome(config, env), path);\n  return parseStoredFile(raw, path);\n}\n\n/**\n * Read the stored OAuth credential (with its refresh token), or `undefined` when the store is absent or\n * holds an api credential. The oauth engine needs the refresh token, which the resolved bearer does not\n * carry. Enforces the same 0600/0700 gates as every other read.\n */\nexport function readStoredOAuth(\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): StoredOAuthCredential | undefined {\n  const stored = readAuthFile(config, env);\n  return stored !== undefined && stored.type === \"oauth\" ? stored : undefined;\n}\n\n/** Narrows a writable credential to the oauth variant. */\nfunction isOAuthWrite(\n  c: { provider: string; apiKey: string } | StoredOAuthCredential,\n): c is StoredOAuthCredential {\n  return \"type\" in c && c.type === \"oauth\";\n}\n\n/** Build the on-disk JSON payload for the credential variant, validating non-empty tokens. */\nfunction buildStorePayload(\n  cred: { provider: string; apiKey: string } | StoredOAuthCredential,\n): Record<string, unknown> {\n  if (isOAuthWrite(cred)) {\n    if (cred.access.length === 0 || cred.refresh.length === 0) {\n      throw new CredentialError(\n        \"refusing to write an oauth credential with an empty access/refresh token\",\n      );\n    }\n    return {\n      type: \"oauth\",\n      provider: cred.provider,\n      access: cred.access,\n      refresh: cred.refresh,\n      expires: cred.expires,\n      ...(cred.account_id !== undefined ? { account_id: cred.account_id } : {}),\n      ...(cred.id_token !== undefined ? { id_token: cred.id_token } : {}),\n    };\n  }\n  if (typeof cred.apiKey !== \"string\" || cred.apiKey.length === 0) {\n    throw new CredentialError(\"refusing to write an empty API key\");\n  }\n  return { provider: cred.provider, api_key: cred.apiKey };\n}\n\n/**\n * Persist a credential atomically at mode `0600`. Ported VERBATIM (ADR D3): write to a random-named temp\n * file in the same directory with `wx` (O_EXCL), fsync, close, chmod, then `rename` (atomic on POSIX) —\n * so a crash mid-write leaves whatever was there untouched, and a pre-planted symlink cannot capture the\n * key. The api variant persists the unchanged `{provider, api_key}` (back-compat, no `type` key); the\n * oauth variant persists `{type:'oauth', provider, access, refresh, expires, account_id?, id_token?}`.\n */\nexport function writeCredential(\n  cred: { provider: string; apiKey: string } | StoredOAuthCredential,\n  config: CredentialStoreConfig,\n  env: Record<string, string | undefined> = {},\n): string {\n  const payload = buildStorePayload(cred);\n\n  const dir = credentialHome(config, env);\n  mkdirSync(dir, { recursive: true, mode: 0o700 });\n  chmodSync(dir, 0o700); // unconditional: mkdirSync's mode applies only at creation\n\n  const path = authFilePath(config, env);\n  // RANDOM name + `wx` (O_EXCL): a predictable temp name with a plain write follows a pre-planted SYMLINK,\n  // landing the key in an attacker's file while reporting success. O_EXCL refuses any pre-existing file or\n  // link; the random suffix also removes the pid collision two containers sharing a bind-mounted home make.\n  const tmp = `${path}.tmp-${randomBytes(8).toString(\"hex\")}`;\n  try {\n    const fd = openSync(tmp, \"wx\", 0o600);\n    try {\n      writeFileSync(fd, `${JSON.stringify(payload, null, 2)}\\n`);\n      fsyncSync(fd);\n    } finally {\n      closeSync(fd);\n    }\n    chmodSync(tmp, 0o600); // explicit: the mode argument is subject to umask\n    renameSync(tmp, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmp);\n    } catch {\n      // the temp file may not exist; its absence is not a failure of the write\n    }\n    throw new CredentialError(`cannot write ${path}: ${(err as Error).message}`);\n  }\n  return path;\n}\n"]}

package/dist/{chunk-AB4OPJLD.js → chunk-RGVMJU57.js}

@@ -1,7 +1,7 @@
 import { acquireSessionWriter } from './chunk-5IRDK5BC.js';
 import { transcriptPath, legacyTranscriptPath, readTranscript } from './chunk-XESYJ4JC.js';
 import { appendJsonl } from './chunk-KU5O7WPK.js';
-import { withFileLock } from './chunk-354F3OF5.js';
+import { withFileLock } from './chunk-FGGVSHDW.js';
 import { existsSync } from 'fs';
 import { mkdir } from 'fs/promises';
 import { dirname } from 'path';
@@ -130,5 +130,5 @@ var FsSessionStore = class {
 };
 
 export { FsSessionStore };
-//# sourceMappingURL=chunk-AB4OPJLD.js.map
-//# sourceMappingURL=chunk-AB4OPJLD.js.map
+//# sourceMappingURL=chunk-RGVMJU57.js.map
+//# sourceMappingURL=chunk-RGVMJU57.js.map

package/dist/{chunk-AB4OPJLD.js.map → chunk-RGVMJU57.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/persistence/fs-session-store.ts"],"names":[],"mappings":";;;;;;;;AA2DA,IAAM,YAAA,uBAAmB,GAAA,EAAyD;AAElF,eAAe,cAAc,IAAA,EAA2C;AACtE,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACtC,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,QAAA,CAAS,IAAA,EAAA;AACT,IAAA,OAAO,YAAY,IAAI,CAAA;AAAA,EACzB;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,oBAAA,CAAqB,IAAI,CAAA;AAC7C,EAAA,YAAA,CAAa,IAAI,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACzC,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAGA,SAAS,YAAY,IAAA,EAAkC;AACrD,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA,IAIb,OAAO,MAAY;AACjB,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA,EAAG,KAAA,CAAM,KAAA,EAAM;AAAA,IACtC,CAAA;AAAA,IACA,SAAS,YAA2B;AAClC,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,MAAA,IAAI,UAAU,MAAA,EAAW;AACzB,MAAA,KAAA,CAAM,IAAA,EAAA;AACN,MAAA,IAAI,KAAA,CAAM,OAAO,CAAA,EAAG;AACpB,MAAA,YAAA,CAAa,OAAO,IAAI,CAAA;AACxB,MAAA,MAAM,KAAA,CAAM,MAAM,OAAA,EAAQ;AAAA,IAC5B;AAAA,GACF;AACF;AAKO,IAAM,iBAAN,MAA6C;AAAA,EACzC,QAAA;AAAA,EACA,IAAA;AAAA;AAAA,EAEA,OAAA,uBAAc,GAAA,EAAgC;AAAA;AAAA,EAE9C,MAAA,uBAAa,GAAA,EAAoB;AAAA,EAE1C,YAAY,OAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,OAAA;AACxB,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,GAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,SAAS,OAAA,EAAyB;AAChC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AACxC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,IAAA,MAAM,YAAY,cAAA,CAAe,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,MAAM,OAAO,CAAA;AAClE,IAAA,MAAM,SAAS,oBAAA,CAAqB,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,MAAM,OAAO,CAAA;AACrE,IAAA,MAAM,WAAW,MAAA,KAAW,SAAA,IAAa,UAAA,CAAW,MAAM,IAAI,MAAA,GAAS,SAAA;AACvE,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AACjC,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAAA,EAA2C;AAC3D,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,EAC9C;AAAA,EAEA,MAAM,aAAA,CAAc,OAAA,EAAiB,OAAA,EAAkD;AAErF,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAElC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAE9C,IAAA,MAAM,YAAA,CAAa,MAAM,YAAY;AA0BnC,MAAA,KAAA,MAAW,MAAA,IAAU,OAAA,EAAS,WAAA,CAAY,IAAA,EAAM,MAAM,CAAA;AAAA,IACxD,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,QAAQ,OAAA,EAAgC;AAC5C,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAClC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,IAAA,CAAK,QAAQ,GAAA,CAAI,OAAA,EAAS,MAAM,aAAA,CAAc,IAAI,CAAC,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAAQ,OAAA,EAAgC;AAC5C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACtC,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,OAAO,CAAA;AAC3B,IAAA,MAAM,MAAM,OAAA,EAAQ;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,SAAS,CAAC,GAAG,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AACnB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,EAAQ,MAAM,KAAA,CAAM,OAAA,EAAQ;AAAA,EAClD;AACF","file":"chunk-AB4OPJLD.js","sourcesContent":["/**\n * SE41 — `FsSessionStore`, the DEFAULT reference implementation of the pluggable\n * {@link SessionStore} seam. It reads and append-writes the native Claude-shaped\n * `.jsonl` transcript at `<baseDir>/projects/<encoded-cwd>/<agentId>.jsonl` — the\n * exact on-disk format SE40 introduced (the file the Claude Code CLI can\n * `--continue`). Omitting `local.sessionStore` resolves to this store, so the\n * default persistence path is byte-identical to SE40 behavior.\n *\n * `readRecords` is `readTranscript(transcriptPath(...))` (a missing session →\n * `[]`, not an error — a fresh agent has no history). `appendRecords` is a TRUE\n * append: it reads the prior records, concatenates the new-turn delta, and\n * rewrites the whole line set atomically under the SE40 cross-process file lock\n * (`writeTranscript` never shrinks — the native format is an append-only\n * `parentUuid` DAG). The parent dir is created BEFORE acquiring the lock because\n * the lock's companion `<path>.lock` file needs an existing parent dir (the SE40\n * `mkdir(dirname)`-before-lock fix).\n *\n * @internal\n */\n\nimport { existsSync } from \"node:fs\";\nimport { mkdir } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { withFileLock } from \"./file-lock.js\";\nimport { appendJsonl } from \"./jsonl.js\";\nimport {\n  legacyTranscriptPath,\n  readTranscript,\n  type SessionRecord,\n  transcriptPath,\n} from \"./session-transcript.js\";\nimport { acquireSessionWriter, type SessionWriterLease } from \"./session-writer.js\";\n\n/** Options identifying the on-disk transcript location for the FS default store. */\nexport interface FsSessionStoreOptions {\n  /** Transcript base dir (`~/.theokit` default, `~/.claude` for CLI interop) — already `~`-expanded. */\n  baseDir: string;\n  /** The workspace cwd whose encoded form is the transcript project dir. */\n  cwd: string;\n}\n\n/**\n * Reference-counted leases, shared per path.\n *\n * `acquireSessionWriter` is STRICT on purpose: two concurrent acquisitions of the same path, and\n * exactly one wins — \"a lease that let both through would be decorative\" (the M81 test says exactly\n * that, and it is right). That is the primitive's contract, and it does not change.\n *\n * But within ONE process it is normal to have more than one store over the same session: the golden\n * compaction tests and the concurrent-send tests do exactly that, and they record real runtime\n * behavior. Applying the raw primitive there would turn a legitimate pattern into a\n * `SessionBusyError`.\n *\n * The reconciliation belongs here, in the primitive's consumer: the process takes ONE lease per path\n * and counts how many stores use it. The last to release actually frees it. Cross-process stays\n * strict — which is the problem M81 states (\"`exec resume --last` can write into the TUI's live\n * session\").\n */\nconst sharedLeases = new Map<string, { lease: SessionWriterLease; refs: number }>();\n\nasync function acquireShared(path: string): Promise<SessionWriterLease> {\n  const existing = sharedLeases.get(path);\n  if (existing !== undefined) {\n    existing.refs++;\n    return createProxy(path);\n  }\n  const lease = await acquireSessionWriter(path);\n  sharedLeases.set(path, { lease, refs: 1 });\n  return createProxy(path);\n}\n\n/** A handle that decrements the count; the last to release frees the real lease. */\nfunction createProxy(path: string): SessionWriterLease {\n  let released = false;\n  return {\n    sessionPath: path,\n    // The proxy forwards the renewal to the ONE real lease this path shares. Renewing through any\n    // holder is correct and is the point: the record must say \"someone in this process is still\n    // writing\", and the refcount already guarantees they are all the same owner.\n    renew: (): void => {\n      if (released) return;\n      sharedLeases.get(path)?.lease.renew();\n    },\n    release: async (): Promise<void> => {\n      if (released) return;\n      released = true;\n      const entry = sharedLeases.get(path);\n      if (entry === undefined) return;\n      entry.refs--;\n      if (entry.refs > 0) return;\n      sharedLeases.delete(path);\n      await entry.lease.release();\n    },\n  };\n}\n\n/**\n * The default `SessionStore` — reads/append-writes the native `.jsonl` transcript.\n */\nexport class FsSessionStore implements SessionStore {\n  readonly #baseDir: string;\n  readonly #cwd: string;\n  /** One lease per `agentId` — a store serves more than one session over the process lifetime. */\n  readonly #leases = new Map<string, SessionWriterLease>();\n  /** Memoized per agent so read, append and lease can never disagree about which file is the session. */\n  readonly #paths = new Map<string, string>();\n\n  constructor(options: FsSessionStoreOptions) {\n    this.#baseDir = options.baseDir;\n    this.#cwd = options.cwd;\n  }\n\n  /**\n   * The file that IS this agent's session.\n   *\n   * #400 made transcript filenames UUIDs so `claude --continue` can find them. A transcript written\n   * before that lives under the old name, and switching to the new one would not lose the file but\n   * would abandon it: the agent would start a second, empty history beside its real one. So an\n   * existing legacy file wins, and only a session with no file yet gets the new name.\n   *\n   * Resolved ONCE per agent. Re-deciding per call would let `acquire` lock one path while\n   * `appendRecords` wrote another — the lease would be guarding a file nobody was writing.\n   */\n  #pathFor(agentId: string): string {\n    const memoized = this.#paths.get(agentId);\n    if (memoized !== undefined) return memoized;\n    const canonical = transcriptPath(this.#baseDir, this.#cwd, agentId);\n    const legacy = legacyTranscriptPath(this.#baseDir, this.#cwd, agentId);\n    const resolved = legacy !== canonical && existsSync(legacy) ? legacy : canonical;\n    this.#paths.set(agentId, resolved);\n    return resolved;\n  }\n\n  async readRecords(agentId: string): Promise<SessionRecord[]> {\n    return readTranscript(this.#pathFor(agentId));\n  }\n\n  async appendRecords(agentId: string, records: readonly SessionRecord[]): Promise<void> {\n    // Empty delta → nothing to persist (avoids an unnecessary lock + rewrite).\n    if (records.length === 0) return;\n    const path = this.#pathFor(agentId);\n    // mkdir BEFORE the lock: withFileLock's companion `<path>.lock` needs the parent dir.\n    await mkdir(dirname(path), { recursive: true });\n\n    await withFileLock(path, async () => {\n      // M93 — appends the DELTA instead of rewriting the whole file.\n      //\n      // Before: `readTranscript` + `writeTranscript` of everything, per turn. O(n) of I/O **and** of\n      // parsing on every turn, O(n^2) per session — the consumer note in\n      // `agents/lib/session/backtrack.ts` records 1.4 MB / 3000 lines over 200 turns.\n      //\n      // Correct because the format **is already append-only**: the `parentUuid` DAG does not depend\n      // on line order, and every record carries its own parent. `appendJsonl` **already existed in\n      // the package** and had a single caller (`eval/runner.ts`) — the primitive was there, it was\n      // the store that ignored it (rung 4).\n      //\n      // `withFileLock` stays — but the earlier claim that \"it is what serializes two concurrent\n      // `appendRecords`\" was too strong, and M93's adversarial review measured it: removing it fails\n      // no test. The reason is the paragraph above — the `parentUuid` DAG does not depend on line\n      // order, so two interleaved batches reconstruct identically. The work the lock was doing\n      // (protecting a read-modify-write) disappeared along with the rewrite.\n      //\n      // What it still covers is the TOCTOU window in `needsLineBreakBefore` (read the last byte,\n      // then write): without it, two processes can both conclude \"a \\n is missing\" and produce a\n      // blank line — which the reader discards, i.e. benign. It stays as a **declared, not\n      // mechanized** defense (the discipline in `error-handling.md` § 4: enumerate the residue\n      // rather than let a missing test pass for coverage).\n      //\n      // `writeTranscript` still exists for **compaction**, the one operation that legitimately\n      // rewrites the file.\n      for (const record of records) appendJsonl(path, record);\n    });\n  }\n\n  /**\n   * Takes the session's writer lease. Throws `SessionBusyError` when another process holds it.\n   *\n   * **Explicit, and NOT inside `appendRecords`** — M95's adversarial review measured why that\n   * matters: the `SessionStore` contract states that \"an `appendRecords` rejection is logged to\n   * stderr, NOT thrown to the caller (best-effort write)\". Acquiring there made the\n   * `SessionBusyError` get **swallowed**, and the result was worse than the original problem:\n   * instead of two writers interleaving lines, the loser **lost the turn silently** — nothing on\n   * disk, a stderr warning invisible under the TUI, and no way for the caller to react.\n   *\n   * At init the error reaches someone who can act: `exec` forks to a new id, which is exactly what\n   * the error message itself prescribes. It is the difference between failing where a decision is\n   * possible and failing where only loss is.\n   */\n  async acquire(agentId: string): Promise<void> {\n    if (this.#leases.has(agentId)) return;\n    const path = this.#pathFor(agentId);\n    await mkdir(dirname(path), { recursive: true });\n    this.#leases.set(agentId, await acquireShared(path));\n  }\n\n  /**\n   * Releases ONE agent's lease.\n   *\n   * It exists because `dispose()` releases **every** lease the store holds, and a store injected by\n   * the consumer may serve several agents: an init that fails for agent B must not free agent A's\n   * lease, which is still live and writing.\n   */\n  async release(agentId: string): Promise<void> {\n    const lease = this.#leases.get(agentId);\n    if (lease === undefined) return;\n    this.#leases.delete(agentId);\n    await lease.release();\n  }\n\n  /**\n   * Releases every lease this store holds.\n   *\n   * Without it the `.writer.lock` outlives the process and the next open would have to wait out the\n   * heartbeat window — recoverable, but 30 s of waiting after a CLEAN shutdown would be an avoidable\n   * defect. Idempotent: calling it twice is not an error.\n   */\n  async dispose(): Promise<void> {\n    const leases = [...this.#leases.values()];\n    this.#leases.clear();\n    for (const lease of leases) await lease.release();\n  }\n}\n"]}
+{"version":3,"sources":["../src/internal/persistence/fs-session-store.ts"],"names":[],"mappings":";;;;;;;;AA2DA,IAAM,YAAA,uBAAmB,GAAA,EAAyD;AAElF,eAAe,cAAc,IAAA,EAA2C;AACtE,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACtC,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,QAAA,CAAS,IAAA,EAAA;AACT,IAAA,OAAO,YAAY,IAAI,CAAA;AAAA,EACzB;AACA,EAAA,MAAM,KAAA,GAAQ,MAAM,oBAAA,CAAqB,IAAI,CAAA;AAC7C,EAAA,YAAA,CAAa,IAAI,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,GAAG,CAAA;AACzC,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAGA,SAAS,YAAY,IAAA,EAAkC;AACrD,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,IAAA;AAAA;AAAA;AAAA;AAAA,IAIb,OAAO,MAAY;AACjB,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA,EAAG,KAAA,CAAM,KAAA,EAAM;AAAA,IACtC,CAAA;AAAA,IACA,SAAS,YAA2B;AAClC,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,GAAA,CAAI,IAAI,CAAA;AACnC,MAAA,IAAI,UAAU,MAAA,EAAW;AACzB,MAAA,KAAA,CAAM,IAAA,EAAA;AACN,MAAA,IAAI,KAAA,CAAM,OAAO,CAAA,EAAG;AACpB,MAAA,YAAA,CAAa,OAAO,IAAI,CAAA;AACxB,MAAA,MAAM,KAAA,CAAM,MAAM,OAAA,EAAQ;AAAA,IAC5B;AAAA,GACF;AACF;AAKO,IAAM,iBAAN,MAA6C;AAAA,EACzC,QAAA;AAAA,EACA,IAAA;AAAA;AAAA,EAEA,OAAA,uBAAc,GAAA,EAAgC;AAAA;AAAA,EAE9C,MAAA,uBAAa,GAAA,EAAoB;AAAA,EAE1C,YAAY,OAAA,EAAgC;AAC1C,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,OAAA;AACxB,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,GAAA;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,SAAS,OAAA,EAAyB;AAChC,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AACxC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,QAAA;AACnC,IAAA,MAAM,YAAY,cAAA,CAAe,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,MAAM,OAAO,CAAA;AAClE,IAAA,MAAM,SAAS,oBAAA,CAAqB,IAAA,CAAK,QAAA,EAAU,IAAA,CAAK,MAAM,OAAO,CAAA;AACrE,IAAA,MAAM,WAAW,MAAA,KAAW,SAAA,IAAa,UAAA,CAAW,MAAM,IAAI,MAAA,GAAS,SAAA;AACvE,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,QAAQ,CAAA;AACjC,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAAA,EAA2C;AAC3D,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,EAC9C;AAAA,EAEA,MAAM,aAAA,CAAc,OAAA,EAAiB,OAAA,EAAkD;AAErF,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAElC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAE9C,IAAA,MAAM,YAAA,CAAa,MAAM,YAAY;AA0BnC,MAAA,KAAA,MAAW,MAAA,IAAU,OAAA,EAAS,WAAA,CAAY,IAAA,EAAM,MAAM,CAAA;AAAA,IACxD,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,QAAQ,OAAA,EAAgC;AAC5C,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA;AAClC,IAAA,MAAM,MAAM,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9C,IAAA,IAAA,CAAK,QAAQ,GAAA,CAAI,OAAA,EAAS,MAAM,aAAA,CAAc,IAAI,CAAC,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QAAQ,OAAA,EAAgC;AAC5C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACtC,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,OAAO,CAAA;AAC3B,IAAA,MAAM,MAAM,OAAA,EAAQ;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAA,GAAyB;AAC7B,IAAA,MAAM,SAAS,CAAC,GAAG,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACxC,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AACnB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,EAAQ,MAAM,KAAA,CAAM,OAAA,EAAQ;AAAA,EAClD;AACF","file":"chunk-RGVMJU57.js","sourcesContent":["/**\n * SE41 — `FsSessionStore`, the DEFAULT reference implementation of the pluggable\n * {@link SessionStore} seam. It reads and append-writes the native Claude-shaped\n * `.jsonl` transcript at `<baseDir>/projects/<encoded-cwd>/<agentId>.jsonl` — the\n * exact on-disk format SE40 introduced (the file the Claude Code CLI can\n * `--continue`). Omitting `local.sessionStore` resolves to this store, so the\n * default persistence path is byte-identical to SE40 behavior.\n *\n * `readRecords` is `readTranscript(transcriptPath(...))` (a missing session →\n * `[]`, not an error — a fresh agent has no history). `appendRecords` is a TRUE\n * append: it reads the prior records, concatenates the new-turn delta, and\n * rewrites the whole line set atomically under the SE40 cross-process file lock\n * (`writeTranscript` never shrinks — the native format is an append-only\n * `parentUuid` DAG). The parent dir is created BEFORE acquiring the lock because\n * the lock's companion `<path>.lock` file needs an existing parent dir (the SE40\n * `mkdir(dirname)`-before-lock fix).\n *\n * @internal\n */\n\nimport { existsSync } from \"node:fs\";\nimport { mkdir } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { withFileLock } from \"./file-lock.js\";\nimport { appendJsonl } from \"./jsonl.js\";\nimport {\n  legacyTranscriptPath,\n  readTranscript,\n  type SessionRecord,\n  transcriptPath,\n} from \"./session-transcript.js\";\nimport { acquireSessionWriter, type SessionWriterLease } from \"./session-writer.js\";\n\n/** Options identifying the on-disk transcript location for the FS default store. */\nexport interface FsSessionStoreOptions {\n  /** Transcript base dir (`~/.theokit` default, `~/.claude` for CLI interop) — already `~`-expanded. */\n  baseDir: string;\n  /** The workspace cwd whose encoded form is the transcript project dir. */\n  cwd: string;\n}\n\n/**\n * Reference-counted leases, shared per path.\n *\n * `acquireSessionWriter` is STRICT on purpose: two concurrent acquisitions of the same path, and\n * exactly one wins — \"a lease that let both through would be decorative\" (the M81 test says exactly\n * that, and it is right). That is the primitive's contract, and it does not change.\n *\n * But within ONE process it is normal to have more than one store over the same session: the golden\n * compaction tests and the concurrent-send tests do exactly that, and they record real runtime\n * behavior. Applying the raw primitive there would turn a legitimate pattern into a\n * `SessionBusyError`.\n *\n * The reconciliation belongs here, in the primitive's consumer: the process takes ONE lease per path\n * and counts how many stores use it. The last to release actually frees it. Cross-process stays\n * strict — which is the problem M81 states (\"`exec resume --last` can write into the TUI's live\n * session\").\n */\nconst sharedLeases = new Map<string, { lease: SessionWriterLease; refs: number }>();\n\nasync function acquireShared(path: string): Promise<SessionWriterLease> {\n  const existing = sharedLeases.get(path);\n  if (existing !== undefined) {\n    existing.refs++;\n    return createProxy(path);\n  }\n  const lease = await acquireSessionWriter(path);\n  sharedLeases.set(path, { lease, refs: 1 });\n  return createProxy(path);\n}\n\n/** A handle that decrements the count; the last to release frees the real lease. */\nfunction createProxy(path: string): SessionWriterLease {\n  let released = false;\n  return {\n    sessionPath: path,\n    // The proxy forwards the renewal to the ONE real lease this path shares. Renewing through any\n    // holder is correct and is the point: the record must say \"someone in this process is still\n    // writing\", and the refcount already guarantees they are all the same owner.\n    renew: (): void => {\n      if (released) return;\n      sharedLeases.get(path)?.lease.renew();\n    },\n    release: async (): Promise<void> => {\n      if (released) return;\n      released = true;\n      const entry = sharedLeases.get(path);\n      if (entry === undefined) return;\n      entry.refs--;\n      if (entry.refs > 0) return;\n      sharedLeases.delete(path);\n      await entry.lease.release();\n    },\n  };\n}\n\n/**\n * The default `SessionStore` — reads/append-writes the native `.jsonl` transcript.\n */\nexport class FsSessionStore implements SessionStore {\n  readonly #baseDir: string;\n  readonly #cwd: string;\n  /** One lease per `agentId` — a store serves more than one session over the process lifetime. */\n  readonly #leases = new Map<string, SessionWriterLease>();\n  /** Memoized per agent so read, append and lease can never disagree about which file is the session. */\n  readonly #paths = new Map<string, string>();\n\n  constructor(options: FsSessionStoreOptions) {\n    this.#baseDir = options.baseDir;\n    this.#cwd = options.cwd;\n  }\n\n  /**\n   * The file that IS this agent's session.\n   *\n   * #400 made transcript filenames UUIDs so `claude --continue` can find them. A transcript written\n   * before that lives under the old name, and switching to the new one would not lose the file but\n   * would abandon it: the agent would start a second, empty history beside its real one. So an\n   * existing legacy file wins, and only a session with no file yet gets the new name.\n   *\n   * Resolved ONCE per agent. Re-deciding per call would let `acquire` lock one path while\n   * `appendRecords` wrote another — the lease would be guarding a file nobody was writing.\n   */\n  #pathFor(agentId: string): string {\n    const memoized = this.#paths.get(agentId);\n    if (memoized !== undefined) return memoized;\n    const canonical = transcriptPath(this.#baseDir, this.#cwd, agentId);\n    const legacy = legacyTranscriptPath(this.#baseDir, this.#cwd, agentId);\n    const resolved = legacy !== canonical && existsSync(legacy) ? legacy : canonical;\n    this.#paths.set(agentId, resolved);\n    return resolved;\n  }\n\n  async readRecords(agentId: string): Promise<SessionRecord[]> {\n    return readTranscript(this.#pathFor(agentId));\n  }\n\n  async appendRecords(agentId: string, records: readonly SessionRecord[]): Promise<void> {\n    // Empty delta → nothing to persist (avoids an unnecessary lock + rewrite).\n    if (records.length === 0) return;\n    const path = this.#pathFor(agentId);\n    // mkdir BEFORE the lock: withFileLock's companion `<path>.lock` needs the parent dir.\n    await mkdir(dirname(path), { recursive: true });\n\n    await withFileLock(path, async () => {\n      // M93 — appends the DELTA instead of rewriting the whole file.\n      //\n      // Before: `readTranscript` + `writeTranscript` of everything, per turn. O(n) of I/O **and** of\n      // parsing on every turn, O(n^2) per session — the consumer note in\n      // `agents/lib/session/backtrack.ts` records 1.4 MB / 3000 lines over 200 turns.\n      //\n      // Correct because the format **is already append-only**: the `parentUuid` DAG does not depend\n      // on line order, and every record carries its own parent. `appendJsonl` **already existed in\n      // the package** and had a single caller (`eval/runner.ts`) — the primitive was there, it was\n      // the store that ignored it (rung 4).\n      //\n      // `withFileLock` stays — but the earlier claim that \"it is what serializes two concurrent\n      // `appendRecords`\" was too strong, and M93's adversarial review measured it: removing it fails\n      // no test. The reason is the paragraph above — the `parentUuid` DAG does not depend on line\n      // order, so two interleaved batches reconstruct identically. The work the lock was doing\n      // (protecting a read-modify-write) disappeared along with the rewrite.\n      //\n      // What it still covers is the TOCTOU window in `needsLineBreakBefore` (read the last byte,\n      // then write): without it, two processes can both conclude \"a \\n is missing\" and produce a\n      // blank line — which the reader discards, i.e. benign. It stays as a **declared, not\n      // mechanized** defense (the discipline in `error-handling.md` § 4: enumerate the residue\n      // rather than let a missing test pass for coverage).\n      //\n      // `writeTranscript` still exists for **compaction**, the one operation that legitimately\n      // rewrites the file.\n      for (const record of records) appendJsonl(path, record);\n    });\n  }\n\n  /**\n   * Takes the session's writer lease. Throws `SessionBusyError` when another process holds it.\n   *\n   * **Explicit, and NOT inside `appendRecords`** — M95's adversarial review measured why that\n   * matters: the `SessionStore` contract states that \"an `appendRecords` rejection is logged to\n   * stderr, NOT thrown to the caller (best-effort write)\". Acquiring there made the\n   * `SessionBusyError` get **swallowed**, and the result was worse than the original problem:\n   * instead of two writers interleaving lines, the loser **lost the turn silently** — nothing on\n   * disk, a stderr warning invisible under the TUI, and no way for the caller to react.\n   *\n   * At init the error reaches someone who can act: `exec` forks to a new id, which is exactly what\n   * the error message itself prescribes. It is the difference between failing where a decision is\n   * possible and failing where only loss is.\n   */\n  async acquire(agentId: string): Promise<void> {\n    if (this.#leases.has(agentId)) return;\n    const path = this.#pathFor(agentId);\n    await mkdir(dirname(path), { recursive: true });\n    this.#leases.set(agentId, await acquireShared(path));\n  }\n\n  /**\n   * Releases ONE agent's lease.\n   *\n   * It exists because `dispose()` releases **every** lease the store holds, and a store injected by\n   * the consumer may serve several agents: an init that fails for agent B must not free agent A's\n   * lease, which is still live and writing.\n   */\n  async release(agentId: string): Promise<void> {\n    const lease = this.#leases.get(agentId);\n    if (lease === undefined) return;\n    this.#leases.delete(agentId);\n    await lease.release();\n  }\n\n  /**\n   * Releases every lease this store holds.\n   *\n   * Without it the `.writer.lock` outlives the process and the next open would have to wait out the\n   * heartbeat window — recoverable, but 30 s of waiting after a CLEAN shutdown would be an avoidable\n   * defect. Idempotent: calling it twice is not an error.\n   */\n  async dispose(): Promise<void> {\n    const leases = [...this.#leases.values()];\n    this.#leases.clear();\n    for (const lease of leases) await lease.release();\n  }\n}\n"]}

package/dist/{chunk-NWWTYBD3.cjs → chunk-RTDVSHJR.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkS46WJTDL_cjs = require('./chunk-S46WJTDL.cjs');
+var chunkP7QYG4RZ_cjs = require('./chunk-P7QYG4RZ.cjs');
 
 // src/internal/llm/model-capabilities.ts
 var CONSERVATIVE_DEFAULTS = {
@@ -24,11 +24,11 @@ function capsFromCatalog(m) {
 }
 function resolveModelCapabilities(modelId) {
   const bare = stripVariantSuffix(stripRoutingPrefix(modelId));
-  const fromIndex = chunkS46WJTDL_cjs.getCatalogModelInfo(bare);
+  const fromIndex = chunkP7QYG4RZ_cjs.getCatalogModelInfo(bare);
   if (fromIndex !== void 0) return capsFromCatalog(fromIndex);
   const withVendor = inferVendorPrefix(bare);
   if (withVendor !== bare) {
-    const vendored = chunkS46WJTDL_cjs.getCatalogModelInfo(withVendor);
+    const vendored = chunkP7QYG4RZ_cjs.getCatalogModelInfo(withVendor);
     if (vendored !== void 0) return capsFromCatalog(vendored);
   }
   return CONSERVATIVE_DEFAULTS;
@@ -57,5 +57,5 @@ function inferVendorPrefix(bare) {
 
 exports.isAnthropicFamilyModel = isAnthropicFamilyModel;
 exports.resolveModelCapabilities = resolveModelCapabilities;
-//# sourceMappingURL=chunk-NWWTYBD3.cjs.map
-//# sourceMappingURL=chunk-NWWTYBD3.cjs.map
+//# sourceMappingURL=chunk-RTDVSHJR.cjs.map
+//# sourceMappingURL=chunk-RTDVSHJR.cjs.map

package/dist/{chunk-NWWTYBD3.cjs.map → chunk-RTDVSHJR.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/llm/model-capabilities.ts"],"names":["getCatalogModelInfo"],"mappings":";;;;;AAgCA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,eAAA,EAAiB,KAAA;AAAA,EACjB,oBAAA,EAAsB,KAAA;AAAA,EACtB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAGA,IAAM,gBAAA,GAAmB,CAAC,aAAA,EAAe,SAAA,EAAW,UAAU,CAAA;AAM9D,SAAS,gBAAgB,CAAA,EAAoC;AAC3D,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,EAAE,UAAA,EAAY,KAAA,EAAO,SAAS,OAAO,CAAA,IAAK,EAAE,UAAA,IAAc,KAAA;AAAA,IAC1E,wBAAA,EAA0B,EAAE,iBAAA,IAAqB,KAAA;AAAA,IACjD,eAAA,EAAiB,EAAE,SAAA,IAAa,KAAA;AAAA,IAChC,oBAAA,EAAuB,EAAkC,aAAA,IAAiB,KAAA;AAAA,IAC1E,gBAAA,EAAkB,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,qBAAA,CAAsB,gBAAA;AAAA,IAC5D,eAAA,EAAiB,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU,qBAAA,CAAsB;AAAA,GAC5D;AACF;AAWO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAG3D,EAAA,MAAM,SAAA,GAAYA,sCAAoB,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,eAAA,CAAgB,SAAS,CAAA;AAG7D,EAAA,MAAM,UAAA,GAAa,kBAAkB,IAAI,CAAA;AACzC,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,QAAA,GAAWA,sCAAoB,UAAU,CAAA;AAC/C,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,eAAA,CAAgB,QAAQ,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,qBAAA;AACT;AAUO,SAAS,uBAAuB,OAAA,EAAsC;AAC3E,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,KAAA;AAClC,EAAA,OAAO,uBAAA,CAAwB,IAAA,CAAK,kBAAA,CAAmB,OAAO,CAAC,CAAA;AACjE;AAEA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,KAAA,MAAW,UAAU,gBAAA,EAAkB;AACrC,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAM,CAAA,SAAU,OAAA,CAAQ,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,OAAA;AACT;AAOA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,OAAO,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,GAAI,OAAA;AACxC;AAGA,SAAS,kBAAkB,IAAA,EAAsB;AAC/C,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,aAAa,IAAI,CAAA,CAAA;AACvD,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,IAAI,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAC1E,IAAA,OAAO,UAAU,IAAI,CAAA,CAAA;AACvB,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,UAAU,IAAI,CAAA,CAAA;AACpD,EAAA,OAAO,IAAA;AACT","file":"chunk-NWWTYBD3.cjs","sourcesContent":["/**\n * T3.10c — Model capability registry (DR3 #17).\n *\n * Typed per-model flags that let the SDK gate features at the boundary\n * (before hitting the provider) instead of letting opaque 400s surface.\n *\n * Resolution algorithm:\n *   1. Strip routing prefixes (openrouter/, vertex/, bedrock/) AND the\n *      OpenRouter `:variant` suffix (:free/:nitro/…) to find the bare vendor id.\n *   2. Exact match in the `EXACT` catalog → return entry.\n *   3. Vendor inference (e.g., `claude-*` → `anthropic/claude-*`) → return entry.\n *   4. No match → conservative defaults (all false, minimum tokens).\n *\n * Module is internal, but `ModelCapabilities` + `resolveModelCapabilities` are\n * re-exported publicly via the `@theokit/sdk/models` subpath (see their @public tags).\n */\n\n/**\n * Per-model capability shape. Consumers use this to gate features at\n * the SDK boundary (before request construction, not after 400).\n *\n * @public\n */\nexport interface ModelCapabilities {\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsToolUse: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens: number;\n  maxOutputTokens: number;\n}\n\nconst CONSERVATIVE_DEFAULTS: ModelCapabilities = {\n  supportsVision: false,\n  supportsStructuredOutput: false,\n  supportsToolUse: false,\n  supportsCacheControl: false,\n  maxContextTokens: 4096,\n  maxOutputTokens: 4096,\n};\n\n/** Routing prefixes to strip to find the underlying vendor model. */\nconst ROUTING_PREFIXES = [\"openrouter/\", \"vertex/\", \"bedrock/\"] as const;\n\nimport { getCatalogModelInfo } from \"../providers/catalog-loader.js\";\nimport type { CatalogModel } from \"../providers/catalog-schema.js\";\n\n/** Map a catalog model block (models.dev shape) to the SDK's ModelCapabilities (M44 — catalog-backed). */\nfunction capsFromCatalog(m: CatalogModel): ModelCapabilities {\n  return {\n    supportsVision: m.modalities?.input?.includes(\"image\") ?? m.attachment ?? false,\n    supportsStructuredOutput: m.structured_output ?? false,\n    supportsToolUse: m.tool_call ?? false,\n    supportsCacheControl: (m as { cache_control?: boolean }).cache_control ?? false,\n    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,\n    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens,\n  };\n}\n\n/**\n * Resolve per-model capability flags (vision/structured-output/tool-use/cache +\n * `maxContextTokens`/`maxOutputTokens`) for a model id. Pure, sync, offline (a\n * static catalog — no network). Strips routing prefixes (`openrouter/`/`vertex/`/\n * `bedrock/`) and OpenRouter `:variant` suffixes before lookup; unknown models get\n * conservative defaults. Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function resolveModelCapabilities(modelId: string): ModelCapabilities {\n  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));\n  // M44 — the catalog model-info index replaced the hand-curated EXACT map (single source of truth; the\n  // vendored provider-catalog.json carries the migrated data — parity-tested against the old map snapshot).\n  const fromIndex = getCatalogModelInfo(bare);\n  if (fromIndex !== undefined) return capsFromCatalog(fromIndex);\n  // Routing-prefixed models (vertex/claude-3-5-sonnet) strip to bare\n  // model name without vendor. Try inferring the vendor from the name.\n  const withVendor = inferVendorPrefix(bare);\n  if (withVendor !== bare) {\n    const vendored = getCatalogModelInfo(withVendor);\n    if (vendored !== undefined) return capsFromCatalog(vendored);\n  }\n  return CONSERVATIVE_DEFAULTS;\n}\n\n/**\n * B-412 / B-475 — whether a model id names an Anthropic model the loop sends cacheable system\n * blocks to. Decided by the id, not by the catalog's `supportsCacheControl`, which is false for the\n * Anthropic ids measured on OpenRouter. After the same routing prefixes the capability lookup\n * strips (`openrouter/`, `vertex/`, `bedrock/`), the id must start with `anthropic/` or `claude`,\n * so Vertex Anthropic ids match and Bedrock ids (`anthropic.claude-…`) do not.\n * @internal\n */\nexport function isAnthropicFamilyModel(modelId: string | undefined): boolean {\n  if (modelId === undefined) return false;\n  return /^(anthropic\\/|claude)/.test(stripRoutingPrefix(modelId));\n}\n\nfunction stripRoutingPrefix(modelId: string): string {\n  for (const prefix of ROUTING_PREFIXES) {\n    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);\n  }\n  return modelId;\n}\n\n/**\n * Strip an OpenRouter variant suffix (`:free`/`:nitro`/`:floor`/`:beta`/…) so the\n * catalog lookup hits the underlying model. Model slugs contain no `:` except the\n * variant separator, so cutting at the first `:` is safe.\n */\nfunction stripVariantSuffix(modelId: string): string {\n  const i = modelId.indexOf(\":\");\n  return i >= 0 ? modelId.slice(0, i) : modelId;\n}\n\n/** Infer vendor prefix from bare model name for routing-prefixed lookups. */\nfunction inferVendorPrefix(bare: string): string {\n  if (bare.startsWith(\"claude\")) return `anthropic/${bare}`;\n  if (bare.startsWith(\"gpt-\") || bare.startsWith(\"o1\") || bare.startsWith(\"o3\"))\n    return `openai/${bare}`;\n  if (bare.startsWith(\"gemini\")) return `google/${bare}`;\n  return bare;\n}\n"]}
+{"version":3,"sources":["../src/internal/llm/model-capabilities.ts"],"names":["getCatalogModelInfo"],"mappings":";;;;;AAgCA,IAAM,qBAAA,GAA2C;AAAA,EAC/C,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,eAAA,EAAiB,KAAA;AAAA,EACjB,oBAAA,EAAsB,KAAA;AAAA,EACtB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB;AACnB,CAAA;AAGA,IAAM,gBAAA,GAAmB,CAAC,aAAA,EAAe,SAAA,EAAW,UAAU,CAAA;AAM9D,SAAS,gBAAgB,CAAA,EAAoC;AAC3D,EAAA,OAAO;AAAA,IACL,cAAA,EAAgB,EAAE,UAAA,EAAY,KAAA,EAAO,SAAS,OAAO,CAAA,IAAK,EAAE,UAAA,IAAc,KAAA;AAAA,IAC1E,wBAAA,EAA0B,EAAE,iBAAA,IAAqB,KAAA;AAAA,IACjD,eAAA,EAAiB,EAAE,SAAA,IAAa,KAAA;AAAA,IAChC,oBAAA,EAAuB,EAAkC,aAAA,IAAiB,KAAA;AAAA,IAC1E,gBAAA,EAAkB,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,qBAAA,CAAsB,gBAAA;AAAA,IAC5D,eAAA,EAAiB,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU,qBAAA,CAAsB;AAAA,GAC5D;AACF;AAWO,SAAS,yBAAyB,OAAA,EAAoC;AAC3E,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAG3D,EAAA,MAAM,SAAA,GAAYA,sCAAoB,IAAI,CAAA;AAC1C,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,eAAA,CAAgB,SAAS,CAAA;AAG7D,EAAA,MAAM,UAAA,GAAa,kBAAkB,IAAI,CAAA;AACzC,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,QAAA,GAAWA,sCAAoB,UAAU,CAAA;AAC/C,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,OAAO,eAAA,CAAgB,QAAQ,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,qBAAA;AACT;AAUO,SAAS,uBAAuB,OAAA,EAAsC;AAC3E,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,KAAA;AAClC,EAAA,OAAO,uBAAA,CAAwB,IAAA,CAAK,kBAAA,CAAmB,OAAO,CAAC,CAAA;AACjE;AAEA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,KAAA,MAAW,UAAU,gBAAA,EAAkB;AACrC,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAM,CAAA,SAAU,OAAA,CAAQ,KAAA,CAAM,OAAO,MAAM,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,OAAA;AACT;AAOA,SAAS,mBAAmB,OAAA,EAAyB;AACnD,EAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,OAAO,KAAK,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA,GAAI,OAAA;AACxC;AAGA,SAAS,kBAAkB,IAAA,EAAsB;AAC/C,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,aAAa,IAAI,CAAA,CAAA;AACvD,EAAA,IAAI,IAAA,CAAK,UAAA,CAAW,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,IAAI,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,IAAI,CAAA;AAC1E,IAAA,OAAO,UAAU,IAAI,CAAA,CAAA;AACvB,EAAA,IAAI,KAAK,UAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,UAAU,IAAI,CAAA,CAAA;AACpD,EAAA,OAAO,IAAA;AACT","file":"chunk-RTDVSHJR.cjs","sourcesContent":["/**\n * T3.10c — Model capability registry (DR3 #17).\n *\n * Typed per-model flags that let the SDK gate features at the boundary\n * (before hitting the provider) instead of letting opaque 400s surface.\n *\n * Resolution algorithm:\n *   1. Strip routing prefixes (openrouter/, vertex/, bedrock/) AND the\n *      OpenRouter `:variant` suffix (:free/:nitro/…) to find the bare vendor id.\n *   2. Exact match in the `EXACT` catalog → return entry.\n *   3. Vendor inference (e.g., `claude-*` → `anthropic/claude-*`) → return entry.\n *   4. No match → conservative defaults (all false, minimum tokens).\n *\n * Module is internal, but `ModelCapabilities` + `resolveModelCapabilities` are\n * re-exported publicly via the `@theokit/sdk/models` subpath (see their @public tags).\n */\n\n/**\n * Per-model capability shape. Consumers use this to gate features at\n * the SDK boundary (before request construction, not after 400).\n *\n * @public\n */\nexport interface ModelCapabilities {\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsToolUse: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens: number;\n  maxOutputTokens: number;\n}\n\nconst CONSERVATIVE_DEFAULTS: ModelCapabilities = {\n  supportsVision: false,\n  supportsStructuredOutput: false,\n  supportsToolUse: false,\n  supportsCacheControl: false,\n  maxContextTokens: 4096,\n  maxOutputTokens: 4096,\n};\n\n/** Routing prefixes to strip to find the underlying vendor model. */\nconst ROUTING_PREFIXES = [\"openrouter/\", \"vertex/\", \"bedrock/\"] as const;\n\nimport { getCatalogModelInfo } from \"../providers/catalog-loader.js\";\nimport type { CatalogModel } from \"../providers/catalog-schema.js\";\n\n/** Map a catalog model block (models.dev shape) to the SDK's ModelCapabilities (M44 — catalog-backed). */\nfunction capsFromCatalog(m: CatalogModel): ModelCapabilities {\n  return {\n    supportsVision: m.modalities?.input?.includes(\"image\") ?? m.attachment ?? false,\n    supportsStructuredOutput: m.structured_output ?? false,\n    supportsToolUse: m.tool_call ?? false,\n    supportsCacheControl: (m as { cache_control?: boolean }).cache_control ?? false,\n    maxContextTokens: m.limit?.context ?? CONSERVATIVE_DEFAULTS.maxContextTokens,\n    maxOutputTokens: m.limit?.output ?? CONSERVATIVE_DEFAULTS.maxOutputTokens,\n  };\n}\n\n/**\n * Resolve per-model capability flags (vision/structured-output/tool-use/cache +\n * `maxContextTokens`/`maxOutputTokens`) for a model id. Pure, sync, offline (a\n * static catalog — no network). Strips routing prefixes (`openrouter/`/`vertex/`/\n * `bedrock/`) and OpenRouter `:variant` suffixes before lookup; unknown models get\n * conservative defaults. Public via `@theokit/sdk/models`.\n *\n * @public\n */\nexport function resolveModelCapabilities(modelId: string): ModelCapabilities {\n  const bare = stripVariantSuffix(stripRoutingPrefix(modelId));\n  // M44 — the catalog model-info index replaced the hand-curated EXACT map (single source of truth; the\n  // vendored provider-catalog.json carries the migrated data — parity-tested against the old map snapshot).\n  const fromIndex = getCatalogModelInfo(bare);\n  if (fromIndex !== undefined) return capsFromCatalog(fromIndex);\n  // Routing-prefixed models (vertex/claude-3-5-sonnet) strip to bare\n  // model name without vendor. Try inferring the vendor from the name.\n  const withVendor = inferVendorPrefix(bare);\n  if (withVendor !== bare) {\n    const vendored = getCatalogModelInfo(withVendor);\n    if (vendored !== undefined) return capsFromCatalog(vendored);\n  }\n  return CONSERVATIVE_DEFAULTS;\n}\n\n/**\n * B-412 / B-475 — whether a model id names an Anthropic model the loop sends cacheable system\n * blocks to. Decided by the id, not by the catalog's `supportsCacheControl`, which is false for the\n * Anthropic ids measured on OpenRouter. After the same routing prefixes the capability lookup\n * strips (`openrouter/`, `vertex/`, `bedrock/`), the id must start with `anthropic/` or `claude`,\n * so Vertex Anthropic ids match and Bedrock ids (`anthropic.claude-…`) do not.\n * @internal\n */\nexport function isAnthropicFamilyModel(modelId: string | undefined): boolean {\n  if (modelId === undefined) return false;\n  return /^(anthropic\\/|claude)/.test(stripRoutingPrefix(modelId));\n}\n\nfunction stripRoutingPrefix(modelId: string): string {\n  for (const prefix of ROUTING_PREFIXES) {\n    if (modelId.startsWith(prefix)) return modelId.slice(prefix.length);\n  }\n  return modelId;\n}\n\n/**\n * Strip an OpenRouter variant suffix (`:free`/`:nitro`/`:floor`/`:beta`/…) so the\n * catalog lookup hits the underlying model. Model slugs contain no `:` except the\n * variant separator, so cutting at the first `:` is safe.\n */\nfunction stripVariantSuffix(modelId: string): string {\n  const i = modelId.indexOf(\":\");\n  return i >= 0 ? modelId.slice(0, i) : modelId;\n}\n\n/** Infer vendor prefix from bare model name for routing-prefixed lookups. */\nfunction inferVendorPrefix(bare: string): string {\n  if (bare.startsWith(\"claude\")) return `anthropic/${bare}`;\n  if (bare.startsWith(\"gpt-\") || bare.startsWith(\"o1\") || bare.startsWith(\"o3\"))\n    return `openai/${bare}`;\n  if (bare.startsWith(\"gemini\")) return `google/${bare}`;\n  return bare;\n}\n"]}

package/dist/{chunk-5HSMH2ZZ.js → chunk-RZL2W4C3.js}

@@ -1,6 +1,6 @@
 import { globalSingleton } from './chunk-AGACYRJ2.js';
-import { resolveCredential } from './chunk-3FSBE4PS.js';
-import { readStoredOAuth } from './chunk-MS3TQSXU.js';
+import { resolveCredential } from './chunk-3GTN4HOO.js';
+import { readStoredOAuth } from './chunk-QD6B6W6I.js';
 import { AuthenticationError } from './chunk-TNFOU6SB.js';
 import { diag } from './chunk-3OY6H3I7.js';
 import { z } from 'zod';
@@ -12,7 +12,15 @@ var REGISTRY = globalSingleton(
   () => /* @__PURE__ */ new Map()
 );
 var ALIASES = globalSingleton("theokit-sdk.providers.aliases", () => /* @__PURE__ */ new Map());
-function registerProvider(profile) {
+function key(name) {
+  return name.toLowerCase();
+}
+function registerProvider(input) {
+  const profile = {
+    ...input,
+    name: key(input.name),
+    ...input.aliases === void 0 ? {} : { aliases: input.aliases.map(key) }
+  };
   if (REGISTRY.has(profile.name)) {
     diag(`[theokit-sdk] Provider "${profile.name}" overridden by user plugin.
 `);
@@ -28,8 +36,8 @@ function registerProvider(profile) {
   }
 }
 function getProviderProfile(name) {
-  const canonical = ALIASES.get(name) ?? name;
-  return REGISTRY.get(canonical);
+  const lower = key(name);
+  return REGISTRY.get(ALIASES.get(lower) ?? lower);
 }
 function listProviders() {
   return Array.from(REGISTRY.values());
@@ -1414,18 +1422,18 @@ var patchedModelKeys = globalSingleton(
 var indexState = globalSingleton("theokit-sdk.providers.model-info-loaded", () => ({
   loaded: false
 }));
-function getCatalogModelInfo(key) {
+function getCatalogModelInfo(key2) {
   ensureModelIndexLoaded();
-  return modelInfoIndex.get(key);
+  return modelInfoIndex.get(key2);
 }
-function isPatchedModelKey(key) {
-  return patchedModelKeys.has(key);
+function isPatchedModelKey(key2) {
+  return patchedModelKeys.has(key2);
 }
-function patchModelInfo(key, model) {
+function patchModelInfo(key2, model) {
   ensureModelIndexLoaded();
-  const existing = modelInfoIndex.get(key);
-  modelInfoIndex.set(key, existing === void 0 ? model : { ...existing, ...model });
-  patchedModelKeys.add(key);
+  const existing = modelInfoIndex.get(key2);
+  modelInfoIndex.set(key2, existing === void 0 ? model : { ...existing, ...model });
+  patchedModelKeys.add(key2);
 }
 function ensureModelIndexLoaded() {
   if (indexState.loaded) return;
@@ -1455,8 +1463,8 @@ function indexEntryModels(entry) {
     }
     modelInfoIndex.set(`${entry.id}/${modelId}`, parsed.data);
     for (const alias of entry.aliases ?? []) {
-      const key = `${alias}/${modelId}`;
-      if (!modelInfoIndex.has(key)) modelInfoIndex.set(key, parsed.data);
+      const key2 = `${alias}/${modelId}`;
+      if (!modelInfoIndex.has(key2)) modelInfoIndex.set(key2, parsed.data);
     }
   }
 }
@@ -1870,5 +1878,5 @@ function registerBuiltins() {
 }
 
 export { catalogModelSchema, getCatalogCapabilities, getCatalogModelInfo, getProviderProfile, inferModelDialect, inferRegionFromModelId, isPatchedModelKey, listProviders, loadProviderCatalog, patchModelInfo, registerBuiltins, registerProvider, resolveBedrockBaseUrl, resolveVertexBaseUrl, stripBedrockPrefix, stripVertexPrefix };
-//# sourceMappingURL=chunk-5HSMH2ZZ.js.map
-//# sourceMappingURL=chunk-5HSMH2ZZ.js.map
+//# sourceMappingURL=chunk-RZL2W4C3.js.map
+//# sourceMappingURL=chunk-RZL2W4C3.js.map