@agimon-ai/po-profile 0.0.0-alpha.113 → 0.0.0-alpha.115

package/dist/extensions/server.cjs

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_profileText = require("../profileText-BinY2lbY.cjs");
+const require_profileText = require("../profileText-CeZ8Up0n.cjs");
 let _agimon_ai_po_core_extensionFile = require("@agimon-ai/po-core/extensionFile");
 let _agimon_ai_po_config_profiles = require("@agimon-ai/po-config/profiles");
 let _agimon_ai_po_core_serverPlugin = require("@agimon-ai/po-core/serverPlugin");

package/dist/extensions/server.mjs

@@ -1,4 +1,4 @@
-import { A as PROFILE_SOURCES_SERVICE, C as PROFILE_RESOLUTION_TIMEOUT_MS, D as resolveInitialProfile, E as readInitialProfileOutcome, N as PROFILE_INITIAL_OUTCOME_SERVICE, O as waitForSources, T as profileWarningText, b as createProfileRuntimePlugin, f as findProfile, g as createProfileSecrets, i as profileItems, j as PROFILE_SECRETS_SERVICE, k as FILE_PROFILE_SOURCE_ID, l as redactSecrets, m as readProfileSources, p as mergeProfiles, s as profileTitle, t as PROFILE_COMMAND, u as createProfileSources, w as createDeadline, y as createProfileRuntime } from "../profileText-3qUgFIgc.mjs";
+import { A as PROFILE_SOURCES_SERVICE, C as PROFILE_RESOLUTION_TIMEOUT_MS, D as resolveInitialProfile, E as readInitialProfileOutcome, N as PROFILE_INITIAL_OUTCOME_SERVICE, O as waitForSources, T as profileWarningText, b as createProfileRuntimePlugin, f as findProfile, g as createProfileSecrets, i as profileItems, j as PROFILE_SECRETS_SERVICE, k as FILE_PROFILE_SOURCE_ID, l as redactSecrets, m as readProfileSources, p as mergeProfiles, s as profileTitle, t as PROFILE_COMMAND, u as createProfileSources, w as createDeadline, y as createProfileRuntime } from "../profileText-zg12bf1S.mjs";
 import { composeRootHooks, composeRootInjects, defineHook, defineResource, defineRoot, defineRoute, defineRoutedContribution, defineServiceContract, runCleanups } from "@agimon-ai/po-core/extensionFile";
 import { ProfileCatalogChangedError, buildPersonaPrompt, commitGlobalProfileRootAsync, loadProfiles, loadProfilesAsync, planGlobalProfileRootAsync } from "@agimon-ai/po-config/profiles";
 import { PO_SERVER_SCOPE_SERVICE, composeServerProviderOverrides, defineServerPlugin, packageResourcePath, readPackageResource, requirePoServerScope } from "@agimon-ai/po-core/serverPlugin";

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_profileText = require("./profileText-BinY2lbY.cjs");
+const require_profileText = require("./profileText-CeZ8Up0n.cjs");
 exports.FILE_PROFILE_SOURCE_ID = require_profileText.FILE_PROFILE_SOURCE_ID;
 exports.PROFILE_INITIAL_OUTCOME_CONTRACT = require_profileText.PROFILE_INITIAL_OUTCOME_CONTRACT;
 exports.PROFILE_INITIAL_OUTCOME_SERVICE = require_profileText.PROFILE_INITIAL_OUTCOME_SERVICE;

package/dist/index.d.mts

@@ -168,6 +168,7 @@ declare module '@deepseek-ai/cordis' {
 //#region src/services/profileRuntime/type.d.ts
 interface ProfileRuntimeSnapshot {
   readonly profileName?: string;
+  /** Selected identity snapshot. Secret delivery rechecks the source's current aliases. */
   readonly integration?: ProfileIntegrationBinding;
   /** The profile's declared nonsecret env, never the host process environment. */
   readonly env?: Readonly<Record<string, string>>;
@@ -219,7 +220,7 @@ interface ProfileRuntime {
 }
 interface ProfileRuntimeOptions {
   readonly profileName?: string;
-  /** Reads only metadata. The runtime clones it before handing it to providers. */
+  /** Reads current value-free metadata. Selection pins identity; each grant refreshes and fences aliases. */
   readonly readBinding: (profileName: string) => ProfileIntegrationBinding | undefined;
   /** Reads the profile's declared nonsecret env. */
   readonly readEnv?: (profileName: string) => Readonly<Record<string, string>> | undefined;

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":["_0","_0","_0"],"sources":["../src/constants/profileInitialOutcome.ts","../src/constants/profileRuntime.ts","../src/constants/profileSecrets.ts","../src/constants/profileSources.ts","../src/services/profileSources/type.ts","../src/services/launchProfiles/type.ts","../src/services/profileResolution/type.ts","../src/services/profileResolution/index.ts","../src/services/profileRuntime/type.ts","../src/services/profileRuntime/index.ts","../src/services/profileSecrets/type.ts","../src/services/profileSecrets/index.ts","../src/services/profileSources/index.ts","../src/services/secretRedaction/type.ts","../src/services/secretRedaction/index.ts","../src/services/profileText/index.ts"],"mappings":";;;;qBACa;;;qBCDA;;;qBCCA;;;qBCAA;;;;UCEI;WACN;;;;;;;;UASM;;EAEf,KAAK,QAAQ,wBAAwB;;;;;EAKrC,OAAO,OAAO,0BAA0B,QAAQ,cAAc;;;;;EAK9D,gBACE,OAAO,0BACP,QAAQ,mCACc;;;KAId,qBAAqB;WAA0B;;;UAG1C;WACN;WACA,SAAS;;UAGH;;EAEf,SAAS,YAAY,QAAQ;;;;;EAK7B,KAAK,QAAQ,eAAe;;EAE5B,YAAY,QAAQ,eAAe;;;;;EAKnC,MAAM,OAAO,0BAA0B,QAAQ,cAAc;;;;;EAK7D,eAAe,OAAO,0BAA0B,QAAQ,cAAc;;;;;qBCtD3D;;UAGI;WACN;WACA;aACE;aACA;aACA;aACA;;;WAGF;;UAGM;WACN,mBAAmB;;WAEnB;;UAGM;WACN,gBAAgB;WAChB,SAAS;WACT,OAAO;;WAEP,QAAQ;;WAER;;;;;;;;;;KCzBC;WACG;;WACA;WAAwB;;WACxB;;;UAGE;WACN;;WAEA;;;;;;UAOM;WACN,QAAQ;WACR;;WAEA;WACA,UAAU;;UAGJ;WACN,QAAQ;;WAER,QAAQ;;WAER,QAAQ;;WAER;;;;;qBCvBE;;qBAIA,4EAAgC,kBAAA;;wBAM7B,0BAA0B,SAAS,UAAU;;;;;;;;;wBA0FvC,sBACpB,gBAAgB,gBAChB,SAAS,4BACT,SAAS,+BACR,QAAQ;;wBA4CK,mBAAmB,SAAS;;YAWhC;IACR,8BAA8B;;;;;UC1KjB;WACN;WACA,cAAc;;WAEd,MAAM,SAAS;WACf,UAAU,SAAS,eAAe;WAClC;WACA,QAAQ;;;UAIF;EACf,cAAc,WAAW,wBAAwB,QAAQ,cAAc;EACvE,kBAAkB;;;KAIR,0BACV,SAAS,2BACT;WAAoB;WAA8B,QAAQ;WAAsB;MAC7E,QAAQ;UAEI;;WAEN;WACA,SAAS;;UAGH;;WAEN;WACA;WACA,SAAS;;UAGH;EACf,iBAAiB;;EAEjB,SAAS;;EAET,eAAe,sBAAsB,SAAS,yBAAyB,cAAc;;EAErF,cAAc,cAAc,SAAS,uBAAuB;;EAE5D,mBAAmB,cAAc,SAAS,4BAA4B;;EAEtE,mBAAmB,SAAS,cAAc;;EAE1C,OAAO,sBAAsB;aAAqB;MAAoB;;EAEtE;EACA,WAAW;;UAGI;WACN;;WAEA,cAAc,wBAAwB;;WAEtC,WAAW,wBAAwB,SAAS;WAC5C,eAAe,wBAAwB,SAAS,eAAe;;WAE/D,aAAa,mBAAmB,aAAa,QAAQ,gBAAgB;;;;wBCqOhE,qBAAqB,SAAS,wBAAwB;;wBAKtD,2BAA2B,SAAS,kBAAkB,SAAS;wBAM/D,sBAAsB,SAAS,UAAU;;YAO7C;IACR,sBAAsB;;;;;UCxTT;;WAEN;WACA;;WAEA;WACA,SAAS;WACT;;;UAIM;;EAEf,iBAAiB,kBAAkB,SAAS;;EAE5C,WAAW,SAAS,0BAA0B,QAAQ;;UAGvC;;WAEN,cACP,aACA,iBACA,sCACG,wCAAwC,QAAQ;;;;wBCyCvC,qBAAqB,SAAS,wBAAwB;;qBAKzD,8BAA8B,mBAAmB;mBAGzC;EAFnB,YACE,SAAS,SACQ,QAAQ;EAK3B,iBAAiB,kBAAkB,SAAS;EAI5C,WAAW,SAAS,0BAA0B,QAAQ;;;wBAMxC,2BAA2B,QAAQ,kBAAkB,SAAS;wBAM9D,sBAAsB,SAAS,UAAU;;YAO7C;IAER,sBAAsB;;;;;wBCvCV,wBAAwB;;wBAKxB,cAAc,gBAAgB,gBAAgB,SAAS,6BAA6B;wBAMpF,YACd,gBAAgB,gBAChB,SAAS,4BACT,eACC;;wBAsCa,2BAA2B,QAAQ,kBAAkB,SAAS;;wBAO9D,mBAAmB,SAAS,SAAS,QAAQ,eAAe;;YAahE;IAER,sBAAsB;;;;;;UC7IT;;EAEf,MAAM;;EAEN;;;;;wBC+Cc,cAAc,GAAG,OAAO,GAAG,SAAS,mBAAmB;wBAIvD,4BAA4B,SAAS,mBAAmB;;;;UCpD9D;EACR;EACA;EACA;EACA;;qBAGW;;;;;;wBAaG,cAAc,6BAA6B;;;;;wBAc3C,aAAa,UAAU,iBAAiB;;wBAkBxC,mBAAmB,SAAS;;wBAQ5B,eAAe,SAAS;wBAUxB,aAAa"}
+{"version":3,"file":"index.d.mts","names":["_0","_0","_0"],"sources":["../src/constants/profileInitialOutcome.ts","../src/constants/profileRuntime.ts","../src/constants/profileSecrets.ts","../src/constants/profileSources.ts","../src/services/profileSources/type.ts","../src/services/launchProfiles/type.ts","../src/services/profileResolution/type.ts","../src/services/profileResolution/index.ts","../src/services/profileRuntime/type.ts","../src/services/profileRuntime/index.ts","../src/services/profileSecrets/type.ts","../src/services/profileSecrets/index.ts","../src/services/profileSources/index.ts","../src/services/secretRedaction/type.ts","../src/services/secretRedaction/index.ts","../src/services/profileText/index.ts"],"mappings":";;;;qBACa;;;qBCDA;;;qBCCA;;;qBCAA;;;;UCEI;WACN;;;;;;;;UASM;;EAEf,KAAK,QAAQ,wBAAwB;;;;;EAKrC,OAAO,OAAO,0BAA0B,QAAQ,cAAc;;;;;EAK9D,gBACE,OAAO,0BACP,QAAQ,mCACc;;;KAId,qBAAqB;WAA0B;;;UAG1C;WACN;WACA,SAAS;;UAGH;;EAEf,SAAS,YAAY,QAAQ;;;;;EAK7B,KAAK,QAAQ,eAAe;;EAE5B,YAAY,QAAQ,eAAe;;;;;EAKnC,MAAM,OAAO,0BAA0B,QAAQ,cAAc;;;;;EAK7D,eAAe,OAAO,0BAA0B,QAAQ,cAAc;;;;;qBCtD3D;;UAGI;WACN;WACA;aACE;aACA;aACA;aACA;;;WAGF;;UAGM;WACN,mBAAmB;;WAEnB;;UAGM;WACN,gBAAgB;WAChB,SAAS;WACT,OAAO;;WAEP,QAAQ;;WAER;;;;;;;;;;KCzBC;WACG;;WACA;WAAwB;;WACxB;;;UAGE;WACN;;WAEA;;;;;;UAOM;WACN,QAAQ;WACR;;WAEA;WACA,UAAU;;UAGJ;WACN,QAAQ;;WAER,QAAQ;;WAER,QAAQ;;WAER;;;;;qBCvBE;;qBAIA,4EAAgC,kBAAA;;wBAM7B,0BAA0B,SAAS,UAAU;;;;;;;;;wBA0FvC,sBACpB,gBAAgB,gBAChB,SAAS,4BACT,SAAS,+BACR,QAAQ;;wBA4CK,mBAAmB,SAAS;;YAWhC;IACR,8BAA8B;;;;;UC1KjB;WACN;;WAEA,cAAc;;WAEd,MAAM,SAAS;WACf,UAAU,SAAS,eAAe;WAClC;WACA,QAAQ;;;UAIF;EACf,cAAc,WAAW,wBAAwB,QAAQ,cAAc;EACvE,kBAAkB;;;KAIR,0BACV,SAAS,2BACT;WAAoB;WAA8B,QAAQ;WAAsB;MAC7E,QAAQ;UAEI;;WAEN;WACA,SAAS;;UAGH;;WAEN;WACA;WACA,SAAS;;UAGH;EACf,iBAAiB;;EAEjB,SAAS;;EAET,eAAe,sBAAsB,SAAS,yBAAyB,cAAc;;EAErF,cAAc,cAAc,SAAS,uBAAuB;;EAE5D,mBAAmB,cAAc,SAAS,4BAA4B;;EAEtE,mBAAmB,SAAS,cAAc;;EAE1C,OAAO,sBAAsB;aAAqB;MAAoB;;EAEtE;EACA,WAAW;;UAGI;WACN;;WAEA,cAAc,wBAAwB;;WAEtC,WAAW,wBAAwB,SAAS;WAC5C,eAAe,wBAAwB,SAAS,eAAe;;WAE/D,aAAa,mBAAmB,aAAa,QAAQ,gBAAgB;;;;wBC4PhE,qBAAqB,SAAS,wBAAwB;;wBAKtD,2BAA2B,SAAS,kBAAkB,SAAS;wBAM/D,sBAAsB,SAAS,UAAU;;YAO7C;IACR,sBAAsB;;;;;UChVT;;WAEN;WACA;;WAEA;WACA,SAAS;WACT;;;UAIM;;EAEf,iBAAiB,kBAAkB,SAAS;;EAE5C,WAAW,SAAS,0BAA0B,QAAQ;;UAGvC;;WAEN,cACP,aACA,iBACA,sCACG,wCAAwC,QAAQ;;;;wBCyCvC,qBAAqB,SAAS,wBAAwB;;qBAKzD,8BAA8B,mBAAmB;mBAGzC;EAFnB,YACE,SAAS,SACQ,QAAQ;EAK3B,iBAAiB,kBAAkB,SAAS;EAI5C,WAAW,SAAS,0BAA0B,QAAQ;;;wBAMxC,2BAA2B,QAAQ,kBAAkB,SAAS;wBAM9D,sBAAsB,SAAS,UAAU;;YAO7C;IAER,sBAAsB;;;;;wBCvCV,wBAAwB;;wBAKxB,cAAc,gBAAgB,gBAAgB,SAAS,6BAA6B;wBAMpF,YACd,gBAAgB,gBAChB,SAAS,4BACT,eACC;;wBAsCa,2BAA2B,QAAQ,kBAAkB,SAAS;;wBAO9D,mBAAmB,SAAS,SAAS,QAAQ,eAAe;;YAahE;IAER,sBAAsB;;;;;;UC7IT;;EAEf,MAAM;;EAEN;;;;;wBC+Cc,cAAc,GAAG,OAAO,GAAG,SAAS,mBAAmB;wBAIvD,4BAA4B,SAAS,mBAAmB;;;;UCpD9D;EACR;EACA;EACA;EACA;;qBAGW;;;;;;wBAaG,cAAc,6BAA6B;;;;;wBAc3C,aAAa,UAAU,iBAAiB;;wBAkBxC,mBAAmB,SAAS;;wBAQ5B,eAAe,SAAS;wBAUxB,aAAa"}

package/dist/index.mjs

@@ -1 +1 @@
-export { k as FILE_PROFILE_SOURCE_ID, S as PROFILE_INITIAL_OUTCOME_CONTRACT, N as PROFILE_INITIAL_OUTCOME_SERVICE, C as PROFILE_RESOLUTION_TIMEOUT_MS, M as PROFILE_RUNTIME_SERVICE, j as PROFILE_SECRETS_SERVICE, A as PROFILE_SOURCES_SERVICE, n as PROFILE_STATUS_KEY, h as ProfileSecretsService, y as createProfileRuntime, b as createProfileRuntimePlugin, g as createProfileSecrets, _ as createProfileSecretsPlugin, u as createProfileSources, d as createProfileSourcesPlugin, c as createSecretRedactionStream, f as findProfile, p as mergeProfiles, r as profileDescription, i as profileItems, a as profileStatus, o as profileSummary, s as profileTitle, T as profileWarningText, E as readInitialProfileOutcome, m as readProfileSources, l as redactSecrets, x as requireProfileRuntime, v as requireProfileSecrets, D as resolveInitialProfile } from "./profileText-3qUgFIgc.mjs";
+export { k as FILE_PROFILE_SOURCE_ID, S as PROFILE_INITIAL_OUTCOME_CONTRACT, N as PROFILE_INITIAL_OUTCOME_SERVICE, C as PROFILE_RESOLUTION_TIMEOUT_MS, M as PROFILE_RUNTIME_SERVICE, j as PROFILE_SECRETS_SERVICE, A as PROFILE_SOURCES_SERVICE, n as PROFILE_STATUS_KEY, h as ProfileSecretsService, y as createProfileRuntime, b as createProfileRuntimePlugin, g as createProfileSecrets, _ as createProfileSecretsPlugin, u as createProfileSources, d as createProfileSourcesPlugin, c as createSecretRedactionStream, f as findProfile, p as mergeProfiles, r as profileDescription, i as profileItems, a as profileStatus, o as profileSummary, s as profileTitle, T as profileWarningText, E as readInitialProfileOutcome, m as readProfileSources, l as redactSecrets, x as requireProfileRuntime, v as requireProfileSecrets, D as resolveInitialProfile } from "./profileText-zg12bf1S.mjs";

package/dist/{profileText-BinY2lbY.cjs → profileText-CeZ8Up0n.cjs}

@@ -347,13 +347,28 @@ var SessionProfileRuntime = class {
 			if (!reference.purposes.includes("proxy")) throw new Error("Profile secret alias is unavailable");
 		});
 	}
+	/** Refresh only value-free aliases, never the selected provider or browser identity. */
+	currentBinding(snapshot) {
+		if (!snapshot.integration || snapshot.profileName === void 0) return void 0;
+		let current;
+		try {
+			current = (0, _agimon_ai_po_config_profiles.parseProfileBinding)(this.options.readBinding(snapshot.profileName));
+		} catch {
+			throw new Error(INVALIDATED);
+		}
+		const selected = snapshot.integration;
+		if (current.provider !== selected.provider || current.organizationId !== selected.organizationId || current.mailboxId !== selected.mailboxId || current.credentialRef !== selected.credentialRef) throw new Error(INVALIDATED);
+		return current;
+	}
 	async resolveReference(name, requestSignal, authorize) {
 		if (this.initializing) throw new Error("Profile secrets are unavailable during provider initialization");
 		await this.ready();
 		const snapshot = this.snapshot;
 		const connection = this.connection;
+		const current = this.currentBinding(snapshot);
 		const vaultReference = snapshot.secrets && Object.hasOwn(snapshot.secrets, name) ? snapshot.secrets[name] : void 0;
-		const providerReference = snapshot.integration?.secrets && Object.hasOwn(snapshot.integration.secrets, name) ? snapshot.integration.secrets[name] : void 0;
+		const providerReference = current?.secrets && Object.hasOwn(current.secrets, name) ? current.secrets[name] : void 0;
+		if (vaultReference && providerReference) throw new Error("Profile secret aliases must be unique");
 		const signal = requestSignal ? AbortSignal.any([snapshot.signal, requestSignal]) : snapshot.signal;
 		const saved = vaultReference || providerReference ? void 0 : await this.savedSecret(name, signal);
 		const reference = vaultReference ?? providerReference ?? saved?.reference;
@@ -378,6 +393,7 @@ var SessionProfileRuntime = class {
 			throw new Error("Profile secret resolution failed");
 		}
 		if (signal.aborted || this.snapshot !== snapshot || this.connection !== connection) throw new Error(INVALIDATED);
+		if (JSON.stringify(this.currentBinding(snapshot)?.secrets[name]) !== JSON.stringify(providerReference)) throw new Error(INVALIDATED);
 		if (typeof value !== "string" || value.length === 0) throw new Error("Profile secret field is unavailable");
 		return value;
 	}
@@ -955,4 +971,4 @@ Object.defineProperty(exports, "waitForSources", {
 	}
 });
 
-//# sourceMappingURL=profileText-BinY2lbY.cjs.map
+//# sourceMappingURL=profileText-CeZ8Up0n.cjs.map

package/dist/profileText-CeZ8Up0n.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"profileText-CeZ8Up0n.cjs","names":["defineServiceContract","UNAVAILABLE","parseProfileVaultSecrets","parseProfileBinding","Service","inlineProfile","Service"],"sources":["../src/constants/profileInitialOutcome.ts","../src/constants/profileRuntime.ts","../src/constants/profileSecrets.ts","../src/constants/profileSources.ts","../src/services/launchProfiles/type.ts","../src/services/profileResolution/index.ts","../src/services/profileRuntime/index.ts","../src/services/profileSecrets/index.ts","../src/services/profileSources/index.ts","../src/services/secretRedaction/index.ts","../src/services/profileText/index.ts"],"sourcesContent":["/** The decision about a session's first profile, published on the session context before its plugins start. */\nexport const PROFILE_INITIAL_OUTCOME_SERVICE = 'po/profile-initial-outcome';\n","export const PROFILE_RUNTIME_SERVICE = 'po/profile-runtime';\n","// @scaffold-generated\nexport const PROFILE_SECRETS_SERVICE = 'po/profile-secrets';\n","// @scaffold-generated\nexport const PROFILE_SOURCES_SERVICE = 'po/profile-sources';\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\n\n/** The source id every profile read from a `profiles.yaml` carries. */\nexport const FILE_PROFILE_SOURCE_ID = 'files';\n\n/** One profile a launcher may offer. Display data only: never a persona, environment, binding or secret. */\nexport interface LaunchProfileItem {\n  readonly name: string;\n  readonly identity?: {\n    readonly name?: string;\n    readonly icon?: string;\n    readonly role?: string;\n    readonly contact?: string;\n  };\n  /** `files`, or the id a plugin registered its source under. */\n  readonly sourceId: string;\n}\n\nexport interface LaunchProfileCatalog {\n  readonly profiles: readonly LaunchProfileItem[];\n  /** `unavailable` means a source did not become ready in time or failed; `profiles` lists what exists already. */\n  readonly readiness: 'ready' | 'unavailable';\n}\n\nexport interface ListLaunchProfilesInput {\n  readonly files: readonly AgentProfile[];\n  readonly sources: ProfileSources | undefined;\n  readonly scope: ProfileScope;\n  /** The request going away rejects the listing. */\n  readonly signal: AbortSignal;\n  /** The one budget for waiting on sources. Defaults to ten seconds. */\n  readonly timeoutMs?: number;\n}\n","// @scaffold-generated\nimport type { AgentProfile } from '@agimon-ai/po-config/profiles';\nimport { defineServiceContract } from '@agimon-ai/po-core/extensionFile';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_INITIAL_OUTCOME_SERVICE } from '../../constants/profileInitialOutcome';\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\nimport type {\n  Deadline,\n  DeadlineResult,\n  InitialProfileOutcome,\n  InitialProfileWarning,\n  ResolveInitialProfileOptions,\n} from './type';\n\n/** One budget for every wait of a resolution. */\nexport const PROFILE_RESOLUTION_TIMEOUT_MS = 10_000;\nconst SECONDS = PROFILE_RESOLUTION_TIMEOUT_MS / 1_000;\n\n/** Published on a session context by whoever launches it, or by the session itself when nobody did. */\nexport const PROFILE_INITIAL_OUTCOME_CONTRACT = defineServiceContract<InitialProfileOutcome>(\n  PROFILE_INITIAL_OUTCOME_SERVICE,\n  { scope: 'session' },\n);\n\n/** The outcome a launcher already decided, or undefined when this session was not launched with one. */\nexport function readInitialProfileOutcome(context: Context): InitialProfileOutcome | undefined {\n  return context.get(PROFILE_INITIAL_OUTCOME_SERVICE);\n}\n\nconst abortReason = (signal: AbortSignal): Error =>\n  signal.reason instanceof Error ? signal.reason : new Error('Profile resolution was aborted');\n\n/**\n * A single absolute deadline shared by every wait of one resolution.\n *\n * Hooks receive a signal that aborts when the deadline passes, the owner aborts, or the deadline is disposed:\n * work shared with other waiters must keep running when that signal fires. A hook that ignores the signal cannot\n * hold the resolution back, and its late result or failure is dropped.\n */\nexport function createDeadline(owner: AbortSignal, timeoutMs: number): Deadline {\n  const controller = new AbortController();\n  let expired = false;\n  let expire!: (result: DeadlineResult<never>) => void;\n  let interrupt!: (error: Error) => void;\n  const interruption = new Promise<DeadlineResult<never>>((resolve, reject) => {\n    expire = resolve;\n    interrupt = reject;\n  });\n  // Waits observe this promise, but it can settle between two of them.\n  interruption.catch(() => undefined);\n\n  const onOwnerAbort = () => {\n    interrupt(abortReason(owner));\n    controller.abort(owner.reason);\n  };\n  if (owner.aborted) onOwnerAbort();\n  else owner.addEventListener('abort', onOwnerAbort, { once: true });\n  const timer = setTimeout(() => {\n    expired = true;\n    expire({ status: 'timeout' });\n    controller.abort(new Error('Profile resolution timed out'));\n  }, timeoutMs);\n\n  return {\n    signal: controller.signal,\n    within<T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> {\n      if (owner.aborted) return Promise.reject(abortReason(owner));\n      if (expired) return Promise.resolve({ status: 'timeout' });\n      let work: Promise<T>;\n      try {\n        work = Promise.resolve(start(controller.signal));\n      } catch {\n        return Promise.resolve({ status: 'failed' });\n      }\n      const finished = work.then(\n        (value): DeadlineResult<T> => ({ status: 'done', value }),\n        (): DeadlineResult<T> => ({ status: 'failed' }),\n      );\n      return Promise.race([finished, interruption]);\n    },\n    dispose() {\n      clearTimeout(timer);\n      owner.removeEventListener('abort', onOwnerAbort);\n      if (!controller.signal.aborted) controller.abort(new Error('Profile resolution finished'));\n    },\n  };\n}\n\n/** Waits once for source readiness, without discarding profiles that already loaded. */\nexport async function waitForSources(\n  sources: ProfileSources | undefined,\n  scope: ProfileScope | undefined,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Promise<'done' | 'timeout' | 'failed'> {\n  signal.throwIfAborted();\n  if (sources === undefined) return 'done';\n  const deadline = createDeadline(signal, timeoutMs);\n  try {\n    return (await deadline.within((waitSignal) => sources.ready(scope, waitSignal))).status;\n  } finally {\n    deadline.dispose();\n  }\n}\nconst names = (files: readonly AgentProfile[], sources: ProfileSources | undefined, scope: ProfileScope | undefined) =>\n  new Set([...files.map(({ name }) => name), ...(sources?.list(scope).map(({ name }) => name) ?? [])]);\n\n/**\n * Decides which profile a session starts with, once.\n *\n * Resolves a name that is already listed at once. Waits for sources to become ready only when a requested name\n * is missing, and consults a source default only when nothing was requested in a known workspace; a default its\n * catalog does not list yet waits for readiness too. Every wait shares one deadline. A name that never arrives, a source that fails and a default that is not in the\n * workspace catalog all give a session with no profile and one warning; only the owner aborting rejects.\n */\nexport async function resolveInitialProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  options: ResolveInitialProfileOptions,\n): Promise<InitialProfileOutcome> {\n  options.signal.throwIfAborted();\n  const { intent, scope } = options;\n  const workspaceId = scope?.workspaceId;\n  const base: InitialProfileOutcome = { intent, ...(workspaceId === undefined ? {} : { workspaceId }) };\n  if (intent.kind === 'none') return base;\n\n  // Created by the first wait, so a profile that is already listed costs no timer.\n  const held: { deadline?: Deadline } = {};\n  const within = <T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> => {\n    held.deadline ??= createDeadline(options.signal, options.timeoutMs ?? PROFILE_RESOLUTION_TIMEOUT_MS);\n    return held.deadline.within(start);\n  };\n  const warn = (warning: InitialProfileWarning): InitialProfileOutcome => ({ ...base, warning });\n  try {\n    if (intent.kind === 'named') {\n      const requested = intent.name;\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (sources === undefined) return warn({ code: 'missing', requested });\n      const waited = await within((signal) => sources.ready(scope, signal));\n      // A usable profile wins over a source that failed or ran out of time.\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (waited.status === 'timeout') return warn({ code: 'timeout', requested });\n      return warn({ code: waited.status === 'failed' ? 'source-failed' : 'missing', requested });\n    }\n    if (workspaceId === undefined || sources === undefined) return base;\n    const waited = await within((signal) => sources.defaultProfile(scope, signal));\n    if (waited.status === 'timeout') return warn({ code: 'timeout' });\n    if (waited.status === 'failed') return warn({ code: 'source-failed' });\n    const chosen = waited.value;\n    if (chosen === undefined) return base;\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    // A source may name its default before its catalog is published: wait for the sources before ruling it out.\n    const settled = await within((signal) => sources.ready(scope, signal));\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    if (settled.status === 'timeout') return warn({ code: 'timeout', requested: chosen });\n    if (settled.status === 'failed') return warn({ code: 'source-failed', requested: chosen });\n    return warn({ code: 'invalid-default', requested: chosen });\n  } finally {\n    held.deadline?.dispose();\n  }\n}\n\n/** The one-line notice for a session that started without the profile it was meant to have. Names only. */\nexport function profileWarningText(warning: InitialProfileWarning): string {\n  const { code, requested } = warning;\n  const subject = requested === undefined ? 'The workspace default profile' : `Profile \"${requested}\"`;\n  const outcome = 'so this session started without a profile.';\n  if (code === 'timeout') return `${subject} was not ready within ${SECONDS} seconds, ${outcome}`;\n  if (code === 'source-failed') return `${subject} could not be loaded because its source failed, ${outcome}`;\n  if (code === 'invalid-default') return `The default profile \"${requested}\" is not available, ${outcome}`;\n  return `${subject} is not available, ${outcome}`;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-initial-outcome': InitialProfileOutcome;\n  }\n}\n","import {\n  parseProfileBinding,\n  parseProfileVaultSecrets,\n  type ProfileIntegrationBinding,\n  type ProfileSecretReference,\n  type ProfileVaultSecretReference,\n} from '@agimon-ai/po-config/profiles';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_RUNTIME_SERVICE } from '../../constants/profileRuntime';\nimport type {\n  ProfileProviderFactory,\n  ProfileInputSecretRequest,\n  ProfileRuntime,\n  ProfileRuntimeOptions,\n  ProfileRuntimeSnapshot,\n  ProfileSecretRequest,\n  ProfileSecretResolver,\n} from './type';\n\nconst UNAVAILABLE = 'Profile integration provider is unavailable';\nconst INVALIDATED = 'Profile operation was invalidated';\n/** Vault namespace for secrets saved from the composer; po-vault's `VAULT_SECRETS_NAMESPACE` writes it. */\nconst VAULT_SECRETS_NAMESPACE = 'secrets';\nconst ALIAS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/u;\n\n/** A single selected profile and provider, owned by one session, not a provider registry. */\nclass SessionProfileRuntime implements ProfileRuntime {\n  private controller = new AbortController();\n  private snapshot: ProfileRuntimeSnapshot;\n  private provider?: { name: string; factory: ProfileProviderFactory };\n  private connection?: ProfileSecretResolver;\n  private transition: Promise<void> = Promise.resolve();\n  private retirement: Promise<void> = Promise.resolve();\n  private readonly pending = new Set<Promise<void>>();\n  private initializing = false;\n  private disposed = false;\n  private disposal?: Promise<void>;\n\n  constructor(private readonly options: ProfileRuntimeOptions) {\n    this.snapshot = this.capture(options.profileName, 1);\n  }\n\n  private capture(profileName: string | undefined, generation: number): ProfileRuntimeSnapshot {\n    const binding = profileName === undefined ? undefined : this.options.readBinding(profileName);\n    const env = profileName === undefined ? undefined : this.options.readEnv?.(profileName);\n    const sourceSecrets = profileName === undefined ? undefined : this.options.readSecrets?.(profileName);\n    const secrets = sourceSecrets === undefined ? undefined : parseProfileVaultSecrets(sourceSecrets);\n    if (secrets && Object.keys(secrets).some((name) => binding?.secrets && Object.hasOwn(binding.secrets, name))) {\n      throw new Error('Profile secret aliases must be unique');\n    }\n    return Object.freeze({\n      ...(profileName === undefined ? {} : { profileName }),\n      ...(binding === undefined ? {} : { integration: parseProfileBinding(binding) }),\n      ...(env === undefined ? {} : { env: Object.freeze({ ...env }) }),\n      ...(secrets === undefined ? {} : { secrets }),\n      generation,\n      signal: this.controller.signal,\n    });\n  }\n\n  readSelection(): ProfileRuntimeSnapshot {\n    return this.snapshot;\n  }\n\n  invalidate(): void {\n    this.controller.abort();\n    const connection = this.connection;\n    this.connection = undefined;\n    if (connection) {\n      this.retirement = this.retirement.then(async () => {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n      });\n      void this.track(this.retirement);\n    }\n  }\n\n  private track(work: Promise<void>): Promise<void> {\n    this.pending.add(work);\n    // Keep rejection observable through ready/dispose while preventing an unhandled\n    // rejection when selection invalidates an initialization before its owner awaits it.\n    void work.then(\n      () => this.pending.delete(work),\n      () => this.pending.delete(work),\n    );\n    return work;\n  }\n\n  private initialize(): Promise<void> {\n    const snapshot = this.snapshot;\n    const provider = this.provider;\n    this.initializing = Boolean(snapshot.integration && provider);\n    const work = (async () => {\n      await this.retirement;\n      if (snapshot.signal.aborted) return;\n      if (!snapshot.integration || !provider) return;\n      if (snapshot.integration.provider !== provider.name) throw new Error(UNAVAILABLE);\n      let connection: ProfileSecretResolver;\n      try {\n        connection = await provider.factory(snapshot.integration, {\n          profileName: snapshot.profileName!,\n          generation: snapshot.generation,\n          signal: snapshot.signal,\n        });\n      } catch {\n        // A retired factory commonly rejects on abort. That cannot remove the\n        // provider attachment or poison the replacement generation.\n        if (snapshot.signal.aborted) return;\n        throw new Error('Profile provider initialization failed');\n      }\n      if (snapshot.signal.aborted || this.snapshot !== snapshot || this.disposed) {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n        return;\n      }\n      this.connection = connection;\n    })();\n    this.transition = this.track(\n      work.finally(() => {\n        if (this.snapshot === snapshot) this.initializing = false;\n      }),\n    );\n    return this.transition;\n  }\n\n  async select(profileName?: string, options?: { readonly force?: boolean }): Promise<void> {\n    if (this.disposed) throw new Error(INVALIDATED);\n    if (\n      options?.force !== true &&\n      this.snapshot.profileName === profileName &&\n      !this.snapshot.signal.aborted &&\n      (!this.snapshot.integration || !this.provider || this.connection || this.initializing)\n    )\n      return;\n    this.invalidate();\n    this.controller = new AbortController();\n    // If reading/validation fails, leave the old generation aborted, never usable.\n    this.snapshot = this.capture(profileName, this.snapshot.generation + 1);\n    await this.initialize();\n  }\n\n  async ready(): Promise<void> {\n    const snapshot = this.snapshot;\n    await this.transition;\n    if (this.disposed || snapshot.signal.aborted || this.snapshot !== snapshot) throw new Error(INVALIDATED);\n    if (snapshot.integration && !this.connection) throw new Error(UNAVAILABLE);\n  }\n\n  async attachProvider(providerName: string, factory: ProfileProviderFactory): Promise<() => Promise<void>> {\n    if (this.disposed || this.snapshot.signal.aborted) throw new Error(INVALIDATED);\n    if (this.provider) throw new Error('Profile provider is already attached');\n    if (this.snapshot.integration && this.snapshot.integration.provider !== providerName) throw new Error(UNAVAILABLE);\n    const provider = { name: providerName, factory };\n    this.provider = provider;\n    try {\n      await this.initialize();\n      await this.ready();\n      if (this.disposed || this.provider !== provider) throw new Error(INVALIDATED);\n    } catch {\n      if (this.provider === provider) this.provider = undefined;\n      this.invalidate();\n      throw new Error('Profile provider initialization failed');\n    }\n    let detached = false;\n    return async () => {\n      if (detached || this.provider !== provider) return;\n      detached = true;\n      this.invalidate();\n      this.provider = undefined;\n      this.controller = new AbortController();\n      this.snapshot = Object.freeze({\n        ...this.snapshot,\n        generation: this.snapshot.generation + 1,\n        signal: this.controller.signal,\n      });\n      await this.retirement;\n    };\n  }\n\n  resolveSecret(name: string, request: ProfileSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (!reference.purposes.includes('browser')) throw new Error('Profile secret alias is unavailable');\n      if (!reference.allowedOrigins.includes(request.origin)) throw new Error('Profile secret origin is not allowed');\n    });\n  }\n\n  resolveInputSecret(name: string, request: ProfileInputSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (\n        !reference.purposes.includes('input') ||\n        !reference.allowedTargets ||\n        !Object.hasOwn(reference.allowedTargets, request.surface) ||\n        !reference.allowedTargets[request.surface]?.includes(request.target)\n      ) {\n        throw new Error('Profile secret input target is not allowed');\n      }\n    });\n  }\n\n  resolveProxySecret(signal?: AbortSignal): Promise<string> {\n    const name = this.snapshot.integration?.browser?.proxySecret;\n    if (name === undefined) return Promise.reject(new Error('Profile proxy is not configured'));\n    return this.resolveReference(name, signal, (reference) => {\n      if (!reference.purposes.includes('proxy')) throw new Error('Profile secret alias is unavailable');\n    });\n  }\n\n  /** Refresh only value-free aliases, never the selected provider or browser identity. */\n  private currentBinding(snapshot: ProfileRuntimeSnapshot): ProfileIntegrationBinding | undefined {\n    if (!snapshot.integration || snapshot.profileName === undefined) return undefined;\n    let current: ProfileIntegrationBinding;\n    try {\n      current = parseProfileBinding(this.options.readBinding(snapshot.profileName));\n    } catch {\n      throw new Error(INVALIDATED);\n    }\n    const selected = snapshot.integration;\n    if (\n      current.provider !== selected.provider ||\n      current.organizationId !== selected.organizationId ||\n      current.mailboxId !== selected.mailboxId ||\n      current.credentialRef !== selected.credentialRef\n    )\n      throw new Error(INVALIDATED);\n    return current;\n  }\n\n  private async resolveReference(\n    name: string,\n    requestSignal: AbortSignal | undefined,\n    authorize: (reference: ProfileSecretReference | ProfileVaultSecretReference) => void,\n  ): Promise<string> {\n    // Do not await ready here: a provider factory invoking this callback would\n    // otherwise wait for itself. Browser creation may retain, but not invoke it.\n    if (this.initializing) throw new Error('Profile secrets are unavailable during provider initialization');\n    await this.ready();\n    const snapshot = this.snapshot;\n    const connection = this.connection;\n    const current = this.currentBinding(snapshot);\n    const vaultReference =\n      snapshot.secrets && Object.hasOwn(snapshot.secrets, name) ? snapshot.secrets[name] : undefined;\n    const providerReference =\n      current?.secrets && Object.hasOwn(current.secrets, name) ? current.secrets[name] : undefined;\n    if (vaultReference && providerReference) throw new Error('Profile secret aliases must be unique');\n    const signal = requestSignal ? AbortSignal.any([snapshot.signal, requestSignal]) : snapshot.signal;\n    // Profile aliases win; otherwise a secret saved from the composer, under its own allowlist.\n    const saved = vaultReference || providerReference ? undefined : await this.savedSecret(name, signal);\n    const reference = vaultReference ?? providerReference ?? saved?.reference;\n    if (!reference) throw new Error('Profile secret alias is unavailable');\n    authorize(reference);\n    if (signal.aborted) throw new Error(INVALIDATED);\n    let value: string;\n    try {\n      if (saved) {\n        value = saved.value as string;\n      } else if (vaultReference) {\n        if (!this.options.readVault) throw new Error('Vault unavailable');\n        const { namespace, key, field } = vaultReference.vault;\n        const entry = await this.options.readVault(namespace, key, signal);\n        const selected =\n          field === undefined\n            ? entry\n            : typeof entry === 'object' && entry !== null && !Array.isArray(entry) && Object.hasOwn(entry, field)\n              ? (entry as Record<string, unknown>)[field]\n              : undefined;\n        if (typeof selected !== 'string') throw new Error('Vault field unavailable');\n        value = selected;\n      } else {\n        if (!connection || !providerReference) throw new Error('Provider unavailable');\n        value = await connection.resolveSecret(providerReference, signal);\n      }\n    } catch {\n      // Provider failures must not leak API responses, credential fields or secrets.\n      throw new Error('Profile secret resolution failed');\n    }\n    if (signal.aborted || this.snapshot !== snapshot || this.connection !== connection) throw new Error(INVALIDATED);\n    if (JSON.stringify(this.currentBinding(snapshot)?.secrets[name]) !== JSON.stringify(providerReference)) {\n      throw new Error(INVALIDATED);\n    }\n    if (typeof value !== 'string' || value.length === 0) throw new Error('Profile secret field is unavailable');\n    return value;\n  }\n\n  /** `secrets/<name>` as `{value, purposes, allowedOrigins?, allowedTargets?}`, checked like a profile alias. */\n  private async savedSecret(\n    name: string,\n    signal: AbortSignal,\n  ): Promise<{ reference: ProfileVaultSecretReference; value: unknown } | undefined> {\n    if (!this.options.readVault || !ALIAS_PATTERN.test(name)) return undefined;\n    try {\n      const entry = await this.options.readVault(VAULT_SECRETS_NAMESPACE, name, signal);\n      if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) return undefined;\n      const { value, ...delivery } = entry as Record<string, unknown>;\n      const vault = { namespace: VAULT_SECRETS_NAMESPACE, key: name, field: 'value' };\n      const reference = parseProfileVaultSecrets({ [name]: { ...delivery, vault } }, 'Saved secret')[name];\n      return reference && { reference, value };\n    } catch {\n      return undefined;\n    }\n  }\n\n  dispose(): Promise<void> {\n    if (this.disposal) return this.disposal;\n    this.disposed = true;\n    this.invalidate();\n    this.provider = undefined;\n    this.disposal = (async () => {\n      const results = await Promise.allSettled([...this.pending, this.retirement]);\n      if (results.some((result) => result.status === 'rejected')) throw new Error('Profile runtime disposal failed');\n    })();\n    return this.disposal;\n  }\n}\n\nexport function createProfileRuntime(options: ProfileRuntimeOptions): ProfileRuntime {\n  return new SessionProfileRuntime(options);\n}\n\n/** Mounted in the scoped root services array, before dependent integration tools. */\nexport function createProfileRuntimePlugin(runtime: ProfileRuntime): (context: Context) => void {\n  return (context) => {\n    context.provide(PROFILE_RUNTIME_SERVICE, runtime);\n  };\n}\n\nexport function requireProfileRuntime(context: Context): ProfileRuntime {\n  const service = context.get(PROFILE_RUNTIME_SERVICE);\n  if (!service) throw new Error('Profile runtime service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-runtime': ProfileRuntime;\n  }\n}\n","// @scaffold-generated\nimport type { ProfileIntegrationBinding } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SECRETS_SERVICE } from '../../constants/profileSecrets';\nimport type { ProfileProviderFactory, ProfileSecretResolver } from '../profileRuntime/type';\nimport type { ProfileEnvSecretRequest, ProfileSecrets, ProfileSecretsOptions } from './type';\n\n/** Every failure is generic so callers never learn which alias, field or provider response failed. */\nconst UNAVAILABLE = 'Profile secrets are unavailable';\n\nclass HostProfileSecrets implements ProfileSecrets {\n  private readonly providers = new Map<string, ProfileProviderFactory>();\n  private generation = 0;\n\n  constructor(private readonly options: ProfileSecretsOptions) {}\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    if (this.providers.has(provider)) throw new Error('Profile secrets provider is already registered');\n    this.providers.set(provider, factory);\n    return () => {\n      if (this.providers.get(provider) === factory) this.providers.delete(provider);\n    };\n  }\n\n  async resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    if (request.names.length === 0) return {};\n    if (new Set(request.names).size !== request.names.length) throw new Error(UNAVAILABLE);\n    let binding: ProfileIntegrationBinding | undefined;\n    try {\n      binding = await this.options.readBinding(request.cwd, request.profile, request.homeDirectory);\n    } catch {\n      throw new Error(UNAVAILABLE);\n    }\n    const factory = binding && this.providers.get(binding.provider);\n    if (!binding || !factory) throw new Error(UNAVAILABLE);\n    const references = request.names.map((name) => {\n      const reference = Object.hasOwn(binding.secrets, name) ? binding.secrets[name] : undefined;\n      if (!reference?.purposes.includes('env')) throw new Error(UNAVAILABLE);\n      return [name, reference] as const;\n    });\n\n    const controller = new AbortController();\n    const signal = request.signal ? AbortSignal.any([controller.signal, request.signal]) : controller.signal;\n    let connection: ProfileSecretResolver | undefined;\n    try {\n      connection = await factory(binding, { profileName: request.profile, generation: ++this.generation, signal });\n      const values: Record<string, string> = {};\n      for (const [name, reference] of references) {\n        const value = await connection.resolveSecret(reference, signal);\n        if (signal.aborted || typeof value !== 'string' || value.length === 0) throw new Error(UNAVAILABLE);\n        values[name] = value;\n      }\n      return values;\n    } catch {\n      throw new Error(UNAVAILABLE);\n    } finally {\n      controller.abort();\n      try {\n        await connection?.dispose();\n      } catch {\n        // Disposal failures are not secret-bearing, but the resolved values are still discarded.\n        // oxlint-disable-next-line no-unsafe-finally\n        throw new Error(UNAVAILABLE);\n      }\n    }\n  }\n}\n\nexport function createProfileSecrets(options: ProfileSecretsOptions): ProfileSecrets {\n  return new HostProfileSecrets(options);\n}\n\n/** Host-side env secret resolution for workflow run steps. Never registered as a model tool. */\nexport class ProfileSecretsService extends Service implements ProfileSecrets {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSecrets,\n  ) {\n    super(context, PROFILE_SECRETS_SERVICE);\n  }\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    return this.source.registerProvider(provider, factory);\n  }\n\n  resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    return this.source.resolveEnv(request);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSecretsPlugin(source: ProfileSecrets): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSecretsService(context, source);\n  };\n}\n\nexport function requireProfileSecrets(context: Context): ProfileSecrets {\n  const service = context.get(PROFILE_SECRETS_SERVICE);\n  if (!service) throw new Error('Profile secrets service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-secrets': ProfileSecrets;\n  }\n}\n","// @scaffold-generated\nimport { type AgentProfile, inlineProfile } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SOURCES_SERVICE } from '../../constants/profileSources';\nimport type { ContributedProfile, ProfileScope, ProfileSource, ProfileSources, SourcedProfile } from './type';\n\n/** Runs a hook that may throw before it returns a promise, so both kinds of failure are one rejection. */\nasync function settle(run: () => Promise<void> | void): Promise<void> {\n  await run();\n}\n\nclass HostProfileSources implements ProfileSources {\n  private readonly sources = new Map<string, ProfileSource>();\n\n  register(id: string, source: ProfileSource): () => void {\n    if (this.sources.has(id)) throw new Error('Profile source is already registered');\n    this.sources.set(id, source);\n    return () => {\n      if (this.sources.get(id) === source) this.sources.delete(id);\n    };\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.listSourced(scope).map(({ profile }) => profile);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    const byName = new Map<string, SourcedProfile>();\n    for (const [sourceId, source] of this.sources) {\n      let inputs;\n      try {\n        inputs = source.list(scope);\n      } catch {\n        continue;\n      }\n      for (const input of inputs) {\n        if (byName.has(input.name)) continue;\n        try {\n          const profile = inlineProfile(input);\n          if (profile.personaPrompt)\n            byName.set(profile.name, { sourceId, profile: { ...profile, personaPrompt: profile.personaPrompt } });\n        } catch {\n          // An invalid definition is skipped like an invalid directory profile.\n        }\n      }\n    }\n    return [...byName.values()].sort((left, right) => left.profile.name.localeCompare(right.profile.name));\n  }\n\n  async ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    const entries = [...this.sources].filter(([, source]) => source.ready !== undefined);\n    const results = await Promise.allSettled(entries.map(([, source]) => settle(() => source.ready?.(scope, signal))));\n    const failed = entries.filter((_, index) => results[index]?.status === 'rejected').map(([id]) => id);\n    // Source ids only: a rejection reason may carry anything the source put in it.\n    if (failed.length) throw new Error(`Profile source not ready: ${failed.join(', ')}`);\n  }\n\n  async defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    for (const source of this.sources.values()) {\n      if (source.defaultProfile === undefined) continue;\n      const chosen = await source.defaultProfile(scope, signal);\n      if (chosen !== undefined) return chosen;\n    }\n    return undefined;\n  }\n}\n\nexport function createProfileSources(): ProfileSources {\n  return new HostProfileSources();\n}\n\n/** File profiles win; a contributed profile only fills a name the file catalog does not hold. */\nexport function mergeProfiles(files: readonly AgentProfile[], sources: ProfileSources | undefined): AgentProfile[] {\n  const names = new Set(files.map(({ name }) => name));\n  const contributed = (sources?.list() ?? []).filter(({ name }) => !names.has(name));\n  return [...files, ...contributed].sort((left, right) => left.name.localeCompare(right.name));\n}\n\nexport function findProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  name: string,\n): AgentProfile {\n  const profile =\n    files.find((candidate) => candidate.name === name) ?? sources?.list().find((candidate) => candidate.name === name);\n  if (!profile) throw new Error(`Unknown profile: ${name}`);\n  return profile;\n}\n\n/** Profiles plugins hold in memory, merged into the session catalog. Optional: absent means files only. */\nexport class ProfileSourcesService extends Service implements ProfileSources {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSources,\n  ) {\n    super(context, PROFILE_SOURCES_SERVICE);\n  }\n\n  register(id: string, source: ProfileSource): () => void {\n    return this.source.register(id, source);\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.source.list(scope);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    return this.source.listSourced(scope);\n  }\n\n  ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    return this.source.ready(scope, signal);\n  }\n\n  defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    return this.source.defaultProfile(scope, signal);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSourcesPlugin(source: ProfileSources): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSourcesService(context, source);\n  };\n}\n\n/** With a scope, every `list` call through the returned view reads as that workspace. */\nexport function readProfileSources(context: Context, scope?: ProfileScope): ProfileSources | undefined {\n  const sources = context.get(PROFILE_SOURCES_SERVICE);\n  if (!sources || !scope) return sources;\n  return {\n    register: (id, source) => sources.register(id, source),\n    list: () => sources.list(scope),\n    listSourced: () => sources.listSourced(scope),\n    ready: (_ignored, signal) => sources.ready(scope, signal),\n    defaultProfile: (_ignored, signal) => sources.defaultProfile(scope, signal),\n  };\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-sources': ProfileSources;\n  }\n}\n","// @scaffold-generated\nimport type { SecretRedactionStream } from './type';\n\nconst REDACTED = '[redacted]';\n\n/** Raw, JSON-escaped and URL-encoded forms of every non-empty value. */\nfunction secretForms(secrets: Iterable<string>): string[] {\n  const forms = new Set<string>();\n  for (const secret of secrets) {\n    if (typeof secret !== 'string' || !secret) continue;\n    forms.add(secret);\n    forms.add(JSON.stringify(secret).slice(1, -1));\n    forms.add(encodeURIComponent(secret));\n  }\n  return [...forms];\n}\n\n/** Marks every occurrence of every form, so overlapping secrets cannot leave fragments behind. */\nfunction coverage(value: string, forms: readonly string[]): Uint8Array {\n  const covered = new Uint8Array(value.length);\n  for (const form of forms)\n    for (let index = value.indexOf(form); index !== -1; index = value.indexOf(form, index + 1))\n      covered.fill(1, index, index + form.length);\n  return covered;\n}\n\nfunction render(value: string, covered: Uint8Array, end: number): string {\n  let safe = '';\n  let start = 0;\n  for (let index = 0; index <= end; index++) {\n    if (index < end && covered[index] === covered[start]) continue;\n    if (index > start) safe += covered[start] ? REDACTED : value.slice(start, index);\n    start = index;\n  }\n  return safe;\n}\n\nfunction redactText(value: string, forms: readonly string[]): string {\n  return forms.length === 0 ? value : render(value, coverage(value, forms), value.length);\n}\n\nfunction redactValue(value: unknown, forms: readonly string[]): unknown {\n  if (typeof value === 'string') return redactText(value, forms);\n  if (Array.isArray(value)) return value.map((entry) => redactValue(entry, forms));\n  if (value !== null && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entry]) => [redactText(key, forms), redactValue(entry, forms)]),\n    );\n  }\n  return value;\n}\n\n/** Deeply redacts strings and object keys. Non-plain objects become plain records. */\nexport function redactSecrets<T>(value: T, secrets: Iterable<string>): T {\n  return redactValue(value, secretForms(secrets)) as T;\n}\n\nexport function createSecretRedactionStream(secrets: Iterable<string>): SecretRedactionStream {\n  const forms = secretForms(secrets);\n  // A secret not yet complete must start within the last `hold` characters of the buffer.\n  const hold = Math.max(0, ...forms.map((form) => form.length - 1));\n  let buffer = '';\n  return {\n    write(chunk) {\n      buffer += chunk;\n      const covered = coverage(buffer, forms);\n      let end = Math.max(0, buffer.length - hold);\n      // Never split a completed match: hold back the whole run that crosses the boundary.\n      while (end > 0 && end < buffer.length && covered[end] && covered[end - 1]) end--;\n      const safe = render(buffer, covered, end);\n      buffer = buffer.slice(end);\n      return safe;\n    },\n    flush() {\n      const safe = redactText(buffer, forms);\n      buffer = '';\n      return safe;\n    },\n  };\n}\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nconst NONE = 'None';\n\n/** Footer status key the cockpit's profile axis reads. */\ninterface SelectItem {\n  value: string;\n  label: string;\n  description?: string;\n  icon?: string;\n}\n\nexport const PROFILE_STATUS_KEY = 'po-profile';\n\n/** Identity this package registers voice capabilities under. */\nexport const PROFILE_SOURCE = '@agimon-ai/po-profile';\n\n/** The command a queued voice switch invokes, and the reload handoff kind it parks. */\nexport const PROFILE_COMMAND = 'profile';\n\n/**\n * The published axis content: the active profile's name, empty while\n * profiles exist with none active, and undefined to withhold the status so\n * the cockpit keeps the axis off the bar entirely.\n */\nexport function profileStatus(current: string | undefined, hasProfiles: boolean): string | undefined {\n  if (current) return current;\n  return hasProfiles ? '' : undefined;\n}\n\n/** What a person reads for a profile: its declared display name, otherwise the profile name. */\nexport function profileLabel(profile: AgentProfile): string {\n  return profile.identity?.name || profile.name;\n}\n\n/**\n * Rows for the single-select profile picker. A client answers with the label, so a display name two\n * profiles share, or one that reads as None, carries the profile name to stay unique.\n */\nexport function profileItems(profiles: AgentProfile[]): SelectItem[] {\n  const labels = profiles.map(profileLabel);\n  return [\n    { value: '', label: NONE },\n    ...profiles.map((profile, index) => {\n      const label = labels[index] ?? profile.name;\n      const unique = label !== NONE && labels.indexOf(label) === labels.lastIndexOf(label);\n      return {\n        value: profile.name,\n        label: unique ? label : `${label} (${profile.name})`,\n        description: profileDescription(profile),\n        ...(profile.identity?.icon ? { icon: profile.identity.icon } : {}),\n      };\n    }),\n  ];\n}\n\n/** The role and contact a profile declares, otherwise its persona source and environment keys. */\nexport function profileDescription(profile: AgentProfile): string {\n  const presented = [profile.identity?.role, profile.identity?.contact].filter(Boolean).join(' · ');\n  if (presented) return presented;\n  const environmentKeys = Object.keys(profile.env).sort();\n  return environmentKeys.length > 0 ? `${profile.persona} (env: ${environmentKeys.join(', ')})` : profile.persona;\n}\n\n/** Shown when the picked profile is already active. */\nexport function profileSummary(profile: AgentProfile): string {\n  const environmentKeys = Object.keys(profile.env).sort();\n  return [\n    `Profile ${profile.name}`,\n    `Persona: ${profile.persona}`,\n    `Env: ${environmentKeys.join(', ') || '(none)'}`,\n    'Already loaded.',\n  ].join('\\n');\n}\n\nexport function profileTitle(current?: string): string {\n  return `Profile (current: ${current ?? NONE})`;\n}\n"],"mappings":";;;;;AACA,MAAa,kCAAkC;;;ACD/C,MAAa,0BAA0B;;;ACCvC,MAAa,0BAA0B;;;ACAvC,MAAa,0BAA0B;;;;ACIvC,MAAa,yBAAyB;;;;ACWtC,MAAa,gCAAgC;AAC7C,MAAM,UAAU,gCAAgC;;AAGhD,MAAa,oCAAA,GAAmCA,iCAAAA,sBAAAA,CAC9C,iCACA,EAAE,OAAO,UAAU,CACrB;;AAGA,SAAgB,0BAA0B,SAAqD;CAC7F,OAAO,QAAQ,IAAI,+BAA+B;AACpD;AAEA,MAAM,eAAe,WACnB,OAAO,kBAAkB,QAAQ,OAAO,yBAAS,IAAI,MAAM,gCAAgC;;;;;;;;AAS7F,SAAgB,eAAe,OAAoB,WAA6B;CAC9E,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,UAAU;CACd,IAAI;CACJ,IAAI;CACJ,MAAM,eAAe,IAAI,SAAgC,SAAS,WAAW;EAC3E,SAAS;EACT,YAAY;CACd,CAAC;CAED,aAAa,YAAY,KAAA,CAAS;CAElC,MAAM,qBAAqB;EACzB,UAAU,YAAY,KAAK,CAAC;EAC5B,WAAW,MAAM,MAAM,MAAM;CAC/B;CACA,IAAI,MAAM,SAAS,aAAa;MAC3B,MAAM,iBAAiB,SAAS,cAAc,EAAE,MAAM,KAAK,CAAC;CACjE,MAAM,QAAQ,iBAAiB;EAC7B,UAAU;EACV,OAAO,EAAE,QAAQ,UAAU,CAAC;EAC5B,WAAW,sBAAM,IAAI,MAAM,8BAA8B,CAAC;CAC5D,GAAG,SAAS;CAEZ,OAAO;EACL,QAAQ,WAAW;EACnB,OAAU,OAA4E;GACpF,IAAI,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,KAAK,CAAC;GAC3D,IAAI,SAAS,OAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,CAAC;GACzD,IAAI;GACJ,IAAI;IACF,OAAO,QAAQ,QAAQ,MAAM,WAAW,MAAM,CAAC;GACjD,QAAQ;IACN,OAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,CAAC;GAC7C;GACA,MAAM,WAAW,KAAK,MACnB,WAA8B;IAAE,QAAQ;IAAQ;GAAM,WAC7B,EAAE,QAAQ,SAAS,EAC/C;GACA,OAAO,QAAQ,KAAK,CAAC,UAAU,YAAY,CAAC;EAC9C;EACA,UAAU;GACR,aAAa,KAAK;GAClB,MAAM,oBAAoB,SAAS,YAAY;GAC/C,IAAI,CAAC,WAAW,OAAO,SAAS,WAAW,sBAAM,IAAI,MAAM,6BAA6B,CAAC;EAC3F;CACF;AACF;;AAGA,eAAsB,eACpB,SACA,OACA,QACA,WACwC;CACxC,OAAO,eAAe;CACtB,IAAI,YAAY,KAAA,GAAW,OAAO;CAClC,MAAM,WAAW,eAAe,QAAQ,SAAS;CACjD,IAAI;EACF,QAAQ,MAAM,SAAS,QAAQ,eAAe,QAAQ,MAAM,OAAO,UAAU,CAAC,EAAA,CAAG;CACnF,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AACA,MAAM,SAAS,OAAgC,SAAqC,0BAClF,IAAI,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE,WAAW,IAAI,GAAG,GAAI,SAAS,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK,CAAC,CAAE,CAAC;;;;;;;;;AAUrG,eAAsB,sBACpB,OACA,SACA,SACgC;CAChC,QAAQ,OAAO,eAAe;CAC9B,MAAM,EAAE,QAAQ,UAAU;CAC1B,MAAM,cAAc,OAAO;CAC3B,MAAM,OAA8B;EAAE;EAAQ,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CAAG;CACpG,IAAI,OAAO,SAAS,QAAQ,OAAO;CAGnC,MAAM,OAAgC,CAAC;CACvC,MAAM,UAAa,UAA+E;EAChG,KAAK,aAAa,eAAe,QAAQ,QAAQ,QAAQ,aAAA,GAA0C;EACnG,OAAO,KAAK,SAAS,OAAO,KAAK;CACnC;CACA,MAAM,QAAQ,aAA2D;EAAE,GAAG;EAAM;CAAQ;CAC5F,IAAI;EACF,IAAI,OAAO,SAAS,SAAS;GAC3B,MAAM,YAAY,OAAO;GACzB,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,YAAY,KAAA,GAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GACrE,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;GAEpE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GAC3E,OAAO,KAAK;IAAE,MAAM,OAAO,WAAW,WAAW,kBAAkB;IAAW;GAAU,CAAC;EAC3F;EACA,IAAI,gBAAgB,KAAA,KAAa,YAAY,KAAA,GAAW,OAAO;EAC/D,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,eAAe,OAAO,MAAM,CAAC;EAC7E,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;EAChE,IAAI,OAAO,WAAW,UAAU,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;EACrE,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EAExF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;EACrE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EACxF,IAAI,QAAQ,WAAW,WAAW,OAAO,KAAK;GAAE,MAAM;GAAW,WAAW;EAAO,CAAC;EACpF,IAAI,QAAQ,WAAW,UAAU,OAAO,KAAK;GAAE,MAAM;GAAiB,WAAW;EAAO,CAAC;EACzF,OAAO,KAAK;GAAE,MAAM;GAAmB,WAAW;EAAO,CAAC;CAC5D,UAAU;EACR,KAAK,UAAU,QAAQ;CACzB;AACF;;AAGA,SAAgB,mBAAmB,SAAwC;CACzE,MAAM,EAAE,MAAM,cAAc;CAC5B,MAAM,UAAU,cAAc,KAAA,IAAY,kCAAkC,YAAY,UAAU;CAClG,MAAM,UAAU;CAChB,IAAI,SAAS,WAAW,OAAO,GAAG,QAAQ,wBAAwB,QAAQ,YAAY;CACtF,IAAI,SAAS,iBAAiB,OAAO,GAAG,QAAQ,kDAAkD;CAClG,IAAI,SAAS,mBAAmB,OAAO,wBAAwB,UAAU,sBAAsB;CAC/F,OAAO,GAAG,QAAQ,qBAAqB;AACzC;;;ACxJA,MAAMC,gBAAc;AACpB,MAAM,cAAc;;AAEpB,MAAM,0BAA0B;AAChC,MAAM,gBAAgB;;AAGtB,IAAM,wBAAN,MAAsD;CAYvB;CAX7B,aAAqB,IAAI,gBAAgB;CACzC;CACA;CACA;CACA,aAAoC,QAAQ,QAAQ;CACpD,aAAoC,QAAQ,QAAQ;CACpD,0BAA2B,IAAI,IAAmB;CAClD,eAAuB;CACvB,WAAmB;CACnB;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,WAAW,KAAK,QAAQ,QAAQ,aAAa,CAAC;CACrD;CAEA,QAAgB,aAAiC,YAA4C;EAC3F,MAAM,UAAU,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,YAAY,WAAW;EAC5F,MAAM,MAAM,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,UAAU,WAAW;EACtF,MAAM,gBAAgB,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,cAAc,WAAW;EACpG,MAAM,UAAU,kBAAkB,KAAA,IAAY,KAAA,KAAA,GAAYC,8BAAAA,yBAAAA,CAAyB,aAAa;EAChG,IAAI,WAAW,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO,QAAQ,SAAS,IAAI,CAAC,GACzG,MAAM,IAAI,MAAM,uCAAuC;EAEzD,OAAO,OAAO,OAAO;GACnB,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;GACnD,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,cAAA,GAAaC,8BAAAA,oBAAAA,CAAoB,OAAO,EAAE;GAC7E,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;GAC9D,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,QAAQ,KAAK,WAAW;EAC1B,CAAC;CACH;CAEA,gBAAwC;EACtC,OAAO,KAAK;CACd;CAEA,aAAmB;EACjB,KAAK,WAAW,MAAM;EACtB,MAAM,aAAa,KAAK;EACxB,KAAK,aAAa,KAAA;EAClB,IAAI,YAAY;GACd,KAAK,aAAa,KAAK,WAAW,KAAK,YAAY;IACjD,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;GACF,CAAC;GACD,KAAU,MAAM,KAAK,UAAU;EACjC;CACF;CAEA,MAAc,MAAoC;EAChD,KAAK,QAAQ,IAAI,IAAI;EAGrB,KAAU,WACF,KAAK,QAAQ,OAAO,IAAI,SACxB,KAAK,QAAQ,OAAO,IAAI,CAChC;EACA,OAAO;CACT;CAEA,aAAoC;EAClC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,KAAK,eAAe,QAAQ,SAAS,eAAe,QAAQ;EAC5D,MAAM,QAAQ,YAAY;GACxB,MAAM,KAAK;GACX,IAAI,SAAS,OAAO,SAAS;GAC7B,IAAI,CAAC,SAAS,eAAe,CAAC,UAAU;GACxC,IAAI,SAAS,YAAY,aAAa,SAAS,MAAM,MAAM,IAAI,MAAMF,aAAW;GAChF,IAAI;GACJ,IAAI;IACF,aAAa,MAAM,SAAS,QAAQ,SAAS,aAAa;KACxD,aAAa,SAAS;KACtB,YAAY,SAAS;KACrB,QAAQ,SAAS;IACnB,CAAC;GACH,QAAQ;IAGN,IAAI,SAAS,OAAO,SAAS;IAC7B,MAAM,IAAI,MAAM,wCAAwC;GAC1D;GACA,IAAI,SAAS,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,UAAU;IAC1E,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;IACA;GACF;GACA,KAAK,aAAa;EACpB,EAAA,CAAG;EACH,KAAK,aAAa,KAAK,MACrB,KAAK,cAAc;GACjB,IAAI,KAAK,aAAa,UAAU,KAAK,eAAe;EACtD,CAAC,CACH;EACA,OAAO,KAAK;CACd;CAEA,MAAM,OAAO,aAAsB,SAAuD;EACxF,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9C,IACE,SAAS,UAAU,QACnB,KAAK,SAAS,gBAAgB,eAC9B,CAAC,KAAK,SAAS,OAAO,YACrB,CAAC,KAAK,SAAS,eAAe,CAAC,KAAK,YAAY,KAAK,cAAc,KAAK,eAEzE;EACF,KAAK,WAAW;EAChB,KAAK,aAAa,IAAI,gBAAgB;EAEtC,KAAK,WAAW,KAAK,QAAQ,aAAa,KAAK,SAAS,aAAa,CAAC;EACtE,MAAM,KAAK,WAAW;CACxB;CAEA,MAAM,QAAuB;EAC3B,MAAM,WAAW,KAAK;EACtB,MAAM,KAAK;EACX,IAAI,KAAK,YAAY,SAAS,OAAO,WAAW,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EACvG,IAAI,SAAS,eAAe,CAAC,KAAK,YAAY,MAAM,IAAI,MAAMA,aAAW;CAC3E;CAEA,MAAM,eAAe,cAAsB,SAA+D;EACxG,IAAI,KAAK,YAAY,KAAK,SAAS,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC9E,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,sCAAsC;EACzE,IAAI,KAAK,SAAS,eAAe,KAAK,SAAS,YAAY,aAAa,cAAc,MAAM,IAAI,MAAMA,aAAW;EACjH,MAAM,WAAW;GAAE,MAAM;GAAc;EAAQ;EAC/C,KAAK,WAAW;EAChB,IAAI;GACF,MAAM,KAAK,WAAW;GACtB,MAAM,KAAK,MAAM;GACjB,IAAI,KAAK,YAAY,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9E,QAAQ;GACN,IAAI,KAAK,aAAa,UAAU,KAAK,WAAW,KAAA;GAChD,KAAK,WAAW;GAChB,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,IAAI,WAAW;EACf,OAAO,YAAY;GACjB,IAAI,YAAY,KAAK,aAAa,UAAU;GAC5C,WAAW;GACX,KAAK,WAAW;GAChB,KAAK,WAAW,KAAA;GAChB,KAAK,aAAa,IAAI,gBAAgB;GACtC,KAAK,WAAW,OAAO,OAAO;IAC5B,GAAG,KAAK;IACR,YAAY,KAAK,SAAS,aAAa;IACvC,QAAQ,KAAK,WAAW;GAC1B,CAAC;GACD,MAAM,KAAK;EACb;CACF;CAEA,cAAc,MAAc,SAAgD;EAC1E,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IAAI,CAAC,UAAU,SAAS,SAAS,SAAS,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAClG,IAAI,CAAC,UAAU,eAAe,SAAS,QAAQ,MAAM,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChH,CAAC;CACH;CAEA,mBAAmB,MAAc,SAAqD;EACpF,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IACE,CAAC,UAAU,SAAS,SAAS,OAAO,KACpC,CAAC,UAAU,kBACX,CAAC,OAAO,OAAO,UAAU,gBAAgB,QAAQ,OAAO,KACxD,CAAC,UAAU,eAAe,QAAQ,QAAQ,EAAE,SAAS,QAAQ,MAAM,GAEnE,MAAM,IAAI,MAAM,4CAA4C;EAEhE,CAAC;CACH;CAEA,mBAAmB,QAAuC;EACxD,MAAM,OAAO,KAAK,SAAS,aAAa,SAAS;EACjD,IAAI,SAAS,KAAA,GAAW,OAAO,QAAQ,uBAAO,IAAI,MAAM,iCAAiC,CAAC;EAC1F,OAAO,KAAK,iBAAiB,MAAM,SAAS,cAAc;GACxD,IAAI,CAAC,UAAU,SAAS,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAClG,CAAC;CACH;;CAGA,eAAuB,UAAyE;EAC9F,IAAI,CAAC,SAAS,eAAe,SAAS,gBAAgB,KAAA,GAAW,OAAO,KAAA;EACxE,IAAI;EACJ,IAAI;GACF,WAAA,GAAUE,8BAAAA,oBAAAA,CAAoB,KAAK,QAAQ,YAAY,SAAS,WAAW,CAAC;EAC9E,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B;EACA,MAAM,WAAW,SAAS;EAC1B,IACE,QAAQ,aAAa,SAAS,YAC9B,QAAQ,mBAAmB,SAAS,kBACpC,QAAQ,cAAc,SAAS,aAC/B,QAAQ,kBAAkB,SAAS,eAEnC,MAAM,IAAI,MAAM,WAAW;EAC7B,OAAO;CACT;CAEA,MAAc,iBACZ,MACA,eACA,WACiB;EAGjB,IAAI,KAAK,cAAc,MAAM,IAAI,MAAM,gEAAgE;EACvG,MAAM,KAAK,MAAM;EACjB,MAAM,WAAW,KAAK;EACtB,MAAM,aAAa,KAAK;EACxB,MAAM,UAAU,KAAK,eAAe,QAAQ;EAC5C,MAAM,iBACJ,SAAS,WAAW,OAAO,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,QAAQ,QAAQ,KAAA;EACvF,MAAM,oBACJ,SAAS,WAAW,OAAO,OAAO,QAAQ,SAAS,IAAI,IAAI,QAAQ,QAAQ,QAAQ,KAAA;EACrF,IAAI,kBAAkB,mBAAmB,MAAM,IAAI,MAAM,uCAAuC;EAChG,MAAM,SAAS,gBAAgB,YAAY,IAAI,CAAC,SAAS,QAAQ,aAAa,CAAC,IAAI,SAAS;EAE5F,MAAM,QAAQ,kBAAkB,oBAAoB,KAAA,IAAY,MAAM,KAAK,YAAY,MAAM,MAAM;EACnG,MAAM,YAAY,kBAAkB,qBAAqB,OAAO;EAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qCAAqC;EACrE,UAAU,SAAS;EACnB,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC/C,IAAI;EACJ,IAAI;GACF,IAAI,OACF,QAAQ,MAAM;QACT,IAAI,gBAAgB;IACzB,IAAI,CAAC,KAAK,QAAQ,WAAW,MAAM,IAAI,MAAM,mBAAmB;IAChE,MAAM,EAAE,WAAW,KAAK,UAAU,eAAe;IACjD,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,WAAW,KAAK,MAAM;IACjE,MAAM,WACJ,UAAU,KAAA,IACN,QACA,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,OAAO,OAAO,KAAK,IAC/F,MAAkC,SACnC,KAAA;IACR,IAAI,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,yBAAyB;IAC3E,QAAQ;GACV,OAAO;IACL,IAAI,CAAC,cAAc,CAAC,mBAAmB,MAAM,IAAI,MAAM,sBAAsB;IAC7E,QAAQ,MAAM,WAAW,cAAc,mBAAmB,MAAM;GAClE;EACF,QAAQ;GAEN,MAAM,IAAI,MAAM,kCAAkC;EACpD;EACA,IAAI,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,eAAe,YAAY,MAAM,IAAI,MAAM,WAAW;EAC/G,IAAI,KAAK,UAAU,KAAK,eAAe,QAAQ,CAAC,EAAE,QAAQ,KAAK,MAAM,KAAK,UAAU,iBAAiB,GACnG,MAAM,IAAI,MAAM,WAAW;EAE7B,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAC1G,OAAO;CACT;;CAGA,MAAc,YACZ,MACA,QACiF;EACjF,IAAI,CAAC,KAAK,QAAQ,aAAa,CAAC,cAAc,KAAK,IAAI,GAAG,OAAO,KAAA;EACjE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,yBAAyB,MAAM,MAAM;GAChF,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;GAChF,MAAM,EAAE,OAAO,GAAG,aAAa;GAC/B,MAAM,QAAQ;IAAE,WAAW;IAAyB,KAAK;IAAM,OAAO;GAAQ;GAC9E,MAAM,aAAA,GAAYD,8BAAAA,yBAAAA,CAAyB,GAAG,OAAO;IAAE,GAAG;IAAU;GAAM,EAAE,GAAG,cAAc,CAAC,CAAC;GAC/F,OAAO,aAAa;IAAE;IAAW;GAAM;EACzC,QAAQ;GACN;EACF;CACF;CAEA,UAAyB;EACvB,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,KAAK,WAAW;EAChB,KAAK,WAAW;EAChB,KAAK,WAAW,KAAA;EAChB,KAAK,YAAY,YAAY;GAE3B,KAAI,MADkB,QAAQ,WAAW,CAAC,GAAG,KAAK,SAAS,KAAK,UAAU,CAAC,EAAA,CAC/D,MAAM,WAAW,OAAO,WAAW,UAAU,GAAG,MAAM,IAAI,MAAM,iCAAiC;EAC/G,EAAA,CAAG;EACH,OAAO,KAAK;CACd;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,sBAAsB,OAAO;AAC1C;;AAGA,SAAgB,2BAA2B,SAAqD;CAC9F,QAAQ,YAAY;EAClB,QAAQ,QAAQ,yBAAyB,OAAO;CAClD;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;ACvUA,MAAM,cAAc;AAEpB,IAAM,qBAAN,MAAmD;CAIpB;CAH7B,4BAA6B,IAAI,IAAoC;CACrE,aAAqB;CAErB,YAAY,SAAiD;EAAhC,KAAA,UAAA;CAAiC;CAE9D,iBAAiB,UAAkB,SAA6C;EAC9E,IAAI,KAAK,UAAU,IAAI,QAAQ,GAAG,MAAM,IAAI,MAAM,gDAAgD;EAClG,KAAK,UAAU,IAAI,UAAU,OAAO;EACpC,aAAa;GACX,IAAI,KAAK,UAAU,IAAI,QAAQ,MAAM,SAAS,KAAK,UAAU,OAAO,QAAQ;EAC9E;CACF;CAEA,MAAM,WAAW,SAAmE;EAClF,IAAI,QAAQ,MAAM,WAAW,GAAG,OAAO,CAAC;EACxC,IAAI,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,SAAS,QAAQ,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW;EACrF,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,KAAK,QAAQ,YAAY,QAAQ,KAAK,QAAQ,SAAS,QAAQ,aAAa;EAC9F,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B;EACA,MAAM,UAAU,WAAW,KAAK,UAAU,IAAI,QAAQ,QAAQ;EAC9D,IAAI,CAAC,WAAW,CAAC,SAAS,MAAM,IAAI,MAAM,WAAW;EACrD,MAAM,aAAa,QAAQ,MAAM,KAAK,SAAS;GAC7C,MAAM,YAAY,OAAO,OAAO,QAAQ,SAAS,IAAI,IAAI,QAAQ,QAAQ,QAAQ,KAAA;GACjF,IAAI,CAAC,WAAW,SAAS,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,WAAW;GACrE,OAAO,CAAC,MAAM,SAAS;EACzB,CAAC;EAED,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,MAAM,CAAC,IAAI,WAAW;EAClG,IAAI;EACJ,IAAI;GACF,aAAa,MAAM,QAAQ,SAAS;IAAE,aAAa,QAAQ;IAAS,YAAY,EAAE,KAAK;IAAY;GAAO,CAAC;GAC3G,MAAM,SAAiC,CAAC;GACxC,KAAK,MAAM,CAAC,MAAM,cAAc,YAAY;IAC1C,MAAM,QAAQ,MAAM,WAAW,cAAc,WAAW,MAAM;IAC9D,IAAI,OAAO,WAAW,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,WAAW;IAClG,OAAO,QAAQ;GACjB;GACA,OAAO;EACT,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B,UAAU;GACR,WAAW,MAAM;GACjB,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,QAAQ;IAGN,MAAM,IAAI,MAAM,WAAW;GAC7B;EACF;CACF;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,mBAAmB,OAAO;AACvC;;AAGA,IAAa,wBAAb,cAA2CE,oBAAAA,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,iBAAiB,UAAkB,SAA6C;EAC9E,OAAO,KAAK,OAAO,iBAAiB,UAAU,OAAO;CACvD;CAEA,WAAW,SAAmE;EAC5E,OAAO,KAAK,OAAO,WAAW,OAAO;CACvC;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;AC9FA,eAAe,OAAO,KAAgD;CACpE,MAAM,IAAI;AACZ;AAEA,IAAM,qBAAN,MAAmD;CACjD,0BAA2B,IAAI,IAA2B;CAE1D,SAAS,IAAY,QAAmC;EACtD,IAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChF,KAAK,QAAQ,IAAI,IAAI,MAAM;EAC3B,aAAa;GACX,IAAI,KAAK,QAAQ,IAAI,EAAE,MAAM,QAAQ,KAAK,QAAQ,OAAO,EAAE;EAC7D;CACF;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,cAAc,OAAO;CAC7D;CAEA,YAAY,OAAwC;EAClD,MAAM,yBAAS,IAAI,IAA4B;EAC/C,KAAK,MAAM,CAAC,UAAU,WAAW,KAAK,SAAS;GAC7C,IAAI;GACJ,IAAI;IACF,SAAS,OAAO,KAAK,KAAK;GAC5B,QAAQ;IACN;GACF;GACA,KAAK,MAAM,SAAS,QAAQ;IAC1B,IAAI,OAAO,IAAI,MAAM,IAAI,GAAG;IAC5B,IAAI;KACF,MAAM,WAAA,GAAUC,8BAAAA,cAAAA,CAAc,KAAK;KACnC,IAAI,QAAQ,eACV,OAAO,IAAI,QAAQ,MAAM;MAAE;MAAU,SAAS;OAAE,GAAG;OAAS,eAAe,QAAQ;MAAc;KAAE,CAAC;IACxG,QAAQ,CAER;GACF;EACF;EACA,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,QAAQ,KAAK,cAAc,MAAM,QAAQ,IAAI,CAAC;CACvG;CAEA,MAAM,MAAM,OAAiC,QAAoC;EAC/E,MAAM,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,QAAQ,GAAG,YAAY,OAAO,UAAU,KAAA,CAAS;EACnF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,KAAK,GAAG,YAAY,aAAa,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC;EACjH,MAAM,SAAS,QAAQ,QAAQ,GAAG,UAAU,QAAQ,MAAM,EAAE,WAAW,UAAU,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;EAEnG,IAAI,OAAO,QAAQ,MAAM,IAAI,MAAM,6BAA6B,OAAO,KAAK,IAAI,GAAG;CACrF;CAEA,MAAM,eAAe,OAAiC,QAAkD;EACtG,KAAK,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG;GAC1C,IAAI,OAAO,mBAAmB,KAAA,GAAW;GACzC,MAAM,SAAS,MAAM,OAAO,eAAe,OAAO,MAAM;GACxD,IAAI,WAAW,KAAA,GAAW,OAAO;EACnC;CAEF;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO,IAAI,mBAAmB;AAChC;;AAGA,SAAgB,cAAc,OAAgC,SAAqD;CACjH,MAAM,QAAQ,IAAI,IAAI,MAAM,KAAK,EAAE,WAAW,IAAI,CAAC;CACnD,MAAM,eAAe,SAAS,KAAK,KAAK,CAAC,EAAA,CAAG,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC;CACjF,OAAO,CAAC,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC7F;AAEA,SAAgB,YACd,OACA,SACA,MACc;CACd,MAAM,UACJ,MAAM,MAAM,cAAc,UAAU,SAAS,IAAI,KAAK,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc,UAAU,SAAS,IAAI;CACnH,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,oBAAoB,MAAM;CACxD,OAAO;AACT;;AAGA,IAAa,wBAAb,cAA2CC,oBAAAA,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,SAAS,IAAY,QAAmC;EACtD,OAAO,KAAK,OAAO,SAAS,IAAI,MAAM;CACxC;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,OAAO,KAAK,KAAK;CAC/B;CAEA,YAAY,OAAwC;EAClD,OAAO,KAAK,OAAO,YAAY,KAAK;CACtC;CAEA,MAAM,OAAiC,QAAoC;EACzE,OAAO,KAAK,OAAO,MAAM,OAAO,MAAM;CACxC;CAEA,eAAe,OAAiC,QAAkD;EAChG,OAAO,KAAK,OAAO,eAAe,OAAO,MAAM;CACjD;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;;AAGA,SAAgB,mBAAmB,SAAkB,OAAkD;CACrG,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,WAAW,CAAC,OAAO,OAAO;CAC/B,OAAO;EACL,WAAW,IAAI,WAAW,QAAQ,SAAS,IAAI,MAAM;EACrD,YAAY,QAAQ,KAAK,KAAK;EAC9B,mBAAmB,QAAQ,YAAY,KAAK;EAC5C,QAAQ,UAAU,WAAW,QAAQ,MAAM,OAAO,MAAM;EACxD,iBAAiB,UAAU,WAAW,QAAQ,eAAe,OAAO,MAAM;CAC5E;AACF;;;ACvIA,MAAM,WAAW;;AAGjB,SAAS,YAAY,SAAqC;CACxD,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ;EAC3C,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,KAAK,UAAU,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;EAC7C,MAAM,IAAI,mBAAmB,MAAM,CAAC;CACtC;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,SAAS,SAAS,OAAe,OAAsC;CACrE,MAAM,UAAU,IAAI,WAAW,MAAM,MAAM;CAC3C,KAAK,MAAM,QAAQ,OACjB,KAAK,IAAI,QAAQ,MAAM,QAAQ,IAAI,GAAG,UAAU,IAAI,QAAQ,MAAM,QAAQ,MAAM,QAAQ,CAAC,GACvF,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,OAAO,OAAe,SAAqB,KAAqB;CACvE,IAAI,OAAO;CACX,IAAI,QAAQ;CACZ,KAAK,IAAI,QAAQ,GAAG,SAAS,KAAK,SAAS;EACzC,IAAI,QAAQ,OAAO,QAAQ,WAAW,QAAQ,QAAQ;EACtD,IAAI,QAAQ,OAAO,QAAQ,QAAQ,SAAS,WAAW,MAAM,MAAM,OAAO,KAAK;EAC/E,QAAQ;CACV;CACA,OAAO;AACT;AAEA,SAAS,WAAW,OAAe,OAAkC;CACnE,OAAO,MAAM,WAAW,IAAI,QAAQ,OAAO,OAAO,SAAS,OAAO,KAAK,GAAG,MAAM,MAAM;AACxF;AAEA,SAAS,YAAY,OAAgB,OAAmC;CACtE,IAAI,OAAO,UAAU,UAAU,OAAO,WAAW,OAAO,KAAK;CAC7D,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,UAAU,YAAY,OAAO,KAAK,CAAC;CAC/E,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,WAAW,KAAK,KAAK,GAAG,YAAY,OAAO,KAAK,CAAC,CAAC,CACjG;CAEF,OAAO;AACT;;AAGA,SAAgB,cAAiB,OAAU,SAA8B;CACvE,OAAO,YAAY,OAAO,YAAY,OAAO,CAAC;AAChD;AAEA,SAAgB,4BAA4B,SAAkD;CAC5F,MAAM,QAAQ,YAAY,OAAO;CAEjC,MAAM,OAAO,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,SAAS,KAAK,SAAS,CAAC,CAAC;CAChE,IAAI,SAAS;CACb,OAAO;EACL,MAAM,OAAO;GACX,UAAU;GACV,MAAM,UAAU,SAAS,QAAQ,KAAK;GACtC,IAAI,MAAM,KAAK,IAAI,GAAG,OAAO,SAAS,IAAI;GAE1C,OAAO,MAAM,KAAK,MAAM,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,IAAI;GAC3E,MAAM,OAAO,OAAO,QAAQ,SAAS,GAAG;GACxC,SAAS,OAAO,MAAM,GAAG;GACzB,OAAO;EACT;EACA,QAAQ;GACN,MAAM,OAAO,WAAW,QAAQ,KAAK;GACrC,SAAS;GACT,OAAO;EACT;CACF;AACF;;;AC7EA,MAAM,OAAO;AAUb,MAAa,qBAAqB;;AAMlC,MAAa,kBAAkB;;;;;;AAO/B,SAAgB,cAAc,SAA6B,aAA0C;CACnG,IAAI,SAAS,OAAO;CACpB,OAAO,cAAc,KAAK,KAAA;AAC5B;;AAGA,SAAgB,aAAa,SAA+B;CAC1D,OAAO,QAAQ,UAAU,QAAQ,QAAQ;AAC3C;;;;;AAMA,SAAgB,aAAa,UAAwC;CACnE,MAAM,SAAS,SAAS,IAAI,YAAY;CACxC,OAAO,CACL;EAAE,OAAO;EAAI,OAAO;CAAK,GACzB,GAAG,SAAS,KAAK,SAAS,UAAU;EAClC,MAAM,QAAQ,OAAO,UAAU,QAAQ;EACvC,MAAM,SAAS,UAAU,QAAQ,OAAO,QAAQ,KAAK,MAAM,OAAO,YAAY,KAAK;EACnF,OAAO;GACL,OAAO,QAAQ;GACf,OAAO,SAAS,QAAQ,GAAG,MAAM,IAAI,QAAQ,KAAK;GAClD,aAAa,mBAAmB,OAAO;GACvC,GAAI,QAAQ,UAAU,OAAO,EAAE,MAAM,QAAQ,SAAS,KAAK,IAAI,CAAC;EAClE;CACF,CAAC,CACH;AACF;;AAGA,SAAgB,mBAAmB,SAA+B;CAChE,MAAM,YAAY,CAAC,QAAQ,UAAU,MAAM,QAAQ,UAAU,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK;CAChG,IAAI,WAAW,OAAO;CACtB,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO,gBAAgB,SAAS,IAAI,GAAG,QAAQ,QAAQ,SAAS,gBAAgB,KAAK,IAAI,EAAE,KAAK,QAAQ;AAC1G;;AAGA,SAAgB,eAAe,SAA+B;CAC5D,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO;EACL,WAAW,QAAQ;EACnB,YAAY,QAAQ;EACpB,QAAQ,gBAAgB,KAAK,IAAI,KAAK;EACtC;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,aAAa,SAA0B;CACrD,OAAO,qBAAqB,WAAW,KAAK;AAC9C"}

package/dist/{profileText-3qUgFIgc.mjs → profileText-zg12bf1S.mjs}

@@ -347,13 +347,28 @@ var SessionProfileRuntime = class {
 			if (!reference.purposes.includes("proxy")) throw new Error("Profile secret alias is unavailable");
 		});
 	}
+	/** Refresh only value-free aliases, never the selected provider or browser identity. */
+	currentBinding(snapshot) {
+		if (!snapshot.integration || snapshot.profileName === void 0) return void 0;
+		let current;
+		try {
+			current = parseProfileBinding(this.options.readBinding(snapshot.profileName));
+		} catch {
+			throw new Error(INVALIDATED);
+		}
+		const selected = snapshot.integration;
+		if (current.provider !== selected.provider || current.organizationId !== selected.organizationId || current.mailboxId !== selected.mailboxId || current.credentialRef !== selected.credentialRef) throw new Error(INVALIDATED);
+		return current;
+	}
 	async resolveReference(name, requestSignal, authorize) {
 		if (this.initializing) throw new Error("Profile secrets are unavailable during provider initialization");
 		await this.ready();
 		const snapshot = this.snapshot;
 		const connection = this.connection;
+		const current = this.currentBinding(snapshot);
 		const vaultReference = snapshot.secrets && Object.hasOwn(snapshot.secrets, name) ? snapshot.secrets[name] : void 0;
-		const providerReference = snapshot.integration?.secrets && Object.hasOwn(snapshot.integration.secrets, name) ? snapshot.integration.secrets[name] : void 0;
+		const providerReference = current?.secrets && Object.hasOwn(current.secrets, name) ? current.secrets[name] : void 0;
+		if (vaultReference && providerReference) throw new Error("Profile secret aliases must be unique");
 		const signal = requestSignal ? AbortSignal.any([snapshot.signal, requestSignal]) : snapshot.signal;
 		const saved = vaultReference || providerReference ? void 0 : await this.savedSecret(name, signal);
 		const reference = vaultReference ?? providerReference ?? saved?.reference;
@@ -378,6 +393,7 @@ var SessionProfileRuntime = class {
 			throw new Error("Profile secret resolution failed");
 		}
 		if (signal.aborted || this.snapshot !== snapshot || this.connection !== connection) throw new Error(INVALIDATED);
+		if (JSON.stringify(this.currentBinding(snapshot)?.secrets[name]) !== JSON.stringify(providerReference)) throw new Error(INVALIDATED);
 		if (typeof value !== "string" || value.length === 0) throw new Error("Profile secret field is unavailable");
 		return value;
 	}
@@ -758,4 +774,4 @@ function profileTitle(current) {
 //#endregion
 export { PROFILE_SOURCES_SERVICE as A, PROFILE_RESOLUTION_TIMEOUT_MS as C, resolveInitialProfile as D, readInitialProfileOutcome as E, PROFILE_RUNTIME_SERVICE as M, PROFILE_INITIAL_OUTCOME_SERVICE as N, waitForSources as O, PROFILE_INITIAL_OUTCOME_CONTRACT as S, profileWarningText as T, createProfileSecretsPlugin as _, profileStatus as a, createProfileRuntimePlugin as b, createSecretRedactionStream as c, createProfileSourcesPlugin as d, findProfile as f, createProfileSecrets as g, ProfileSecretsService as h, profileItems as i, PROFILE_SECRETS_SERVICE as j, FILE_PROFILE_SOURCE_ID as k, redactSecrets as l, readProfileSources as m, PROFILE_STATUS_KEY as n, profileSummary as o, mergeProfiles as p, profileDescription as r, profileTitle as s, PROFILE_COMMAND as t, createProfileSources as u, requireProfileSecrets as v, createDeadline as w, requireProfileRuntime as x, createProfileRuntime as y };
 
-//# sourceMappingURL=profileText-3qUgFIgc.mjs.map
+//# sourceMappingURL=profileText-zg12bf1S.mjs.map

package/dist/profileText-zg12bf1S.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"profileText-zg12bf1S.mjs","names":["UNAVAILABLE"],"sources":["../src/constants/profileInitialOutcome.ts","../src/constants/profileRuntime.ts","../src/constants/profileSecrets.ts","../src/constants/profileSources.ts","../src/services/launchProfiles/type.ts","../src/services/profileResolution/index.ts","../src/services/profileRuntime/index.ts","../src/services/profileSecrets/index.ts","../src/services/profileSources/index.ts","../src/services/secretRedaction/index.ts","../src/services/profileText/index.ts"],"sourcesContent":["/** The decision about a session's first profile, published on the session context before its plugins start. */\nexport const PROFILE_INITIAL_OUTCOME_SERVICE = 'po/profile-initial-outcome';\n","export const PROFILE_RUNTIME_SERVICE = 'po/profile-runtime';\n","// @scaffold-generated\nexport const PROFILE_SECRETS_SERVICE = 'po/profile-secrets';\n","// @scaffold-generated\nexport const PROFILE_SOURCES_SERVICE = 'po/profile-sources';\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\n\n/** The source id every profile read from a `profiles.yaml` carries. */\nexport const FILE_PROFILE_SOURCE_ID = 'files';\n\n/** One profile a launcher may offer. Display data only: never a persona, environment, binding or secret. */\nexport interface LaunchProfileItem {\n  readonly name: string;\n  readonly identity?: {\n    readonly name?: string;\n    readonly icon?: string;\n    readonly role?: string;\n    readonly contact?: string;\n  };\n  /** `files`, or the id a plugin registered its source under. */\n  readonly sourceId: string;\n}\n\nexport interface LaunchProfileCatalog {\n  readonly profiles: readonly LaunchProfileItem[];\n  /** `unavailable` means a source did not become ready in time or failed; `profiles` lists what exists already. */\n  readonly readiness: 'ready' | 'unavailable';\n}\n\nexport interface ListLaunchProfilesInput {\n  readonly files: readonly AgentProfile[];\n  readonly sources: ProfileSources | undefined;\n  readonly scope: ProfileScope;\n  /** The request going away rejects the listing. */\n  readonly signal: AbortSignal;\n  /** The one budget for waiting on sources. Defaults to ten seconds. */\n  readonly timeoutMs?: number;\n}\n","// @scaffold-generated\nimport type { AgentProfile } from '@agimon-ai/po-config/profiles';\nimport { defineServiceContract } from '@agimon-ai/po-core/extensionFile';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_INITIAL_OUTCOME_SERVICE } from '../../constants/profileInitialOutcome';\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\nimport type {\n  Deadline,\n  DeadlineResult,\n  InitialProfileOutcome,\n  InitialProfileWarning,\n  ResolveInitialProfileOptions,\n} from './type';\n\n/** One budget for every wait of a resolution. */\nexport const PROFILE_RESOLUTION_TIMEOUT_MS = 10_000;\nconst SECONDS = PROFILE_RESOLUTION_TIMEOUT_MS / 1_000;\n\n/** Published on a session context by whoever launches it, or by the session itself when nobody did. */\nexport const PROFILE_INITIAL_OUTCOME_CONTRACT = defineServiceContract<InitialProfileOutcome>(\n  PROFILE_INITIAL_OUTCOME_SERVICE,\n  { scope: 'session' },\n);\n\n/** The outcome a launcher already decided, or undefined when this session was not launched with one. */\nexport function readInitialProfileOutcome(context: Context): InitialProfileOutcome | undefined {\n  return context.get(PROFILE_INITIAL_OUTCOME_SERVICE);\n}\n\nconst abortReason = (signal: AbortSignal): Error =>\n  signal.reason instanceof Error ? signal.reason : new Error('Profile resolution was aborted');\n\n/**\n * A single absolute deadline shared by every wait of one resolution.\n *\n * Hooks receive a signal that aborts when the deadline passes, the owner aborts, or the deadline is disposed:\n * work shared with other waiters must keep running when that signal fires. A hook that ignores the signal cannot\n * hold the resolution back, and its late result or failure is dropped.\n */\nexport function createDeadline(owner: AbortSignal, timeoutMs: number): Deadline {\n  const controller = new AbortController();\n  let expired = false;\n  let expire!: (result: DeadlineResult<never>) => void;\n  let interrupt!: (error: Error) => void;\n  const interruption = new Promise<DeadlineResult<never>>((resolve, reject) => {\n    expire = resolve;\n    interrupt = reject;\n  });\n  // Waits observe this promise, but it can settle between two of them.\n  interruption.catch(() => undefined);\n\n  const onOwnerAbort = () => {\n    interrupt(abortReason(owner));\n    controller.abort(owner.reason);\n  };\n  if (owner.aborted) onOwnerAbort();\n  else owner.addEventListener('abort', onOwnerAbort, { once: true });\n  const timer = setTimeout(() => {\n    expired = true;\n    expire({ status: 'timeout' });\n    controller.abort(new Error('Profile resolution timed out'));\n  }, timeoutMs);\n\n  return {\n    signal: controller.signal,\n    within<T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> {\n      if (owner.aborted) return Promise.reject(abortReason(owner));\n      if (expired) return Promise.resolve({ status: 'timeout' });\n      let work: Promise<T>;\n      try {\n        work = Promise.resolve(start(controller.signal));\n      } catch {\n        return Promise.resolve({ status: 'failed' });\n      }\n      const finished = work.then(\n        (value): DeadlineResult<T> => ({ status: 'done', value }),\n        (): DeadlineResult<T> => ({ status: 'failed' }),\n      );\n      return Promise.race([finished, interruption]);\n    },\n    dispose() {\n      clearTimeout(timer);\n      owner.removeEventListener('abort', onOwnerAbort);\n      if (!controller.signal.aborted) controller.abort(new Error('Profile resolution finished'));\n    },\n  };\n}\n\n/** Waits once for source readiness, without discarding profiles that already loaded. */\nexport async function waitForSources(\n  sources: ProfileSources | undefined,\n  scope: ProfileScope | undefined,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Promise<'done' | 'timeout' | 'failed'> {\n  signal.throwIfAborted();\n  if (sources === undefined) return 'done';\n  const deadline = createDeadline(signal, timeoutMs);\n  try {\n    return (await deadline.within((waitSignal) => sources.ready(scope, waitSignal))).status;\n  } finally {\n    deadline.dispose();\n  }\n}\nconst names = (files: readonly AgentProfile[], sources: ProfileSources | undefined, scope: ProfileScope | undefined) =>\n  new Set([...files.map(({ name }) => name), ...(sources?.list(scope).map(({ name }) => name) ?? [])]);\n\n/**\n * Decides which profile a session starts with, once.\n *\n * Resolves a name that is already listed at once. Waits for sources to become ready only when a requested name\n * is missing, and consults a source default only when nothing was requested in a known workspace; a default its\n * catalog does not list yet waits for readiness too. Every wait shares one deadline. A name that never arrives, a source that fails and a default that is not in the\n * workspace catalog all give a session with no profile and one warning; only the owner aborting rejects.\n */\nexport async function resolveInitialProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  options: ResolveInitialProfileOptions,\n): Promise<InitialProfileOutcome> {\n  options.signal.throwIfAborted();\n  const { intent, scope } = options;\n  const workspaceId = scope?.workspaceId;\n  const base: InitialProfileOutcome = { intent, ...(workspaceId === undefined ? {} : { workspaceId }) };\n  if (intent.kind === 'none') return base;\n\n  // Created by the first wait, so a profile that is already listed costs no timer.\n  const held: { deadline?: Deadline } = {};\n  const within = <T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> => {\n    held.deadline ??= createDeadline(options.signal, options.timeoutMs ?? PROFILE_RESOLUTION_TIMEOUT_MS);\n    return held.deadline.within(start);\n  };\n  const warn = (warning: InitialProfileWarning): InitialProfileOutcome => ({ ...base, warning });\n  try {\n    if (intent.kind === 'named') {\n      const requested = intent.name;\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (sources === undefined) return warn({ code: 'missing', requested });\n      const waited = await within((signal) => sources.ready(scope, signal));\n      // A usable profile wins over a source that failed or ran out of time.\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (waited.status === 'timeout') return warn({ code: 'timeout', requested });\n      return warn({ code: waited.status === 'failed' ? 'source-failed' : 'missing', requested });\n    }\n    if (workspaceId === undefined || sources === undefined) return base;\n    const waited = await within((signal) => sources.defaultProfile(scope, signal));\n    if (waited.status === 'timeout') return warn({ code: 'timeout' });\n    if (waited.status === 'failed') return warn({ code: 'source-failed' });\n    const chosen = waited.value;\n    if (chosen === undefined) return base;\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    // A source may name its default before its catalog is published: wait for the sources before ruling it out.\n    const settled = await within((signal) => sources.ready(scope, signal));\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    if (settled.status === 'timeout') return warn({ code: 'timeout', requested: chosen });\n    if (settled.status === 'failed') return warn({ code: 'source-failed', requested: chosen });\n    return warn({ code: 'invalid-default', requested: chosen });\n  } finally {\n    held.deadline?.dispose();\n  }\n}\n\n/** The one-line notice for a session that started without the profile it was meant to have. Names only. */\nexport function profileWarningText(warning: InitialProfileWarning): string {\n  const { code, requested } = warning;\n  const subject = requested === undefined ? 'The workspace default profile' : `Profile \"${requested}\"`;\n  const outcome = 'so this session started without a profile.';\n  if (code === 'timeout') return `${subject} was not ready within ${SECONDS} seconds, ${outcome}`;\n  if (code === 'source-failed') return `${subject} could not be loaded because its source failed, ${outcome}`;\n  if (code === 'invalid-default') return `The default profile \"${requested}\" is not available, ${outcome}`;\n  return `${subject} is not available, ${outcome}`;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-initial-outcome': InitialProfileOutcome;\n  }\n}\n","import {\n  parseProfileBinding,\n  parseProfileVaultSecrets,\n  type ProfileIntegrationBinding,\n  type ProfileSecretReference,\n  type ProfileVaultSecretReference,\n} from '@agimon-ai/po-config/profiles';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_RUNTIME_SERVICE } from '../../constants/profileRuntime';\nimport type {\n  ProfileProviderFactory,\n  ProfileInputSecretRequest,\n  ProfileRuntime,\n  ProfileRuntimeOptions,\n  ProfileRuntimeSnapshot,\n  ProfileSecretRequest,\n  ProfileSecretResolver,\n} from './type';\n\nconst UNAVAILABLE = 'Profile integration provider is unavailable';\nconst INVALIDATED = 'Profile operation was invalidated';\n/** Vault namespace for secrets saved from the composer; po-vault's `VAULT_SECRETS_NAMESPACE` writes it. */\nconst VAULT_SECRETS_NAMESPACE = 'secrets';\nconst ALIAS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/u;\n\n/** A single selected profile and provider, owned by one session, not a provider registry. */\nclass SessionProfileRuntime implements ProfileRuntime {\n  private controller = new AbortController();\n  private snapshot: ProfileRuntimeSnapshot;\n  private provider?: { name: string; factory: ProfileProviderFactory };\n  private connection?: ProfileSecretResolver;\n  private transition: Promise<void> = Promise.resolve();\n  private retirement: Promise<void> = Promise.resolve();\n  private readonly pending = new Set<Promise<void>>();\n  private initializing = false;\n  private disposed = false;\n  private disposal?: Promise<void>;\n\n  constructor(private readonly options: ProfileRuntimeOptions) {\n    this.snapshot = this.capture(options.profileName, 1);\n  }\n\n  private capture(profileName: string | undefined, generation: number): ProfileRuntimeSnapshot {\n    const binding = profileName === undefined ? undefined : this.options.readBinding(profileName);\n    const env = profileName === undefined ? undefined : this.options.readEnv?.(profileName);\n    const sourceSecrets = profileName === undefined ? undefined : this.options.readSecrets?.(profileName);\n    const secrets = sourceSecrets === undefined ? undefined : parseProfileVaultSecrets(sourceSecrets);\n    if (secrets && Object.keys(secrets).some((name) => binding?.secrets && Object.hasOwn(binding.secrets, name))) {\n      throw new Error('Profile secret aliases must be unique');\n    }\n    return Object.freeze({\n      ...(profileName === undefined ? {} : { profileName }),\n      ...(binding === undefined ? {} : { integration: parseProfileBinding(binding) }),\n      ...(env === undefined ? {} : { env: Object.freeze({ ...env }) }),\n      ...(secrets === undefined ? {} : { secrets }),\n      generation,\n      signal: this.controller.signal,\n    });\n  }\n\n  readSelection(): ProfileRuntimeSnapshot {\n    return this.snapshot;\n  }\n\n  invalidate(): void {\n    this.controller.abort();\n    const connection = this.connection;\n    this.connection = undefined;\n    if (connection) {\n      this.retirement = this.retirement.then(async () => {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n      });\n      void this.track(this.retirement);\n    }\n  }\n\n  private track(work: Promise<void>): Promise<void> {\n    this.pending.add(work);\n    // Keep rejection observable through ready/dispose while preventing an unhandled\n    // rejection when selection invalidates an initialization before its owner awaits it.\n    void work.then(\n      () => this.pending.delete(work),\n      () => this.pending.delete(work),\n    );\n    return work;\n  }\n\n  private initialize(): Promise<void> {\n    const snapshot = this.snapshot;\n    const provider = this.provider;\n    this.initializing = Boolean(snapshot.integration && provider);\n    const work = (async () => {\n      await this.retirement;\n      if (snapshot.signal.aborted) return;\n      if (!snapshot.integration || !provider) return;\n      if (snapshot.integration.provider !== provider.name) throw new Error(UNAVAILABLE);\n      let connection: ProfileSecretResolver;\n      try {\n        connection = await provider.factory(snapshot.integration, {\n          profileName: snapshot.profileName!,\n          generation: snapshot.generation,\n          signal: snapshot.signal,\n        });\n      } catch {\n        // A retired factory commonly rejects on abort. That cannot remove the\n        // provider attachment or poison the replacement generation.\n        if (snapshot.signal.aborted) return;\n        throw new Error('Profile provider initialization failed');\n      }\n      if (snapshot.signal.aborted || this.snapshot !== snapshot || this.disposed) {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n        return;\n      }\n      this.connection = connection;\n    })();\n    this.transition = this.track(\n      work.finally(() => {\n        if (this.snapshot === snapshot) this.initializing = false;\n      }),\n    );\n    return this.transition;\n  }\n\n  async select(profileName?: string, options?: { readonly force?: boolean }): Promise<void> {\n    if (this.disposed) throw new Error(INVALIDATED);\n    if (\n      options?.force !== true &&\n      this.snapshot.profileName === profileName &&\n      !this.snapshot.signal.aborted &&\n      (!this.snapshot.integration || !this.provider || this.connection || this.initializing)\n    )\n      return;\n    this.invalidate();\n    this.controller = new AbortController();\n    // If reading/validation fails, leave the old generation aborted, never usable.\n    this.snapshot = this.capture(profileName, this.snapshot.generation + 1);\n    await this.initialize();\n  }\n\n  async ready(): Promise<void> {\n    const snapshot = this.snapshot;\n    await this.transition;\n    if (this.disposed || snapshot.signal.aborted || this.snapshot !== snapshot) throw new Error(INVALIDATED);\n    if (snapshot.integration && !this.connection) throw new Error(UNAVAILABLE);\n  }\n\n  async attachProvider(providerName: string, factory: ProfileProviderFactory): Promise<() => Promise<void>> {\n    if (this.disposed || this.snapshot.signal.aborted) throw new Error(INVALIDATED);\n    if (this.provider) throw new Error('Profile provider is already attached');\n    if (this.snapshot.integration && this.snapshot.integration.provider !== providerName) throw new Error(UNAVAILABLE);\n    const provider = { name: providerName, factory };\n    this.provider = provider;\n    try {\n      await this.initialize();\n      await this.ready();\n      if (this.disposed || this.provider !== provider) throw new Error(INVALIDATED);\n    } catch {\n      if (this.provider === provider) this.provider = undefined;\n      this.invalidate();\n      throw new Error('Profile provider initialization failed');\n    }\n    let detached = false;\n    return async () => {\n      if (detached || this.provider !== provider) return;\n      detached = true;\n      this.invalidate();\n      this.provider = undefined;\n      this.controller = new AbortController();\n      this.snapshot = Object.freeze({\n        ...this.snapshot,\n        generation: this.snapshot.generation + 1,\n        signal: this.controller.signal,\n      });\n      await this.retirement;\n    };\n  }\n\n  resolveSecret(name: string, request: ProfileSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (!reference.purposes.includes('browser')) throw new Error('Profile secret alias is unavailable');\n      if (!reference.allowedOrigins.includes(request.origin)) throw new Error('Profile secret origin is not allowed');\n    });\n  }\n\n  resolveInputSecret(name: string, request: ProfileInputSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (\n        !reference.purposes.includes('input') ||\n        !reference.allowedTargets ||\n        !Object.hasOwn(reference.allowedTargets, request.surface) ||\n        !reference.allowedTargets[request.surface]?.includes(request.target)\n      ) {\n        throw new Error('Profile secret input target is not allowed');\n      }\n    });\n  }\n\n  resolveProxySecret(signal?: AbortSignal): Promise<string> {\n    const name = this.snapshot.integration?.browser?.proxySecret;\n    if (name === undefined) return Promise.reject(new Error('Profile proxy is not configured'));\n    return this.resolveReference(name, signal, (reference) => {\n      if (!reference.purposes.includes('proxy')) throw new Error('Profile secret alias is unavailable');\n    });\n  }\n\n  /** Refresh only value-free aliases, never the selected provider or browser identity. */\n  private currentBinding(snapshot: ProfileRuntimeSnapshot): ProfileIntegrationBinding | undefined {\n    if (!snapshot.integration || snapshot.profileName === undefined) return undefined;\n    let current: ProfileIntegrationBinding;\n    try {\n      current = parseProfileBinding(this.options.readBinding(snapshot.profileName));\n    } catch {\n      throw new Error(INVALIDATED);\n    }\n    const selected = snapshot.integration;\n    if (\n      current.provider !== selected.provider ||\n      current.organizationId !== selected.organizationId ||\n      current.mailboxId !== selected.mailboxId ||\n      current.credentialRef !== selected.credentialRef\n    )\n      throw new Error(INVALIDATED);\n    return current;\n  }\n\n  private async resolveReference(\n    name: string,\n    requestSignal: AbortSignal | undefined,\n    authorize: (reference: ProfileSecretReference | ProfileVaultSecretReference) => void,\n  ): Promise<string> {\n    // Do not await ready here: a provider factory invoking this callback would\n    // otherwise wait for itself. Browser creation may retain, but not invoke it.\n    if (this.initializing) throw new Error('Profile secrets are unavailable during provider initialization');\n    await this.ready();\n    const snapshot = this.snapshot;\n    const connection = this.connection;\n    const current = this.currentBinding(snapshot);\n    const vaultReference =\n      snapshot.secrets && Object.hasOwn(snapshot.secrets, name) ? snapshot.secrets[name] : undefined;\n    const providerReference =\n      current?.secrets && Object.hasOwn(current.secrets, name) ? current.secrets[name] : undefined;\n    if (vaultReference && providerReference) throw new Error('Profile secret aliases must be unique');\n    const signal = requestSignal ? AbortSignal.any([snapshot.signal, requestSignal]) : snapshot.signal;\n    // Profile aliases win; otherwise a secret saved from the composer, under its own allowlist.\n    const saved = vaultReference || providerReference ? undefined : await this.savedSecret(name, signal);\n    const reference = vaultReference ?? providerReference ?? saved?.reference;\n    if (!reference) throw new Error('Profile secret alias is unavailable');\n    authorize(reference);\n    if (signal.aborted) throw new Error(INVALIDATED);\n    let value: string;\n    try {\n      if (saved) {\n        value = saved.value as string;\n      } else if (vaultReference) {\n        if (!this.options.readVault) throw new Error('Vault unavailable');\n        const { namespace, key, field } = vaultReference.vault;\n        const entry = await this.options.readVault(namespace, key, signal);\n        const selected =\n          field === undefined\n            ? entry\n            : typeof entry === 'object' && entry !== null && !Array.isArray(entry) && Object.hasOwn(entry, field)\n              ? (entry as Record<string, unknown>)[field]\n              : undefined;\n        if (typeof selected !== 'string') throw new Error('Vault field unavailable');\n        value = selected;\n      } else {\n        if (!connection || !providerReference) throw new Error('Provider unavailable');\n        value = await connection.resolveSecret(providerReference, signal);\n      }\n    } catch {\n      // Provider failures must not leak API responses, credential fields or secrets.\n      throw new Error('Profile secret resolution failed');\n    }\n    if (signal.aborted || this.snapshot !== snapshot || this.connection !== connection) throw new Error(INVALIDATED);\n    if (JSON.stringify(this.currentBinding(snapshot)?.secrets[name]) !== JSON.stringify(providerReference)) {\n      throw new Error(INVALIDATED);\n    }\n    if (typeof value !== 'string' || value.length === 0) throw new Error('Profile secret field is unavailable');\n    return value;\n  }\n\n  /** `secrets/<name>` as `{value, purposes, allowedOrigins?, allowedTargets?}`, checked like a profile alias. */\n  private async savedSecret(\n    name: string,\n    signal: AbortSignal,\n  ): Promise<{ reference: ProfileVaultSecretReference; value: unknown } | undefined> {\n    if (!this.options.readVault || !ALIAS_PATTERN.test(name)) return undefined;\n    try {\n      const entry = await this.options.readVault(VAULT_SECRETS_NAMESPACE, name, signal);\n      if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) return undefined;\n      const { value, ...delivery } = entry as Record<string, unknown>;\n      const vault = { namespace: VAULT_SECRETS_NAMESPACE, key: name, field: 'value' };\n      const reference = parseProfileVaultSecrets({ [name]: { ...delivery, vault } }, 'Saved secret')[name];\n      return reference && { reference, value };\n    } catch {\n      return undefined;\n    }\n  }\n\n  dispose(): Promise<void> {\n    if (this.disposal) return this.disposal;\n    this.disposed = true;\n    this.invalidate();\n    this.provider = undefined;\n    this.disposal = (async () => {\n      const results = await Promise.allSettled([...this.pending, this.retirement]);\n      if (results.some((result) => result.status === 'rejected')) throw new Error('Profile runtime disposal failed');\n    })();\n    return this.disposal;\n  }\n}\n\nexport function createProfileRuntime(options: ProfileRuntimeOptions): ProfileRuntime {\n  return new SessionProfileRuntime(options);\n}\n\n/** Mounted in the scoped root services array, before dependent integration tools. */\nexport function createProfileRuntimePlugin(runtime: ProfileRuntime): (context: Context) => void {\n  return (context) => {\n    context.provide(PROFILE_RUNTIME_SERVICE, runtime);\n  };\n}\n\nexport function requireProfileRuntime(context: Context): ProfileRuntime {\n  const service = context.get(PROFILE_RUNTIME_SERVICE);\n  if (!service) throw new Error('Profile runtime service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-runtime': ProfileRuntime;\n  }\n}\n","// @scaffold-generated\nimport type { ProfileIntegrationBinding } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SECRETS_SERVICE } from '../../constants/profileSecrets';\nimport type { ProfileProviderFactory, ProfileSecretResolver } from '../profileRuntime/type';\nimport type { ProfileEnvSecretRequest, ProfileSecrets, ProfileSecretsOptions } from './type';\n\n/** Every failure is generic so callers never learn which alias, field or provider response failed. */\nconst UNAVAILABLE = 'Profile secrets are unavailable';\n\nclass HostProfileSecrets implements ProfileSecrets {\n  private readonly providers = new Map<string, ProfileProviderFactory>();\n  private generation = 0;\n\n  constructor(private readonly options: ProfileSecretsOptions) {}\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    if (this.providers.has(provider)) throw new Error('Profile secrets provider is already registered');\n    this.providers.set(provider, factory);\n    return () => {\n      if (this.providers.get(provider) === factory) this.providers.delete(provider);\n    };\n  }\n\n  async resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    if (request.names.length === 0) return {};\n    if (new Set(request.names).size !== request.names.length) throw new Error(UNAVAILABLE);\n    let binding: ProfileIntegrationBinding | undefined;\n    try {\n      binding = await this.options.readBinding(request.cwd, request.profile, request.homeDirectory);\n    } catch {\n      throw new Error(UNAVAILABLE);\n    }\n    const factory = binding && this.providers.get(binding.provider);\n    if (!binding || !factory) throw new Error(UNAVAILABLE);\n    const references = request.names.map((name) => {\n      const reference = Object.hasOwn(binding.secrets, name) ? binding.secrets[name] : undefined;\n      if (!reference?.purposes.includes('env')) throw new Error(UNAVAILABLE);\n      return [name, reference] as const;\n    });\n\n    const controller = new AbortController();\n    const signal = request.signal ? AbortSignal.any([controller.signal, request.signal]) : controller.signal;\n    let connection: ProfileSecretResolver | undefined;\n    try {\n      connection = await factory(binding, { profileName: request.profile, generation: ++this.generation, signal });\n      const values: Record<string, string> = {};\n      for (const [name, reference] of references) {\n        const value = await connection.resolveSecret(reference, signal);\n        if (signal.aborted || typeof value !== 'string' || value.length === 0) throw new Error(UNAVAILABLE);\n        values[name] = value;\n      }\n      return values;\n    } catch {\n      throw new Error(UNAVAILABLE);\n    } finally {\n      controller.abort();\n      try {\n        await connection?.dispose();\n      } catch {\n        // Disposal failures are not secret-bearing, but the resolved values are still discarded.\n        // oxlint-disable-next-line no-unsafe-finally\n        throw new Error(UNAVAILABLE);\n      }\n    }\n  }\n}\n\nexport function createProfileSecrets(options: ProfileSecretsOptions): ProfileSecrets {\n  return new HostProfileSecrets(options);\n}\n\n/** Host-side env secret resolution for workflow run steps. Never registered as a model tool. */\nexport class ProfileSecretsService extends Service implements ProfileSecrets {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSecrets,\n  ) {\n    super(context, PROFILE_SECRETS_SERVICE);\n  }\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    return this.source.registerProvider(provider, factory);\n  }\n\n  resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    return this.source.resolveEnv(request);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSecretsPlugin(source: ProfileSecrets): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSecretsService(context, source);\n  };\n}\n\nexport function requireProfileSecrets(context: Context): ProfileSecrets {\n  const service = context.get(PROFILE_SECRETS_SERVICE);\n  if (!service) throw new Error('Profile secrets service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-secrets': ProfileSecrets;\n  }\n}\n","// @scaffold-generated\nimport { type AgentProfile, inlineProfile } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SOURCES_SERVICE } from '../../constants/profileSources';\nimport type { ContributedProfile, ProfileScope, ProfileSource, ProfileSources, SourcedProfile } from './type';\n\n/** Runs a hook that may throw before it returns a promise, so both kinds of failure are one rejection. */\nasync function settle(run: () => Promise<void> | void): Promise<void> {\n  await run();\n}\n\nclass HostProfileSources implements ProfileSources {\n  private readonly sources = new Map<string, ProfileSource>();\n\n  register(id: string, source: ProfileSource): () => void {\n    if (this.sources.has(id)) throw new Error('Profile source is already registered');\n    this.sources.set(id, source);\n    return () => {\n      if (this.sources.get(id) === source) this.sources.delete(id);\n    };\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.listSourced(scope).map(({ profile }) => profile);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    const byName = new Map<string, SourcedProfile>();\n    for (const [sourceId, source] of this.sources) {\n      let inputs;\n      try {\n        inputs = source.list(scope);\n      } catch {\n        continue;\n      }\n      for (const input of inputs) {\n        if (byName.has(input.name)) continue;\n        try {\n          const profile = inlineProfile(input);\n          if (profile.personaPrompt)\n            byName.set(profile.name, { sourceId, profile: { ...profile, personaPrompt: profile.personaPrompt } });\n        } catch {\n          // An invalid definition is skipped like an invalid directory profile.\n        }\n      }\n    }\n    return [...byName.values()].sort((left, right) => left.profile.name.localeCompare(right.profile.name));\n  }\n\n  async ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    const entries = [...this.sources].filter(([, source]) => source.ready !== undefined);\n    const results = await Promise.allSettled(entries.map(([, source]) => settle(() => source.ready?.(scope, signal))));\n    const failed = entries.filter((_, index) => results[index]?.status === 'rejected').map(([id]) => id);\n    // Source ids only: a rejection reason may carry anything the source put in it.\n    if (failed.length) throw new Error(`Profile source not ready: ${failed.join(', ')}`);\n  }\n\n  async defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    for (const source of this.sources.values()) {\n      if (source.defaultProfile === undefined) continue;\n      const chosen = await source.defaultProfile(scope, signal);\n      if (chosen !== undefined) return chosen;\n    }\n    return undefined;\n  }\n}\n\nexport function createProfileSources(): ProfileSources {\n  return new HostProfileSources();\n}\n\n/** File profiles win; a contributed profile only fills a name the file catalog does not hold. */\nexport function mergeProfiles(files: readonly AgentProfile[], sources: ProfileSources | undefined): AgentProfile[] {\n  const names = new Set(files.map(({ name }) => name));\n  const contributed = (sources?.list() ?? []).filter(({ name }) => !names.has(name));\n  return [...files, ...contributed].sort((left, right) => left.name.localeCompare(right.name));\n}\n\nexport function findProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  name: string,\n): AgentProfile {\n  const profile =\n    files.find((candidate) => candidate.name === name) ?? sources?.list().find((candidate) => candidate.name === name);\n  if (!profile) throw new Error(`Unknown profile: ${name}`);\n  return profile;\n}\n\n/** Profiles plugins hold in memory, merged into the session catalog. Optional: absent means files only. */\nexport class ProfileSourcesService extends Service implements ProfileSources {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSources,\n  ) {\n    super(context, PROFILE_SOURCES_SERVICE);\n  }\n\n  register(id: string, source: ProfileSource): () => void {\n    return this.source.register(id, source);\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.source.list(scope);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    return this.source.listSourced(scope);\n  }\n\n  ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    return this.source.ready(scope, signal);\n  }\n\n  defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    return this.source.defaultProfile(scope, signal);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSourcesPlugin(source: ProfileSources): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSourcesService(context, source);\n  };\n}\n\n/** With a scope, every `list` call through the returned view reads as that workspace. */\nexport function readProfileSources(context: Context, scope?: ProfileScope): ProfileSources | undefined {\n  const sources = context.get(PROFILE_SOURCES_SERVICE);\n  if (!sources || !scope) return sources;\n  return {\n    register: (id, source) => sources.register(id, source),\n    list: () => sources.list(scope),\n    listSourced: () => sources.listSourced(scope),\n    ready: (_ignored, signal) => sources.ready(scope, signal),\n    defaultProfile: (_ignored, signal) => sources.defaultProfile(scope, signal),\n  };\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-sources': ProfileSources;\n  }\n}\n","// @scaffold-generated\nimport type { SecretRedactionStream } from './type';\n\nconst REDACTED = '[redacted]';\n\n/** Raw, JSON-escaped and URL-encoded forms of every non-empty value. */\nfunction secretForms(secrets: Iterable<string>): string[] {\n  const forms = new Set<string>();\n  for (const secret of secrets) {\n    if (typeof secret !== 'string' || !secret) continue;\n    forms.add(secret);\n    forms.add(JSON.stringify(secret).slice(1, -1));\n    forms.add(encodeURIComponent(secret));\n  }\n  return [...forms];\n}\n\n/** Marks every occurrence of every form, so overlapping secrets cannot leave fragments behind. */\nfunction coverage(value: string, forms: readonly string[]): Uint8Array {\n  const covered = new Uint8Array(value.length);\n  for (const form of forms)\n    for (let index = value.indexOf(form); index !== -1; index = value.indexOf(form, index + 1))\n      covered.fill(1, index, index + form.length);\n  return covered;\n}\n\nfunction render(value: string, covered: Uint8Array, end: number): string {\n  let safe = '';\n  let start = 0;\n  for (let index = 0; index <= end; index++) {\n    if (index < end && covered[index] === covered[start]) continue;\n    if (index > start) safe += covered[start] ? REDACTED : value.slice(start, index);\n    start = index;\n  }\n  return safe;\n}\n\nfunction redactText(value: string, forms: readonly string[]): string {\n  return forms.length === 0 ? value : render(value, coverage(value, forms), value.length);\n}\n\nfunction redactValue(value: unknown, forms: readonly string[]): unknown {\n  if (typeof value === 'string') return redactText(value, forms);\n  if (Array.isArray(value)) return value.map((entry) => redactValue(entry, forms));\n  if (value !== null && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entry]) => [redactText(key, forms), redactValue(entry, forms)]),\n    );\n  }\n  return value;\n}\n\n/** Deeply redacts strings and object keys. Non-plain objects become plain records. */\nexport function redactSecrets<T>(value: T, secrets: Iterable<string>): T {\n  return redactValue(value, secretForms(secrets)) as T;\n}\n\nexport function createSecretRedactionStream(secrets: Iterable<string>): SecretRedactionStream {\n  const forms = secretForms(secrets);\n  // A secret not yet complete must start within the last `hold` characters of the buffer.\n  const hold = Math.max(0, ...forms.map((form) => form.length - 1));\n  let buffer = '';\n  return {\n    write(chunk) {\n      buffer += chunk;\n      const covered = coverage(buffer, forms);\n      let end = Math.max(0, buffer.length - hold);\n      // Never split a completed match: hold back the whole run that crosses the boundary.\n      while (end > 0 && end < buffer.length && covered[end] && covered[end - 1]) end--;\n      const safe = render(buffer, covered, end);\n      buffer = buffer.slice(end);\n      return safe;\n    },\n    flush() {\n      const safe = redactText(buffer, forms);\n      buffer = '';\n      return safe;\n    },\n  };\n}\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nconst NONE = 'None';\n\n/** Footer status key the cockpit's profile axis reads. */\ninterface SelectItem {\n  value: string;\n  label: string;\n  description?: string;\n  icon?: string;\n}\n\nexport const PROFILE_STATUS_KEY = 'po-profile';\n\n/** Identity this package registers voice capabilities under. */\nexport const PROFILE_SOURCE = '@agimon-ai/po-profile';\n\n/** The command a queued voice switch invokes, and the reload handoff kind it parks. */\nexport const PROFILE_COMMAND = 'profile';\n\n/**\n * The published axis content: the active profile's name, empty while\n * profiles exist with none active, and undefined to withhold the status so\n * the cockpit keeps the axis off the bar entirely.\n */\nexport function profileStatus(current: string | undefined, hasProfiles: boolean): string | undefined {\n  if (current) return current;\n  return hasProfiles ? '' : undefined;\n}\n\n/** What a person reads for a profile: its declared display name, otherwise the profile name. */\nexport function profileLabel(profile: AgentProfile): string {\n  return profile.identity?.name || profile.name;\n}\n\n/**\n * Rows for the single-select profile picker. A client answers with the label, so a display name two\n * profiles share, or one that reads as None, carries the profile name to stay unique.\n */\nexport function profileItems(profiles: AgentProfile[]): SelectItem[] {\n  const labels = profiles.map(profileLabel);\n  return [\n    { value: '', label: NONE },\n    ...profiles.map((profile, index) => {\n      const label = labels[index] ?? profile.name;\n      const unique = label !== NONE && labels.indexOf(label) === labels.lastIndexOf(label);\n      return {\n        value: profile.name,\n        label: unique ? label : `${label} (${profile.name})`,\n        description: profileDescription(profile),\n        ...(profile.identity?.icon ? { icon: profile.identity.icon } : {}),\n      };\n    }),\n  ];\n}\n\n/** The role and contact a profile declares, otherwise its persona source and environment keys. */\nexport function profileDescription(profile: AgentProfile): string {\n  const presented = [profile.identity?.role, profile.identity?.contact].filter(Boolean).join(' · ');\n  if (presented) return presented;\n  const environmentKeys = Object.keys(profile.env).sort();\n  return environmentKeys.length > 0 ? `${profile.persona} (env: ${environmentKeys.join(', ')})` : profile.persona;\n}\n\n/** Shown when the picked profile is already active. */\nexport function profileSummary(profile: AgentProfile): string {\n  const environmentKeys = Object.keys(profile.env).sort();\n  return [\n    `Profile ${profile.name}`,\n    `Persona: ${profile.persona}`,\n    `Env: ${environmentKeys.join(', ') || '(none)'}`,\n    'Already loaded.',\n  ].join('\\n');\n}\n\nexport function profileTitle(current?: string): string {\n  return `Profile (current: ${current ?? NONE})`;\n}\n"],"mappings":";;;;;AACA,MAAa,kCAAkC;;;ACD/C,MAAa,0BAA0B;;;ACCvC,MAAa,0BAA0B;;;ACAvC,MAAa,0BAA0B;;;;ACIvC,MAAa,yBAAyB;;;;ACWtC,MAAa,gCAAgC;AAC7C,MAAM,UAAU,gCAAgC;;AAGhD,MAAa,mCAAmC,sBAC9C,iCACA,EAAE,OAAO,UAAU,CACrB;;AAGA,SAAgB,0BAA0B,SAAqD;CAC7F,OAAO,QAAQ,IAAI,+BAA+B;AACpD;AAEA,MAAM,eAAe,WACnB,OAAO,kBAAkB,QAAQ,OAAO,yBAAS,IAAI,MAAM,gCAAgC;;;;;;;;AAS7F,SAAgB,eAAe,OAAoB,WAA6B;CAC9E,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,UAAU;CACd,IAAI;CACJ,IAAI;CACJ,MAAM,eAAe,IAAI,SAAgC,SAAS,WAAW;EAC3E,SAAS;EACT,YAAY;CACd,CAAC;CAED,aAAa,YAAY,KAAA,CAAS;CAElC,MAAM,qBAAqB;EACzB,UAAU,YAAY,KAAK,CAAC;EAC5B,WAAW,MAAM,MAAM,MAAM;CAC/B;CACA,IAAI,MAAM,SAAS,aAAa;MAC3B,MAAM,iBAAiB,SAAS,cAAc,EAAE,MAAM,KAAK,CAAC;CACjE,MAAM,QAAQ,iBAAiB;EAC7B,UAAU;EACV,OAAO,EAAE,QAAQ,UAAU,CAAC;EAC5B,WAAW,sBAAM,IAAI,MAAM,8BAA8B,CAAC;CAC5D,GAAG,SAAS;CAEZ,OAAO;EACL,QAAQ,WAAW;EACnB,OAAU,OAA4E;GACpF,IAAI,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,KAAK,CAAC;GAC3D,IAAI,SAAS,OAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,CAAC;GACzD,IAAI;GACJ,IAAI;IACF,OAAO,QAAQ,QAAQ,MAAM,WAAW,MAAM,CAAC;GACjD,QAAQ;IACN,OAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,CAAC;GAC7C;GACA,MAAM,WAAW,KAAK,MACnB,WAA8B;IAAE,QAAQ;IAAQ;GAAM,WAC7B,EAAE,QAAQ,SAAS,EAC/C;GACA,OAAO,QAAQ,KAAK,CAAC,UAAU,YAAY,CAAC;EAC9C;EACA,UAAU;GACR,aAAa,KAAK;GAClB,MAAM,oBAAoB,SAAS,YAAY;GAC/C,IAAI,CAAC,WAAW,OAAO,SAAS,WAAW,sBAAM,IAAI,MAAM,6BAA6B,CAAC;EAC3F;CACF;AACF;;AAGA,eAAsB,eACpB,SACA,OACA,QACA,WACwC;CACxC,OAAO,eAAe;CACtB,IAAI,YAAY,KAAA,GAAW,OAAO;CAClC,MAAM,WAAW,eAAe,QAAQ,SAAS;CACjD,IAAI;EACF,QAAQ,MAAM,SAAS,QAAQ,eAAe,QAAQ,MAAM,OAAO,UAAU,CAAC,EAAA,CAAG;CACnF,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AACA,MAAM,SAAS,OAAgC,SAAqC,0BAClF,IAAI,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE,WAAW,IAAI,GAAG,GAAI,SAAS,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK,CAAC,CAAE,CAAC;;;;;;;;;AAUrG,eAAsB,sBACpB,OACA,SACA,SACgC;CAChC,QAAQ,OAAO,eAAe;CAC9B,MAAM,EAAE,QAAQ,UAAU;CAC1B,MAAM,cAAc,OAAO;CAC3B,MAAM,OAA8B;EAAE;EAAQ,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CAAG;CACpG,IAAI,OAAO,SAAS,QAAQ,OAAO;CAGnC,MAAM,OAAgC,CAAC;CACvC,MAAM,UAAa,UAA+E;EAChG,KAAK,aAAa,eAAe,QAAQ,QAAQ,QAAQ,aAAA,GAA0C;EACnG,OAAO,KAAK,SAAS,OAAO,KAAK;CACnC;CACA,MAAM,QAAQ,aAA2D;EAAE,GAAG;EAAM;CAAQ;CAC5F,IAAI;EACF,IAAI,OAAO,SAAS,SAAS;GAC3B,MAAM,YAAY,OAAO;GACzB,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,YAAY,KAAA,GAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GACrE,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;GAEpE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GAC3E,OAAO,KAAK;IAAE,MAAM,OAAO,WAAW,WAAW,kBAAkB;IAAW;GAAU,CAAC;EAC3F;EACA,IAAI,gBAAgB,KAAA,KAAa,YAAY,KAAA,GAAW,OAAO;EAC/D,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,eAAe,OAAO,MAAM,CAAC;EAC7E,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;EAChE,IAAI,OAAO,WAAW,UAAU,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;EACrE,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EAExF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;EACrE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EACxF,IAAI,QAAQ,WAAW,WAAW,OAAO,KAAK;GAAE,MAAM;GAAW,WAAW;EAAO,CAAC;EACpF,IAAI,QAAQ,WAAW,UAAU,OAAO,KAAK;GAAE,MAAM;GAAiB,WAAW;EAAO,CAAC;EACzF,OAAO,KAAK;GAAE,MAAM;GAAmB,WAAW;EAAO,CAAC;CAC5D,UAAU;EACR,KAAK,UAAU,QAAQ;CACzB;AACF;;AAGA,SAAgB,mBAAmB,SAAwC;CACzE,MAAM,EAAE,MAAM,cAAc;CAC5B,MAAM,UAAU,cAAc,KAAA,IAAY,kCAAkC,YAAY,UAAU;CAClG,MAAM,UAAU;CAChB,IAAI,SAAS,WAAW,OAAO,GAAG,QAAQ,wBAAwB,QAAQ,YAAY;CACtF,IAAI,SAAS,iBAAiB,OAAO,GAAG,QAAQ,kDAAkD;CAClG,IAAI,SAAS,mBAAmB,OAAO,wBAAwB,UAAU,sBAAsB;CAC/F,OAAO,GAAG,QAAQ,qBAAqB;AACzC;;;ACxJA,MAAMA,gBAAc;AACpB,MAAM,cAAc;;AAEpB,MAAM,0BAA0B;AAChC,MAAM,gBAAgB;;AAGtB,IAAM,wBAAN,MAAsD;CAYvB;CAX7B,aAAqB,IAAI,gBAAgB;CACzC;CACA;CACA;CACA,aAAoC,QAAQ,QAAQ;CACpD,aAAoC,QAAQ,QAAQ;CACpD,0BAA2B,IAAI,IAAmB;CAClD,eAAuB;CACvB,WAAmB;CACnB;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,WAAW,KAAK,QAAQ,QAAQ,aAAa,CAAC;CACrD;CAEA,QAAgB,aAAiC,YAA4C;EAC3F,MAAM,UAAU,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,YAAY,WAAW;EAC5F,MAAM,MAAM,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,UAAU,WAAW;EACtF,MAAM,gBAAgB,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,cAAc,WAAW;EACpG,MAAM,UAAU,kBAAkB,KAAA,IAAY,KAAA,IAAY,yBAAyB,aAAa;EAChG,IAAI,WAAW,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO,QAAQ,SAAS,IAAI,CAAC,GACzG,MAAM,IAAI,MAAM,uCAAuC;EAEzD,OAAO,OAAO,OAAO;GACnB,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;GACnD,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,oBAAoB,OAAO,EAAE;GAC7E,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;GAC9D,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,QAAQ,KAAK,WAAW;EAC1B,CAAC;CACH;CAEA,gBAAwC;EACtC,OAAO,KAAK;CACd;CAEA,aAAmB;EACjB,KAAK,WAAW,MAAM;EACtB,MAAM,aAAa,KAAK;EACxB,KAAK,aAAa,KAAA;EAClB,IAAI,YAAY;GACd,KAAK,aAAa,KAAK,WAAW,KAAK,YAAY;IACjD,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;GACF,CAAC;GACD,KAAU,MAAM,KAAK,UAAU;EACjC;CACF;CAEA,MAAc,MAAoC;EAChD,KAAK,QAAQ,IAAI,IAAI;EAGrB,KAAU,WACF,KAAK,QAAQ,OAAO,IAAI,SACxB,KAAK,QAAQ,OAAO,IAAI,CAChC;EACA,OAAO;CACT;CAEA,aAAoC;EAClC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,KAAK,eAAe,QAAQ,SAAS,eAAe,QAAQ;EAC5D,MAAM,QAAQ,YAAY;GACxB,MAAM,KAAK;GACX,IAAI,SAAS,OAAO,SAAS;GAC7B,IAAI,CAAC,SAAS,eAAe,CAAC,UAAU;GACxC,IAAI,SAAS,YAAY,aAAa,SAAS,MAAM,MAAM,IAAI,MAAMA,aAAW;GAChF,IAAI;GACJ,IAAI;IACF,aAAa,MAAM,SAAS,QAAQ,SAAS,aAAa;KACxD,aAAa,SAAS;KACtB,YAAY,SAAS;KACrB,QAAQ,SAAS;IACnB,CAAC;GACH,QAAQ;IAGN,IAAI,SAAS,OAAO,SAAS;IAC7B,MAAM,IAAI,MAAM,wCAAwC;GAC1D;GACA,IAAI,SAAS,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,UAAU;IAC1E,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;IACA;GACF;GACA,KAAK,aAAa;EACpB,EAAA,CAAG;EACH,KAAK,aAAa,KAAK,MACrB,KAAK,cAAc;GACjB,IAAI,KAAK,aAAa,UAAU,KAAK,eAAe;EACtD,CAAC,CACH;EACA,OAAO,KAAK;CACd;CAEA,MAAM,OAAO,aAAsB,SAAuD;EACxF,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9C,IACE,SAAS,UAAU,QACnB,KAAK,SAAS,gBAAgB,eAC9B,CAAC,KAAK,SAAS,OAAO,YACrB,CAAC,KAAK,SAAS,eAAe,CAAC,KAAK,YAAY,KAAK,cAAc,KAAK,eAEzE;EACF,KAAK,WAAW;EAChB,KAAK,aAAa,IAAI,gBAAgB;EAEtC,KAAK,WAAW,KAAK,QAAQ,aAAa,KAAK,SAAS,aAAa,CAAC;EACtE,MAAM,KAAK,WAAW;CACxB;CAEA,MAAM,QAAuB;EAC3B,MAAM,WAAW,KAAK;EACtB,MAAM,KAAK;EACX,IAAI,KAAK,YAAY,SAAS,OAAO,WAAW,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EACvG,IAAI,SAAS,eAAe,CAAC,KAAK,YAAY,MAAM,IAAI,MAAMA,aAAW;CAC3E;CAEA,MAAM,eAAe,cAAsB,SAA+D;EACxG,IAAI,KAAK,YAAY,KAAK,SAAS,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC9E,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,sCAAsC;EACzE,IAAI,KAAK,SAAS,eAAe,KAAK,SAAS,YAAY,aAAa,cAAc,MAAM,IAAI,MAAMA,aAAW;EACjH,MAAM,WAAW;GAAE,MAAM;GAAc;EAAQ;EAC/C,KAAK,WAAW;EAChB,IAAI;GACF,MAAM,KAAK,WAAW;GACtB,MAAM,KAAK,MAAM;GACjB,IAAI,KAAK,YAAY,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9E,QAAQ;GACN,IAAI,KAAK,aAAa,UAAU,KAAK,WAAW,KAAA;GAChD,KAAK,WAAW;GAChB,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,IAAI,WAAW;EACf,OAAO,YAAY;GACjB,IAAI,YAAY,KAAK,aAAa,UAAU;GAC5C,WAAW;GACX,KAAK,WAAW;GAChB,KAAK,WAAW,KAAA;GAChB,KAAK,aAAa,IAAI,gBAAgB;GACtC,KAAK,WAAW,OAAO,OAAO;IAC5B,GAAG,KAAK;IACR,YAAY,KAAK,SAAS,aAAa;IACvC,QAAQ,KAAK,WAAW;GAC1B,CAAC;GACD,MAAM,KAAK;EACb;CACF;CAEA,cAAc,MAAc,SAAgD;EAC1E,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IAAI,CAAC,UAAU,SAAS,SAAS,SAAS,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAClG,IAAI,CAAC,UAAU,eAAe,SAAS,QAAQ,MAAM,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChH,CAAC;CACH;CAEA,mBAAmB,MAAc,SAAqD;EACpF,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IACE,CAAC,UAAU,SAAS,SAAS,OAAO,KACpC,CAAC,UAAU,kBACX,CAAC,OAAO,OAAO,UAAU,gBAAgB,QAAQ,OAAO,KACxD,CAAC,UAAU,eAAe,QAAQ,QAAQ,EAAE,SAAS,QAAQ,MAAM,GAEnE,MAAM,IAAI,MAAM,4CAA4C;EAEhE,CAAC;CACH;CAEA,mBAAmB,QAAuC;EACxD,MAAM,OAAO,KAAK,SAAS,aAAa,SAAS;EACjD,IAAI,SAAS,KAAA,GAAW,OAAO,QAAQ,uBAAO,IAAI,MAAM,iCAAiC,CAAC;EAC1F,OAAO,KAAK,iBAAiB,MAAM,SAAS,cAAc;GACxD,IAAI,CAAC,UAAU,SAAS,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAClG,CAAC;CACH;;CAGA,eAAuB,UAAyE;EAC9F,IAAI,CAAC,SAAS,eAAe,SAAS,gBAAgB,KAAA,GAAW,OAAO,KAAA;EACxE,IAAI;EACJ,IAAI;GACF,UAAU,oBAAoB,KAAK,QAAQ,YAAY,SAAS,WAAW,CAAC;EAC9E,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B;EACA,MAAM,WAAW,SAAS;EAC1B,IACE,QAAQ,aAAa,SAAS,YAC9B,QAAQ,mBAAmB,SAAS,kBACpC,QAAQ,cAAc,SAAS,aAC/B,QAAQ,kBAAkB,SAAS,eAEnC,MAAM,IAAI,MAAM,WAAW;EAC7B,OAAO;CACT;CAEA,MAAc,iBACZ,MACA,eACA,WACiB;EAGjB,IAAI,KAAK,cAAc,MAAM,IAAI,MAAM,gEAAgE;EACvG,MAAM,KAAK,MAAM;EACjB,MAAM,WAAW,KAAK;EACtB,MAAM,aAAa,KAAK;EACxB,MAAM,UAAU,KAAK,eAAe,QAAQ;EAC5C,MAAM,iBACJ,SAAS,WAAW,OAAO,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,QAAQ,QAAQ,KAAA;EACvF,MAAM,oBACJ,SAAS,WAAW,OAAO,OAAO,QAAQ,SAAS,IAAI,IAAI,QAAQ,QAAQ,QAAQ,KAAA;EACrF,IAAI,kBAAkB,mBAAmB,MAAM,IAAI,MAAM,uCAAuC;EAChG,MAAM,SAAS,gBAAgB,YAAY,IAAI,CAAC,SAAS,QAAQ,aAAa,CAAC,IAAI,SAAS;EAE5F,MAAM,QAAQ,kBAAkB,oBAAoB,KAAA,IAAY,MAAM,KAAK,YAAY,MAAM,MAAM;EACnG,MAAM,YAAY,kBAAkB,qBAAqB,OAAO;EAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qCAAqC;EACrE,UAAU,SAAS;EACnB,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC/C,IAAI;EACJ,IAAI;GACF,IAAI,OACF,QAAQ,MAAM;QACT,IAAI,gBAAgB;IACzB,IAAI,CAAC,KAAK,QAAQ,WAAW,MAAM,IAAI,MAAM,mBAAmB;IAChE,MAAM,EAAE,WAAW,KAAK,UAAU,eAAe;IACjD,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,WAAW,KAAK,MAAM;IACjE,MAAM,WACJ,UAAU,KAAA,IACN,QACA,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,OAAO,OAAO,KAAK,IAC/F,MAAkC,SACnC,KAAA;IACR,IAAI,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,yBAAyB;IAC3E,QAAQ;GACV,OAAO;IACL,IAAI,CAAC,cAAc,CAAC,mBAAmB,MAAM,IAAI,MAAM,sBAAsB;IAC7E,QAAQ,MAAM,WAAW,cAAc,mBAAmB,MAAM;GAClE;EACF,QAAQ;GAEN,MAAM,IAAI,MAAM,kCAAkC;EACpD;EACA,IAAI,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,eAAe,YAAY,MAAM,IAAI,MAAM,WAAW;EAC/G,IAAI,KAAK,UAAU,KAAK,eAAe,QAAQ,CAAC,EAAE,QAAQ,KAAK,MAAM,KAAK,UAAU,iBAAiB,GACnG,MAAM,IAAI,MAAM,WAAW;EAE7B,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAC1G,OAAO;CACT;;CAGA,MAAc,YACZ,MACA,QACiF;EACjF,IAAI,CAAC,KAAK,QAAQ,aAAa,CAAC,cAAc,KAAK,IAAI,GAAG,OAAO,KAAA;EACjE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,yBAAyB,MAAM,MAAM;GAChF,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;GAChF,MAAM,EAAE,OAAO,GAAG,aAAa;GAC/B,MAAM,QAAQ;IAAE,WAAW;IAAyB,KAAK;IAAM,OAAO;GAAQ;GAC9E,MAAM,YAAY,yBAAyB,GAAG,OAAO;IAAE,GAAG;IAAU;GAAM,EAAE,GAAG,cAAc,CAAC,CAAC;GAC/F,OAAO,aAAa;IAAE;IAAW;GAAM;EACzC,QAAQ;GACN;EACF;CACF;CAEA,UAAyB;EACvB,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,KAAK,WAAW;EAChB,KAAK,WAAW;EAChB,KAAK,WAAW,KAAA;EAChB,KAAK,YAAY,YAAY;GAE3B,KAAI,MADkB,QAAQ,WAAW,CAAC,GAAG,KAAK,SAAS,KAAK,UAAU,CAAC,EAAA,CAC/D,MAAM,WAAW,OAAO,WAAW,UAAU,GAAG,MAAM,IAAI,MAAM,iCAAiC;EAC/G,EAAA,CAAG;EACH,OAAO,KAAK;CACd;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,sBAAsB,OAAO;AAC1C;;AAGA,SAAgB,2BAA2B,SAAqD;CAC9F,QAAQ,YAAY;EAClB,QAAQ,QAAQ,yBAAyB,OAAO;CAClD;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;ACvUA,MAAM,cAAc;AAEpB,IAAM,qBAAN,MAAmD;CAIpB;CAH7B,4BAA6B,IAAI,IAAoC;CACrE,aAAqB;CAErB,YAAY,SAAiD;EAAhC,KAAA,UAAA;CAAiC;CAE9D,iBAAiB,UAAkB,SAA6C;EAC9E,IAAI,KAAK,UAAU,IAAI,QAAQ,GAAG,MAAM,IAAI,MAAM,gDAAgD;EAClG,KAAK,UAAU,IAAI,UAAU,OAAO;EACpC,aAAa;GACX,IAAI,KAAK,UAAU,IAAI,QAAQ,MAAM,SAAS,KAAK,UAAU,OAAO,QAAQ;EAC9E;CACF;CAEA,MAAM,WAAW,SAAmE;EAClF,IAAI,QAAQ,MAAM,WAAW,GAAG,OAAO,CAAC;EACxC,IAAI,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,SAAS,QAAQ,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW;EACrF,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,KAAK,QAAQ,YAAY,QAAQ,KAAK,QAAQ,SAAS,QAAQ,aAAa;EAC9F,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B;EACA,MAAM,UAAU,WAAW,KAAK,UAAU,IAAI,QAAQ,QAAQ;EAC9D,IAAI,CAAC,WAAW,CAAC,SAAS,MAAM,IAAI,MAAM,WAAW;EACrD,MAAM,aAAa,QAAQ,MAAM,KAAK,SAAS;GAC7C,MAAM,YAAY,OAAO,OAAO,QAAQ,SAAS,IAAI,IAAI,QAAQ,QAAQ,QAAQ,KAAA;GACjF,IAAI,CAAC,WAAW,SAAS,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,WAAW;GACrE,OAAO,CAAC,MAAM,SAAS;EACzB,CAAC;EAED,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,MAAM,CAAC,IAAI,WAAW;EAClG,IAAI;EACJ,IAAI;GACF,aAAa,MAAM,QAAQ,SAAS;IAAE,aAAa,QAAQ;IAAS,YAAY,EAAE,KAAK;IAAY;GAAO,CAAC;GAC3G,MAAM,SAAiC,CAAC;GACxC,KAAK,MAAM,CAAC,MAAM,cAAc,YAAY;IAC1C,MAAM,QAAQ,MAAM,WAAW,cAAc,WAAW,MAAM;IAC9D,IAAI,OAAO,WAAW,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,WAAW;IAClG,OAAO,QAAQ;GACjB;GACA,OAAO;EACT,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B,UAAU;GACR,WAAW,MAAM;GACjB,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,QAAQ;IAGN,MAAM,IAAI,MAAM,WAAW;GAC7B;EACF;CACF;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,mBAAmB,OAAO;AACvC;;AAGA,IAAa,wBAAb,cAA2C,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,iBAAiB,UAAkB,SAA6C;EAC9E,OAAO,KAAK,OAAO,iBAAiB,UAAU,OAAO;CACvD;CAEA,WAAW,SAAmE;EAC5E,OAAO,KAAK,OAAO,WAAW,OAAO;CACvC;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;AC9FA,eAAe,OAAO,KAAgD;CACpE,MAAM,IAAI;AACZ;AAEA,IAAM,qBAAN,MAAmD;CACjD,0BAA2B,IAAI,IAA2B;CAE1D,SAAS,IAAY,QAAmC;EACtD,IAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChF,KAAK,QAAQ,IAAI,IAAI,MAAM;EAC3B,aAAa;GACX,IAAI,KAAK,QAAQ,IAAI,EAAE,MAAM,QAAQ,KAAK,QAAQ,OAAO,EAAE;EAC7D;CACF;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,cAAc,OAAO;CAC7D;CAEA,YAAY,OAAwC;EAClD,MAAM,yBAAS,IAAI,IAA4B;EAC/C,KAAK,MAAM,CAAC,UAAU,WAAW,KAAK,SAAS;GAC7C,IAAI;GACJ,IAAI;IACF,SAAS,OAAO,KAAK,KAAK;GAC5B,QAAQ;IACN;GACF;GACA,KAAK,MAAM,SAAS,QAAQ;IAC1B,IAAI,OAAO,IAAI,MAAM,IAAI,GAAG;IAC5B,IAAI;KACF,MAAM,UAAU,cAAc,KAAK;KACnC,IAAI,QAAQ,eACV,OAAO,IAAI,QAAQ,MAAM;MAAE;MAAU,SAAS;OAAE,GAAG;OAAS,eAAe,QAAQ;MAAc;KAAE,CAAC;IACxG,QAAQ,CAER;GACF;EACF;EACA,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,QAAQ,KAAK,cAAc,MAAM,QAAQ,IAAI,CAAC;CACvG;CAEA,MAAM,MAAM,OAAiC,QAAoC;EAC/E,MAAM,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,QAAQ,GAAG,YAAY,OAAO,UAAU,KAAA,CAAS;EACnF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,KAAK,GAAG,YAAY,aAAa,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC;EACjH,MAAM,SAAS,QAAQ,QAAQ,GAAG,UAAU,QAAQ,MAAM,EAAE,WAAW,UAAU,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;EAEnG,IAAI,OAAO,QAAQ,MAAM,IAAI,MAAM,6BAA6B,OAAO,KAAK,IAAI,GAAG;CACrF;CAEA,MAAM,eAAe,OAAiC,QAAkD;EACtG,KAAK,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG;GAC1C,IAAI,OAAO,mBAAmB,KAAA,GAAW;GACzC,MAAM,SAAS,MAAM,OAAO,eAAe,OAAO,MAAM;GACxD,IAAI,WAAW,KAAA,GAAW,OAAO;EACnC;CAEF;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO,IAAI,mBAAmB;AAChC;;AAGA,SAAgB,cAAc,OAAgC,SAAqD;CACjH,MAAM,QAAQ,IAAI,IAAI,MAAM,KAAK,EAAE,WAAW,IAAI,CAAC;CACnD,MAAM,eAAe,SAAS,KAAK,KAAK,CAAC,EAAA,CAAG,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC;CACjF,OAAO,CAAC,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC7F;AAEA,SAAgB,YACd,OACA,SACA,MACc;CACd,MAAM,UACJ,MAAM,MAAM,cAAc,UAAU,SAAS,IAAI,KAAK,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc,UAAU,SAAS,IAAI;CACnH,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,oBAAoB,MAAM;CACxD,OAAO;AACT;;AAGA,IAAa,wBAAb,cAA2C,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,SAAS,IAAY,QAAmC;EACtD,OAAO,KAAK,OAAO,SAAS,IAAI,MAAM;CACxC;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,OAAO,KAAK,KAAK;CAC/B;CAEA,YAAY,OAAwC;EAClD,OAAO,KAAK,OAAO,YAAY,KAAK;CACtC;CAEA,MAAM,OAAiC,QAAoC;EACzE,OAAO,KAAK,OAAO,MAAM,OAAO,MAAM;CACxC;CAEA,eAAe,OAAiC,QAAkD;EAChG,OAAO,KAAK,OAAO,eAAe,OAAO,MAAM;CACjD;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;;AAGA,SAAgB,mBAAmB,SAAkB,OAAkD;CACrG,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,WAAW,CAAC,OAAO,OAAO;CAC/B,OAAO;EACL,WAAW,IAAI,WAAW,QAAQ,SAAS,IAAI,MAAM;EACrD,YAAY,QAAQ,KAAK,KAAK;EAC9B,mBAAmB,QAAQ,YAAY,KAAK;EAC5C,QAAQ,UAAU,WAAW,QAAQ,MAAM,OAAO,MAAM;EACxD,iBAAiB,UAAU,WAAW,QAAQ,eAAe,OAAO,MAAM;CAC5E;AACF;;;ACvIA,MAAM,WAAW;;AAGjB,SAAS,YAAY,SAAqC;CACxD,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ;EAC3C,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,KAAK,UAAU,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;EAC7C,MAAM,IAAI,mBAAmB,MAAM,CAAC;CACtC;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,SAAS,SAAS,OAAe,OAAsC;CACrE,MAAM,UAAU,IAAI,WAAW,MAAM,MAAM;CAC3C,KAAK,MAAM,QAAQ,OACjB,KAAK,IAAI,QAAQ,MAAM,QAAQ,IAAI,GAAG,UAAU,IAAI,QAAQ,MAAM,QAAQ,MAAM,QAAQ,CAAC,GACvF,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,OAAO,OAAe,SAAqB,KAAqB;CACvE,IAAI,OAAO;CACX,IAAI,QAAQ;CACZ,KAAK,IAAI,QAAQ,GAAG,SAAS,KAAK,SAAS;EACzC,IAAI,QAAQ,OAAO,QAAQ,WAAW,QAAQ,QAAQ;EACtD,IAAI,QAAQ,OAAO,QAAQ,QAAQ,SAAS,WAAW,MAAM,MAAM,OAAO,KAAK;EAC/E,QAAQ;CACV;CACA,OAAO;AACT;AAEA,SAAS,WAAW,OAAe,OAAkC;CACnE,OAAO,MAAM,WAAW,IAAI,QAAQ,OAAO,OAAO,SAAS,OAAO,KAAK,GAAG,MAAM,MAAM;AACxF;AAEA,SAAS,YAAY,OAAgB,OAAmC;CACtE,IAAI,OAAO,UAAU,UAAU,OAAO,WAAW,OAAO,KAAK;CAC7D,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,UAAU,YAAY,OAAO,KAAK,CAAC;CAC/E,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,WAAW,KAAK,KAAK,GAAG,YAAY,OAAO,KAAK,CAAC,CAAC,CACjG;CAEF,OAAO;AACT;;AAGA,SAAgB,cAAiB,OAAU,SAA8B;CACvE,OAAO,YAAY,OAAO,YAAY,OAAO,CAAC;AAChD;AAEA,SAAgB,4BAA4B,SAAkD;CAC5F,MAAM,QAAQ,YAAY,OAAO;CAEjC,MAAM,OAAO,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,SAAS,KAAK,SAAS,CAAC,CAAC;CAChE,IAAI,SAAS;CACb,OAAO;EACL,MAAM,OAAO;GACX,UAAU;GACV,MAAM,UAAU,SAAS,QAAQ,KAAK;GACtC,IAAI,MAAM,KAAK,IAAI,GAAG,OAAO,SAAS,IAAI;GAE1C,OAAO,MAAM,KAAK,MAAM,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,IAAI;GAC3E,MAAM,OAAO,OAAO,QAAQ,SAAS,GAAG;GACxC,SAAS,OAAO,MAAM,GAAG;GACzB,OAAO;EACT;EACA,QAAQ;GACN,MAAM,OAAO,WAAW,QAAQ,KAAK;GACrC,SAAS;GACT,OAAO;EACT;CACF;AACF;;;AC7EA,MAAM,OAAO;AAUb,MAAa,qBAAqB;;AAMlC,MAAa,kBAAkB;;;;;;AAO/B,SAAgB,cAAc,SAA6B,aAA0C;CACnG,IAAI,SAAS,OAAO;CACpB,OAAO,cAAc,KAAK,KAAA;AAC5B;;AAGA,SAAgB,aAAa,SAA+B;CAC1D,OAAO,QAAQ,UAAU,QAAQ,QAAQ;AAC3C;;;;;AAMA,SAAgB,aAAa,UAAwC;CACnE,MAAM,SAAS,SAAS,IAAI,YAAY;CACxC,OAAO,CACL;EAAE,OAAO;EAAI,OAAO;CAAK,GACzB,GAAG,SAAS,KAAK,SAAS,UAAU;EAClC,MAAM,QAAQ,OAAO,UAAU,QAAQ;EACvC,MAAM,SAAS,UAAU,QAAQ,OAAO,QAAQ,KAAK,MAAM,OAAO,YAAY,KAAK;EACnF,OAAO;GACL,OAAO,QAAQ;GACf,OAAO,SAAS,QAAQ,GAAG,MAAM,IAAI,QAAQ,KAAK;GAClD,aAAa,mBAAmB,OAAO;GACvC,GAAI,QAAQ,UAAU,OAAO,EAAE,MAAM,QAAQ,SAAS,KAAK,IAAI,CAAC;EAClE;CACF,CAAC,CACH;AACF;;AAGA,SAAgB,mBAAmB,SAA+B;CAChE,MAAM,YAAY,CAAC,QAAQ,UAAU,MAAM,QAAQ,UAAU,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK;CAChG,IAAI,WAAW,OAAO;CACtB,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO,gBAAgB,SAAS,IAAI,GAAG,QAAQ,QAAQ,SAAS,gBAAgB,KAAK,IAAI,EAAE,KAAK,QAAQ;AAC1G;;AAGA,SAAgB,eAAe,SAA+B;CAC5D,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO;EACL,WAAW,QAAQ;EACnB,YAAY,QAAQ;EACpB,QAAQ,gBAAgB,KAAK,IAAI,KAAK;EACtC;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,aAAa,SAA0B;CACrD,OAAO,qBAAqB,WAAW,KAAK;AAC9C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agimon-ai/po-profile",
-  "version": "0.0.0-alpha.113",
+  "version": "0.0.0-alpha.115",
   "description": "Persona and environment profile switching for Po sessions.",
   "keywords": [
     "agent-persona",
@@ -66,17 +66,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@agimon-ai/po-config": "0.0.0-alpha.113",
-    "@agimon-ai/po-core": "0.0.0-alpha.113",
-    "@agimon-ai/po-minor-mode": "0.0.0-alpha.113",
+    "@agimon-ai/po-config": "0.0.0-alpha.115",
+    "@agimon-ai/po-core": "0.0.0-alpha.115",
+    "@agimon-ai/po-minor-mode": "0.0.0-alpha.115",
     "@deepseek-ai/cordis": "4.0.5",
     "typebox": "1.4.2"
   },
   "devDependencies": {
-    "@agimon-ai/po-build": "0.0.0-alpha.113",
-    "@agimon-ai/po-core": "0.0.0-alpha.113",
-    "@agimon-ai/po-voice": "0.0.0-alpha.113",
-    "@agimon-ai/vibe-lint-plugin-po-extension": "0.0.0-alpha.113",
+    "@agimon-ai/po-build": "0.0.0-alpha.115",
+    "@agimon-ai/po-core": "0.0.0-alpha.115",
+    "@agimon-ai/po-voice": "0.0.0-alpha.115",
+    "@agimon-ai/vibe-lint-plugin-po-extension": "0.0.0-alpha.115",
     "@deepseek-ai/cordis": "4.0.5",
     "@earendil-works/pi-coding-agent": "1.5.0",
     "@types/node": "26.6.5",
@@ -86,7 +86,7 @@
     "vitest": "5.0.4"
   },
   "peerDependencies": {
-    "@agimon-ai/po-core": "0.0.0-alpha.113",
+    "@agimon-ai/po-core": "0.0.0-alpha.115",
     "@earendil-works/pi-coding-agent": "1.5.0"
   },
   "peerDependenciesMeta": {

package/src/prompts/help-how-to-profile/references/profiles-contract.md

@@ -140,9 +140,14 @@ to `[browser]`:
   env and proxy are reserved and cannot be native surface names. Non-input aliases cannot set targets.
 
 A secret without the `browser` purpose cannot list origins. The optional browser binding requires a
-safe profile name, not a filesystem path, and its own nonempty `allowedOrigins` containing every
-browser-purpose secret origin. It may set `mode` (`playwright`, `extension`, or `stealth`) and
-`proxySecret`, which must name a `proxy`-purpose secret. Unknown metadata is rejected.
+safe profile name, not a filesystem path, and its own nonempty exact `allowedOrigins`. Browser
+policies combine configured origins with `PROFILE_SOCIAL_BROWSER_ORIGINS` from
+`@agimon-ai/po-config/profiles`: exact HTTPS apex/www origins for X, Reddit, LinkedIn, Facebook,
+Instagram, TikTok and YouTube, plus legacy Twitter origins and `https://accounts.google.com` for
+YouTube sign-in. The effective browser origins must contain every browser-purpose secret origin.
+These shared defaults never expand an individual secret's origins or purposes. They also apply to
+persona-only browser policies. A browser binding may set `mode` (`playwright`, `extension`, or
+`stealth`) and `proxySecret`, which must name a `proxy`-purpose secret. Unknown metadata is rejected.
 
 The public `@agimon-ai/po-profile` API exposes the session-owned `po/profile-runtime` Cordis service.
 Consumers declare that service as an injected dependency, use `requireProfileRuntime(context)`,
@@ -161,6 +166,13 @@ late secret results are rejected rather than delivered to a replacement profile.
 profiles remain compatible. The concrete browser integration owns persistence and exclusive profile
 leases.
 
+Session secret delivery rereads current provider-backed alias metadata before resolution and again
+before returning a value. New aliases become usable after the provider publishes them, without a
+profile refresh, provider reconnection, selection generation change or browser tab closure. Removed
+or changed aliases invalidate in-flight results. Provider, organization, mailbox and authentication
+references must still match the selected identity. Browser launch identity, env and file-backed vault
+aliases stay pinned until an explicit profile selection or refresh.
+
 The global `po/profile-secrets` service serves jobs that run outside a session. Providers call
 `registerProvider(provider, factory)`; workflow hosts call `resolveEnv({cwd, profile, names, signal})`.
 Each call loads the profile catalog for `cwd`, requires the `env` purpose for every name, opens a fresh

package/dist/profileText-3qUgFIgc.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"profileText-3qUgFIgc.mjs","names":["UNAVAILABLE"],"sources":["../src/constants/profileInitialOutcome.ts","../src/constants/profileRuntime.ts","../src/constants/profileSecrets.ts","../src/constants/profileSources.ts","../src/services/launchProfiles/type.ts","../src/services/profileResolution/index.ts","../src/services/profileRuntime/index.ts","../src/services/profileSecrets/index.ts","../src/services/profileSources/index.ts","../src/services/secretRedaction/index.ts","../src/services/profileText/index.ts"],"sourcesContent":["/** The decision about a session's first profile, published on the session context before its plugins start. */\nexport const PROFILE_INITIAL_OUTCOME_SERVICE = 'po/profile-initial-outcome';\n","export const PROFILE_RUNTIME_SERVICE = 'po/profile-runtime';\n","// @scaffold-generated\nexport const PROFILE_SECRETS_SERVICE = 'po/profile-secrets';\n","// @scaffold-generated\nexport const PROFILE_SOURCES_SERVICE = 'po/profile-sources';\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\n\n/** The source id every profile read from a `profiles.yaml` carries. */\nexport const FILE_PROFILE_SOURCE_ID = 'files';\n\n/** One profile a launcher may offer. Display data only: never a persona, environment, binding or secret. */\nexport interface LaunchProfileItem {\n  readonly name: string;\n  readonly identity?: {\n    readonly name?: string;\n    readonly icon?: string;\n    readonly role?: string;\n    readonly contact?: string;\n  };\n  /** `files`, or the id a plugin registered its source under. */\n  readonly sourceId: string;\n}\n\nexport interface LaunchProfileCatalog {\n  readonly profiles: readonly LaunchProfileItem[];\n  /** `unavailable` means a source did not become ready in time or failed; `profiles` lists what exists already. */\n  readonly readiness: 'ready' | 'unavailable';\n}\n\nexport interface ListLaunchProfilesInput {\n  readonly files: readonly AgentProfile[];\n  readonly sources: ProfileSources | undefined;\n  readonly scope: ProfileScope;\n  /** The request going away rejects the listing. */\n  readonly signal: AbortSignal;\n  /** The one budget for waiting on sources. Defaults to ten seconds. */\n  readonly timeoutMs?: number;\n}\n","// @scaffold-generated\nimport type { AgentProfile } from '@agimon-ai/po-config/profiles';\nimport { defineServiceContract } from '@agimon-ai/po-core/extensionFile';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_INITIAL_OUTCOME_SERVICE } from '../../constants/profileInitialOutcome';\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\nimport type {\n  Deadline,\n  DeadlineResult,\n  InitialProfileOutcome,\n  InitialProfileWarning,\n  ResolveInitialProfileOptions,\n} from './type';\n\n/** One budget for every wait of a resolution. */\nexport const PROFILE_RESOLUTION_TIMEOUT_MS = 10_000;\nconst SECONDS = PROFILE_RESOLUTION_TIMEOUT_MS / 1_000;\n\n/** Published on a session context by whoever launches it, or by the session itself when nobody did. */\nexport const PROFILE_INITIAL_OUTCOME_CONTRACT = defineServiceContract<InitialProfileOutcome>(\n  PROFILE_INITIAL_OUTCOME_SERVICE,\n  { scope: 'session' },\n);\n\n/** The outcome a launcher already decided, or undefined when this session was not launched with one. */\nexport function readInitialProfileOutcome(context: Context): InitialProfileOutcome | undefined {\n  return context.get(PROFILE_INITIAL_OUTCOME_SERVICE);\n}\n\nconst abortReason = (signal: AbortSignal): Error =>\n  signal.reason instanceof Error ? signal.reason : new Error('Profile resolution was aborted');\n\n/**\n * A single absolute deadline shared by every wait of one resolution.\n *\n * Hooks receive a signal that aborts when the deadline passes, the owner aborts, or the deadline is disposed:\n * work shared with other waiters must keep running when that signal fires. A hook that ignores the signal cannot\n * hold the resolution back, and its late result or failure is dropped.\n */\nexport function createDeadline(owner: AbortSignal, timeoutMs: number): Deadline {\n  const controller = new AbortController();\n  let expired = false;\n  let expire!: (result: DeadlineResult<never>) => void;\n  let interrupt!: (error: Error) => void;\n  const interruption = new Promise<DeadlineResult<never>>((resolve, reject) => {\n    expire = resolve;\n    interrupt = reject;\n  });\n  // Waits observe this promise, but it can settle between two of them.\n  interruption.catch(() => undefined);\n\n  const onOwnerAbort = () => {\n    interrupt(abortReason(owner));\n    controller.abort(owner.reason);\n  };\n  if (owner.aborted) onOwnerAbort();\n  else owner.addEventListener('abort', onOwnerAbort, { once: true });\n  const timer = setTimeout(() => {\n    expired = true;\n    expire({ status: 'timeout' });\n    controller.abort(new Error('Profile resolution timed out'));\n  }, timeoutMs);\n\n  return {\n    signal: controller.signal,\n    within<T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> {\n      if (owner.aborted) return Promise.reject(abortReason(owner));\n      if (expired) return Promise.resolve({ status: 'timeout' });\n      let work: Promise<T>;\n      try {\n        work = Promise.resolve(start(controller.signal));\n      } catch {\n        return Promise.resolve({ status: 'failed' });\n      }\n      const finished = work.then(\n        (value): DeadlineResult<T> => ({ status: 'done', value }),\n        (): DeadlineResult<T> => ({ status: 'failed' }),\n      );\n      return Promise.race([finished, interruption]);\n    },\n    dispose() {\n      clearTimeout(timer);\n      owner.removeEventListener('abort', onOwnerAbort);\n      if (!controller.signal.aborted) controller.abort(new Error('Profile resolution finished'));\n    },\n  };\n}\n\n/** Waits once for source readiness, without discarding profiles that already loaded. */\nexport async function waitForSources(\n  sources: ProfileSources | undefined,\n  scope: ProfileScope | undefined,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Promise<'done' | 'timeout' | 'failed'> {\n  signal.throwIfAborted();\n  if (sources === undefined) return 'done';\n  const deadline = createDeadline(signal, timeoutMs);\n  try {\n    return (await deadline.within((waitSignal) => sources.ready(scope, waitSignal))).status;\n  } finally {\n    deadline.dispose();\n  }\n}\nconst names = (files: readonly AgentProfile[], sources: ProfileSources | undefined, scope: ProfileScope | undefined) =>\n  new Set([...files.map(({ name }) => name), ...(sources?.list(scope).map(({ name }) => name) ?? [])]);\n\n/**\n * Decides which profile a session starts with, once.\n *\n * Resolves a name that is already listed at once. Waits for sources to become ready only when a requested name\n * is missing, and consults a source default only when nothing was requested in a known workspace; a default its\n * catalog does not list yet waits for readiness too. Every wait shares one deadline. A name that never arrives, a source that fails and a default that is not in the\n * workspace catalog all give a session with no profile and one warning; only the owner aborting rejects.\n */\nexport async function resolveInitialProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  options: ResolveInitialProfileOptions,\n): Promise<InitialProfileOutcome> {\n  options.signal.throwIfAborted();\n  const { intent, scope } = options;\n  const workspaceId = scope?.workspaceId;\n  const base: InitialProfileOutcome = { intent, ...(workspaceId === undefined ? {} : { workspaceId }) };\n  if (intent.kind === 'none') return base;\n\n  // Created by the first wait, so a profile that is already listed costs no timer.\n  const held: { deadline?: Deadline } = {};\n  const within = <T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> => {\n    held.deadline ??= createDeadline(options.signal, options.timeoutMs ?? PROFILE_RESOLUTION_TIMEOUT_MS);\n    return held.deadline.within(start);\n  };\n  const warn = (warning: InitialProfileWarning): InitialProfileOutcome => ({ ...base, warning });\n  try {\n    if (intent.kind === 'named') {\n      const requested = intent.name;\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (sources === undefined) return warn({ code: 'missing', requested });\n      const waited = await within((signal) => sources.ready(scope, signal));\n      // A usable profile wins over a source that failed or ran out of time.\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (waited.status === 'timeout') return warn({ code: 'timeout', requested });\n      return warn({ code: waited.status === 'failed' ? 'source-failed' : 'missing', requested });\n    }\n    if (workspaceId === undefined || sources === undefined) return base;\n    const waited = await within((signal) => sources.defaultProfile(scope, signal));\n    if (waited.status === 'timeout') return warn({ code: 'timeout' });\n    if (waited.status === 'failed') return warn({ code: 'source-failed' });\n    const chosen = waited.value;\n    if (chosen === undefined) return base;\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    // A source may name its default before its catalog is published: wait for the sources before ruling it out.\n    const settled = await within((signal) => sources.ready(scope, signal));\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    if (settled.status === 'timeout') return warn({ code: 'timeout', requested: chosen });\n    if (settled.status === 'failed') return warn({ code: 'source-failed', requested: chosen });\n    return warn({ code: 'invalid-default', requested: chosen });\n  } finally {\n    held.deadline?.dispose();\n  }\n}\n\n/** The one-line notice for a session that started without the profile it was meant to have. Names only. */\nexport function profileWarningText(warning: InitialProfileWarning): string {\n  const { code, requested } = warning;\n  const subject = requested === undefined ? 'The workspace default profile' : `Profile \"${requested}\"`;\n  const outcome = 'so this session started without a profile.';\n  if (code === 'timeout') return `${subject} was not ready within ${SECONDS} seconds, ${outcome}`;\n  if (code === 'source-failed') return `${subject} could not be loaded because its source failed, ${outcome}`;\n  if (code === 'invalid-default') return `The default profile \"${requested}\" is not available, ${outcome}`;\n  return `${subject} is not available, ${outcome}`;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-initial-outcome': InitialProfileOutcome;\n  }\n}\n","import {\n  parseProfileBinding,\n  parseProfileVaultSecrets,\n  type ProfileSecretReference,\n  type ProfileVaultSecretReference,\n} from '@agimon-ai/po-config/profiles';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_RUNTIME_SERVICE } from '../../constants/profileRuntime';\nimport type {\n  ProfileProviderFactory,\n  ProfileInputSecretRequest,\n  ProfileRuntime,\n  ProfileRuntimeOptions,\n  ProfileRuntimeSnapshot,\n  ProfileSecretRequest,\n  ProfileSecretResolver,\n} from './type';\n\nconst UNAVAILABLE = 'Profile integration provider is unavailable';\nconst INVALIDATED = 'Profile operation was invalidated';\n/** Vault namespace for secrets saved from the composer; po-vault's `VAULT_SECRETS_NAMESPACE` writes it. */\nconst VAULT_SECRETS_NAMESPACE = 'secrets';\nconst ALIAS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/u;\n\n/** A single selected profile and provider, owned by one session, not a provider registry. */\nclass SessionProfileRuntime implements ProfileRuntime {\n  private controller = new AbortController();\n  private snapshot: ProfileRuntimeSnapshot;\n  private provider?: { name: string; factory: ProfileProviderFactory };\n  private connection?: ProfileSecretResolver;\n  private transition: Promise<void> = Promise.resolve();\n  private retirement: Promise<void> = Promise.resolve();\n  private readonly pending = new Set<Promise<void>>();\n  private initializing = false;\n  private disposed = false;\n  private disposal?: Promise<void>;\n\n  constructor(private readonly options: ProfileRuntimeOptions) {\n    this.snapshot = this.capture(options.profileName, 1);\n  }\n\n  private capture(profileName: string | undefined, generation: number): ProfileRuntimeSnapshot {\n    const binding = profileName === undefined ? undefined : this.options.readBinding(profileName);\n    const env = profileName === undefined ? undefined : this.options.readEnv?.(profileName);\n    const sourceSecrets = profileName === undefined ? undefined : this.options.readSecrets?.(profileName);\n    const secrets = sourceSecrets === undefined ? undefined : parseProfileVaultSecrets(sourceSecrets);\n    if (secrets && Object.keys(secrets).some((name) => binding?.secrets && Object.hasOwn(binding.secrets, name))) {\n      throw new Error('Profile secret aliases must be unique');\n    }\n    return Object.freeze({\n      ...(profileName === undefined ? {} : { profileName }),\n      ...(binding === undefined ? {} : { integration: parseProfileBinding(binding) }),\n      ...(env === undefined ? {} : { env: Object.freeze({ ...env }) }),\n      ...(secrets === undefined ? {} : { secrets }),\n      generation,\n      signal: this.controller.signal,\n    });\n  }\n\n  readSelection(): ProfileRuntimeSnapshot {\n    return this.snapshot;\n  }\n\n  invalidate(): void {\n    this.controller.abort();\n    const connection = this.connection;\n    this.connection = undefined;\n    if (connection) {\n      this.retirement = this.retirement.then(async () => {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n      });\n      void this.track(this.retirement);\n    }\n  }\n\n  private track(work: Promise<void>): Promise<void> {\n    this.pending.add(work);\n    // Keep rejection observable through ready/dispose while preventing an unhandled\n    // rejection when selection invalidates an initialization before its owner awaits it.\n    void work.then(\n      () => this.pending.delete(work),\n      () => this.pending.delete(work),\n    );\n    return work;\n  }\n\n  private initialize(): Promise<void> {\n    const snapshot = this.snapshot;\n    const provider = this.provider;\n    this.initializing = Boolean(snapshot.integration && provider);\n    const work = (async () => {\n      await this.retirement;\n      if (snapshot.signal.aborted) return;\n      if (!snapshot.integration || !provider) return;\n      if (snapshot.integration.provider !== provider.name) throw new Error(UNAVAILABLE);\n      let connection: ProfileSecretResolver;\n      try {\n        connection = await provider.factory(snapshot.integration, {\n          profileName: snapshot.profileName!,\n          generation: snapshot.generation,\n          signal: snapshot.signal,\n        });\n      } catch {\n        // A retired factory commonly rejects on abort. That cannot remove the\n        // provider attachment or poison the replacement generation.\n        if (snapshot.signal.aborted) return;\n        throw new Error('Profile provider initialization failed');\n      }\n      if (snapshot.signal.aborted || this.snapshot !== snapshot || this.disposed) {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n        return;\n      }\n      this.connection = connection;\n    })();\n    this.transition = this.track(\n      work.finally(() => {\n        if (this.snapshot === snapshot) this.initializing = false;\n      }),\n    );\n    return this.transition;\n  }\n\n  async select(profileName?: string, options?: { readonly force?: boolean }): Promise<void> {\n    if (this.disposed) throw new Error(INVALIDATED);\n    if (\n      options?.force !== true &&\n      this.snapshot.profileName === profileName &&\n      !this.snapshot.signal.aborted &&\n      (!this.snapshot.integration || !this.provider || this.connection || this.initializing)\n    )\n      return;\n    this.invalidate();\n    this.controller = new AbortController();\n    // If reading/validation fails, leave the old generation aborted, never usable.\n    this.snapshot = this.capture(profileName, this.snapshot.generation + 1);\n    await this.initialize();\n  }\n\n  async ready(): Promise<void> {\n    const snapshot = this.snapshot;\n    await this.transition;\n    if (this.disposed || snapshot.signal.aborted || this.snapshot !== snapshot) throw new Error(INVALIDATED);\n    if (snapshot.integration && !this.connection) throw new Error(UNAVAILABLE);\n  }\n\n  async attachProvider(providerName: string, factory: ProfileProviderFactory): Promise<() => Promise<void>> {\n    if (this.disposed || this.snapshot.signal.aborted) throw new Error(INVALIDATED);\n    if (this.provider) throw new Error('Profile provider is already attached');\n    if (this.snapshot.integration && this.snapshot.integration.provider !== providerName) throw new Error(UNAVAILABLE);\n    const provider = { name: providerName, factory };\n    this.provider = provider;\n    try {\n      await this.initialize();\n      await this.ready();\n      if (this.disposed || this.provider !== provider) throw new Error(INVALIDATED);\n    } catch {\n      if (this.provider === provider) this.provider = undefined;\n      this.invalidate();\n      throw new Error('Profile provider initialization failed');\n    }\n    let detached = false;\n    return async () => {\n      if (detached || this.provider !== provider) return;\n      detached = true;\n      this.invalidate();\n      this.provider = undefined;\n      this.controller = new AbortController();\n      this.snapshot = Object.freeze({\n        ...this.snapshot,\n        generation: this.snapshot.generation + 1,\n        signal: this.controller.signal,\n      });\n      await this.retirement;\n    };\n  }\n\n  resolveSecret(name: string, request: ProfileSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (!reference.purposes.includes('browser')) throw new Error('Profile secret alias is unavailable');\n      if (!reference.allowedOrigins.includes(request.origin)) throw new Error('Profile secret origin is not allowed');\n    });\n  }\n\n  resolveInputSecret(name: string, request: ProfileInputSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (\n        !reference.purposes.includes('input') ||\n        !reference.allowedTargets ||\n        !Object.hasOwn(reference.allowedTargets, request.surface) ||\n        !reference.allowedTargets[request.surface]?.includes(request.target)\n      ) {\n        throw new Error('Profile secret input target is not allowed');\n      }\n    });\n  }\n\n  resolveProxySecret(signal?: AbortSignal): Promise<string> {\n    const name = this.snapshot.integration?.browser?.proxySecret;\n    if (name === undefined) return Promise.reject(new Error('Profile proxy is not configured'));\n    return this.resolveReference(name, signal, (reference) => {\n      if (!reference.purposes.includes('proxy')) throw new Error('Profile secret alias is unavailable');\n    });\n  }\n\n  private async resolveReference(\n    name: string,\n    requestSignal: AbortSignal | undefined,\n    authorize: (reference: ProfileSecretReference | ProfileVaultSecretReference) => void,\n  ): Promise<string> {\n    // Do not await ready here: a provider factory invoking this callback would\n    // otherwise wait for itself. Browser creation may retain, but not invoke it.\n    if (this.initializing) throw new Error('Profile secrets are unavailable during provider initialization');\n    await this.ready();\n    const snapshot = this.snapshot;\n    const connection = this.connection;\n    const vaultReference =\n      snapshot.secrets && Object.hasOwn(snapshot.secrets, name) ? snapshot.secrets[name] : undefined;\n    const providerReference =\n      snapshot.integration?.secrets && Object.hasOwn(snapshot.integration.secrets, name)\n        ? snapshot.integration.secrets[name]\n        : undefined;\n    const signal = requestSignal ? AbortSignal.any([snapshot.signal, requestSignal]) : snapshot.signal;\n    // Profile aliases win; otherwise a secret saved from the composer, under its own allowlist.\n    const saved = vaultReference || providerReference ? undefined : await this.savedSecret(name, signal);\n    const reference = vaultReference ?? providerReference ?? saved?.reference;\n    if (!reference) throw new Error('Profile secret alias is unavailable');\n    authorize(reference);\n    if (signal.aborted) throw new Error(INVALIDATED);\n    let value: string;\n    try {\n      if (saved) {\n        value = saved.value as string;\n      } else if (vaultReference) {\n        if (!this.options.readVault) throw new Error('Vault unavailable');\n        const { namespace, key, field } = vaultReference.vault;\n        const entry = await this.options.readVault(namespace, key, signal);\n        const selected =\n          field === undefined\n            ? entry\n            : typeof entry === 'object' && entry !== null && !Array.isArray(entry) && Object.hasOwn(entry, field)\n              ? (entry as Record<string, unknown>)[field]\n              : undefined;\n        if (typeof selected !== 'string') throw new Error('Vault field unavailable');\n        value = selected;\n      } else {\n        if (!connection || !providerReference) throw new Error('Provider unavailable');\n        value = await connection.resolveSecret(providerReference, signal);\n      }\n    } catch {\n      // Provider failures must not leak API responses, credential fields or secrets.\n      throw new Error('Profile secret resolution failed');\n    }\n    if (signal.aborted || this.snapshot !== snapshot || this.connection !== connection) throw new Error(INVALIDATED);\n    if (typeof value !== 'string' || value.length === 0) throw new Error('Profile secret field is unavailable');\n    return value;\n  }\n\n  /** `secrets/<name>` as `{value, purposes, allowedOrigins?, allowedTargets?}`, checked like a profile alias. */\n  private async savedSecret(\n    name: string,\n    signal: AbortSignal,\n  ): Promise<{ reference: ProfileVaultSecretReference; value: unknown } | undefined> {\n    if (!this.options.readVault || !ALIAS_PATTERN.test(name)) return undefined;\n    try {\n      const entry = await this.options.readVault(VAULT_SECRETS_NAMESPACE, name, signal);\n      if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) return undefined;\n      const { value, ...delivery } = entry as Record<string, unknown>;\n      const vault = { namespace: VAULT_SECRETS_NAMESPACE, key: name, field: 'value' };\n      const reference = parseProfileVaultSecrets({ [name]: { ...delivery, vault } }, 'Saved secret')[name];\n      return reference && { reference, value };\n    } catch {\n      return undefined;\n    }\n  }\n\n  dispose(): Promise<void> {\n    if (this.disposal) return this.disposal;\n    this.disposed = true;\n    this.invalidate();\n    this.provider = undefined;\n    this.disposal = (async () => {\n      const results = await Promise.allSettled([...this.pending, this.retirement]);\n      if (results.some((result) => result.status === 'rejected')) throw new Error('Profile runtime disposal failed');\n    })();\n    return this.disposal;\n  }\n}\n\nexport function createProfileRuntime(options: ProfileRuntimeOptions): ProfileRuntime {\n  return new SessionProfileRuntime(options);\n}\n\n/** Mounted in the scoped root services array, before dependent integration tools. */\nexport function createProfileRuntimePlugin(runtime: ProfileRuntime): (context: Context) => void {\n  return (context) => {\n    context.provide(PROFILE_RUNTIME_SERVICE, runtime);\n  };\n}\n\nexport function requireProfileRuntime(context: Context): ProfileRuntime {\n  const service = context.get(PROFILE_RUNTIME_SERVICE);\n  if (!service) throw new Error('Profile runtime service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-runtime': ProfileRuntime;\n  }\n}\n","// @scaffold-generated\nimport type { ProfileIntegrationBinding } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SECRETS_SERVICE } from '../../constants/profileSecrets';\nimport type { ProfileProviderFactory, ProfileSecretResolver } from '../profileRuntime/type';\nimport type { ProfileEnvSecretRequest, ProfileSecrets, ProfileSecretsOptions } from './type';\n\n/** Every failure is generic so callers never learn which alias, field or provider response failed. */\nconst UNAVAILABLE = 'Profile secrets are unavailable';\n\nclass HostProfileSecrets implements ProfileSecrets {\n  private readonly providers = new Map<string, ProfileProviderFactory>();\n  private generation = 0;\n\n  constructor(private readonly options: ProfileSecretsOptions) {}\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    if (this.providers.has(provider)) throw new Error('Profile secrets provider is already registered');\n    this.providers.set(provider, factory);\n    return () => {\n      if (this.providers.get(provider) === factory) this.providers.delete(provider);\n    };\n  }\n\n  async resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    if (request.names.length === 0) return {};\n    if (new Set(request.names).size !== request.names.length) throw new Error(UNAVAILABLE);\n    let binding: ProfileIntegrationBinding | undefined;\n    try {\n      binding = await this.options.readBinding(request.cwd, request.profile, request.homeDirectory);\n    } catch {\n      throw new Error(UNAVAILABLE);\n    }\n    const factory = binding && this.providers.get(binding.provider);\n    if (!binding || !factory) throw new Error(UNAVAILABLE);\n    const references = request.names.map((name) => {\n      const reference = Object.hasOwn(binding.secrets, name) ? binding.secrets[name] : undefined;\n      if (!reference?.purposes.includes('env')) throw new Error(UNAVAILABLE);\n      return [name, reference] as const;\n    });\n\n    const controller = new AbortController();\n    const signal = request.signal ? AbortSignal.any([controller.signal, request.signal]) : controller.signal;\n    let connection: ProfileSecretResolver | undefined;\n    try {\n      connection = await factory(binding, { profileName: request.profile, generation: ++this.generation, signal });\n      const values: Record<string, string> = {};\n      for (const [name, reference] of references) {\n        const value = await connection.resolveSecret(reference, signal);\n        if (signal.aborted || typeof value !== 'string' || value.length === 0) throw new Error(UNAVAILABLE);\n        values[name] = value;\n      }\n      return values;\n    } catch {\n      throw new Error(UNAVAILABLE);\n    } finally {\n      controller.abort();\n      try {\n        await connection?.dispose();\n      } catch {\n        // Disposal failures are not secret-bearing, but the resolved values are still discarded.\n        // oxlint-disable-next-line no-unsafe-finally\n        throw new Error(UNAVAILABLE);\n      }\n    }\n  }\n}\n\nexport function createProfileSecrets(options: ProfileSecretsOptions): ProfileSecrets {\n  return new HostProfileSecrets(options);\n}\n\n/** Host-side env secret resolution for workflow run steps. Never registered as a model tool. */\nexport class ProfileSecretsService extends Service implements ProfileSecrets {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSecrets,\n  ) {\n    super(context, PROFILE_SECRETS_SERVICE);\n  }\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    return this.source.registerProvider(provider, factory);\n  }\n\n  resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    return this.source.resolveEnv(request);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSecretsPlugin(source: ProfileSecrets): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSecretsService(context, source);\n  };\n}\n\nexport function requireProfileSecrets(context: Context): ProfileSecrets {\n  const service = context.get(PROFILE_SECRETS_SERVICE);\n  if (!service) throw new Error('Profile secrets service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-secrets': ProfileSecrets;\n  }\n}\n","// @scaffold-generated\nimport { type AgentProfile, inlineProfile } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SOURCES_SERVICE } from '../../constants/profileSources';\nimport type { ContributedProfile, ProfileScope, ProfileSource, ProfileSources, SourcedProfile } from './type';\n\n/** Runs a hook that may throw before it returns a promise, so both kinds of failure are one rejection. */\nasync function settle(run: () => Promise<void> | void): Promise<void> {\n  await run();\n}\n\nclass HostProfileSources implements ProfileSources {\n  private readonly sources = new Map<string, ProfileSource>();\n\n  register(id: string, source: ProfileSource): () => void {\n    if (this.sources.has(id)) throw new Error('Profile source is already registered');\n    this.sources.set(id, source);\n    return () => {\n      if (this.sources.get(id) === source) this.sources.delete(id);\n    };\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.listSourced(scope).map(({ profile }) => profile);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    const byName = new Map<string, SourcedProfile>();\n    for (const [sourceId, source] of this.sources) {\n      let inputs;\n      try {\n        inputs = source.list(scope);\n      } catch {\n        continue;\n      }\n      for (const input of inputs) {\n        if (byName.has(input.name)) continue;\n        try {\n          const profile = inlineProfile(input);\n          if (profile.personaPrompt)\n            byName.set(profile.name, { sourceId, profile: { ...profile, personaPrompt: profile.personaPrompt } });\n        } catch {\n          // An invalid definition is skipped like an invalid directory profile.\n        }\n      }\n    }\n    return [...byName.values()].sort((left, right) => left.profile.name.localeCompare(right.profile.name));\n  }\n\n  async ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    const entries = [...this.sources].filter(([, source]) => source.ready !== undefined);\n    const results = await Promise.allSettled(entries.map(([, source]) => settle(() => source.ready?.(scope, signal))));\n    const failed = entries.filter((_, index) => results[index]?.status === 'rejected').map(([id]) => id);\n    // Source ids only: a rejection reason may carry anything the source put in it.\n    if (failed.length) throw new Error(`Profile source not ready: ${failed.join(', ')}`);\n  }\n\n  async defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    for (const source of this.sources.values()) {\n      if (source.defaultProfile === undefined) continue;\n      const chosen = await source.defaultProfile(scope, signal);\n      if (chosen !== undefined) return chosen;\n    }\n    return undefined;\n  }\n}\n\nexport function createProfileSources(): ProfileSources {\n  return new HostProfileSources();\n}\n\n/** File profiles win; a contributed profile only fills a name the file catalog does not hold. */\nexport function mergeProfiles(files: readonly AgentProfile[], sources: ProfileSources | undefined): AgentProfile[] {\n  const names = new Set(files.map(({ name }) => name));\n  const contributed = (sources?.list() ?? []).filter(({ name }) => !names.has(name));\n  return [...files, ...contributed].sort((left, right) => left.name.localeCompare(right.name));\n}\n\nexport function findProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  name: string,\n): AgentProfile {\n  const profile =\n    files.find((candidate) => candidate.name === name) ?? sources?.list().find((candidate) => candidate.name === name);\n  if (!profile) throw new Error(`Unknown profile: ${name}`);\n  return profile;\n}\n\n/** Profiles plugins hold in memory, merged into the session catalog. Optional: absent means files only. */\nexport class ProfileSourcesService extends Service implements ProfileSources {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSources,\n  ) {\n    super(context, PROFILE_SOURCES_SERVICE);\n  }\n\n  register(id: string, source: ProfileSource): () => void {\n    return this.source.register(id, source);\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.source.list(scope);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    return this.source.listSourced(scope);\n  }\n\n  ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    return this.source.ready(scope, signal);\n  }\n\n  defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    return this.source.defaultProfile(scope, signal);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSourcesPlugin(source: ProfileSources): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSourcesService(context, source);\n  };\n}\n\n/** With a scope, every `list` call through the returned view reads as that workspace. */\nexport function readProfileSources(context: Context, scope?: ProfileScope): ProfileSources | undefined {\n  const sources = context.get(PROFILE_SOURCES_SERVICE);\n  if (!sources || !scope) return sources;\n  return {\n    register: (id, source) => sources.register(id, source),\n    list: () => sources.list(scope),\n    listSourced: () => sources.listSourced(scope),\n    ready: (_ignored, signal) => sources.ready(scope, signal),\n    defaultProfile: (_ignored, signal) => sources.defaultProfile(scope, signal),\n  };\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-sources': ProfileSources;\n  }\n}\n","// @scaffold-generated\nimport type { SecretRedactionStream } from './type';\n\nconst REDACTED = '[redacted]';\n\n/** Raw, JSON-escaped and URL-encoded forms of every non-empty value. */\nfunction secretForms(secrets: Iterable<string>): string[] {\n  const forms = new Set<string>();\n  for (const secret of secrets) {\n    if (typeof secret !== 'string' || !secret) continue;\n    forms.add(secret);\n    forms.add(JSON.stringify(secret).slice(1, -1));\n    forms.add(encodeURIComponent(secret));\n  }\n  return [...forms];\n}\n\n/** Marks every occurrence of every form, so overlapping secrets cannot leave fragments behind. */\nfunction coverage(value: string, forms: readonly string[]): Uint8Array {\n  const covered = new Uint8Array(value.length);\n  for (const form of forms)\n    for (let index = value.indexOf(form); index !== -1; index = value.indexOf(form, index + 1))\n      covered.fill(1, index, index + form.length);\n  return covered;\n}\n\nfunction render(value: string, covered: Uint8Array, end: number): string {\n  let safe = '';\n  let start = 0;\n  for (let index = 0; index <= end; index++) {\n    if (index < end && covered[index] === covered[start]) continue;\n    if (index > start) safe += covered[start] ? REDACTED : value.slice(start, index);\n    start = index;\n  }\n  return safe;\n}\n\nfunction redactText(value: string, forms: readonly string[]): string {\n  return forms.length === 0 ? value : render(value, coverage(value, forms), value.length);\n}\n\nfunction redactValue(value: unknown, forms: readonly string[]): unknown {\n  if (typeof value === 'string') return redactText(value, forms);\n  if (Array.isArray(value)) return value.map((entry) => redactValue(entry, forms));\n  if (value !== null && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entry]) => [redactText(key, forms), redactValue(entry, forms)]),\n    );\n  }\n  return value;\n}\n\n/** Deeply redacts strings and object keys. Non-plain objects become plain records. */\nexport function redactSecrets<T>(value: T, secrets: Iterable<string>): T {\n  return redactValue(value, secretForms(secrets)) as T;\n}\n\nexport function createSecretRedactionStream(secrets: Iterable<string>): SecretRedactionStream {\n  const forms = secretForms(secrets);\n  // A secret not yet complete must start within the last `hold` characters of the buffer.\n  const hold = Math.max(0, ...forms.map((form) => form.length - 1));\n  let buffer = '';\n  return {\n    write(chunk) {\n      buffer += chunk;\n      const covered = coverage(buffer, forms);\n      let end = Math.max(0, buffer.length - hold);\n      // Never split a completed match: hold back the whole run that crosses the boundary.\n      while (end > 0 && end < buffer.length && covered[end] && covered[end - 1]) end--;\n      const safe = render(buffer, covered, end);\n      buffer = buffer.slice(end);\n      return safe;\n    },\n    flush() {\n      const safe = redactText(buffer, forms);\n      buffer = '';\n      return safe;\n    },\n  };\n}\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nconst NONE = 'None';\n\n/** Footer status key the cockpit's profile axis reads. */\ninterface SelectItem {\n  value: string;\n  label: string;\n  description?: string;\n  icon?: string;\n}\n\nexport const PROFILE_STATUS_KEY = 'po-profile';\n\n/** Identity this package registers voice capabilities under. */\nexport const PROFILE_SOURCE = '@agimon-ai/po-profile';\n\n/** The command a queued voice switch invokes, and the reload handoff kind it parks. */\nexport const PROFILE_COMMAND = 'profile';\n\n/**\n * The published axis content: the active profile's name, empty while\n * profiles exist with none active, and undefined to withhold the status so\n * the cockpit keeps the axis off the bar entirely.\n */\nexport function profileStatus(current: string | undefined, hasProfiles: boolean): string | undefined {\n  if (current) return current;\n  return hasProfiles ? '' : undefined;\n}\n\n/** What a person reads for a profile: its declared display name, otherwise the profile name. */\nexport function profileLabel(profile: AgentProfile): string {\n  return profile.identity?.name || profile.name;\n}\n\n/**\n * Rows for the single-select profile picker. A client answers with the label, so a display name two\n * profiles share, or one that reads as None, carries the profile name to stay unique.\n */\nexport function profileItems(profiles: AgentProfile[]): SelectItem[] {\n  const labels = profiles.map(profileLabel);\n  return [\n    { value: '', label: NONE },\n    ...profiles.map((profile, index) => {\n      const label = labels[index] ?? profile.name;\n      const unique = label !== NONE && labels.indexOf(label) === labels.lastIndexOf(label);\n      return {\n        value: profile.name,\n        label: unique ? label : `${label} (${profile.name})`,\n        description: profileDescription(profile),\n        ...(profile.identity?.icon ? { icon: profile.identity.icon } : {}),\n      };\n    }),\n  ];\n}\n\n/** The role and contact a profile declares, otherwise its persona source and environment keys. */\nexport function profileDescription(profile: AgentProfile): string {\n  const presented = [profile.identity?.role, profile.identity?.contact].filter(Boolean).join(' · ');\n  if (presented) return presented;\n  const environmentKeys = Object.keys(profile.env).sort();\n  return environmentKeys.length > 0 ? `${profile.persona} (env: ${environmentKeys.join(', ')})` : profile.persona;\n}\n\n/** Shown when the picked profile is already active. */\nexport function profileSummary(profile: AgentProfile): string {\n  const environmentKeys = Object.keys(profile.env).sort();\n  return [\n    `Profile ${profile.name}`,\n    `Persona: ${profile.persona}`,\n    `Env: ${environmentKeys.join(', ') || '(none)'}`,\n    'Already loaded.',\n  ].join('\\n');\n}\n\nexport function profileTitle(current?: string): string {\n  return `Profile (current: ${current ?? NONE})`;\n}\n"],"mappings":";;;;;AACA,MAAa,kCAAkC;;;ACD/C,MAAa,0BAA0B;;;ACCvC,MAAa,0BAA0B;;;ACAvC,MAAa,0BAA0B;;;;ACIvC,MAAa,yBAAyB;;;;ACWtC,MAAa,gCAAgC;AAC7C,MAAM,UAAU,gCAAgC;;AAGhD,MAAa,mCAAmC,sBAC9C,iCACA,EAAE,OAAO,UAAU,CACrB;;AAGA,SAAgB,0BAA0B,SAAqD;CAC7F,OAAO,QAAQ,IAAI,+BAA+B;AACpD;AAEA,MAAM,eAAe,WACnB,OAAO,kBAAkB,QAAQ,OAAO,yBAAS,IAAI,MAAM,gCAAgC;;;;;;;;AAS7F,SAAgB,eAAe,OAAoB,WAA6B;CAC9E,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,UAAU;CACd,IAAI;CACJ,IAAI;CACJ,MAAM,eAAe,IAAI,SAAgC,SAAS,WAAW;EAC3E,SAAS;EACT,YAAY;CACd,CAAC;CAED,aAAa,YAAY,KAAA,CAAS;CAElC,MAAM,qBAAqB;EACzB,UAAU,YAAY,KAAK,CAAC;EAC5B,WAAW,MAAM,MAAM,MAAM;CAC/B;CACA,IAAI,MAAM,SAAS,aAAa;MAC3B,MAAM,iBAAiB,SAAS,cAAc,EAAE,MAAM,KAAK,CAAC;CACjE,MAAM,QAAQ,iBAAiB;EAC7B,UAAU;EACV,OAAO,EAAE,QAAQ,UAAU,CAAC;EAC5B,WAAW,sBAAM,IAAI,MAAM,8BAA8B,CAAC;CAC5D,GAAG,SAAS;CAEZ,OAAO;EACL,QAAQ,WAAW;EACnB,OAAU,OAA4E;GACpF,IAAI,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,KAAK,CAAC;GAC3D,IAAI,SAAS,OAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,CAAC;GACzD,IAAI;GACJ,IAAI;IACF,OAAO,QAAQ,QAAQ,MAAM,WAAW,MAAM,CAAC;GACjD,QAAQ;IACN,OAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,CAAC;GAC7C;GACA,MAAM,WAAW,KAAK,MACnB,WAA8B;IAAE,QAAQ;IAAQ;GAAM,WAC7B,EAAE,QAAQ,SAAS,EAC/C;GACA,OAAO,QAAQ,KAAK,CAAC,UAAU,YAAY,CAAC;EAC9C;EACA,UAAU;GACR,aAAa,KAAK;GAClB,MAAM,oBAAoB,SAAS,YAAY;GAC/C,IAAI,CAAC,WAAW,OAAO,SAAS,WAAW,sBAAM,IAAI,MAAM,6BAA6B,CAAC;EAC3F;CACF;AACF;;AAGA,eAAsB,eACpB,SACA,OACA,QACA,WACwC;CACxC,OAAO,eAAe;CACtB,IAAI,YAAY,KAAA,GAAW,OAAO;CAClC,MAAM,WAAW,eAAe,QAAQ,SAAS;CACjD,IAAI;EACF,QAAQ,MAAM,SAAS,QAAQ,eAAe,QAAQ,MAAM,OAAO,UAAU,CAAC,EAAA,CAAG;CACnF,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AACA,MAAM,SAAS,OAAgC,SAAqC,0BAClF,IAAI,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE,WAAW,IAAI,GAAG,GAAI,SAAS,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK,CAAC,CAAE,CAAC;;;;;;;;;AAUrG,eAAsB,sBACpB,OACA,SACA,SACgC;CAChC,QAAQ,OAAO,eAAe;CAC9B,MAAM,EAAE,QAAQ,UAAU;CAC1B,MAAM,cAAc,OAAO;CAC3B,MAAM,OAA8B;EAAE;EAAQ,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CAAG;CACpG,IAAI,OAAO,SAAS,QAAQ,OAAO;CAGnC,MAAM,OAAgC,CAAC;CACvC,MAAM,UAAa,UAA+E;EAChG,KAAK,aAAa,eAAe,QAAQ,QAAQ,QAAQ,aAAA,GAA0C;EACnG,OAAO,KAAK,SAAS,OAAO,KAAK;CACnC;CACA,MAAM,QAAQ,aAA2D;EAAE,GAAG;EAAM;CAAQ;CAC5F,IAAI;EACF,IAAI,OAAO,SAAS,SAAS;GAC3B,MAAM,YAAY,OAAO;GACzB,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,YAAY,KAAA,GAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GACrE,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;GAEpE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GAC3E,OAAO,KAAK;IAAE,MAAM,OAAO,WAAW,WAAW,kBAAkB;IAAW;GAAU,CAAC;EAC3F;EACA,IAAI,gBAAgB,KAAA,KAAa,YAAY,KAAA,GAAW,OAAO;EAC/D,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,eAAe,OAAO,MAAM,CAAC;EAC7E,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;EAChE,IAAI,OAAO,WAAW,UAAU,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;EACrE,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EAExF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;EACrE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EACxF,IAAI,QAAQ,WAAW,WAAW,OAAO,KAAK;GAAE,MAAM;GAAW,WAAW;EAAO,CAAC;EACpF,IAAI,QAAQ,WAAW,UAAU,OAAO,KAAK;GAAE,MAAM;GAAiB,WAAW;EAAO,CAAC;EACzF,OAAO,KAAK;GAAE,MAAM;GAAmB,WAAW;EAAO,CAAC;CAC5D,UAAU;EACR,KAAK,UAAU,QAAQ;CACzB;AACF;;AAGA,SAAgB,mBAAmB,SAAwC;CACzE,MAAM,EAAE,MAAM,cAAc;CAC5B,MAAM,UAAU,cAAc,KAAA,IAAY,kCAAkC,YAAY,UAAU;CAClG,MAAM,UAAU;CAChB,IAAI,SAAS,WAAW,OAAO,GAAG,QAAQ,wBAAwB,QAAQ,YAAY;CACtF,IAAI,SAAS,iBAAiB,OAAO,GAAG,QAAQ,kDAAkD;CAClG,IAAI,SAAS,mBAAmB,OAAO,wBAAwB,UAAU,sBAAsB;CAC/F,OAAO,GAAG,QAAQ,qBAAqB;AACzC;;;ACzJA,MAAMA,gBAAc;AACpB,MAAM,cAAc;;AAEpB,MAAM,0BAA0B;AAChC,MAAM,gBAAgB;;AAGtB,IAAM,wBAAN,MAAsD;CAYvB;CAX7B,aAAqB,IAAI,gBAAgB;CACzC;CACA;CACA;CACA,aAAoC,QAAQ,QAAQ;CACpD,aAAoC,QAAQ,QAAQ;CACpD,0BAA2B,IAAI,IAAmB;CAClD,eAAuB;CACvB,WAAmB;CACnB;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,WAAW,KAAK,QAAQ,QAAQ,aAAa,CAAC;CACrD;CAEA,QAAgB,aAAiC,YAA4C;EAC3F,MAAM,UAAU,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,YAAY,WAAW;EAC5F,MAAM,MAAM,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,UAAU,WAAW;EACtF,MAAM,gBAAgB,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,cAAc,WAAW;EACpG,MAAM,UAAU,kBAAkB,KAAA,IAAY,KAAA,IAAY,yBAAyB,aAAa;EAChG,IAAI,WAAW,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO,QAAQ,SAAS,IAAI,CAAC,GACzG,MAAM,IAAI,MAAM,uCAAuC;EAEzD,OAAO,OAAO,OAAO;GACnB,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;GACnD,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa,oBAAoB,OAAO,EAAE;GAC7E,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;GAC9D,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,QAAQ,KAAK,WAAW;EAC1B,CAAC;CACH;CAEA,gBAAwC;EACtC,OAAO,KAAK;CACd;CAEA,aAAmB;EACjB,KAAK,WAAW,MAAM;EACtB,MAAM,aAAa,KAAK;EACxB,KAAK,aAAa,KAAA;EAClB,IAAI,YAAY;GACd,KAAK,aAAa,KAAK,WAAW,KAAK,YAAY;IACjD,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;GACF,CAAC;GACD,KAAU,MAAM,KAAK,UAAU;EACjC;CACF;CAEA,MAAc,MAAoC;EAChD,KAAK,QAAQ,IAAI,IAAI;EAGrB,KAAU,WACF,KAAK,QAAQ,OAAO,IAAI,SACxB,KAAK,QAAQ,OAAO,IAAI,CAChC;EACA,OAAO;CACT;CAEA,aAAoC;EAClC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,KAAK,eAAe,QAAQ,SAAS,eAAe,QAAQ;EAC5D,MAAM,QAAQ,YAAY;GACxB,MAAM,KAAK;GACX,IAAI,SAAS,OAAO,SAAS;GAC7B,IAAI,CAAC,SAAS,eAAe,CAAC,UAAU;GACxC,IAAI,SAAS,YAAY,aAAa,SAAS,MAAM,MAAM,IAAI,MAAMA,aAAW;GAChF,IAAI;GACJ,IAAI;IACF,aAAa,MAAM,SAAS,QAAQ,SAAS,aAAa;KACxD,aAAa,SAAS;KACtB,YAAY,SAAS;KACrB,QAAQ,SAAS;IACnB,CAAC;GACH,QAAQ;IAGN,IAAI,SAAS,OAAO,SAAS;IAC7B,MAAM,IAAI,MAAM,wCAAwC;GAC1D;GACA,IAAI,SAAS,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,UAAU;IAC1E,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;IACA;GACF;GACA,KAAK,aAAa;EACpB,EAAA,CAAG;EACH,KAAK,aAAa,KAAK,MACrB,KAAK,cAAc;GACjB,IAAI,KAAK,aAAa,UAAU,KAAK,eAAe;EACtD,CAAC,CACH;EACA,OAAO,KAAK;CACd;CAEA,MAAM,OAAO,aAAsB,SAAuD;EACxF,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9C,IACE,SAAS,UAAU,QACnB,KAAK,SAAS,gBAAgB,eAC9B,CAAC,KAAK,SAAS,OAAO,YACrB,CAAC,KAAK,SAAS,eAAe,CAAC,KAAK,YAAY,KAAK,cAAc,KAAK,eAEzE;EACF,KAAK,WAAW;EAChB,KAAK,aAAa,IAAI,gBAAgB;EAEtC,KAAK,WAAW,KAAK,QAAQ,aAAa,KAAK,SAAS,aAAa,CAAC;EACtE,MAAM,KAAK,WAAW;CACxB;CAEA,MAAM,QAAuB;EAC3B,MAAM,WAAW,KAAK;EACtB,MAAM,KAAK;EACX,IAAI,KAAK,YAAY,SAAS,OAAO,WAAW,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EACvG,IAAI,SAAS,eAAe,CAAC,KAAK,YAAY,MAAM,IAAI,MAAMA,aAAW;CAC3E;CAEA,MAAM,eAAe,cAAsB,SAA+D;EACxG,IAAI,KAAK,YAAY,KAAK,SAAS,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC9E,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,sCAAsC;EACzE,IAAI,KAAK,SAAS,eAAe,KAAK,SAAS,YAAY,aAAa,cAAc,MAAM,IAAI,MAAMA,aAAW;EACjH,MAAM,WAAW;GAAE,MAAM;GAAc;EAAQ;EAC/C,KAAK,WAAW;EAChB,IAAI;GACF,MAAM,KAAK,WAAW;GACtB,MAAM,KAAK,MAAM;GACjB,IAAI,KAAK,YAAY,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9E,QAAQ;GACN,IAAI,KAAK,aAAa,UAAU,KAAK,WAAW,KAAA;GAChD,KAAK,WAAW;GAChB,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,IAAI,WAAW;EACf,OAAO,YAAY;GACjB,IAAI,YAAY,KAAK,aAAa,UAAU;GAC5C,WAAW;GACX,KAAK,WAAW;GAChB,KAAK,WAAW,KAAA;GAChB,KAAK,aAAa,IAAI,gBAAgB;GACtC,KAAK,WAAW,OAAO,OAAO;IAC5B,GAAG,KAAK;IACR,YAAY,KAAK,SAAS,aAAa;IACvC,QAAQ,KAAK,WAAW;GAC1B,CAAC;GACD,MAAM,KAAK;EACb;CACF;CAEA,cAAc,MAAc,SAAgD;EAC1E,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IAAI,CAAC,UAAU,SAAS,SAAS,SAAS,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAClG,IAAI,CAAC,UAAU,eAAe,SAAS,QAAQ,MAAM,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChH,CAAC;CACH;CAEA,mBAAmB,MAAc,SAAqD;EACpF,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IACE,CAAC,UAAU,SAAS,SAAS,OAAO,KACpC,CAAC,UAAU,kBACX,CAAC,OAAO,OAAO,UAAU,gBAAgB,QAAQ,OAAO,KACxD,CAAC,UAAU,eAAe,QAAQ,QAAQ,EAAE,SAAS,QAAQ,MAAM,GAEnE,MAAM,IAAI,MAAM,4CAA4C;EAEhE,CAAC;CACH;CAEA,mBAAmB,QAAuC;EACxD,MAAM,OAAO,KAAK,SAAS,aAAa,SAAS;EACjD,IAAI,SAAS,KAAA,GAAW,OAAO,QAAQ,uBAAO,IAAI,MAAM,iCAAiC,CAAC;EAC1F,OAAO,KAAK,iBAAiB,MAAM,SAAS,cAAc;GACxD,IAAI,CAAC,UAAU,SAAS,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAClG,CAAC;CACH;CAEA,MAAc,iBACZ,MACA,eACA,WACiB;EAGjB,IAAI,KAAK,cAAc,MAAM,IAAI,MAAM,gEAAgE;EACvG,MAAM,KAAK,MAAM;EACjB,MAAM,WAAW,KAAK;EACtB,MAAM,aAAa,KAAK;EACxB,MAAM,iBACJ,SAAS,WAAW,OAAO,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,QAAQ,QAAQ,KAAA;EACvF,MAAM,oBACJ,SAAS,aAAa,WAAW,OAAO,OAAO,SAAS,YAAY,SAAS,IAAI,IAC7E,SAAS,YAAY,QAAQ,QAC7B,KAAA;EACN,MAAM,SAAS,gBAAgB,YAAY,IAAI,CAAC,SAAS,QAAQ,aAAa,CAAC,IAAI,SAAS;EAE5F,MAAM,QAAQ,kBAAkB,oBAAoB,KAAA,IAAY,MAAM,KAAK,YAAY,MAAM,MAAM;EACnG,MAAM,YAAY,kBAAkB,qBAAqB,OAAO;EAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qCAAqC;EACrE,UAAU,SAAS;EACnB,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC/C,IAAI;EACJ,IAAI;GACF,IAAI,OACF,QAAQ,MAAM;QACT,IAAI,gBAAgB;IACzB,IAAI,CAAC,KAAK,QAAQ,WAAW,MAAM,IAAI,MAAM,mBAAmB;IAChE,MAAM,EAAE,WAAW,KAAK,UAAU,eAAe;IACjD,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,WAAW,KAAK,MAAM;IACjE,MAAM,WACJ,UAAU,KAAA,IACN,QACA,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,OAAO,OAAO,KAAK,IAC/F,MAAkC,SACnC,KAAA;IACR,IAAI,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,yBAAyB;IAC3E,QAAQ;GACV,OAAO;IACL,IAAI,CAAC,cAAc,CAAC,mBAAmB,MAAM,IAAI,MAAM,sBAAsB;IAC7E,QAAQ,MAAM,WAAW,cAAc,mBAAmB,MAAM;GAClE;EACF,QAAQ;GAEN,MAAM,IAAI,MAAM,kCAAkC;EACpD;EACA,IAAI,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,eAAe,YAAY,MAAM,IAAI,MAAM,WAAW;EAC/G,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAC1G,OAAO;CACT;;CAGA,MAAc,YACZ,MACA,QACiF;EACjF,IAAI,CAAC,KAAK,QAAQ,aAAa,CAAC,cAAc,KAAK,IAAI,GAAG,OAAO,KAAA;EACjE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,yBAAyB,MAAM,MAAM;GAChF,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;GAChF,MAAM,EAAE,OAAO,GAAG,aAAa;GAC/B,MAAM,QAAQ;IAAE,WAAW;IAAyB,KAAK;IAAM,OAAO;GAAQ;GAC9E,MAAM,YAAY,yBAAyB,GAAG,OAAO;IAAE,GAAG;IAAU;GAAM,EAAE,GAAG,cAAc,CAAC,CAAC;GAC/F,OAAO,aAAa;IAAE;IAAW;GAAM;EACzC,QAAQ;GACN;EACF;CACF;CAEA,UAAyB;EACvB,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,KAAK,WAAW;EAChB,KAAK,WAAW;EAChB,KAAK,WAAW,KAAA;EAChB,KAAK,YAAY,YAAY;GAE3B,KAAI,MADkB,QAAQ,WAAW,CAAC,GAAG,KAAK,SAAS,KAAK,UAAU,CAAC,EAAA,CAC/D,MAAM,WAAW,OAAO,WAAW,UAAU,GAAG,MAAM,IAAI,MAAM,iCAAiC;EAC/G,EAAA,CAAG;EACH,OAAO,KAAK;CACd;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,sBAAsB,OAAO;AAC1C;;AAGA,SAAgB,2BAA2B,SAAqD;CAC9F,QAAQ,YAAY;EAClB,QAAQ,QAAQ,yBAAyB,OAAO;CAClD;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;AC/SA,MAAM,cAAc;AAEpB,IAAM,qBAAN,MAAmD;CAIpB;CAH7B,4BAA6B,IAAI,IAAoC;CACrE,aAAqB;CAErB,YAAY,SAAiD;EAAhC,KAAA,UAAA;CAAiC;CAE9D,iBAAiB,UAAkB,SAA6C;EAC9E,IAAI,KAAK,UAAU,IAAI,QAAQ,GAAG,MAAM,IAAI,MAAM,gDAAgD;EAClG,KAAK,UAAU,IAAI,UAAU,OAAO;EACpC,aAAa;GACX,IAAI,KAAK,UAAU,IAAI,QAAQ,MAAM,SAAS,KAAK,UAAU,OAAO,QAAQ;EAC9E;CACF;CAEA,MAAM,WAAW,SAAmE;EAClF,IAAI,QAAQ,MAAM,WAAW,GAAG,OAAO,CAAC;EACxC,IAAI,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,SAAS,QAAQ,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW;EACrF,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,KAAK,QAAQ,YAAY,QAAQ,KAAK,QAAQ,SAAS,QAAQ,aAAa;EAC9F,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B;EACA,MAAM,UAAU,WAAW,KAAK,UAAU,IAAI,QAAQ,QAAQ;EAC9D,IAAI,CAAC,WAAW,CAAC,SAAS,MAAM,IAAI,MAAM,WAAW;EACrD,MAAM,aAAa,QAAQ,MAAM,KAAK,SAAS;GAC7C,MAAM,YAAY,OAAO,OAAO,QAAQ,SAAS,IAAI,IAAI,QAAQ,QAAQ,QAAQ,KAAA;GACjF,IAAI,CAAC,WAAW,SAAS,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,WAAW;GACrE,OAAO,CAAC,MAAM,SAAS;EACzB,CAAC;EAED,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,MAAM,CAAC,IAAI,WAAW;EAClG,IAAI;EACJ,IAAI;GACF,aAAa,MAAM,QAAQ,SAAS;IAAE,aAAa,QAAQ;IAAS,YAAY,EAAE,KAAK;IAAY;GAAO,CAAC;GAC3G,MAAM,SAAiC,CAAC;GACxC,KAAK,MAAM,CAAC,MAAM,cAAc,YAAY;IAC1C,MAAM,QAAQ,MAAM,WAAW,cAAc,WAAW,MAAM;IAC9D,IAAI,OAAO,WAAW,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,WAAW;IAClG,OAAO,QAAQ;GACjB;GACA,OAAO;EACT,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B,UAAU;GACR,WAAW,MAAM;GACjB,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,QAAQ;IAGN,MAAM,IAAI,MAAM,WAAW;GAC7B;EACF;CACF;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,mBAAmB,OAAO;AACvC;;AAGA,IAAa,wBAAb,cAA2C,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,iBAAiB,UAAkB,SAA6C;EAC9E,OAAO,KAAK,OAAO,iBAAiB,UAAU,OAAO;CACvD;CAEA,WAAW,SAAmE;EAC5E,OAAO,KAAK,OAAO,WAAW,OAAO;CACvC;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;AC9FA,eAAe,OAAO,KAAgD;CACpE,MAAM,IAAI;AACZ;AAEA,IAAM,qBAAN,MAAmD;CACjD,0BAA2B,IAAI,IAA2B;CAE1D,SAAS,IAAY,QAAmC;EACtD,IAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChF,KAAK,QAAQ,IAAI,IAAI,MAAM;EAC3B,aAAa;GACX,IAAI,KAAK,QAAQ,IAAI,EAAE,MAAM,QAAQ,KAAK,QAAQ,OAAO,EAAE;EAC7D;CACF;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,cAAc,OAAO;CAC7D;CAEA,YAAY,OAAwC;EAClD,MAAM,yBAAS,IAAI,IAA4B;EAC/C,KAAK,MAAM,CAAC,UAAU,WAAW,KAAK,SAAS;GAC7C,IAAI;GACJ,IAAI;IACF,SAAS,OAAO,KAAK,KAAK;GAC5B,QAAQ;IACN;GACF;GACA,KAAK,MAAM,SAAS,QAAQ;IAC1B,IAAI,OAAO,IAAI,MAAM,IAAI,GAAG;IAC5B,IAAI;KACF,MAAM,UAAU,cAAc,KAAK;KACnC,IAAI,QAAQ,eACV,OAAO,IAAI,QAAQ,MAAM;MAAE;MAAU,SAAS;OAAE,GAAG;OAAS,eAAe,QAAQ;MAAc;KAAE,CAAC;IACxG,QAAQ,CAER;GACF;EACF;EACA,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,QAAQ,KAAK,cAAc,MAAM,QAAQ,IAAI,CAAC;CACvG;CAEA,MAAM,MAAM,OAAiC,QAAoC;EAC/E,MAAM,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,QAAQ,GAAG,YAAY,OAAO,UAAU,KAAA,CAAS;EACnF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,KAAK,GAAG,YAAY,aAAa,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC;EACjH,MAAM,SAAS,QAAQ,QAAQ,GAAG,UAAU,QAAQ,MAAM,EAAE,WAAW,UAAU,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;EAEnG,IAAI,OAAO,QAAQ,MAAM,IAAI,MAAM,6BAA6B,OAAO,KAAK,IAAI,GAAG;CACrF;CAEA,MAAM,eAAe,OAAiC,QAAkD;EACtG,KAAK,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG;GAC1C,IAAI,OAAO,mBAAmB,KAAA,GAAW;GACzC,MAAM,SAAS,MAAM,OAAO,eAAe,OAAO,MAAM;GACxD,IAAI,WAAW,KAAA,GAAW,OAAO;EACnC;CAEF;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO,IAAI,mBAAmB;AAChC;;AAGA,SAAgB,cAAc,OAAgC,SAAqD;CACjH,MAAM,QAAQ,IAAI,IAAI,MAAM,KAAK,EAAE,WAAW,IAAI,CAAC;CACnD,MAAM,eAAe,SAAS,KAAK,KAAK,CAAC,EAAA,CAAG,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC;CACjF,OAAO,CAAC,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC7F;AAEA,SAAgB,YACd,OACA,SACA,MACc;CACd,MAAM,UACJ,MAAM,MAAM,cAAc,UAAU,SAAS,IAAI,KAAK,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc,UAAU,SAAS,IAAI;CACnH,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,oBAAoB,MAAM;CACxD,OAAO;AACT;;AAGA,IAAa,wBAAb,cAA2C,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,SAAS,IAAY,QAAmC;EACtD,OAAO,KAAK,OAAO,SAAS,IAAI,MAAM;CACxC;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,OAAO,KAAK,KAAK;CAC/B;CAEA,YAAY,OAAwC;EAClD,OAAO,KAAK,OAAO,YAAY,KAAK;CACtC;CAEA,MAAM,OAAiC,QAAoC;EACzE,OAAO,KAAK,OAAO,MAAM,OAAO,MAAM;CACxC;CAEA,eAAe,OAAiC,QAAkD;EAChG,OAAO,KAAK,OAAO,eAAe,OAAO,MAAM;CACjD;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;;AAGA,SAAgB,mBAAmB,SAAkB,OAAkD;CACrG,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,WAAW,CAAC,OAAO,OAAO;CAC/B,OAAO;EACL,WAAW,IAAI,WAAW,QAAQ,SAAS,IAAI,MAAM;EACrD,YAAY,QAAQ,KAAK,KAAK;EAC9B,mBAAmB,QAAQ,YAAY,KAAK;EAC5C,QAAQ,UAAU,WAAW,QAAQ,MAAM,OAAO,MAAM;EACxD,iBAAiB,UAAU,WAAW,QAAQ,eAAe,OAAO,MAAM;CAC5E;AACF;;;ACvIA,MAAM,WAAW;;AAGjB,SAAS,YAAY,SAAqC;CACxD,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ;EAC3C,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,KAAK,UAAU,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;EAC7C,MAAM,IAAI,mBAAmB,MAAM,CAAC;CACtC;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,SAAS,SAAS,OAAe,OAAsC;CACrE,MAAM,UAAU,IAAI,WAAW,MAAM,MAAM;CAC3C,KAAK,MAAM,QAAQ,OACjB,KAAK,IAAI,QAAQ,MAAM,QAAQ,IAAI,GAAG,UAAU,IAAI,QAAQ,MAAM,QAAQ,MAAM,QAAQ,CAAC,GACvF,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,OAAO,OAAe,SAAqB,KAAqB;CACvE,IAAI,OAAO;CACX,IAAI,QAAQ;CACZ,KAAK,IAAI,QAAQ,GAAG,SAAS,KAAK,SAAS;EACzC,IAAI,QAAQ,OAAO,QAAQ,WAAW,QAAQ,QAAQ;EACtD,IAAI,QAAQ,OAAO,QAAQ,QAAQ,SAAS,WAAW,MAAM,MAAM,OAAO,KAAK;EAC/E,QAAQ;CACV;CACA,OAAO;AACT;AAEA,SAAS,WAAW,OAAe,OAAkC;CACnE,OAAO,MAAM,WAAW,IAAI,QAAQ,OAAO,OAAO,SAAS,OAAO,KAAK,GAAG,MAAM,MAAM;AACxF;AAEA,SAAS,YAAY,OAAgB,OAAmC;CACtE,IAAI,OAAO,UAAU,UAAU,OAAO,WAAW,OAAO,KAAK;CAC7D,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,UAAU,YAAY,OAAO,KAAK,CAAC;CAC/E,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,WAAW,KAAK,KAAK,GAAG,YAAY,OAAO,KAAK,CAAC,CAAC,CACjG;CAEF,OAAO;AACT;;AAGA,SAAgB,cAAiB,OAAU,SAA8B;CACvE,OAAO,YAAY,OAAO,YAAY,OAAO,CAAC;AAChD;AAEA,SAAgB,4BAA4B,SAAkD;CAC5F,MAAM,QAAQ,YAAY,OAAO;CAEjC,MAAM,OAAO,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,SAAS,KAAK,SAAS,CAAC,CAAC;CAChE,IAAI,SAAS;CACb,OAAO;EACL,MAAM,OAAO;GACX,UAAU;GACV,MAAM,UAAU,SAAS,QAAQ,KAAK;GACtC,IAAI,MAAM,KAAK,IAAI,GAAG,OAAO,SAAS,IAAI;GAE1C,OAAO,MAAM,KAAK,MAAM,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,IAAI;GAC3E,MAAM,OAAO,OAAO,QAAQ,SAAS,GAAG;GACxC,SAAS,OAAO,MAAM,GAAG;GACzB,OAAO;EACT;EACA,QAAQ;GACN,MAAM,OAAO,WAAW,QAAQ,KAAK;GACrC,SAAS;GACT,OAAO;EACT;CACF;AACF;;;AC7EA,MAAM,OAAO;AAUb,MAAa,qBAAqB;;AAMlC,MAAa,kBAAkB;;;;;;AAO/B,SAAgB,cAAc,SAA6B,aAA0C;CACnG,IAAI,SAAS,OAAO;CACpB,OAAO,cAAc,KAAK,KAAA;AAC5B;;AAGA,SAAgB,aAAa,SAA+B;CAC1D,OAAO,QAAQ,UAAU,QAAQ,QAAQ;AAC3C;;;;;AAMA,SAAgB,aAAa,UAAwC;CACnE,MAAM,SAAS,SAAS,IAAI,YAAY;CACxC,OAAO,CACL;EAAE,OAAO;EAAI,OAAO;CAAK,GACzB,GAAG,SAAS,KAAK,SAAS,UAAU;EAClC,MAAM,QAAQ,OAAO,UAAU,QAAQ;EACvC,MAAM,SAAS,UAAU,QAAQ,OAAO,QAAQ,KAAK,MAAM,OAAO,YAAY,KAAK;EACnF,OAAO;GACL,OAAO,QAAQ;GACf,OAAO,SAAS,QAAQ,GAAG,MAAM,IAAI,QAAQ,KAAK;GAClD,aAAa,mBAAmB,OAAO;GACvC,GAAI,QAAQ,UAAU,OAAO,EAAE,MAAM,QAAQ,SAAS,KAAK,IAAI,CAAC;EAClE;CACF,CAAC,CACH;AACF;;AAGA,SAAgB,mBAAmB,SAA+B;CAChE,MAAM,YAAY,CAAC,QAAQ,UAAU,MAAM,QAAQ,UAAU,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK;CAChG,IAAI,WAAW,OAAO;CACtB,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO,gBAAgB,SAAS,IAAI,GAAG,QAAQ,QAAQ,SAAS,gBAAgB,KAAK,IAAI,EAAE,KAAK,QAAQ;AAC1G;;AAGA,SAAgB,eAAe,SAA+B;CAC5D,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO;EACL,WAAW,QAAQ;EACnB,YAAY,QAAQ;EACpB,QAAQ,gBAAgB,KAAK,IAAI,KAAK;EACtC;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,aAAa,SAA0B;CACrD,OAAO,qBAAqB,WAAW,KAAK;AAC9C"}

package/dist/profileText-BinY2lbY.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"profileText-BinY2lbY.cjs","names":["defineServiceContract","UNAVAILABLE","parseProfileVaultSecrets","parseProfileBinding","Service","inlineProfile","Service"],"sources":["../src/constants/profileInitialOutcome.ts","../src/constants/profileRuntime.ts","../src/constants/profileSecrets.ts","../src/constants/profileSources.ts","../src/services/launchProfiles/type.ts","../src/services/profileResolution/index.ts","../src/services/profileRuntime/index.ts","../src/services/profileSecrets/index.ts","../src/services/profileSources/index.ts","../src/services/secretRedaction/index.ts","../src/services/profileText/index.ts"],"sourcesContent":["/** The decision about a session's first profile, published on the session context before its plugins start. */\nexport const PROFILE_INITIAL_OUTCOME_SERVICE = 'po/profile-initial-outcome';\n","export const PROFILE_RUNTIME_SERVICE = 'po/profile-runtime';\n","// @scaffold-generated\nexport const PROFILE_SECRETS_SERVICE = 'po/profile-secrets';\n","// @scaffold-generated\nexport const PROFILE_SOURCES_SERVICE = 'po/profile-sources';\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\n\n/** The source id every profile read from a `profiles.yaml` carries. */\nexport const FILE_PROFILE_SOURCE_ID = 'files';\n\n/** One profile a launcher may offer. Display data only: never a persona, environment, binding or secret. */\nexport interface LaunchProfileItem {\n  readonly name: string;\n  readonly identity?: {\n    readonly name?: string;\n    readonly icon?: string;\n    readonly role?: string;\n    readonly contact?: string;\n  };\n  /** `files`, or the id a plugin registered its source under. */\n  readonly sourceId: string;\n}\n\nexport interface LaunchProfileCatalog {\n  readonly profiles: readonly LaunchProfileItem[];\n  /** `unavailable` means a source did not become ready in time or failed; `profiles` lists what exists already. */\n  readonly readiness: 'ready' | 'unavailable';\n}\n\nexport interface ListLaunchProfilesInput {\n  readonly files: readonly AgentProfile[];\n  readonly sources: ProfileSources | undefined;\n  readonly scope: ProfileScope;\n  /** The request going away rejects the listing. */\n  readonly signal: AbortSignal;\n  /** The one budget for waiting on sources. Defaults to ten seconds. */\n  readonly timeoutMs?: number;\n}\n","// @scaffold-generated\nimport type { AgentProfile } from '@agimon-ai/po-config/profiles';\nimport { defineServiceContract } from '@agimon-ai/po-core/extensionFile';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_INITIAL_OUTCOME_SERVICE } from '../../constants/profileInitialOutcome';\nimport type { ProfileScope, ProfileSources } from '../profileSources/type';\nimport type {\n  Deadline,\n  DeadlineResult,\n  InitialProfileOutcome,\n  InitialProfileWarning,\n  ResolveInitialProfileOptions,\n} from './type';\n\n/** One budget for every wait of a resolution. */\nexport const PROFILE_RESOLUTION_TIMEOUT_MS = 10_000;\nconst SECONDS = PROFILE_RESOLUTION_TIMEOUT_MS / 1_000;\n\n/** Published on a session context by whoever launches it, or by the session itself when nobody did. */\nexport const PROFILE_INITIAL_OUTCOME_CONTRACT = defineServiceContract<InitialProfileOutcome>(\n  PROFILE_INITIAL_OUTCOME_SERVICE,\n  { scope: 'session' },\n);\n\n/** The outcome a launcher already decided, or undefined when this session was not launched with one. */\nexport function readInitialProfileOutcome(context: Context): InitialProfileOutcome | undefined {\n  return context.get(PROFILE_INITIAL_OUTCOME_SERVICE);\n}\n\nconst abortReason = (signal: AbortSignal): Error =>\n  signal.reason instanceof Error ? signal.reason : new Error('Profile resolution was aborted');\n\n/**\n * A single absolute deadline shared by every wait of one resolution.\n *\n * Hooks receive a signal that aborts when the deadline passes, the owner aborts, or the deadline is disposed:\n * work shared with other waiters must keep running when that signal fires. A hook that ignores the signal cannot\n * hold the resolution back, and its late result or failure is dropped.\n */\nexport function createDeadline(owner: AbortSignal, timeoutMs: number): Deadline {\n  const controller = new AbortController();\n  let expired = false;\n  let expire!: (result: DeadlineResult<never>) => void;\n  let interrupt!: (error: Error) => void;\n  const interruption = new Promise<DeadlineResult<never>>((resolve, reject) => {\n    expire = resolve;\n    interrupt = reject;\n  });\n  // Waits observe this promise, but it can settle between two of them.\n  interruption.catch(() => undefined);\n\n  const onOwnerAbort = () => {\n    interrupt(abortReason(owner));\n    controller.abort(owner.reason);\n  };\n  if (owner.aborted) onOwnerAbort();\n  else owner.addEventListener('abort', onOwnerAbort, { once: true });\n  const timer = setTimeout(() => {\n    expired = true;\n    expire({ status: 'timeout' });\n    controller.abort(new Error('Profile resolution timed out'));\n  }, timeoutMs);\n\n  return {\n    signal: controller.signal,\n    within<T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> {\n      if (owner.aborted) return Promise.reject(abortReason(owner));\n      if (expired) return Promise.resolve({ status: 'timeout' });\n      let work: Promise<T>;\n      try {\n        work = Promise.resolve(start(controller.signal));\n      } catch {\n        return Promise.resolve({ status: 'failed' });\n      }\n      const finished = work.then(\n        (value): DeadlineResult<T> => ({ status: 'done', value }),\n        (): DeadlineResult<T> => ({ status: 'failed' }),\n      );\n      return Promise.race([finished, interruption]);\n    },\n    dispose() {\n      clearTimeout(timer);\n      owner.removeEventListener('abort', onOwnerAbort);\n      if (!controller.signal.aborted) controller.abort(new Error('Profile resolution finished'));\n    },\n  };\n}\n\n/** Waits once for source readiness, without discarding profiles that already loaded. */\nexport async function waitForSources(\n  sources: ProfileSources | undefined,\n  scope: ProfileScope | undefined,\n  signal: AbortSignal,\n  timeoutMs: number,\n): Promise<'done' | 'timeout' | 'failed'> {\n  signal.throwIfAborted();\n  if (sources === undefined) return 'done';\n  const deadline = createDeadline(signal, timeoutMs);\n  try {\n    return (await deadline.within((waitSignal) => sources.ready(scope, waitSignal))).status;\n  } finally {\n    deadline.dispose();\n  }\n}\nconst names = (files: readonly AgentProfile[], sources: ProfileSources | undefined, scope: ProfileScope | undefined) =>\n  new Set([...files.map(({ name }) => name), ...(sources?.list(scope).map(({ name }) => name) ?? [])]);\n\n/**\n * Decides which profile a session starts with, once.\n *\n * Resolves a name that is already listed at once. Waits for sources to become ready only when a requested name\n * is missing, and consults a source default only when nothing was requested in a known workspace; a default its\n * catalog does not list yet waits for readiness too. Every wait shares one deadline. A name that never arrives, a source that fails and a default that is not in the\n * workspace catalog all give a session with no profile and one warning; only the owner aborting rejects.\n */\nexport async function resolveInitialProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  options: ResolveInitialProfileOptions,\n): Promise<InitialProfileOutcome> {\n  options.signal.throwIfAborted();\n  const { intent, scope } = options;\n  const workspaceId = scope?.workspaceId;\n  const base: InitialProfileOutcome = { intent, ...(workspaceId === undefined ? {} : { workspaceId }) };\n  if (intent.kind === 'none') return base;\n\n  // Created by the first wait, so a profile that is already listed costs no timer.\n  const held: { deadline?: Deadline } = {};\n  const within = <T>(start: (signal: AbortSignal) => Promise<T> | T): Promise<DeadlineResult<T>> => {\n    held.deadline ??= createDeadline(options.signal, options.timeoutMs ?? PROFILE_RESOLUTION_TIMEOUT_MS);\n    return held.deadline.within(start);\n  };\n  const warn = (warning: InitialProfileWarning): InitialProfileOutcome => ({ ...base, warning });\n  try {\n    if (intent.kind === 'named') {\n      const requested = intent.name;\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (sources === undefined) return warn({ code: 'missing', requested });\n      const waited = await within((signal) => sources.ready(scope, signal));\n      // A usable profile wins over a source that failed or ran out of time.\n      if (names(files, sources, scope).has(requested)) return { ...base, resolvedProfile: requested };\n      if (waited.status === 'timeout') return warn({ code: 'timeout', requested });\n      return warn({ code: waited.status === 'failed' ? 'source-failed' : 'missing', requested });\n    }\n    if (workspaceId === undefined || sources === undefined) return base;\n    const waited = await within((signal) => sources.defaultProfile(scope, signal));\n    if (waited.status === 'timeout') return warn({ code: 'timeout' });\n    if (waited.status === 'failed') return warn({ code: 'source-failed' });\n    const chosen = waited.value;\n    if (chosen === undefined) return base;\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    // A source may name its default before its catalog is published: wait for the sources before ruling it out.\n    const settled = await within((signal) => sources.ready(scope, signal));\n    if (names(files, sources, scope).has(chosen)) return { ...base, resolvedProfile: chosen };\n    if (settled.status === 'timeout') return warn({ code: 'timeout', requested: chosen });\n    if (settled.status === 'failed') return warn({ code: 'source-failed', requested: chosen });\n    return warn({ code: 'invalid-default', requested: chosen });\n  } finally {\n    held.deadline?.dispose();\n  }\n}\n\n/** The one-line notice for a session that started without the profile it was meant to have. Names only. */\nexport function profileWarningText(warning: InitialProfileWarning): string {\n  const { code, requested } = warning;\n  const subject = requested === undefined ? 'The workspace default profile' : `Profile \"${requested}\"`;\n  const outcome = 'so this session started without a profile.';\n  if (code === 'timeout') return `${subject} was not ready within ${SECONDS} seconds, ${outcome}`;\n  if (code === 'source-failed') return `${subject} could not be loaded because its source failed, ${outcome}`;\n  if (code === 'invalid-default') return `The default profile \"${requested}\" is not available, ${outcome}`;\n  return `${subject} is not available, ${outcome}`;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-initial-outcome': InitialProfileOutcome;\n  }\n}\n","import {\n  parseProfileBinding,\n  parseProfileVaultSecrets,\n  type ProfileSecretReference,\n  type ProfileVaultSecretReference,\n} from '@agimon-ai/po-config/profiles';\nimport type { Context } from '@deepseek-ai/cordis';\n\nimport { PROFILE_RUNTIME_SERVICE } from '../../constants/profileRuntime';\nimport type {\n  ProfileProviderFactory,\n  ProfileInputSecretRequest,\n  ProfileRuntime,\n  ProfileRuntimeOptions,\n  ProfileRuntimeSnapshot,\n  ProfileSecretRequest,\n  ProfileSecretResolver,\n} from './type';\n\nconst UNAVAILABLE = 'Profile integration provider is unavailable';\nconst INVALIDATED = 'Profile operation was invalidated';\n/** Vault namespace for secrets saved from the composer; po-vault's `VAULT_SECRETS_NAMESPACE` writes it. */\nconst VAULT_SECRETS_NAMESPACE = 'secrets';\nconst ALIAS_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/u;\n\n/** A single selected profile and provider, owned by one session, not a provider registry. */\nclass SessionProfileRuntime implements ProfileRuntime {\n  private controller = new AbortController();\n  private snapshot: ProfileRuntimeSnapshot;\n  private provider?: { name: string; factory: ProfileProviderFactory };\n  private connection?: ProfileSecretResolver;\n  private transition: Promise<void> = Promise.resolve();\n  private retirement: Promise<void> = Promise.resolve();\n  private readonly pending = new Set<Promise<void>>();\n  private initializing = false;\n  private disposed = false;\n  private disposal?: Promise<void>;\n\n  constructor(private readonly options: ProfileRuntimeOptions) {\n    this.snapshot = this.capture(options.profileName, 1);\n  }\n\n  private capture(profileName: string | undefined, generation: number): ProfileRuntimeSnapshot {\n    const binding = profileName === undefined ? undefined : this.options.readBinding(profileName);\n    const env = profileName === undefined ? undefined : this.options.readEnv?.(profileName);\n    const sourceSecrets = profileName === undefined ? undefined : this.options.readSecrets?.(profileName);\n    const secrets = sourceSecrets === undefined ? undefined : parseProfileVaultSecrets(sourceSecrets);\n    if (secrets && Object.keys(secrets).some((name) => binding?.secrets && Object.hasOwn(binding.secrets, name))) {\n      throw new Error('Profile secret aliases must be unique');\n    }\n    return Object.freeze({\n      ...(profileName === undefined ? {} : { profileName }),\n      ...(binding === undefined ? {} : { integration: parseProfileBinding(binding) }),\n      ...(env === undefined ? {} : { env: Object.freeze({ ...env }) }),\n      ...(secrets === undefined ? {} : { secrets }),\n      generation,\n      signal: this.controller.signal,\n    });\n  }\n\n  readSelection(): ProfileRuntimeSnapshot {\n    return this.snapshot;\n  }\n\n  invalidate(): void {\n    this.controller.abort();\n    const connection = this.connection;\n    this.connection = undefined;\n    if (connection) {\n      this.retirement = this.retirement.then(async () => {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n      });\n      void this.track(this.retirement);\n    }\n  }\n\n  private track(work: Promise<void>): Promise<void> {\n    this.pending.add(work);\n    // Keep rejection observable through ready/dispose while preventing an unhandled\n    // rejection when selection invalidates an initialization before its owner awaits it.\n    void work.then(\n      () => this.pending.delete(work),\n      () => this.pending.delete(work),\n    );\n    return work;\n  }\n\n  private initialize(): Promise<void> {\n    const snapshot = this.snapshot;\n    const provider = this.provider;\n    this.initializing = Boolean(snapshot.integration && provider);\n    const work = (async () => {\n      await this.retirement;\n      if (snapshot.signal.aborted) return;\n      if (!snapshot.integration || !provider) return;\n      if (snapshot.integration.provider !== provider.name) throw new Error(UNAVAILABLE);\n      let connection: ProfileSecretResolver;\n      try {\n        connection = await provider.factory(snapshot.integration, {\n          profileName: snapshot.profileName!,\n          generation: snapshot.generation,\n          signal: snapshot.signal,\n        });\n      } catch {\n        // A retired factory commonly rejects on abort. That cannot remove the\n        // provider attachment or poison the replacement generation.\n        if (snapshot.signal.aborted) return;\n        throw new Error('Profile provider initialization failed');\n      }\n      if (snapshot.signal.aborted || this.snapshot !== snapshot || this.disposed) {\n        try {\n          await connection.dispose();\n        } catch {\n          throw new Error('Profile provider disposal failed');\n        }\n        return;\n      }\n      this.connection = connection;\n    })();\n    this.transition = this.track(\n      work.finally(() => {\n        if (this.snapshot === snapshot) this.initializing = false;\n      }),\n    );\n    return this.transition;\n  }\n\n  async select(profileName?: string, options?: { readonly force?: boolean }): Promise<void> {\n    if (this.disposed) throw new Error(INVALIDATED);\n    if (\n      options?.force !== true &&\n      this.snapshot.profileName === profileName &&\n      !this.snapshot.signal.aborted &&\n      (!this.snapshot.integration || !this.provider || this.connection || this.initializing)\n    )\n      return;\n    this.invalidate();\n    this.controller = new AbortController();\n    // If reading/validation fails, leave the old generation aborted, never usable.\n    this.snapshot = this.capture(profileName, this.snapshot.generation + 1);\n    await this.initialize();\n  }\n\n  async ready(): Promise<void> {\n    const snapshot = this.snapshot;\n    await this.transition;\n    if (this.disposed || snapshot.signal.aborted || this.snapshot !== snapshot) throw new Error(INVALIDATED);\n    if (snapshot.integration && !this.connection) throw new Error(UNAVAILABLE);\n  }\n\n  async attachProvider(providerName: string, factory: ProfileProviderFactory): Promise<() => Promise<void>> {\n    if (this.disposed || this.snapshot.signal.aborted) throw new Error(INVALIDATED);\n    if (this.provider) throw new Error('Profile provider is already attached');\n    if (this.snapshot.integration && this.snapshot.integration.provider !== providerName) throw new Error(UNAVAILABLE);\n    const provider = { name: providerName, factory };\n    this.provider = provider;\n    try {\n      await this.initialize();\n      await this.ready();\n      if (this.disposed || this.provider !== provider) throw new Error(INVALIDATED);\n    } catch {\n      if (this.provider === provider) this.provider = undefined;\n      this.invalidate();\n      throw new Error('Profile provider initialization failed');\n    }\n    let detached = false;\n    return async () => {\n      if (detached || this.provider !== provider) return;\n      detached = true;\n      this.invalidate();\n      this.provider = undefined;\n      this.controller = new AbortController();\n      this.snapshot = Object.freeze({\n        ...this.snapshot,\n        generation: this.snapshot.generation + 1,\n        signal: this.controller.signal,\n      });\n      await this.retirement;\n    };\n  }\n\n  resolveSecret(name: string, request: ProfileSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (!reference.purposes.includes('browser')) throw new Error('Profile secret alias is unavailable');\n      if (!reference.allowedOrigins.includes(request.origin)) throw new Error('Profile secret origin is not allowed');\n    });\n  }\n\n  resolveInputSecret(name: string, request: ProfileInputSecretRequest): Promise<string> {\n    return this.resolveReference(name, request.signal, (reference) => {\n      if (\n        !reference.purposes.includes('input') ||\n        !reference.allowedTargets ||\n        !Object.hasOwn(reference.allowedTargets, request.surface) ||\n        !reference.allowedTargets[request.surface]?.includes(request.target)\n      ) {\n        throw new Error('Profile secret input target is not allowed');\n      }\n    });\n  }\n\n  resolveProxySecret(signal?: AbortSignal): Promise<string> {\n    const name = this.snapshot.integration?.browser?.proxySecret;\n    if (name === undefined) return Promise.reject(new Error('Profile proxy is not configured'));\n    return this.resolveReference(name, signal, (reference) => {\n      if (!reference.purposes.includes('proxy')) throw new Error('Profile secret alias is unavailable');\n    });\n  }\n\n  private async resolveReference(\n    name: string,\n    requestSignal: AbortSignal | undefined,\n    authorize: (reference: ProfileSecretReference | ProfileVaultSecretReference) => void,\n  ): Promise<string> {\n    // Do not await ready here: a provider factory invoking this callback would\n    // otherwise wait for itself. Browser creation may retain, but not invoke it.\n    if (this.initializing) throw new Error('Profile secrets are unavailable during provider initialization');\n    await this.ready();\n    const snapshot = this.snapshot;\n    const connection = this.connection;\n    const vaultReference =\n      snapshot.secrets && Object.hasOwn(snapshot.secrets, name) ? snapshot.secrets[name] : undefined;\n    const providerReference =\n      snapshot.integration?.secrets && Object.hasOwn(snapshot.integration.secrets, name)\n        ? snapshot.integration.secrets[name]\n        : undefined;\n    const signal = requestSignal ? AbortSignal.any([snapshot.signal, requestSignal]) : snapshot.signal;\n    // Profile aliases win; otherwise a secret saved from the composer, under its own allowlist.\n    const saved = vaultReference || providerReference ? undefined : await this.savedSecret(name, signal);\n    const reference = vaultReference ?? providerReference ?? saved?.reference;\n    if (!reference) throw new Error('Profile secret alias is unavailable');\n    authorize(reference);\n    if (signal.aborted) throw new Error(INVALIDATED);\n    let value: string;\n    try {\n      if (saved) {\n        value = saved.value as string;\n      } else if (vaultReference) {\n        if (!this.options.readVault) throw new Error('Vault unavailable');\n        const { namespace, key, field } = vaultReference.vault;\n        const entry = await this.options.readVault(namespace, key, signal);\n        const selected =\n          field === undefined\n            ? entry\n            : typeof entry === 'object' && entry !== null && !Array.isArray(entry) && Object.hasOwn(entry, field)\n              ? (entry as Record<string, unknown>)[field]\n              : undefined;\n        if (typeof selected !== 'string') throw new Error('Vault field unavailable');\n        value = selected;\n      } else {\n        if (!connection || !providerReference) throw new Error('Provider unavailable');\n        value = await connection.resolveSecret(providerReference, signal);\n      }\n    } catch {\n      // Provider failures must not leak API responses, credential fields or secrets.\n      throw new Error('Profile secret resolution failed');\n    }\n    if (signal.aborted || this.snapshot !== snapshot || this.connection !== connection) throw new Error(INVALIDATED);\n    if (typeof value !== 'string' || value.length === 0) throw new Error('Profile secret field is unavailable');\n    return value;\n  }\n\n  /** `secrets/<name>` as `{value, purposes, allowedOrigins?, allowedTargets?}`, checked like a profile alias. */\n  private async savedSecret(\n    name: string,\n    signal: AbortSignal,\n  ): Promise<{ reference: ProfileVaultSecretReference; value: unknown } | undefined> {\n    if (!this.options.readVault || !ALIAS_PATTERN.test(name)) return undefined;\n    try {\n      const entry = await this.options.readVault(VAULT_SECRETS_NAMESPACE, name, signal);\n      if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) return undefined;\n      const { value, ...delivery } = entry as Record<string, unknown>;\n      const vault = { namespace: VAULT_SECRETS_NAMESPACE, key: name, field: 'value' };\n      const reference = parseProfileVaultSecrets({ [name]: { ...delivery, vault } }, 'Saved secret')[name];\n      return reference && { reference, value };\n    } catch {\n      return undefined;\n    }\n  }\n\n  dispose(): Promise<void> {\n    if (this.disposal) return this.disposal;\n    this.disposed = true;\n    this.invalidate();\n    this.provider = undefined;\n    this.disposal = (async () => {\n      const results = await Promise.allSettled([...this.pending, this.retirement]);\n      if (results.some((result) => result.status === 'rejected')) throw new Error('Profile runtime disposal failed');\n    })();\n    return this.disposal;\n  }\n}\n\nexport function createProfileRuntime(options: ProfileRuntimeOptions): ProfileRuntime {\n  return new SessionProfileRuntime(options);\n}\n\n/** Mounted in the scoped root services array, before dependent integration tools. */\nexport function createProfileRuntimePlugin(runtime: ProfileRuntime): (context: Context) => void {\n  return (context) => {\n    context.provide(PROFILE_RUNTIME_SERVICE, runtime);\n  };\n}\n\nexport function requireProfileRuntime(context: Context): ProfileRuntime {\n  const service = context.get(PROFILE_RUNTIME_SERVICE);\n  if (!service) throw new Error('Profile runtime service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    'po/profile-runtime': ProfileRuntime;\n  }\n}\n","// @scaffold-generated\nimport type { ProfileIntegrationBinding } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SECRETS_SERVICE } from '../../constants/profileSecrets';\nimport type { ProfileProviderFactory, ProfileSecretResolver } from '../profileRuntime/type';\nimport type { ProfileEnvSecretRequest, ProfileSecrets, ProfileSecretsOptions } from './type';\n\n/** Every failure is generic so callers never learn which alias, field or provider response failed. */\nconst UNAVAILABLE = 'Profile secrets are unavailable';\n\nclass HostProfileSecrets implements ProfileSecrets {\n  private readonly providers = new Map<string, ProfileProviderFactory>();\n  private generation = 0;\n\n  constructor(private readonly options: ProfileSecretsOptions) {}\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    if (this.providers.has(provider)) throw new Error('Profile secrets provider is already registered');\n    this.providers.set(provider, factory);\n    return () => {\n      if (this.providers.get(provider) === factory) this.providers.delete(provider);\n    };\n  }\n\n  async resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    if (request.names.length === 0) return {};\n    if (new Set(request.names).size !== request.names.length) throw new Error(UNAVAILABLE);\n    let binding: ProfileIntegrationBinding | undefined;\n    try {\n      binding = await this.options.readBinding(request.cwd, request.profile, request.homeDirectory);\n    } catch {\n      throw new Error(UNAVAILABLE);\n    }\n    const factory = binding && this.providers.get(binding.provider);\n    if (!binding || !factory) throw new Error(UNAVAILABLE);\n    const references = request.names.map((name) => {\n      const reference = Object.hasOwn(binding.secrets, name) ? binding.secrets[name] : undefined;\n      if (!reference?.purposes.includes('env')) throw new Error(UNAVAILABLE);\n      return [name, reference] as const;\n    });\n\n    const controller = new AbortController();\n    const signal = request.signal ? AbortSignal.any([controller.signal, request.signal]) : controller.signal;\n    let connection: ProfileSecretResolver | undefined;\n    try {\n      connection = await factory(binding, { profileName: request.profile, generation: ++this.generation, signal });\n      const values: Record<string, string> = {};\n      for (const [name, reference] of references) {\n        const value = await connection.resolveSecret(reference, signal);\n        if (signal.aborted || typeof value !== 'string' || value.length === 0) throw new Error(UNAVAILABLE);\n        values[name] = value;\n      }\n      return values;\n    } catch {\n      throw new Error(UNAVAILABLE);\n    } finally {\n      controller.abort();\n      try {\n        await connection?.dispose();\n      } catch {\n        // Disposal failures are not secret-bearing, but the resolved values are still discarded.\n        // oxlint-disable-next-line no-unsafe-finally\n        throw new Error(UNAVAILABLE);\n      }\n    }\n  }\n}\n\nexport function createProfileSecrets(options: ProfileSecretsOptions): ProfileSecrets {\n  return new HostProfileSecrets(options);\n}\n\n/** Host-side env secret resolution for workflow run steps. Never registered as a model tool. */\nexport class ProfileSecretsService extends Service implements ProfileSecrets {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSecrets,\n  ) {\n    super(context, PROFILE_SECRETS_SERVICE);\n  }\n\n  registerProvider(provider: string, factory: ProfileProviderFactory): () => void {\n    return this.source.registerProvider(provider, factory);\n  }\n\n  resolveEnv(request: ProfileEnvSecretRequest): Promise<Record<string, string>> {\n    return this.source.resolveEnv(request);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSecretsPlugin(source: ProfileSecrets): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSecretsService(context, source);\n  };\n}\n\nexport function requireProfileSecrets(context: Context): ProfileSecrets {\n  const service = context.get(PROFILE_SECRETS_SERVICE);\n  if (!service) throw new Error('Profile secrets service is unavailable');\n  return service;\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-secrets': ProfileSecrets;\n  }\n}\n","// @scaffold-generated\nimport { type AgentProfile, inlineProfile } from '@agimon-ai/po-config/profiles';\nimport { type Context, Service } from '@deepseek-ai/cordis';\n\nimport { PROFILE_SOURCES_SERVICE } from '../../constants/profileSources';\nimport type { ContributedProfile, ProfileScope, ProfileSource, ProfileSources, SourcedProfile } from './type';\n\n/** Runs a hook that may throw before it returns a promise, so both kinds of failure are one rejection. */\nasync function settle(run: () => Promise<void> | void): Promise<void> {\n  await run();\n}\n\nclass HostProfileSources implements ProfileSources {\n  private readonly sources = new Map<string, ProfileSource>();\n\n  register(id: string, source: ProfileSource): () => void {\n    if (this.sources.has(id)) throw new Error('Profile source is already registered');\n    this.sources.set(id, source);\n    return () => {\n      if (this.sources.get(id) === source) this.sources.delete(id);\n    };\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.listSourced(scope).map(({ profile }) => profile);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    const byName = new Map<string, SourcedProfile>();\n    for (const [sourceId, source] of this.sources) {\n      let inputs;\n      try {\n        inputs = source.list(scope);\n      } catch {\n        continue;\n      }\n      for (const input of inputs) {\n        if (byName.has(input.name)) continue;\n        try {\n          const profile = inlineProfile(input);\n          if (profile.personaPrompt)\n            byName.set(profile.name, { sourceId, profile: { ...profile, personaPrompt: profile.personaPrompt } });\n        } catch {\n          // An invalid definition is skipped like an invalid directory profile.\n        }\n      }\n    }\n    return [...byName.values()].sort((left, right) => left.profile.name.localeCompare(right.profile.name));\n  }\n\n  async ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    const entries = [...this.sources].filter(([, source]) => source.ready !== undefined);\n    const results = await Promise.allSettled(entries.map(([, source]) => settle(() => source.ready?.(scope, signal))));\n    const failed = entries.filter((_, index) => results[index]?.status === 'rejected').map(([id]) => id);\n    // Source ids only: a rejection reason may carry anything the source put in it.\n    if (failed.length) throw new Error(`Profile source not ready: ${failed.join(', ')}`);\n  }\n\n  async defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    for (const source of this.sources.values()) {\n      if (source.defaultProfile === undefined) continue;\n      const chosen = await source.defaultProfile(scope, signal);\n      if (chosen !== undefined) return chosen;\n    }\n    return undefined;\n  }\n}\n\nexport function createProfileSources(): ProfileSources {\n  return new HostProfileSources();\n}\n\n/** File profiles win; a contributed profile only fills a name the file catalog does not hold. */\nexport function mergeProfiles(files: readonly AgentProfile[], sources: ProfileSources | undefined): AgentProfile[] {\n  const names = new Set(files.map(({ name }) => name));\n  const contributed = (sources?.list() ?? []).filter(({ name }) => !names.has(name));\n  return [...files, ...contributed].sort((left, right) => left.name.localeCompare(right.name));\n}\n\nexport function findProfile(\n  files: readonly AgentProfile[],\n  sources: ProfileSources | undefined,\n  name: string,\n): AgentProfile {\n  const profile =\n    files.find((candidate) => candidate.name === name) ?? sources?.list().find((candidate) => candidate.name === name);\n  if (!profile) throw new Error(`Unknown profile: ${name}`);\n  return profile;\n}\n\n/** Profiles plugins hold in memory, merged into the session catalog. Optional: absent means files only. */\nexport class ProfileSourcesService extends Service implements ProfileSources {\n  constructor(\n    context: Context,\n    private readonly source: ProfileSources,\n  ) {\n    super(context, PROFILE_SOURCES_SERVICE);\n  }\n\n  register(id: string, source: ProfileSource): () => void {\n    return this.source.register(id, source);\n  }\n\n  list(scope?: ProfileScope): ContributedProfile[] {\n    return this.source.list(scope);\n  }\n\n  listSourced(scope?: ProfileScope): SourcedProfile[] {\n    return this.source.listSourced(scope);\n  }\n\n  ready(scope: ProfileScope | undefined, signal: AbortSignal): Promise<void> {\n    return this.source.ready(scope, signal);\n  }\n\n  defaultProfile(scope: ProfileScope | undefined, signal: AbortSignal): Promise<string | undefined> {\n    return this.source.defaultProfile(scope, signal);\n  }\n}\n\n/** Include in the extension services array. The helper owns the child fiber. */\nexport function createProfileSourcesPlugin(source: ProfileSources): (context: Context) => void {\n  return (context: Context): void => {\n    new ProfileSourcesService(context, source);\n  };\n}\n\n/** With a scope, every `list` call through the returned view reads as that workspace. */\nexport function readProfileSources(context: Context, scope?: ProfileScope): ProfileSources | undefined {\n  const sources = context.get(PROFILE_SOURCES_SERVICE);\n  if (!sources || !scope) return sources;\n  return {\n    register: (id, source) => sources.register(id, source),\n    list: () => sources.list(scope),\n    listSourced: () => sources.listSourced(scope),\n    ready: (_ignored, signal) => sources.ready(scope, signal),\n    defaultProfile: (_ignored, signal) => sources.defaultProfile(scope, signal),\n  };\n}\n\ndeclare module '@deepseek-ai/cordis' {\n  interface Context {\n    // The root publishes the plain source through the server scope, so readers see the interface.\n    'po/profile-sources': ProfileSources;\n  }\n}\n","// @scaffold-generated\nimport type { SecretRedactionStream } from './type';\n\nconst REDACTED = '[redacted]';\n\n/** Raw, JSON-escaped and URL-encoded forms of every non-empty value. */\nfunction secretForms(secrets: Iterable<string>): string[] {\n  const forms = new Set<string>();\n  for (const secret of secrets) {\n    if (typeof secret !== 'string' || !secret) continue;\n    forms.add(secret);\n    forms.add(JSON.stringify(secret).slice(1, -1));\n    forms.add(encodeURIComponent(secret));\n  }\n  return [...forms];\n}\n\n/** Marks every occurrence of every form, so overlapping secrets cannot leave fragments behind. */\nfunction coverage(value: string, forms: readonly string[]): Uint8Array {\n  const covered = new Uint8Array(value.length);\n  for (const form of forms)\n    for (let index = value.indexOf(form); index !== -1; index = value.indexOf(form, index + 1))\n      covered.fill(1, index, index + form.length);\n  return covered;\n}\n\nfunction render(value: string, covered: Uint8Array, end: number): string {\n  let safe = '';\n  let start = 0;\n  for (let index = 0; index <= end; index++) {\n    if (index < end && covered[index] === covered[start]) continue;\n    if (index > start) safe += covered[start] ? REDACTED : value.slice(start, index);\n    start = index;\n  }\n  return safe;\n}\n\nfunction redactText(value: string, forms: readonly string[]): string {\n  return forms.length === 0 ? value : render(value, coverage(value, forms), value.length);\n}\n\nfunction redactValue(value: unknown, forms: readonly string[]): unknown {\n  if (typeof value === 'string') return redactText(value, forms);\n  if (Array.isArray(value)) return value.map((entry) => redactValue(entry, forms));\n  if (value !== null && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, entry]) => [redactText(key, forms), redactValue(entry, forms)]),\n    );\n  }\n  return value;\n}\n\n/** Deeply redacts strings and object keys. Non-plain objects become plain records. */\nexport function redactSecrets<T>(value: T, secrets: Iterable<string>): T {\n  return redactValue(value, secretForms(secrets)) as T;\n}\n\nexport function createSecretRedactionStream(secrets: Iterable<string>): SecretRedactionStream {\n  const forms = secretForms(secrets);\n  // A secret not yet complete must start within the last `hold` characters of the buffer.\n  const hold = Math.max(0, ...forms.map((form) => form.length - 1));\n  let buffer = '';\n  return {\n    write(chunk) {\n      buffer += chunk;\n      const covered = coverage(buffer, forms);\n      let end = Math.max(0, buffer.length - hold);\n      // Never split a completed match: hold back the whole run that crosses the boundary.\n      while (end > 0 && end < buffer.length && covered[end] && covered[end - 1]) end--;\n      const safe = render(buffer, covered, end);\n      buffer = buffer.slice(end);\n      return safe;\n    },\n    flush() {\n      const safe = redactText(buffer, forms);\n      buffer = '';\n      return safe;\n    },\n  };\n}\n","import type { AgentProfile } from '@agimon-ai/po-config/profiles';\n\nconst NONE = 'None';\n\n/** Footer status key the cockpit's profile axis reads. */\ninterface SelectItem {\n  value: string;\n  label: string;\n  description?: string;\n  icon?: string;\n}\n\nexport const PROFILE_STATUS_KEY = 'po-profile';\n\n/** Identity this package registers voice capabilities under. */\nexport const PROFILE_SOURCE = '@agimon-ai/po-profile';\n\n/** The command a queued voice switch invokes, and the reload handoff kind it parks. */\nexport const PROFILE_COMMAND = 'profile';\n\n/**\n * The published axis content: the active profile's name, empty while\n * profiles exist with none active, and undefined to withhold the status so\n * the cockpit keeps the axis off the bar entirely.\n */\nexport function profileStatus(current: string | undefined, hasProfiles: boolean): string | undefined {\n  if (current) return current;\n  return hasProfiles ? '' : undefined;\n}\n\n/** What a person reads for a profile: its declared display name, otherwise the profile name. */\nexport function profileLabel(profile: AgentProfile): string {\n  return profile.identity?.name || profile.name;\n}\n\n/**\n * Rows for the single-select profile picker. A client answers with the label, so a display name two\n * profiles share, or one that reads as None, carries the profile name to stay unique.\n */\nexport function profileItems(profiles: AgentProfile[]): SelectItem[] {\n  const labels = profiles.map(profileLabel);\n  return [\n    { value: '', label: NONE },\n    ...profiles.map((profile, index) => {\n      const label = labels[index] ?? profile.name;\n      const unique = label !== NONE && labels.indexOf(label) === labels.lastIndexOf(label);\n      return {\n        value: profile.name,\n        label: unique ? label : `${label} (${profile.name})`,\n        description: profileDescription(profile),\n        ...(profile.identity?.icon ? { icon: profile.identity.icon } : {}),\n      };\n    }),\n  ];\n}\n\n/** The role and contact a profile declares, otherwise its persona source and environment keys. */\nexport function profileDescription(profile: AgentProfile): string {\n  const presented = [profile.identity?.role, profile.identity?.contact].filter(Boolean).join(' · ');\n  if (presented) return presented;\n  const environmentKeys = Object.keys(profile.env).sort();\n  return environmentKeys.length > 0 ? `${profile.persona} (env: ${environmentKeys.join(', ')})` : profile.persona;\n}\n\n/** Shown when the picked profile is already active. */\nexport function profileSummary(profile: AgentProfile): string {\n  const environmentKeys = Object.keys(profile.env).sort();\n  return [\n    `Profile ${profile.name}`,\n    `Persona: ${profile.persona}`,\n    `Env: ${environmentKeys.join(', ') || '(none)'}`,\n    'Already loaded.',\n  ].join('\\n');\n}\n\nexport function profileTitle(current?: string): string {\n  return `Profile (current: ${current ?? NONE})`;\n}\n"],"mappings":";;;;;AACA,MAAa,kCAAkC;;;ACD/C,MAAa,0BAA0B;;;ACCvC,MAAa,0BAA0B;;;ACAvC,MAAa,0BAA0B;;;;ACIvC,MAAa,yBAAyB;;;;ACWtC,MAAa,gCAAgC;AAC7C,MAAM,UAAU,gCAAgC;;AAGhD,MAAa,oCAAA,GAAmCA,iCAAAA,sBAAAA,CAC9C,iCACA,EAAE,OAAO,UAAU,CACrB;;AAGA,SAAgB,0BAA0B,SAAqD;CAC7F,OAAO,QAAQ,IAAI,+BAA+B;AACpD;AAEA,MAAM,eAAe,WACnB,OAAO,kBAAkB,QAAQ,OAAO,yBAAS,IAAI,MAAM,gCAAgC;;;;;;;;AAS7F,SAAgB,eAAe,OAAoB,WAA6B;CAC9E,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,UAAU;CACd,IAAI;CACJ,IAAI;CACJ,MAAM,eAAe,IAAI,SAAgC,SAAS,WAAW;EAC3E,SAAS;EACT,YAAY;CACd,CAAC;CAED,aAAa,YAAY,KAAA,CAAS;CAElC,MAAM,qBAAqB;EACzB,UAAU,YAAY,KAAK,CAAC;EAC5B,WAAW,MAAM,MAAM,MAAM;CAC/B;CACA,IAAI,MAAM,SAAS,aAAa;MAC3B,MAAM,iBAAiB,SAAS,cAAc,EAAE,MAAM,KAAK,CAAC;CACjE,MAAM,QAAQ,iBAAiB;EAC7B,UAAU;EACV,OAAO,EAAE,QAAQ,UAAU,CAAC;EAC5B,WAAW,sBAAM,IAAI,MAAM,8BAA8B,CAAC;CAC5D,GAAG,SAAS;CAEZ,OAAO;EACL,QAAQ,WAAW;EACnB,OAAU,OAA4E;GACpF,IAAI,MAAM,SAAS,OAAO,QAAQ,OAAO,YAAY,KAAK,CAAC;GAC3D,IAAI,SAAS,OAAO,QAAQ,QAAQ,EAAE,QAAQ,UAAU,CAAC;GACzD,IAAI;GACJ,IAAI;IACF,OAAO,QAAQ,QAAQ,MAAM,WAAW,MAAM,CAAC;GACjD,QAAQ;IACN,OAAO,QAAQ,QAAQ,EAAE,QAAQ,SAAS,CAAC;GAC7C;GACA,MAAM,WAAW,KAAK,MACnB,WAA8B;IAAE,QAAQ;IAAQ;GAAM,WAC7B,EAAE,QAAQ,SAAS,EAC/C;GACA,OAAO,QAAQ,KAAK,CAAC,UAAU,YAAY,CAAC;EAC9C;EACA,UAAU;GACR,aAAa,KAAK;GAClB,MAAM,oBAAoB,SAAS,YAAY;GAC/C,IAAI,CAAC,WAAW,OAAO,SAAS,WAAW,sBAAM,IAAI,MAAM,6BAA6B,CAAC;EAC3F;CACF;AACF;;AAGA,eAAsB,eACpB,SACA,OACA,QACA,WACwC;CACxC,OAAO,eAAe;CACtB,IAAI,YAAY,KAAA,GAAW,OAAO;CAClC,MAAM,WAAW,eAAe,QAAQ,SAAS;CACjD,IAAI;EACF,QAAQ,MAAM,SAAS,QAAQ,eAAe,QAAQ,MAAM,OAAO,UAAU,CAAC,EAAA,CAAG;CACnF,UAAU;EACR,SAAS,QAAQ;CACnB;AACF;AACA,MAAM,SAAS,OAAgC,SAAqC,0BAClF,IAAI,IAAI,CAAC,GAAG,MAAM,KAAK,EAAE,WAAW,IAAI,GAAG,GAAI,SAAS,KAAK,KAAK,CAAC,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK,CAAC,CAAE,CAAC;;;;;;;;;AAUrG,eAAsB,sBACpB,OACA,SACA,SACgC;CAChC,QAAQ,OAAO,eAAe;CAC9B,MAAM,EAAE,QAAQ,UAAU;CAC1B,MAAM,cAAc,OAAO;CAC3B,MAAM,OAA8B;EAAE;EAAQ,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;CAAG;CACpG,IAAI,OAAO,SAAS,QAAQ,OAAO;CAGnC,MAAM,OAAgC,CAAC;CACvC,MAAM,UAAa,UAA+E;EAChG,KAAK,aAAa,eAAe,QAAQ,QAAQ,QAAQ,aAAA,GAA0C;EACnG,OAAO,KAAK,SAAS,OAAO,KAAK;CACnC;CACA,MAAM,QAAQ,aAA2D;EAAE,GAAG;EAAM;CAAQ;CAC5F,IAAI;EACF,IAAI,OAAO,SAAS,SAAS;GAC3B,MAAM,YAAY,OAAO;GACzB,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,YAAY,KAAA,GAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GACrE,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;GAEpE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,GAAG,OAAO;IAAE,GAAG;IAAM,iBAAiB;GAAU;GAC9F,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK;IAAE,MAAM;IAAW;GAAU,CAAC;GAC3E,OAAO,KAAK;IAAE,MAAM,OAAO,WAAW,WAAW,kBAAkB;IAAW;GAAU,CAAC;EAC3F;EACA,IAAI,gBAAgB,KAAA,KAAa,YAAY,KAAA,GAAW,OAAO;EAC/D,MAAM,SAAS,MAAM,QAAQ,WAAW,QAAQ,eAAe,OAAO,MAAM,CAAC;EAC7E,IAAI,OAAO,WAAW,WAAW,OAAO,KAAK,EAAE,MAAM,UAAU,CAAC;EAChE,IAAI,OAAO,WAAW,UAAU,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;EACrE,MAAM,SAAS,OAAO;EACtB,IAAI,WAAW,KAAA,GAAW,OAAO;EACjC,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EAExF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,MAAM,OAAO,MAAM,CAAC;EACrE,IAAI,MAAM,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,OAAO;GAAE,GAAG;GAAM,iBAAiB;EAAO;EACxF,IAAI,QAAQ,WAAW,WAAW,OAAO,KAAK;GAAE,MAAM;GAAW,WAAW;EAAO,CAAC;EACpF,IAAI,QAAQ,WAAW,UAAU,OAAO,KAAK;GAAE,MAAM;GAAiB,WAAW;EAAO,CAAC;EACzF,OAAO,KAAK;GAAE,MAAM;GAAmB,WAAW;EAAO,CAAC;CAC5D,UAAU;EACR,KAAK,UAAU,QAAQ;CACzB;AACF;;AAGA,SAAgB,mBAAmB,SAAwC;CACzE,MAAM,EAAE,MAAM,cAAc;CAC5B,MAAM,UAAU,cAAc,KAAA,IAAY,kCAAkC,YAAY,UAAU;CAClG,MAAM,UAAU;CAChB,IAAI,SAAS,WAAW,OAAO,GAAG,QAAQ,wBAAwB,QAAQ,YAAY;CACtF,IAAI,SAAS,iBAAiB,OAAO,GAAG,QAAQ,kDAAkD;CAClG,IAAI,SAAS,mBAAmB,OAAO,wBAAwB,UAAU,sBAAsB;CAC/F,OAAO,GAAG,QAAQ,qBAAqB;AACzC;;;ACzJA,MAAMC,gBAAc;AACpB,MAAM,cAAc;;AAEpB,MAAM,0BAA0B;AAChC,MAAM,gBAAgB;;AAGtB,IAAM,wBAAN,MAAsD;CAYvB;CAX7B,aAAqB,IAAI,gBAAgB;CACzC;CACA;CACA;CACA,aAAoC,QAAQ,QAAQ;CACpD,aAAoC,QAAQ,QAAQ;CACpD,0BAA2B,IAAI,IAAmB;CAClD,eAAuB;CACvB,WAAmB;CACnB;CAEA,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC3B,KAAK,WAAW,KAAK,QAAQ,QAAQ,aAAa,CAAC;CACrD;CAEA,QAAgB,aAAiC,YAA4C;EAC3F,MAAM,UAAU,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,YAAY,WAAW;EAC5F,MAAM,MAAM,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,UAAU,WAAW;EACtF,MAAM,gBAAgB,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,QAAQ,cAAc,WAAW;EACpG,MAAM,UAAU,kBAAkB,KAAA,IAAY,KAAA,KAAA,GAAYC,8BAAAA,yBAAAA,CAAyB,aAAa;EAChG,IAAI,WAAW,OAAO,KAAK,OAAO,CAAC,CAAC,MAAM,SAAS,SAAS,WAAW,OAAO,OAAO,QAAQ,SAAS,IAAI,CAAC,GACzG,MAAM,IAAI,MAAM,uCAAuC;EAEzD,OAAO,OAAO,OAAO;GACnB,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;GACnD,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,cAAA,GAAaC,8BAAAA,oBAAAA,CAAoB,OAAO,EAAE;GAC7E,GAAI,QAAQ,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK,OAAO,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE;GAC9D,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;GAC3C;GACA,QAAQ,KAAK,WAAW;EAC1B,CAAC;CACH;CAEA,gBAAwC;EACtC,OAAO,KAAK;CACd;CAEA,aAAmB;EACjB,KAAK,WAAW,MAAM;EACtB,MAAM,aAAa,KAAK;EACxB,KAAK,aAAa,KAAA;EAClB,IAAI,YAAY;GACd,KAAK,aAAa,KAAK,WAAW,KAAK,YAAY;IACjD,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;GACF,CAAC;GACD,KAAU,MAAM,KAAK,UAAU;EACjC;CACF;CAEA,MAAc,MAAoC;EAChD,KAAK,QAAQ,IAAI,IAAI;EAGrB,KAAU,WACF,KAAK,QAAQ,OAAO,IAAI,SACxB,KAAK,QAAQ,OAAO,IAAI,CAChC;EACA,OAAO;CACT;CAEA,aAAoC;EAClC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,KAAK,eAAe,QAAQ,SAAS,eAAe,QAAQ;EAC5D,MAAM,QAAQ,YAAY;GACxB,MAAM,KAAK;GACX,IAAI,SAAS,OAAO,SAAS;GAC7B,IAAI,CAAC,SAAS,eAAe,CAAC,UAAU;GACxC,IAAI,SAAS,YAAY,aAAa,SAAS,MAAM,MAAM,IAAI,MAAMF,aAAW;GAChF,IAAI;GACJ,IAAI;IACF,aAAa,MAAM,SAAS,QAAQ,SAAS,aAAa;KACxD,aAAa,SAAS;KACtB,YAAY,SAAS;KACrB,QAAQ,SAAS;IACnB,CAAC;GACH,QAAQ;IAGN,IAAI,SAAS,OAAO,SAAS;IAC7B,MAAM,IAAI,MAAM,wCAAwC;GAC1D;GACA,IAAI,SAAS,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,UAAU;IAC1E,IAAI;KACF,MAAM,WAAW,QAAQ;IAC3B,QAAQ;KACN,MAAM,IAAI,MAAM,kCAAkC;IACpD;IACA;GACF;GACA,KAAK,aAAa;EACpB,EAAA,CAAG;EACH,KAAK,aAAa,KAAK,MACrB,KAAK,cAAc;GACjB,IAAI,KAAK,aAAa,UAAU,KAAK,eAAe;EACtD,CAAC,CACH;EACA,OAAO,KAAK;CACd;CAEA,MAAM,OAAO,aAAsB,SAAuD;EACxF,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9C,IACE,SAAS,UAAU,QACnB,KAAK,SAAS,gBAAgB,eAC9B,CAAC,KAAK,SAAS,OAAO,YACrB,CAAC,KAAK,SAAS,eAAe,CAAC,KAAK,YAAY,KAAK,cAAc,KAAK,eAEzE;EACF,KAAK,WAAW;EAChB,KAAK,aAAa,IAAI,gBAAgB;EAEtC,KAAK,WAAW,KAAK,QAAQ,aAAa,KAAK,SAAS,aAAa,CAAC;EACtE,MAAM,KAAK,WAAW;CACxB;CAEA,MAAM,QAAuB;EAC3B,MAAM,WAAW,KAAK;EACtB,MAAM,KAAK;EACX,IAAI,KAAK,YAAY,SAAS,OAAO,WAAW,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EACvG,IAAI,SAAS,eAAe,CAAC,KAAK,YAAY,MAAM,IAAI,MAAMA,aAAW;CAC3E;CAEA,MAAM,eAAe,cAAsB,SAA+D;EACxG,IAAI,KAAK,YAAY,KAAK,SAAS,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC9E,IAAI,KAAK,UAAU,MAAM,IAAI,MAAM,sCAAsC;EACzE,IAAI,KAAK,SAAS,eAAe,KAAK,SAAS,YAAY,aAAa,cAAc,MAAM,IAAI,MAAMA,aAAW;EACjH,MAAM,WAAW;GAAE,MAAM;GAAc;EAAQ;EAC/C,KAAK,WAAW;EAChB,IAAI;GACF,MAAM,KAAK,WAAW;GACtB,MAAM,KAAK,MAAM;GACjB,IAAI,KAAK,YAAY,KAAK,aAAa,UAAU,MAAM,IAAI,MAAM,WAAW;EAC9E,QAAQ;GACN,IAAI,KAAK,aAAa,UAAU,KAAK,WAAW,KAAA;GAChD,KAAK,WAAW;GAChB,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,IAAI,WAAW;EACf,OAAO,YAAY;GACjB,IAAI,YAAY,KAAK,aAAa,UAAU;GAC5C,WAAW;GACX,KAAK,WAAW;GAChB,KAAK,WAAW,KAAA;GAChB,KAAK,aAAa,IAAI,gBAAgB;GACtC,KAAK,WAAW,OAAO,OAAO;IAC5B,GAAG,KAAK;IACR,YAAY,KAAK,SAAS,aAAa;IACvC,QAAQ,KAAK,WAAW;GAC1B,CAAC;GACD,MAAM,KAAK;EACb;CACF;CAEA,cAAc,MAAc,SAAgD;EAC1E,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IAAI,CAAC,UAAU,SAAS,SAAS,SAAS,GAAG,MAAM,IAAI,MAAM,qCAAqC;GAClG,IAAI,CAAC,UAAU,eAAe,SAAS,QAAQ,MAAM,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChH,CAAC;CACH;CAEA,mBAAmB,MAAc,SAAqD;EACpF,OAAO,KAAK,iBAAiB,MAAM,QAAQ,SAAS,cAAc;GAChE,IACE,CAAC,UAAU,SAAS,SAAS,OAAO,KACpC,CAAC,UAAU,kBACX,CAAC,OAAO,OAAO,UAAU,gBAAgB,QAAQ,OAAO,KACxD,CAAC,UAAU,eAAe,QAAQ,QAAQ,EAAE,SAAS,QAAQ,MAAM,GAEnE,MAAM,IAAI,MAAM,4CAA4C;EAEhE,CAAC;CACH;CAEA,mBAAmB,QAAuC;EACxD,MAAM,OAAO,KAAK,SAAS,aAAa,SAAS;EACjD,IAAI,SAAS,KAAA,GAAW,OAAO,QAAQ,uBAAO,IAAI,MAAM,iCAAiC,CAAC;EAC1F,OAAO,KAAK,iBAAiB,MAAM,SAAS,cAAc;GACxD,IAAI,CAAC,UAAU,SAAS,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAClG,CAAC;CACH;CAEA,MAAc,iBACZ,MACA,eACA,WACiB;EAGjB,IAAI,KAAK,cAAc,MAAM,IAAI,MAAM,gEAAgE;EACvG,MAAM,KAAK,MAAM;EACjB,MAAM,WAAW,KAAK;EACtB,MAAM,aAAa,KAAK;EACxB,MAAM,iBACJ,SAAS,WAAW,OAAO,OAAO,SAAS,SAAS,IAAI,IAAI,SAAS,QAAQ,QAAQ,KAAA;EACvF,MAAM,oBACJ,SAAS,aAAa,WAAW,OAAO,OAAO,SAAS,YAAY,SAAS,IAAI,IAC7E,SAAS,YAAY,QAAQ,QAC7B,KAAA;EACN,MAAM,SAAS,gBAAgB,YAAY,IAAI,CAAC,SAAS,QAAQ,aAAa,CAAC,IAAI,SAAS;EAE5F,MAAM,QAAQ,kBAAkB,oBAAoB,KAAA,IAAY,MAAM,KAAK,YAAY,MAAM,MAAM;EACnG,MAAM,YAAY,kBAAkB,qBAAqB,OAAO;EAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,qCAAqC;EACrE,UAAU,SAAS;EACnB,IAAI,OAAO,SAAS,MAAM,IAAI,MAAM,WAAW;EAC/C,IAAI;EACJ,IAAI;GACF,IAAI,OACF,QAAQ,MAAM;QACT,IAAI,gBAAgB;IACzB,IAAI,CAAC,KAAK,QAAQ,WAAW,MAAM,IAAI,MAAM,mBAAmB;IAChE,MAAM,EAAE,WAAW,KAAK,UAAU,eAAe;IACjD,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,WAAW,KAAK,MAAM;IACjE,MAAM,WACJ,UAAU,KAAA,IACN,QACA,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,KAAK,OAAO,OAAO,OAAO,KAAK,IAC/F,MAAkC,SACnC,KAAA;IACR,IAAI,OAAO,aAAa,UAAU,MAAM,IAAI,MAAM,yBAAyB;IAC3E,QAAQ;GACV,OAAO;IACL,IAAI,CAAC,cAAc,CAAC,mBAAmB,MAAM,IAAI,MAAM,sBAAsB;IAC7E,QAAQ,MAAM,WAAW,cAAc,mBAAmB,MAAM;GAClE;EACF,QAAQ;GAEN,MAAM,IAAI,MAAM,kCAAkC;EACpD;EACA,IAAI,OAAO,WAAW,KAAK,aAAa,YAAY,KAAK,eAAe,YAAY,MAAM,IAAI,MAAM,WAAW;EAC/G,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,qCAAqC;EAC1G,OAAO;CACT;;CAGA,MAAc,YACZ,MACA,QACiF;EACjF,IAAI,CAAC,KAAK,QAAQ,aAAa,CAAC,cAAc,KAAK,IAAI,GAAG,OAAO,KAAA;EACjE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,QAAQ,UAAU,yBAAyB,MAAM,MAAM;GAChF,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;GAChF,MAAM,EAAE,OAAO,GAAG,aAAa;GAC/B,MAAM,QAAQ;IAAE,WAAW;IAAyB,KAAK;IAAM,OAAO;GAAQ;GAC9E,MAAM,aAAA,GAAYC,8BAAAA,yBAAAA,CAAyB,GAAG,OAAO;IAAE,GAAG;IAAU;GAAM,EAAE,GAAG,cAAc,CAAC,CAAC;GAC/F,OAAO,aAAa;IAAE;IAAW;GAAM;EACzC,QAAQ;GACN;EACF;CACF;CAEA,UAAyB;EACvB,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,KAAK,WAAW;EAChB,KAAK,WAAW;EAChB,KAAK,WAAW,KAAA;EAChB,KAAK,YAAY,YAAY;GAE3B,KAAI,MADkB,QAAQ,WAAW,CAAC,GAAG,KAAK,SAAS,KAAK,UAAU,CAAC,EAAA,CAC/D,MAAM,WAAW,OAAO,WAAW,UAAU,GAAG,MAAM,IAAI,MAAM,iCAAiC;EAC/G,EAAA,CAAG;EACH,OAAO,KAAK;CACd;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,sBAAsB,OAAO;AAC1C;;AAGA,SAAgB,2BAA2B,SAAqD;CAC9F,QAAQ,YAAY;EAClB,QAAQ,QAAQ,yBAAyB,OAAO;CAClD;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;AC/SA,MAAM,cAAc;AAEpB,IAAM,qBAAN,MAAmD;CAIpB;CAH7B,4BAA6B,IAAI,IAAoC;CACrE,aAAqB;CAErB,YAAY,SAAiD;EAAhC,KAAA,UAAA;CAAiC;CAE9D,iBAAiB,UAAkB,SAA6C;EAC9E,IAAI,KAAK,UAAU,IAAI,QAAQ,GAAG,MAAM,IAAI,MAAM,gDAAgD;EAClG,KAAK,UAAU,IAAI,UAAU,OAAO;EACpC,aAAa;GACX,IAAI,KAAK,UAAU,IAAI,QAAQ,MAAM,SAAS,KAAK,UAAU,OAAO,QAAQ;EAC9E;CACF;CAEA,MAAM,WAAW,SAAmE;EAClF,IAAI,QAAQ,MAAM,WAAW,GAAG,OAAO,CAAC;EACxC,IAAI,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,SAAS,QAAQ,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW;EACrF,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,KAAK,QAAQ,YAAY,QAAQ,KAAK,QAAQ,SAAS,QAAQ,aAAa;EAC9F,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B;EACA,MAAM,UAAU,WAAW,KAAK,UAAU,IAAI,QAAQ,QAAQ;EAC9D,IAAI,CAAC,WAAW,CAAC,SAAS,MAAM,IAAI,MAAM,WAAW;EACrD,MAAM,aAAa,QAAQ,MAAM,KAAK,SAAS;GAC7C,MAAM,YAAY,OAAO,OAAO,QAAQ,SAAS,IAAI,IAAI,QAAQ,QAAQ,QAAQ,KAAA;GACjF,IAAI,CAAC,WAAW,SAAS,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,WAAW;GACrE,OAAO,CAAC,MAAM,SAAS;EACzB,CAAC;EAED,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,SAAS,QAAQ,SAAS,YAAY,IAAI,CAAC,WAAW,QAAQ,QAAQ,MAAM,CAAC,IAAI,WAAW;EAClG,IAAI;EACJ,IAAI;GACF,aAAa,MAAM,QAAQ,SAAS;IAAE,aAAa,QAAQ;IAAS,YAAY,EAAE,KAAK;IAAY;GAAO,CAAC;GAC3G,MAAM,SAAiC,CAAC;GACxC,KAAK,MAAM,CAAC,MAAM,cAAc,YAAY;IAC1C,MAAM,QAAQ,MAAM,WAAW,cAAc,WAAW,MAAM;IAC9D,IAAI,OAAO,WAAW,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,WAAW;IAClG,OAAO,QAAQ;GACjB;GACA,OAAO;EACT,QAAQ;GACN,MAAM,IAAI,MAAM,WAAW;EAC7B,UAAU;GACR,WAAW,MAAM;GACjB,IAAI;IACF,MAAM,YAAY,QAAQ;GAC5B,QAAQ;IAGN,MAAM,IAAI,MAAM,WAAW;GAC7B;EACF;CACF;AACF;AAEA,SAAgB,qBAAqB,SAAgD;CACnF,OAAO,IAAI,mBAAmB,OAAO;AACvC;;AAGA,IAAa,wBAAb,cAA2CE,oBAAAA,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,iBAAiB,UAAkB,SAA6C;EAC9E,OAAO,KAAK,OAAO,iBAAiB,UAAU,OAAO;CACvD;CAEA,WAAW,SAAmE;EAC5E,OAAO,KAAK,OAAO,WAAW,OAAO;CACvC;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;AAEA,SAAgB,sBAAsB,SAAkC;CACtE,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,wCAAwC;CACtE,OAAO;AACT;;;;AC9FA,eAAe,OAAO,KAAgD;CACpE,MAAM,IAAI;AACZ;AAEA,IAAM,qBAAN,MAAmD;CACjD,0BAA2B,IAAI,IAA2B;CAE1D,SAAS,IAAY,QAAmC;EACtD,IAAI,KAAK,QAAQ,IAAI,EAAE,GAAG,MAAM,IAAI,MAAM,sCAAsC;EAChF,KAAK,QAAQ,IAAI,IAAI,MAAM;EAC3B,aAAa;GACX,IAAI,KAAK,QAAQ,IAAI,EAAE,MAAM,QAAQ,KAAK,QAAQ,OAAO,EAAE;EAC7D;CACF;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,KAAK,EAAE,cAAc,OAAO;CAC7D;CAEA,YAAY,OAAwC;EAClD,MAAM,yBAAS,IAAI,IAA4B;EAC/C,KAAK,MAAM,CAAC,UAAU,WAAW,KAAK,SAAS;GAC7C,IAAI;GACJ,IAAI;IACF,SAAS,OAAO,KAAK,KAAK;GAC5B,QAAQ;IACN;GACF;GACA,KAAK,MAAM,SAAS,QAAQ;IAC1B,IAAI,OAAO,IAAI,MAAM,IAAI,GAAG;IAC5B,IAAI;KACF,MAAM,WAAA,GAAUC,8BAAAA,cAAAA,CAAc,KAAK;KACnC,IAAI,QAAQ,eACV,OAAO,IAAI,QAAQ,MAAM;MAAE;MAAU,SAAS;OAAE,GAAG;OAAS,eAAe,QAAQ;MAAc;KAAE,CAAC;IACxG,QAAQ,CAER;GACF;EACF;EACA,OAAO,CAAC,GAAG,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,QAAQ,KAAK,cAAc,MAAM,QAAQ,IAAI,CAAC;CACvG;CAEA,MAAM,MAAM,OAAiC,QAAoC;EAC/E,MAAM,UAAU,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,QAAQ,GAAG,YAAY,OAAO,UAAU,KAAA,CAAS;EACnF,MAAM,UAAU,MAAM,QAAQ,WAAW,QAAQ,KAAK,GAAG,YAAY,aAAa,OAAO,QAAQ,OAAO,MAAM,CAAC,CAAC,CAAC;EACjH,MAAM,SAAS,QAAQ,QAAQ,GAAG,UAAU,QAAQ,MAAM,EAAE,WAAW,UAAU,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;EAEnG,IAAI,OAAO,QAAQ,MAAM,IAAI,MAAM,6BAA6B,OAAO,KAAK,IAAI,GAAG;CACrF;CAEA,MAAM,eAAe,OAAiC,QAAkD;EACtG,KAAK,MAAM,UAAU,KAAK,QAAQ,OAAO,GAAG;GAC1C,IAAI,OAAO,mBAAmB,KAAA,GAAW;GACzC,MAAM,SAAS,MAAM,OAAO,eAAe,OAAO,MAAM;GACxD,IAAI,WAAW,KAAA,GAAW,OAAO;EACnC;CAEF;AACF;AAEA,SAAgB,uBAAuC;CACrD,OAAO,IAAI,mBAAmB;AAChC;;AAGA,SAAgB,cAAc,OAAgC,SAAqD;CACjH,MAAM,QAAQ,IAAI,IAAI,MAAM,KAAK,EAAE,WAAW,IAAI,CAAC;CACnD,MAAM,eAAe,SAAS,KAAK,KAAK,CAAC,EAAA,CAAG,QAAQ,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC;CACjF,OAAO,CAAC,GAAG,OAAO,GAAG,WAAW,CAAC,CAAC,MAAM,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AAC7F;AAEA,SAAgB,YACd,OACA,SACA,MACc;CACd,MAAM,UACJ,MAAM,MAAM,cAAc,UAAU,SAAS,IAAI,KAAK,SAAS,KAAK,CAAC,CAAC,MAAM,cAAc,UAAU,SAAS,IAAI;CACnH,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,oBAAoB,MAAM;CACxD,OAAO;AACT;;AAGA,IAAa,wBAAb,cAA2CC,oBAAAA,QAAkC;CAGxD;CAFnB,YACE,SACA,QACA;EACA,MAAM,SAAS,uBAAuB;EAFrB,KAAA,SAAA;CAGnB;CAEA,SAAS,IAAY,QAAmC;EACtD,OAAO,KAAK,OAAO,SAAS,IAAI,MAAM;CACxC;CAEA,KAAK,OAA4C;EAC/C,OAAO,KAAK,OAAO,KAAK,KAAK;CAC/B;CAEA,YAAY,OAAwC;EAClD,OAAO,KAAK,OAAO,YAAY,KAAK;CACtC;CAEA,MAAM,OAAiC,QAAoC;EACzE,OAAO,KAAK,OAAO,MAAM,OAAO,MAAM;CACxC;CAEA,eAAe,OAAiC,QAAkD;EAChG,OAAO,KAAK,OAAO,eAAe,OAAO,MAAM;CACjD;AACF;;AAGA,SAAgB,2BAA2B,QAAoD;CAC7F,QAAQ,YAA2B;EACjC,IAAI,sBAAsB,SAAS,MAAM;CAC3C;AACF;;AAGA,SAAgB,mBAAmB,SAAkB,OAAkD;CACrG,MAAM,UAAU,QAAQ,IAAI,uBAAuB;CACnD,IAAI,CAAC,WAAW,CAAC,OAAO,OAAO;CAC/B,OAAO;EACL,WAAW,IAAI,WAAW,QAAQ,SAAS,IAAI,MAAM;EACrD,YAAY,QAAQ,KAAK,KAAK;EAC9B,mBAAmB,QAAQ,YAAY,KAAK;EAC5C,QAAQ,UAAU,WAAW,QAAQ,MAAM,OAAO,MAAM;EACxD,iBAAiB,UAAU,WAAW,QAAQ,eAAe,OAAO,MAAM;CAC5E;AACF;;;ACvIA,MAAM,WAAW;;AAGjB,SAAS,YAAY,SAAqC;CACxD,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,OAAO,WAAW,YAAY,CAAC,QAAQ;EAC3C,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,KAAK,UAAU,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;EAC7C,MAAM,IAAI,mBAAmB,MAAM,CAAC;CACtC;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,SAAS,SAAS,OAAe,OAAsC;CACrE,MAAM,UAAU,IAAI,WAAW,MAAM,MAAM;CAC3C,KAAK,MAAM,QAAQ,OACjB,KAAK,IAAI,QAAQ,MAAM,QAAQ,IAAI,GAAG,UAAU,IAAI,QAAQ,MAAM,QAAQ,MAAM,QAAQ,CAAC,GACvF,QAAQ,KAAK,GAAG,OAAO,QAAQ,KAAK,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,OAAO,OAAe,SAAqB,KAAqB;CACvE,IAAI,OAAO;CACX,IAAI,QAAQ;CACZ,KAAK,IAAI,QAAQ,GAAG,SAAS,KAAK,SAAS;EACzC,IAAI,QAAQ,OAAO,QAAQ,WAAW,QAAQ,QAAQ;EACtD,IAAI,QAAQ,OAAO,QAAQ,QAAQ,SAAS,WAAW,MAAM,MAAM,OAAO,KAAK;EAC/E,QAAQ;CACV;CACA,OAAO;AACT;AAEA,SAAS,WAAW,OAAe,OAAkC;CACnE,OAAO,MAAM,WAAW,IAAI,QAAQ,OAAO,OAAO,SAAS,OAAO,KAAK,GAAG,MAAM,MAAM;AACxF;AAEA,SAAS,YAAY,OAAgB,OAAmC;CACtE,IAAI,OAAO,UAAU,UAAU,OAAO,WAAW,OAAO,KAAK;CAC7D,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,UAAU,YAAY,OAAO,KAAK,CAAC;CAC/E,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,WAAW,KAAK,KAAK,GAAG,YAAY,OAAO,KAAK,CAAC,CAAC,CACjG;CAEF,OAAO;AACT;;AAGA,SAAgB,cAAiB,OAAU,SAA8B;CACvE,OAAO,YAAY,OAAO,YAAY,OAAO,CAAC;AAChD;AAEA,SAAgB,4BAA4B,SAAkD;CAC5F,MAAM,QAAQ,YAAY,OAAO;CAEjC,MAAM,OAAO,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,SAAS,KAAK,SAAS,CAAC,CAAC;CAChE,IAAI,SAAS;CACb,OAAO;EACL,MAAM,OAAO;GACX,UAAU;GACV,MAAM,UAAU,SAAS,QAAQ,KAAK;GACtC,IAAI,MAAM,KAAK,IAAI,GAAG,OAAO,SAAS,IAAI;GAE1C,OAAO,MAAM,KAAK,MAAM,OAAO,UAAU,QAAQ,QAAQ,QAAQ,MAAM,IAAI;GAC3E,MAAM,OAAO,OAAO,QAAQ,SAAS,GAAG;GACxC,SAAS,OAAO,MAAM,GAAG;GACzB,OAAO;EACT;EACA,QAAQ;GACN,MAAM,OAAO,WAAW,QAAQ,KAAK;GACrC,SAAS;GACT,OAAO;EACT;CACF;AACF;;;AC7EA,MAAM,OAAO;AAUb,MAAa,qBAAqB;;AAMlC,MAAa,kBAAkB;;;;;;AAO/B,SAAgB,cAAc,SAA6B,aAA0C;CACnG,IAAI,SAAS,OAAO;CACpB,OAAO,cAAc,KAAK,KAAA;AAC5B;;AAGA,SAAgB,aAAa,SAA+B;CAC1D,OAAO,QAAQ,UAAU,QAAQ,QAAQ;AAC3C;;;;;AAMA,SAAgB,aAAa,UAAwC;CACnE,MAAM,SAAS,SAAS,IAAI,YAAY;CACxC,OAAO,CACL;EAAE,OAAO;EAAI,OAAO;CAAK,GACzB,GAAG,SAAS,KAAK,SAAS,UAAU;EAClC,MAAM,QAAQ,OAAO,UAAU,QAAQ;EACvC,MAAM,SAAS,UAAU,QAAQ,OAAO,QAAQ,KAAK,MAAM,OAAO,YAAY,KAAK;EACnF,OAAO;GACL,OAAO,QAAQ;GACf,OAAO,SAAS,QAAQ,GAAG,MAAM,IAAI,QAAQ,KAAK;GAClD,aAAa,mBAAmB,OAAO;GACvC,GAAI,QAAQ,UAAU,OAAO,EAAE,MAAM,QAAQ,SAAS,KAAK,IAAI,CAAC;EAClE;CACF,CAAC,CACH;AACF;;AAGA,SAAgB,mBAAmB,SAA+B;CAChE,MAAM,YAAY,CAAC,QAAQ,UAAU,MAAM,QAAQ,UAAU,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK;CAChG,IAAI,WAAW,OAAO;CACtB,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO,gBAAgB,SAAS,IAAI,GAAG,QAAQ,QAAQ,SAAS,gBAAgB,KAAK,IAAI,EAAE,KAAK,QAAQ;AAC1G;;AAGA,SAAgB,eAAe,SAA+B;CAC5D,MAAM,kBAAkB,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC,KAAK;CACtD,OAAO;EACL,WAAW,QAAQ;EACnB,YAAY,QAAQ;EACpB,QAAQ,gBAAgB,KAAK,IAAI,KAAK;EACtC;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAgB,aAAa,SAA0B;CACrD,OAAO,qBAAqB,WAAW,KAAK;AAC9C"}