@claudexor/harness-agy 3.6.0 → 3.8.1

package/README.md

@@ -3,11 +3,25 @@
 Adapter for Google's Antigravity CLI (`agy`): translates
 `agy -p --output-format stream-json` into typed `HarnessEvent`s.
 
-Accounts are NAMED credential profiles only (there is no engine-default agy
-credential): each profile is a Claudexor-owned HOME whose vendor config root
-(`$HOME/.gemini/...`) holds a file-based OAuth token. See
-`src/profile.ts` for the mechanism and its constraints (never create a
-keychain inside a profile HOME).
+Accounts use NAMED credential-profile bindings only (there is no engine-default
+agy credential). Every binding has a Claudexor-owned HOME that scopes vendor
+state under `$HOME/.gemini/...`; credential custody is platform-defined.
+On Darwin, Claudexor lazily prepares the profile's own
+`Library/Keychains/login.keychain-db` before an agy child starts. When setup
+succeeds this prevents the missing-keychain prompt; an unsafe profile path
+refuses that child before it can trigger SecurityAgent, while an operational
+setup miss leaves the vendor's own file fallback available. The implementation
+bootstraps the DB under a neutral filename and adopts the canonical name,
+because Apple's `security` tool treats a path containing `login.keychain` as a
+user search-list entry. This keeps host default/list preferences untouched.
+The vendor still owns the item; no host Keychain is bridged and no credential
+bytes are copied. Linux keeps the config-file/HOME route.
+Windows uses the current OS user's Credential Manager identity, permits one
+enabled binding, and treats HOME as state scoping rather than an independent
+Google identity.
+Readiness always comes from the bounded vendor `/model` probe, never from the
+presence or absence of `antigravity-oauth-token`. See `src/profile.ts` for the
+route and verification contract.
 
 Fixtures under `fixtures/` pin the recorded 1.1.13 stream shapes; see
 `fixtures/manifest.yaml` for provenance and stream-semantics expectations.

package/dist/index.d.ts

@@ -1,5 +1,8 @@
+import type { HarnessCapabilityProfile } from "@claudexor/schema";
 import type { HarnessAdapter } from "@claudexor/core";
-export { AGY_BIN, agyProfileRunEnv, agyTokenFilePresent, canonicalAgyProfileHome, } from "./profile.js";
+export { AGY_BIN, agyProfileRunEnv, canonicalAgyProfileHome } from "./profile.js";
+export { isAgyProfileKeychainUnsafe, prepareAgyProfileKeychain } from "./keychain.js";
+export { classifyAgyPrintResult, runAgyPrintCommand, type AgyPrintClassification, } from "./print-command.js";
 /**
  * The vendor's two quota GROUPS map onto disjoint halves of the same
  * inventory: "Gemini Models" and "Claude and GPT models" (PLAN §1.2 F8). The
@@ -8,5 +11,24 @@ export { AGY_BIN, agyProfileRunEnv, agyTokenFilePresent, canonicalAgyProfileHome
  */
 export declare const AGY_GEMINI_MODELS: ("claude-opus-4-6-thinking" | "claude-sonnet-4-6" | "gemini-3.1-pro-high" | "gemini-3.1-pro-low" | "gemini-3.5-flash-high" | "gemini-3.5-flash-low" | "gemini-3.5-flash-medium" | "gemini-3.6-flash-high" | "gemini-3.6-flash-low" | "gemini-3.6-flash-medium" | "gemini-3.7-flash-high" | "gemini-3.7-flash-low" | "gemini-3.7-flash-medium" | "gpt-oss-120b-medium")[];
 export declare const AGY_THIRD_PARTY_MODELS: ("claude-opus-4-6-thinking" | "claude-sonnet-4-6" | "gemini-3.1-pro-high" | "gemini-3.1-pro-low" | "gemini-3.5-flash-high" | "gemini-3.5-flash-low" | "gemini-3.5-flash-medium" | "gemini-3.6-flash-high" | "gemini-3.6-flash-low" | "gemini-3.6-flash-medium" | "gemini-3.7-flash-high" | "gemini-3.7-flash-low" | "gemini-3.7-flash-medium" | "gpt-oss-120b-medium")[];
-export declare function createAgyAdapter(): HarnessAdapter;
+/** One manifest-owned declaration of the managed login's stdin contract. */
+export declare const AGY_MANAGED_LOGIN: {
+    readonly stdin: "terminal";
+};
+/**
+ * Static auth/profile policy. Windows Credential Manager is scoped to the OS
+ * user, not the profile HOME, so only one enabled binding is honest there.
+ * Darwin keeps both the vendor file fallback and its private profile-local
+ * keychain; Linux retains the legacy profile-scoped file route.
+ */
+export declare const AGY_CAPABILITY_PROFILE: HarnessCapabilityProfile;
+/** Platform disclosure derived from the same transport and effective-policy
+ * facts used by admission. Darwin is the one live-proven profile-isolation
+ * lane; other lanes stay explicit rather than maintaining parallel truth. */
+export declare function agyPlatformIsolationDetail(platform?: NodeJS.Platform): string | null;
+export interface AgyAdapterOptions {
+    /** Test seam; production prepares the declared private Darwin keychain. */
+    prepareProfileKeychain?: (home: string, platform?: NodeJS.Platform) => void;
+}
+export declare function createAgyAdapter(options?: AgyAdapterOptions): HarnessAdapter;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAclE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AA2DtB;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,0WAA0D,CAAC;AACzF,eAAO,MAAM,sBAAsB,0WAA2D,CAAC;AAe/F,wBAAgB,gBAAgB,IAAI,cAAc,CA4LjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,wBAAwB,EAIzB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAsBlE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AA0D5B;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,0WAA0D,CAAC;AACzF,eAAO,MAAM,sBAAsB,0WAA2D,CAAC;AAE/F,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB;aAAK,KAAK,EAAE,UAAU;CAAW,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,wBA+CjC,CAAC;AAEL;;6EAE6E;AAC7E,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAgBf;AAeD,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;CAC7E;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,cAAc,CAiLhF"}

package/dist/index.js

@@ -1,13 +1,16 @@
-import { ConformanceReport as ConformanceReportSchema, HarnessManifest as HarnessManifestSchema, } from "@claudexor/schema";
-import { HarnessUnavailableError, promptWithInstructions, runCapture, runCliHarness, } from "@claudexor/core";
+import { ConformanceReport as ConformanceReportSchema, credentialProfilePolicyForPlatform, credentialTransportsForPlatform, HarnessCapabilityProfile as HarnessCapabilityProfileSchema, HarnessManifest as HarnessManifestSchema, } from "@claudexor/schema";
+import { HarnessUnavailableError, harnessPlatform, needsPrivatePerProfileKeychain, promptWithInstructions, runCapture, runCliHarness, } from "@claudexor/core";
 import { CLAUDEXOR_VERSION, nowIso, redactSecrets } from "@claudexor/util";
 import { parseAgyEvent } from "./parse.js";
-import { AGY_BIN, probeAgyCredentialProfile, resolveAgyProfileRoute } from "./profile.js";
+import { isAgyProfileKeychainUnsafe, prepareAgyProfileKeychain } from "./keychain.js";
+import { AGY_BIN, defaultAgyModelProbe, probeAgyCredentialProfile, resolveAgyProfileRoute, } from "./profile.js";
 import { AGY_VENDOR_CLI_VERSION } from "./vendor-cli-version.js";
 // The package publishes only what other packages consume. The profile probe,
 // the route resolver and the stream parser are reached through the adapter
 // this file returns, so re-exporting them would be a dead public surface.
-export { AGY_BIN, agyProfileRunEnv, agyTokenFilePresent, canonicalAgyProfileHome, } from "./profile.js";
+export { AGY_BIN, agyProfileRunEnv, canonicalAgyProfileHome } from "./profile.js";
+export { isAgyProfileKeychainUnsafe, prepareAgyProfileKeychain } from "./keychain.js";
+export { classifyAgyPrintResult, runAgyPrintCommand, } from "./print-command.js";
 /**
  * Access mapping, each leg LIVE-PROVEN on agy 1.1.13 (PLAN §1.2 F11, §1.2d):
  * plan mode answered read-only prompts and withheld a requested write;
@@ -21,7 +24,6 @@ function accessArgs(access) {
         case "workspace_write":
             return ["--mode", "accept-edits"];
         case "full":
-        case "external_sandbox_full":
             return ["--dangerously-skip-permissions"];
         case "inherit_native":
             return [];
@@ -71,6 +73,78 @@ const AGY_KNOWN_MODELS = [
  */
 export const AGY_GEMINI_MODELS = AGY_KNOWN_MODELS.filter((m) => m.startsWith("gemini-"));
 export const AGY_THIRD_PARTY_MODELS = AGY_KNOWN_MODELS.filter((m) => !m.startsWith("gemini-"));
+/** One manifest-owned declaration of the managed login's stdin contract. */
+export const AGY_MANAGED_LOGIN = { stdin: "terminal" };
+/**
+ * Static auth/profile policy. Windows Credential Manager is scoped to the OS
+ * user, not the profile HOME, so only one enabled binding is honest there.
+ * Darwin keeps both the vendor file fallback and its private profile-local
+ * keychain; Linux retains the legacy profile-scoped file route.
+ */
+export const AGY_CAPABILITY_PROFILE = HarnessCapabilityProfileSchema.parse({
+    auth: {
+        supported_sources: ["native_session"],
+        preferred_source: "native_session",
+        credential_transports: [
+            {
+                source: "native_session",
+                kind: "config_file",
+                relocatable_by: ["HOME"],
+                platforms: ["linux"],
+            },
+            {
+                source: "native_session",
+                kind: "config_file",
+                relocatable_by: ["HOME"],
+                platforms: ["darwin"],
+            },
+            {
+                source: "native_session",
+                kind: "os_keychain",
+                relocatable_by: ["HOME"],
+                platforms: ["darwin"],
+            },
+            {
+                source: "native_session",
+                kind: "os_keychain",
+                relocatable_by: [],
+                platforms: ["win32"],
+            },
+        ],
+        credential_profile_policies: [
+            {
+                source: "native_session",
+                platforms: ["win32"],
+                identity_scope: "os_user",
+                max_enabled_profiles: 1,
+                cleanup_owner: "vendor",
+            },
+        ],
+        managed_login: AGY_MANAGED_LOGIN,
+    },
+    access_control: { readonly_mechanism: "permission_deny" },
+    isolation: {
+        supported_containment: ["env_or_file_injection", "private_per_profile_keychain"],
+    },
+    attachment_inputs: [],
+});
+/** Platform disclosure derived from the same transport and effective-policy
+ * facts used by admission. Darwin is the one live-proven profile-isolation
+ * lane; other lanes stay explicit rather than maintaining parallel truth. */
+export function agyPlatformIsolationDetail(platform = process.platform) {
+    const host = harnessPlatform(platform);
+    if (!host)
+        return `Antigravity credential behavior is undeclared on ${platform}`;
+    const transports = credentialTransportsForPlatform(AGY_CAPABILITY_PROFILE.auth, host);
+    const policy = credentialProfilePolicyForPlatform(AGY_CAPABILITY_PROFILE.auth, "native_session", host);
+    if (host === "darwin")
+        return null;
+    const kinds = transports.map((transport) => transport.kind).join(" + ") || "no declared transport";
+    if (policy.identity_scope === "os_user") {
+        return `Antigravity uses ${kinds} credentials scoped to the current OS user; the named HOME scopes vendor state but is not an independent identity (maximum ${policy.max_enabled_profiles ?? "unbounded"} enabled binding)`;
+    }
+    return `named-account isolation is unverified on ${host}: the declared ${kinds} transport has profile-scoped policy but no live multi-account proof on this platform`;
+}
 const AGY_ENABLED_INTENTS = [
     "explain",
     "plan",
@@ -83,9 +157,16 @@ const AGY_ENABLED_INTENTS = [
     "synthesize",
     "audit",
 ];
-export function createAgyAdapter() {
+export function createAgyAdapter(options = {}) {
+    const prepareProfileKeychain = options.prepareProfileKeychain ??
+        ((home, platform = process.platform) => {
+            if (!needsPrivatePerProfileKeychain(AGY_CAPABILITY_PROFILE, platform))
+                return;
+            prepareAgyProfileKeychain(home, { platform });
+        });
     return {
         id: "agy",
+        capabilityProfile: AGY_CAPABILITY_PROFILE,
         async discover() {
             const version = await detectVersion();
             if (version === null) {
@@ -121,47 +202,23 @@ export function createAgyAdapter() {
                     known_models: [...AGY_KNOWN_MODELS],
                     known_models_verified_against: AGY_VENDOR_CLI_VERSION,
                 },
-                capability_profile: {
-                    auth: {
-                        supported_sources: ["native_session"],
-                        preferred_source: "native_session",
-                        credential_transports: [
-                            // The profile HOME relocates the vendor's whole config root and
-                            // its file-based OAuth token (Л-15/Л-16): config_file, HOME.
-                            { source: "native_session", kind: "config_file", relocatable_by: ["HOME"] },
-                        ],
-                    },
-                    // readonly = vendor plan mode: write tools are withheld
-                    // (permission-denied), reads and answers flow (live-proven F11).
-                    access_control: { readonly_mechanism: "permission_deny" },
-                    isolation: { supported_containment: ["env_or_file_injection"] },
-                    // No proven attachment path yet — honest empty set (INV-064/065).
-                    attachment_inputs: [],
-                },
+                capability_profile: AGY_CAPABILITY_PROFILE,
                 auth_modes: ["local_session"],
-                access_profiles_supported: [
-                    "readonly",
-                    "workspace_write",
-                    "full",
-                    "external_sandbox_full",
-                    "inherit_native",
-                ],
+                access_profiles_supported: ["readonly", "workspace_write", "full", "inherit_native"],
             });
         },
         async doctor(spec) {
             const version = await detectVersion();
             const installedSemver = version === null ? null : (/\d+\.\d+\.\d+/.exec(version)?.[0] ?? null);
             const versionDrift = version !== null && installedSemver !== AGY_VENDOR_CLI_VERSION
-                ? `installed agy "${version}" differs from the verified ${AGY_VENDOR_CLI_VERSION}; the file-token profile mechanism is re-proven per version (R-2')`
+                ? `installed agy "${version}" differs from the verified ${AGY_VENDOR_CLI_VERSION}; the platform credential transport and profile policy are re-proven per version (R-2')`
                 : null;
-            // Л-24: the account isolation mechanism — one Claudexor-owned HOME per
-            // identity, with the vendor keeping its token in a file inside it — was
-            // proven on macOS across three live Google accounts. The same HOME lever
-            // exists on every platform the vendor supports, but nobody has run it
-            // there, so the platform says so instead of implying a proof it lacks.
-            const platformProof = process.platform === "darwin"
-                ? null
-                : `named-account isolation is unverified on ${process.platform}: the mechanism is the same profile HOME proven on macOS, but no live multi-account run has been recorded here`;
+            // Л-24 + INV-067: Darwin's profile-local keychain plus vendor fallback
+            // preserves the proven profile identity route. Linux retains the
+            // config-file transport without a live multi-account proof. Windows has
+            // a different effective policy altogether: the vendor credential is
+            // OS-user-scoped and HOME scopes state only.
+            const platformProof = agyPlatformIsolationDetail();
             const requestedSource = spec.authSource;
             if (requestedSource !== undefined && requestedSource !== "native_session") {
                 return ConformanceReportSchema.parse({
@@ -227,7 +284,7 @@ export function createAgyAdapter() {
                         ? [{ id: "version_pin", status: "fail", detail: versionDrift }]
                         : [{ id: "version_pin", status: "pass", detail: AGY_VENDOR_CLI_VERSION }]),
                     ...(platformProof
-                        ? [{ id: "platform_isolation", status: "warn", detail: platformProof }]
+                        ? [{ id: "platform_isolation", status: "skip", detail: platformProof }]
                         : []),
                 ],
                 enabled_intents: [],
@@ -248,21 +305,24 @@ export function createAgyAdapter() {
             });
         },
         run(spec) {
-            return runAgy(spec);
+            return runAgy(spec, prepareProfileKeychain);
         },
         review(spec) {
-            return runAgy(spec);
+            return runAgy(spec, prepareProfileKeychain);
         },
         // INV-135: pinned routing is admitted by THIS probe (there is no default
         // store for the harness doctor to credit).
         async probeCredentialProfile(profile, abortSignal) {
             // The signal must reach the live probe: dropping it left an aborted
             // doctor sweep waiting out the probe's own 30s timeout.
-            return probeAgyCredentialProfile(profile, undefined, abortSignal);
+            return probeAgyCredentialProfile(profile, {
+                runModelProbe: defaultAgyModelProbe,
+                prepareProfileKeychain: (home) => prepareProfileKeychain(home),
+            }, abortSignal);
         },
     };
 }
-async function* runAgy(spec) {
+async function* runAgy(spec, prepareProfileKeychain) {
     const profile = spec.credential_profile;
     // Л-4: no engine-default credential — an unpinned agy run has nothing to
     // route. Typed stream refusal (error then completed), the one refusal
@@ -283,6 +343,25 @@ async function* runAgy(spec) {
         yield { type: "completed", session_id: spec.session_id, ts: nowIso() };
         return;
     }
+    // Path and identity failures are unsafe and stop before the vendor child.
+    // A recoverable security-tool miss keeps agy's own file fallback available;
+    // a custom test seam may model that same operational degradation.
+    try {
+        prepareProfileKeychain(route.home);
+    }
+    catch (error) {
+        if (isAgyProfileKeychainUnsafe(error)) {
+            yield {
+                type: "error",
+                session_id: spec.session_id,
+                ts: nowIso(),
+                error: redactSecrets(error instanceof Error ? error.message : String(error)).slice(0, 300),
+            };
+            yield { type: "completed", session_id: spec.session_id, ts: nowIso() };
+            return;
+        }
+        // The vendor probe/run remains the final transport authority.
+    }
     const args = ["-p", promptWithInstructions(spec), "--output-format", "stream-json"];
     // Л-18: without --add-dir agy resolves relative paths against its own app
     // data dir instead of the workspace (live-proven §1.2d).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,iBAAiB,IAAI,uBAAuB,EAC5C,eAAe,IAAI,qBAAqB,GACzC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAEtB;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU;YACb,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,iBAAiB;YACpB,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC;QACZ,KAAK,uBAAuB;YAC1B,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC5C,KAAK,gBAAgB;YACnB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,EAAE,oBAAoB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;CACb,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAE/F,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,MAAM;IACN,MAAM;IACN,WAAW;IACX,QAAQ;IACR,qBAAqB;IACrB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,OAAO;CACC,CAAC;AAEX,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,EAAE,EAAE,KAAK;QAET,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,uBAAuB,CAC/B,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,aAAa;gBAC3B,IAAI,EAAE,WAAW;gBACjB,OAAO;gBACP,eAAe,EAAE,iBAAiB;gBAClC,eAAe,EAAE,QAAQ;gBACzB,YAAY,EAAE;oBACZ,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,IAAI;oBACf,mBAAmB,EAAE,IAAI;oBACzB,MAAM,EAAE,IAAI;oBACZ,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,IAAI;oBAChB,+DAA+D;oBAC/D,8CAA8C;oBAC9C,YAAY,EAAE,KAAK;oBACnB,qEAAqE;oBACrE,UAAU,EAAE,cAAc;oBAC1B,kEAAkE;oBAClE,oEAAoE;oBACpE,mEAAmE;oBACnE,iBAAiB;oBACjB,qBAAqB,EAAE,WAAW;oBAClC,4DAA4D;oBAC5D,aAAa,EAAE,EAAE;oBACjB,YAAY,EAAE,CAAC,GAAG,gBAAgB,CAAC;oBACnC,6BAA6B,EAAE,sBAAsB;iBACtD;gBACD,kBAAkB,EAAE;oBAClB,IAAI,EAAE;wBACJ,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;wBACrC,gBAAgB,EAAE,gBAAgB;wBAClC,qBAAqB,EAAE;4BACrB,gEAAgE;4BAChE,6DAA6D;4BAC7D,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE;yBAC5E;qBACF;oBACD,wDAAwD;oBACxD,iEAAiE;oBACjE,cAAc,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;oBACzD,SAAS,EAAE,EAAE,qBAAqB,EAAE,CAAC,uBAAuB,CAAC,EAAE;oBAC/D,kEAAkE;oBAClE,iBAAiB,EAAE,EAAE;iBACtB;gBACD,UAAU,EAAE,CAAC,eAAe,CAAC;gBAC7B,yBAAyB,EAAE;oBACzB,UAAU;oBACV,iBAAiB;oBACjB,MAAM;oBACN,uBAAuB;oBACvB,gBAAgB;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAgB;YAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,MAAM,eAAe,GACnB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACzE,MAAM,YAAY,GAChB,OAAO,KAAK,IAAI,IAAI,eAAe,KAAK,sBAAsB;gBAC5D,CAAC,CAAC,kBAAkB,OAAO,+BAA+B,sBAAsB,oEAAoE;gBACpJ,CAAC,CAAC,IAAI,CAAC;YACX,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,aAAa,GACjB,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,4CAA4C,OAAO,CAAC,QAAQ,gHAAgH,CAAC;YACnL,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC;YACxC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;gBAC1E,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE;wBACN,OAAO,KAAK,IAAI;4BACd,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE;4BAC9D,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;wBACvE;4BACE,EAAE,EAAE,aAAa;4BACjB,MAAM,EAAE,MAAM;4BACd,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;oBACD,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,oCAAoC,eAAe,EAAE,CAAC;oBAChE,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,eAAe;4BACvB,YAAY,EAAE,aAAa;4BAC3B,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;oBACtE,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,kEAAkE,CAAC;oBAC7E,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,gBAAgB;4BACxB,YAAY,EAAE,SAAS;4BACvB,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,0BAA0B;yBACnC;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,uBAAuB,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE;oBACN,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;oBACnE;wBACE,EAAE,EAAE,oBAAoB;wBACxB,MAAM,EAAE,MAAM;wBACd,MAAM,EAAE,6EAA6E;qBACtF;oBACD,GAAG,CAAC,YAAY;wBACd,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;wBACxE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACrF,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;wBAChF,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,eAAe,EAAE,EAAE;gBACnB,gBAAgB,EAAE,mBAAmB;gBACrC,OAAO,EAAE;oBACP,kJAAkJ;oBAClJ,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C;gBACD,YAAY,EAAE;oBACZ;wBACE,MAAM,EAAE,gBAAgB;wBACxB,YAAY,EAAE,aAAa;wBAC3B,YAAY,EAAE,SAAS;wBACvB,MAAM,EAAE,0DAA0D;qBACnE;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,IAAoB;YACtB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,CAAC,IAAoB;YACzB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,yEAAyE;QACzE,2CAA2C;QAC3C,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW;YAC/C,oEAAoE;YACpE,wDAAwD;YACxD,OAAO,yBAAyB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,IAAoB;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACxC,yEAAyE;IACzE,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,MAAM,EAAE;YACZ,KAAK,EACH,6GAA6G;SAChH,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACzF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACpF,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,uEAAuE;IACvE,IAAI,IAAI,CAAC,iBAAiB;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEhF,KAAK,CAAC,CAAC,aAAa,CAAC;QACnB,GAAG,EAAE,OAAO,EAAE;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;oBACrB,EAAE,CAAC,gBAAgB,GAAG,eAAe,CAAC;oBACtC,EAAE,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;oBACxC,EAAE,CAAC,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;gBAChD,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,iBAAiB,IAAI,uBAAuB,EAC5C,kCAAkC,EAClC,+BAA+B,EAC/B,wBAAwB,IAAI,8BAA8B,EAC1D,eAAe,IAAI,qBAAqB,GACzC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,8BAA8B,EAC9B,sBAAsB,EACtB,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,OAAO,EACP,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU;YACb,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,iBAAiB;YACpB,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACpC,KAAK,MAAM;YACT,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC5C,KAAK,gBAAgB;YACnB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,EAAE,oBAAoB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;CACb,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAE/F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,KAAK,EAAE,UAAU,EAAW,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,8BAA8B,CAAC,KAAK,CAAC;IACnC,IAAI,EAAE;QACJ,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;QACrC,gBAAgB,EAAE,gBAAgB;QAClC,qBAAqB,EAAE;YACrB;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,CAAC,OAAO,CAAC;aACrB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;aACtB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;aACtB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,EAAE;gBAClB,SAAS,EAAE,CAAC,OAAO,CAAC;aACrB;SACF;QACD,2BAA2B,EAAE;YAC3B;gBACE,MAAM,EAAE,gBAAgB;gBACxB,SAAS,EAAE,CAAC,OAAO,CAAC;gBACpB,cAAc,EAAE,SAAS;gBACzB,oBAAoB,EAAE,CAAC;gBACvB,aAAa,EAAE,QAAQ;aACxB;SACF;QACD,aAAa,EAAE,iBAAiB;KACjC;IACD,cAAc,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;IACzD,SAAS,EAAE;QACT,qBAAqB,EAAE,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;KACjF;IACD,iBAAiB,EAAE,EAAE;CACtB,CAAC,CAAC;AAEL;;6EAE6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,oDAAoD,QAAQ,EAAE,CAAC;IACjF,MAAM,UAAU,GAAG,+BAA+B,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,kCAAkC,CAC/C,sBAAsB,CAAC,IAAI,EAC3B,gBAAgB,EAChB,IAAI,CACL,CAAC;IACF,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GACT,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC;IACvF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,oBAAoB,KAAK,8HAA8H,MAAM,CAAC,oBAAoB,IAAI,WAAW,mBAAmB,CAAC;IAC9N,CAAC;IACD,OAAO,4CAA4C,IAAI,kBAAkB,KAAK,uFAAuF,CAAC;AACxK,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,MAAM;IACN,MAAM;IACN,WAAW;IACX,QAAQ;IACR,qBAAqB;IACrB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,OAAO;CACC,CAAC;AAOX,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAsB,EAAE;IAC9D,MAAM,sBAAsB,GAC1B,OAAO,CAAC,sBAAsB;QAC9B,CAAC,CAAC,IAAY,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAQ,EAAE;YACnD,IAAI,CAAC,8BAA8B,CAAC,sBAAsB,EAAE,QAAQ,CAAC;gBAAE,OAAO;YAC9E,yBAAyB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,OAAO;QACL,EAAE,EAAE,KAAK;QACT,iBAAiB,EAAE,sBAAsB;QAEzC,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,uBAAuB,CAC/B,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,aAAa;gBAC3B,IAAI,EAAE,WAAW;gBACjB,OAAO;gBACP,eAAe,EAAE,iBAAiB;gBAClC,eAAe,EAAE,QAAQ;gBACzB,YAAY,EAAE;oBACZ,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,IAAI;oBACf,mBAAmB,EAAE,IAAI;oBACzB,MAAM,EAAE,IAAI;oBACZ,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,IAAI;oBAChB,+DAA+D;oBAC/D,8CAA8C;oBAC9C,YAAY,EAAE,KAAK;oBACnB,qEAAqE;oBACrE,UAAU,EAAE,cAAc;oBAC1B,kEAAkE;oBAClE,oEAAoE;oBACpE,mEAAmE;oBACnE,iBAAiB;oBACjB,qBAAqB,EAAE,WAAW;oBAClC,4DAA4D;oBAC5D,aAAa,EAAE,EAAE;oBACjB,YAAY,EAAE,CAAC,GAAG,gBAAgB,CAAC;oBACnC,6BAA6B,EAAE,sBAAsB;iBACtD;gBACD,kBAAkB,EAAE,sBAAsB;gBAC1C,UAAU,EAAE,CAAC,eAAe,CAAC;gBAC7B,yBAAyB,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,CAAC;aACrF,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAgB;YAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,MAAM,eAAe,GACnB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACzE,MAAM,YAAY,GAChB,OAAO,KAAK,IAAI,IAAI,eAAe,KAAK,sBAAsB;gBAC5D,CAAC,CAAC,kBAAkB,OAAO,+BAA+B,sBAAsB,yFAAyF;gBACzK,CAAC,CAAC,IAAI,CAAC;YACX,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,aAAa,GAAG,0BAA0B,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC;YACxC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;gBAC1E,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE;wBACN,OAAO,KAAK,IAAI;4BACd,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE;4BAC9D,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;wBACvE;4BACE,EAAE,EAAE,aAAa;4BACjB,MAAM,EAAE,MAAM;4BACd,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;oBACD,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,oCAAoC,eAAe,EAAE,CAAC;oBAChE,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,eAAe;4BACvB,YAAY,EAAE,aAAa;4BAC3B,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;oBACtE,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,kEAAkE,CAAC;oBAC7E,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,gBAAgB;4BACxB,YAAY,EAAE,SAAS;4BACvB,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,0BAA0B;yBACnC;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,uBAAuB,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE;oBACN,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;oBACnE;wBACE,EAAE,EAAE,oBAAoB;wBACxB,MAAM,EAAE,MAAM;wBACd,MAAM,EAAE,6EAA6E;qBACtF;oBACD,GAAG,CAAC,YAAY;wBACd,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;wBACxE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACrF,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;wBAChF,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,eAAe,EAAE,EAAE;gBACnB,gBAAgB,EAAE,mBAAmB;gBACrC,OAAO,EAAE;oBACP,kJAAkJ;oBAClJ,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C;gBACD,YAAY,EAAE;oBACZ;wBACE,MAAM,EAAE,gBAAgB;wBACxB,YAAY,EAAE,aAAa;wBAC3B,YAAY,EAAE,SAAS;wBACvB,MAAM,EAAE,0DAA0D;qBACnE;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,IAAoB;YACtB,OAAO,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,CAAC,IAAoB;YACzB,OAAO,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,yEAAyE;QACzE,2CAA2C;QAC3C,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW;YAC/C,oEAAoE;YACpE,wDAAwD;YACxD,OAAO,yBAAyB,CAC9B,OAAO,EACP;gBACE,aAAa,EAAE,oBAAoB;gBACnC,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC;aAC/D,EACD,WAAW,CACZ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,MAAM,CACpB,IAAoB,EACpB,sBAA0E;IAE1E,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACxC,yEAAyE;IACzE,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,MAAM,EAAE;YACZ,KAAK,EACH,6GAA6G;SAChH,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACzF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,CAAC;QACH,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM;gBACJ,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,EAAE,EAAE,MAAM,EAAE;gBACZ,KAAK,EAAE,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAC3F,CAAC;YACF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,8DAA8D;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACpF,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,uEAAuE;IACvE,IAAI,IAAI,CAAC,iBAAiB;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEhF,KAAK,CAAC,CAAC,aAAa,CAAC;QACnB,GAAG,EAAE,OAAO,EAAE;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;oBACrB,EAAE,CAAC,gBAAgB,GAAG,eAAe,CAAC;oBACtC,EAAE,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;oBACxC,EAAE,CAAC,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;gBAChD,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/keychain.d.ts

@@ -0,0 +1,41 @@
+export interface AgySecurityResult {
+    status: number | null;
+    detail?: string;
+}
+export type AgySecurityRunner = (args: readonly string[], env: NodeJS.ProcessEnv) => AgySecurityResult;
+export interface AgyKeychainOptions {
+    platform?: NodeJS.Platform;
+    runSecurity?: AgySecurityRunner;
+}
+/**
+ * Typed, bounded setup result. `unsafe` means the profile path or target
+ * identity is not proven and callers must refuse the vendor child; a false
+ * value is a recoverable security-tool miss where agy's file fallback may
+ * still keep authentication working.
+ */
+export declare class AgyProfileKeychainError extends Error {
+    readonly code: "agy_profile_keychain_unavailable";
+    readonly unsafe: boolean;
+    constructor(detail: string, options?: {
+        unsafe?: boolean;
+    });
+}
+export declare function isAgyProfileKeychainUnsafe(error: unknown): boolean;
+/** The only keychain path agy may use for one named profile. */
+export declare function agyProfileKeychainPath(profileHome: string): string;
+/**
+ * Prepare the private Darwin keychain declared by the agy capability profile.
+ * Other platforms deliberately do nothing: Linux and Windows retain their
+ * vendor-owned credential behavior. The helper never reads, copies, or
+ * removes credential items; agy itself remains the only item owner. Creation
+ * uses a neutral bootstrap filename before adopting login.keychain-db because
+ * Apple's create operation treats the latter name as a user-list entry on the
+ * supported Darwin path.
+ */
+export declare function prepareAgyProfileKeychain(profileHome: string, options?: AgyKeychainOptions): void;
+/**
+ * Low-level Darwin ensure used by the adapter's production seams and tests.
+ * The caller has already established that this is the private agy route.
+ */
+export declare function ensureAgyProfileKeychain(profileHome: string, options?: AgyKeychainOptions): void;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,iBAAiB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,kCAAkC,CAAU;IAC5D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,YAAY,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,EAI7D;CACF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElE;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAIN;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAqHN"}