@claudexor/harness-agy 3.8.0 → 3.8.1

package/README.md

@@ -6,9 +6,19 @@ Adapter for Google's Antigravity CLI (`agy`): translates
 Accounts use NAMED credential-profile bindings only (there is no engine-default
 agy credential). Every binding has a Claudexor-owned HOME that scopes vendor
 state under `$HOME/.gemini/...`; credential custody is platform-defined.
-Darwin and Linux declare the config-file/HOME transport. Windows uses the
-current OS user's Credential Manager identity, permits one enabled binding,
-and treats HOME as state scoping rather than an independent Google identity.
+On Darwin, Claudexor lazily prepares the profile's own
+`Library/Keychains/login.keychain-db` before an agy child starts. When setup
+succeeds this prevents the missing-keychain prompt; an unsafe profile path
+refuses that child before it can trigger SecurityAgent, while an operational
+setup miss leaves the vendor's own file fallback available. The implementation
+bootstraps the DB under a neutral filename and adopts the canonical name,
+because Apple's `security` tool treats a path containing `login.keychain` as a
+user search-list entry. This keeps host default/list preferences untouched.
+The vendor still owns the item; no host Keychain is bridged and no credential
+bytes are copied. Linux keeps the config-file/HOME route.
+Windows uses the current OS user's Credential Manager identity, permits one
+enabled binding, and treats HOME as state scoping rather than an independent
+Google identity.
 Readiness always comes from the bounded vendor `/model` probe, never from the
 presence or absence of `antigravity-oauth-token`. See `src/profile.ts` for the
 route and verification contract.

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import type { HarnessCapabilityProfile } from "@claudexor/schema";
 import type { HarnessAdapter } from "@claudexor/core";
 export { AGY_BIN, agyProfileRunEnv, canonicalAgyProfileHome } from "./profile.js";
+export { isAgyProfileKeychainUnsafe, prepareAgyProfileKeychain } from "./keychain.js";
 export { classifyAgyPrintResult, runAgyPrintCommand, type AgyPrintClassification, } from "./print-command.js";
 /**
  * The vendor's two quota GROUPS map onto disjoint halves of the same
@@ -17,12 +18,17 @@ export declare const AGY_MANAGED_LOGIN: {
 /**
  * Static auth/profile policy. Windows Credential Manager is scoped to the OS
  * user, not the profile HOME, so only one enabled binding is honest there.
- * Darwin/Linux retain the legacy profile-scoped, unbounded defaults.
+ * Darwin keeps both the vendor file fallback and its private profile-local
+ * keychain; Linux retains the legacy profile-scoped file route.
  */
 export declare const AGY_CAPABILITY_PROFILE: HarnessCapabilityProfile;
 /** Platform disclosure derived from the same transport and effective-policy
  * facts used by admission. Darwin is the one live-proven profile-isolation
  * lane; other lanes stay explicit rather than maintaining parallel truth. */
 export declare function agyPlatformIsolationDetail(platform?: NodeJS.Platform): string | null;
-export declare function createAgyAdapter(): HarnessAdapter;
+export interface AgyAdapterOptions {
+    /** Test seam; production prepares the declared private Darwin keychain. */
+    prepareProfileKeychain?: (home: string, platform?: NodeJS.Platform) => void;
+}
+export declare function createAgyAdapter(options?: AgyAdapterOptions): HarnessAdapter;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,wBAAwB,EAIzB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAelE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AA2D5B;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,0WAA0D,CAAC;AACzF,eAAO,MAAM,sBAAsB,0WAA2D,CAAC;AAE/F,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB;aAAK,KAAK,EAAE,UAAU;CAAW,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,wBAiCjC,CAAC;AAEL;;6EAE6E;AAC7E,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAgBf;AAeD,wBAAgB,gBAAgB,IAAI,cAAc,CAyKjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,wBAAwB,EAIzB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAsBlE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AA0D5B;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,0WAA0D,CAAC;AACzF,eAAO,MAAM,sBAAsB,0WAA2D,CAAC;AAE/F,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB;aAAK,KAAK,EAAE,UAAU;CAAW,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,wBA+CjC,CAAC;AAEL;;6EAE6E;AAC7E,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAgBf;AAeD,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC;CAC7E;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,cAAc,CAiLhF"}

package/dist/index.js

@@ -1,13 +1,15 @@
 import { ConformanceReport as ConformanceReportSchema, credentialProfilePolicyForPlatform, credentialTransportsForPlatform, HarnessCapabilityProfile as HarnessCapabilityProfileSchema, HarnessManifest as HarnessManifestSchema, } from "@claudexor/schema";
-import { HarnessUnavailableError, harnessPlatform, promptWithInstructions, runCapture, runCliHarness, } from "@claudexor/core";
+import { HarnessUnavailableError, harnessPlatform, needsPrivatePerProfileKeychain, promptWithInstructions, runCapture, runCliHarness, } from "@claudexor/core";
 import { CLAUDEXOR_VERSION, nowIso, redactSecrets } from "@claudexor/util";
 import { parseAgyEvent } from "./parse.js";
-import { AGY_BIN, probeAgyCredentialProfile, resolveAgyProfileRoute } from "./profile.js";
+import { isAgyProfileKeychainUnsafe, prepareAgyProfileKeychain } from "./keychain.js";
+import { AGY_BIN, defaultAgyModelProbe, probeAgyCredentialProfile, resolveAgyProfileRoute, } from "./profile.js";
 import { AGY_VENDOR_CLI_VERSION } from "./vendor-cli-version.js";
 // The package publishes only what other packages consume. The profile probe,
 // the route resolver and the stream parser are reached through the adapter
 // this file returns, so re-exporting them would be a dead public surface.
 export { AGY_BIN, agyProfileRunEnv, canonicalAgyProfileHome } from "./profile.js";
+export { isAgyProfileKeychainUnsafe, prepareAgyProfileKeychain } from "./keychain.js";
 export { classifyAgyPrintResult, runAgyPrintCommand, } from "./print-command.js";
 /**
  * Access mapping, each leg LIVE-PROVEN on agy 1.1.13 (PLAN §1.2 F11, §1.2d):
@@ -22,7 +24,6 @@ function accessArgs(access) {
         case "workspace_write":
             return ["--mode", "accept-edits"];
         case "full":
-        case "external_sandbox_full":
             return ["--dangerously-skip-permissions"];
         case "inherit_native":
             return [];
@@ -77,7 +78,8 @@ export const AGY_MANAGED_LOGIN = { stdin: "terminal" };
 /**
  * Static auth/profile policy. Windows Credential Manager is scoped to the OS
  * user, not the profile HOME, so only one enabled binding is honest there.
- * Darwin/Linux retain the legacy profile-scoped, unbounded defaults.
+ * Darwin keeps both the vendor file fallback and its private profile-local
+ * keychain; Linux retains the legacy profile-scoped file route.
  */
 export const AGY_CAPABILITY_PROFILE = HarnessCapabilityProfileSchema.parse({
     auth: {
@@ -88,7 +90,19 @@ export const AGY_CAPABILITY_PROFILE = HarnessCapabilityProfileSchema.parse({
                 source: "native_session",
                 kind: "config_file",
                 relocatable_by: ["HOME"],
-                platforms: ["darwin", "linux"],
+                platforms: ["linux"],
+            },
+            {
+                source: "native_session",
+                kind: "config_file",
+                relocatable_by: ["HOME"],
+                platforms: ["darwin"],
+            },
+            {
+                source: "native_session",
+                kind: "os_keychain",
+                relocatable_by: ["HOME"],
+                platforms: ["darwin"],
             },
             {
                 source: "native_session",
@@ -109,7 +123,9 @@ export const AGY_CAPABILITY_PROFILE = HarnessCapabilityProfileSchema.parse({
         managed_login: AGY_MANAGED_LOGIN,
     },
     access_control: { readonly_mechanism: "permission_deny" },
-    isolation: { supported_containment: ["env_or_file_injection"] },
+    isolation: {
+        supported_containment: ["env_or_file_injection", "private_per_profile_keychain"],
+    },
     attachment_inputs: [],
 });
 /** Platform disclosure derived from the same transport and effective-policy
@@ -141,7 +157,13 @@ const AGY_ENABLED_INTENTS = [
     "synthesize",
     "audit",
 ];
-export function createAgyAdapter() {
+export function createAgyAdapter(options = {}) {
+    const prepareProfileKeychain = options.prepareProfileKeychain ??
+        ((home, platform = process.platform) => {
+            if (!needsPrivatePerProfileKeychain(AGY_CAPABILITY_PROFILE, platform))
+                return;
+            prepareAgyProfileKeychain(home, { platform });
+        });
     return {
         id: "agy",
         capabilityProfile: AGY_CAPABILITY_PROFILE,
@@ -182,13 +204,7 @@ export function createAgyAdapter() {
                 },
                 capability_profile: AGY_CAPABILITY_PROFILE,
                 auth_modes: ["local_session"],
-                access_profiles_supported: [
-                    "readonly",
-                    "workspace_write",
-                    "full",
-                    "external_sandbox_full",
-                    "inherit_native",
-                ],
+                access_profiles_supported: ["readonly", "workspace_write", "full", "inherit_native"],
             });
         },
         async doctor(spec) {
@@ -197,10 +213,11 @@ export function createAgyAdapter() {
             const versionDrift = version !== null && installedSemver !== AGY_VENDOR_CLI_VERSION
                 ? `installed agy "${version}" differs from the verified ${AGY_VENDOR_CLI_VERSION}; the platform credential transport and profile policy are re-proven per version (R-2')`
                 : null;
-            // Л-24 + INV-067: config-file identity isolation is live-proven only on
-            // macOS. Linux retains that declared transport without a live multi-
-            // account proof. Windows has a different effective policy altogether:
-            // the vendor credential is OS-user-scoped and HOME scopes state only.
+            // Л-24 + INV-067: Darwin's profile-local keychain plus vendor fallback
+            // preserves the proven profile identity route. Linux retains the
+            // config-file transport without a live multi-account proof. Windows has
+            // a different effective policy altogether: the vendor credential is
+            // OS-user-scoped and HOME scopes state only.
             const platformProof = agyPlatformIsolationDetail();
             const requestedSource = spec.authSource;
             if (requestedSource !== undefined && requestedSource !== "native_session") {
@@ -288,21 +305,24 @@ export function createAgyAdapter() {
             });
         },
         run(spec) {
-            return runAgy(spec);
+            return runAgy(spec, prepareProfileKeychain);
         },
         review(spec) {
-            return runAgy(spec);
+            return runAgy(spec, prepareProfileKeychain);
         },
         // INV-135: pinned routing is admitted by THIS probe (there is no default
         // store for the harness doctor to credit).
         async probeCredentialProfile(profile, abortSignal) {
             // The signal must reach the live probe: dropping it left an aborted
             // doctor sweep waiting out the probe's own 30s timeout.
-            return probeAgyCredentialProfile(profile, undefined, abortSignal);
+            return probeAgyCredentialProfile(profile, {
+                runModelProbe: defaultAgyModelProbe,
+                prepareProfileKeychain: (home) => prepareProfileKeychain(home),
+            }, abortSignal);
         },
     };
 }
-async function* runAgy(spec) {
+async function* runAgy(spec, prepareProfileKeychain) {
     const profile = spec.credential_profile;
     // Л-4: no engine-default credential — an unpinned agy run has nothing to
     // route. Typed stream refusal (error then completed), the one refusal
@@ -323,6 +343,25 @@ async function* runAgy(spec) {
         yield { type: "completed", session_id: spec.session_id, ts: nowIso() };
         return;
     }
+    // Path and identity failures are unsafe and stop before the vendor child.
+    // A recoverable security-tool miss keeps agy's own file fallback available;
+    // a custom test seam may model that same operational degradation.
+    try {
+        prepareProfileKeychain(route.home);
+    }
+    catch (error) {
+        if (isAgyProfileKeychainUnsafe(error)) {
+            yield {
+                type: "error",
+                session_id: spec.session_id,
+                ts: nowIso(),
+                error: redactSecrets(error instanceof Error ? error.message : String(error)).slice(0, 300),
+            };
+            yield { type: "completed", session_id: spec.session_id, ts: nowIso() };
+            return;
+        }
+        // The vendor probe/run remains the final transport authority.
+    }
     const args = ["-p", promptWithInstructions(spec), "--output-format", "stream-json"];
     // Л-18: without --add-dir agy resolves relative paths against its own app
     // data dir instead of the workspace (live-proven §1.2d).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,iBAAiB,IAAI,uBAAuB,EAC5C,kCAAkC,EAClC,+BAA+B,EAC/B,wBAAwB,IAAI,8BAA8B,EAC1D,eAAe,IAAI,qBAAqB,GACzC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU;YACb,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,iBAAiB;YACpB,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC;QACZ,KAAK,uBAAuB;YAC1B,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC5C,KAAK,gBAAgB;YACnB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,EAAE,oBAAoB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;CACb,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAE/F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,KAAK,EAAE,UAAU,EAAW,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,8BAA8B,CAAC,KAAK,CAAC;IACnC,IAAI,EAAE;QACJ,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;QACrC,gBAAgB,EAAE,gBAAgB;QAClC,qBAAqB,EAAE;YACrB;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;aAC/B;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,EAAE;gBAClB,SAAS,EAAE,CAAC,OAAO,CAAC;aACrB;SACF;QACD,2BAA2B,EAAE;YAC3B;gBACE,MAAM,EAAE,gBAAgB;gBACxB,SAAS,EAAE,CAAC,OAAO,CAAC;gBACpB,cAAc,EAAE,SAAS;gBACzB,oBAAoB,EAAE,CAAC;gBACvB,aAAa,EAAE,QAAQ;aACxB;SACF;QACD,aAAa,EAAE,iBAAiB;KACjC;IACD,cAAc,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;IACzD,SAAS,EAAE,EAAE,qBAAqB,EAAE,CAAC,uBAAuB,CAAC,EAAE;IAC/D,iBAAiB,EAAE,EAAE;CACtB,CAAC,CAAC;AAEL;;6EAE6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,oDAAoD,QAAQ,EAAE,CAAC;IACjF,MAAM,UAAU,GAAG,+BAA+B,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,kCAAkC,CAC/C,sBAAsB,CAAC,IAAI,EAC3B,gBAAgB,EAChB,IAAI,CACL,CAAC;IACF,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GACT,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC;IACvF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,oBAAoB,KAAK,8HAA8H,MAAM,CAAC,oBAAoB,IAAI,WAAW,mBAAmB,CAAC;IAC9N,CAAC;IACD,OAAO,4CAA4C,IAAI,kBAAkB,KAAK,uFAAuF,CAAC;AACxK,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,MAAM;IACN,MAAM;IACN,WAAW;IACX,QAAQ;IACR,qBAAqB;IACrB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,OAAO;CACC,CAAC;AAEX,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,EAAE,EAAE,KAAK;QACT,iBAAiB,EAAE,sBAAsB;QAEzC,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,uBAAuB,CAC/B,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,aAAa;gBAC3B,IAAI,EAAE,WAAW;gBACjB,OAAO;gBACP,eAAe,EAAE,iBAAiB;gBAClC,eAAe,EAAE,QAAQ;gBACzB,YAAY,EAAE;oBACZ,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,IAAI;oBACf,mBAAmB,EAAE,IAAI;oBACzB,MAAM,EAAE,IAAI;oBACZ,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,IAAI;oBAChB,+DAA+D;oBAC/D,8CAA8C;oBAC9C,YAAY,EAAE,KAAK;oBACnB,qEAAqE;oBACrE,UAAU,EAAE,cAAc;oBAC1B,kEAAkE;oBAClE,oEAAoE;oBACpE,mEAAmE;oBACnE,iBAAiB;oBACjB,qBAAqB,EAAE,WAAW;oBAClC,4DAA4D;oBAC5D,aAAa,EAAE,EAAE;oBACjB,YAAY,EAAE,CAAC,GAAG,gBAAgB,CAAC;oBACnC,6BAA6B,EAAE,sBAAsB;iBACtD;gBACD,kBAAkB,EAAE,sBAAsB;gBAC1C,UAAU,EAAE,CAAC,eAAe,CAAC;gBAC7B,yBAAyB,EAAE;oBACzB,UAAU;oBACV,iBAAiB;oBACjB,MAAM;oBACN,uBAAuB;oBACvB,gBAAgB;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAgB;YAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,MAAM,eAAe,GACnB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACzE,MAAM,YAAY,GAChB,OAAO,KAAK,IAAI,IAAI,eAAe,KAAK,sBAAsB;gBAC5D,CAAC,CAAC,kBAAkB,OAAO,+BAA+B,sBAAsB,yFAAyF;gBACzK,CAAC,CAAC,IAAI,CAAC;YACX,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,aAAa,GAAG,0BAA0B,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC;YACxC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;gBAC1E,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE;wBACN,OAAO,KAAK,IAAI;4BACd,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE;4BAC9D,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;wBACvE;4BACE,EAAE,EAAE,aAAa;4BACjB,MAAM,EAAE,MAAM;4BACd,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;oBACD,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,oCAAoC,eAAe,EAAE,CAAC;oBAChE,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,eAAe;4BACvB,YAAY,EAAE,aAAa;4BAC3B,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;oBACtE,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,kEAAkE,CAAC;oBAC7E,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,gBAAgB;4BACxB,YAAY,EAAE,SAAS;4BACvB,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,0BAA0B;yBACnC;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,uBAAuB,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE;oBACN,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;oBACnE;wBACE,EAAE,EAAE,oBAAoB;wBACxB,MAAM,EAAE,MAAM;wBACd,MAAM,EAAE,6EAA6E;qBACtF;oBACD,GAAG,CAAC,YAAY;wBACd,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;wBACxE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACrF,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;wBAChF,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,eAAe,EAAE,EAAE;gBACnB,gBAAgB,EAAE,mBAAmB;gBACrC,OAAO,EAAE;oBACP,kJAAkJ;oBAClJ,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C;gBACD,YAAY,EAAE;oBACZ;wBACE,MAAM,EAAE,gBAAgB;wBACxB,YAAY,EAAE,aAAa;wBAC3B,YAAY,EAAE,SAAS;wBACvB,MAAM,EAAE,0DAA0D;qBACnE;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,IAAoB;YACtB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,CAAC,IAAoB;YACzB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,yEAAyE;QACzE,2CAA2C;QAC3C,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW;YAC/C,oEAAoE;YACpE,wDAAwD;YACxD,OAAO,yBAAyB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,IAAoB;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACxC,yEAAyE;IACzE,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,MAAM,EAAE;YACZ,KAAK,EACH,6GAA6G;SAChH,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACzF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACpF,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,uEAAuE;IACvE,IAAI,IAAI,CAAC,iBAAiB;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEhF,KAAK,CAAC,CAAC,aAAa,CAAC;QACnB,GAAG,EAAE,OAAO,EAAE;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;oBACrB,EAAE,CAAC,gBAAgB,GAAG,eAAe,CAAC;oBACtC,EAAE,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;oBACxC,EAAE,CAAC,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;gBAChD,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,iBAAiB,IAAI,uBAAuB,EAC5C,kCAAkC,EAClC,+BAA+B,EAC/B,wBAAwB,IAAI,8BAA8B,EAC1D,eAAe,IAAI,qBAAqB,GACzC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,8BAA8B,EAC9B,sBAAsB,EACtB,UAAU,EACV,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,OAAO,EACP,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAqB;IACvC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU;YACb,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,iBAAiB;YACpB,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACpC,KAAK,MAAM;YACT,OAAO,CAAC,gCAAgC,CAAC,CAAC;QAC5C,KAAK,gBAAgB;YACnB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,EAAE,oBAAoB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,qBAAqB;CACb,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAE/F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,KAAK,EAAE,UAAU,EAAW,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GACjC,8BAA8B,CAAC,KAAK,CAAC;IACnC,IAAI,EAAE;QACJ,iBAAiB,EAAE,CAAC,gBAAgB,CAAC;QACrC,gBAAgB,EAAE,gBAAgB;QAClC,qBAAqB,EAAE;YACrB;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,CAAC,OAAO,CAAC;aACrB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;aACtB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;aACtB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,aAAa;gBACnB,cAAc,EAAE,EAAE;gBAClB,SAAS,EAAE,CAAC,OAAO,CAAC;aACrB;SACF;QACD,2BAA2B,EAAE;YAC3B;gBACE,MAAM,EAAE,gBAAgB;gBACxB,SAAS,EAAE,CAAC,OAAO,CAAC;gBACpB,cAAc,EAAE,SAAS;gBACzB,oBAAoB,EAAE,CAAC;gBACvB,aAAa,EAAE,QAAQ;aACxB;SACF;QACD,aAAa,EAAE,iBAAiB;KACjC;IACD,cAAc,EAAE,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;IACzD,SAAS,EAAE;QACT,qBAAqB,EAAE,CAAC,uBAAuB,EAAE,8BAA8B,CAAC;KACjF;IACD,iBAAiB,EAAE,EAAE;CACtB,CAAC,CAAC;AAEL;;6EAE6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,oDAAoD,QAAQ,EAAE,CAAC;IACjF,MAAM,UAAU,GAAG,+BAA+B,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,kCAAkC,CAC/C,sBAAsB,CAAC,IAAI,EAC3B,gBAAgB,EAChB,IAAI,CACL,CAAC;IACF,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GACT,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC;IACvF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,oBAAoB,KAAK,8HAA8H,MAAM,CAAC,oBAAoB,IAAI,WAAW,mBAAmB,CAAC;IAC9N,CAAC;IACD,OAAO,4CAA4C,IAAI,kBAAkB,KAAK,uFAAuF,CAAC;AACxK,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,MAAM;IACN,MAAM;IACN,WAAW;IACX,QAAQ;IACR,qBAAqB;IACrB,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,OAAO;CACC,CAAC;AAOX,MAAM,UAAU,gBAAgB,CAAC,OAAO,GAAsB,EAAE;IAC9D,MAAM,sBAAsB,GAC1B,OAAO,CAAC,sBAAsB;QAC9B,CAAC,CAAC,IAAY,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAQ,EAAE;YACnD,IAAI,CAAC,8BAA8B,CAAC,sBAAsB,EAAE,QAAQ,CAAC;gBAAE,OAAO;YAC9E,yBAAyB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,OAAO;QACL,EAAE,EAAE,KAAK;QACT,iBAAiB,EAAE,sBAAsB;QAEzC,KAAK,CAAC,QAAQ;YACZ,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,uBAAuB,CAC/B,0EAA0E,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC;gBACjC,EAAE,EAAE,KAAK;gBACT,YAAY,EAAE,aAAa;gBAC3B,IAAI,EAAE,WAAW;gBACjB,OAAO;gBACP,eAAe,EAAE,iBAAiB;gBAClC,eAAe,EAAE,QAAQ;gBACzB,YAAY,EAAE;oBACZ,IAAI,EAAE,IAAI;oBACV,SAAS,EAAE,IAAI;oBACf,mBAAmB,EAAE,IAAI;oBACzB,MAAM,EAAE,IAAI;oBACZ,MAAM,EAAE,IAAI;oBACZ,UAAU,EAAE,IAAI;oBAChB,UAAU,EAAE,IAAI;oBAChB,+DAA+D;oBAC/D,8CAA8C;oBAC9C,YAAY,EAAE,KAAK;oBACnB,qEAAqE;oBACrE,UAAU,EAAE,cAAc;oBAC1B,kEAAkE;oBAClE,oEAAoE;oBACpE,mEAAmE;oBACnE,iBAAiB;oBACjB,qBAAqB,EAAE,WAAW;oBAClC,4DAA4D;oBAC5D,aAAa,EAAE,EAAE;oBACjB,YAAY,EAAE,CAAC,GAAG,gBAAgB,CAAC;oBACnC,6BAA6B,EAAE,sBAAsB;iBACtD;gBACD,kBAAkB,EAAE,sBAAsB;gBAC1C,UAAU,EAAE,CAAC,eAAe,CAAC;gBAC7B,yBAAyB,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,CAAC;aACrF,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAgB;YAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;YACtC,MAAM,eAAe,GACnB,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACzE,MAAM,YAAY,GAChB,OAAO,KAAK,IAAI,IAAI,eAAe,KAAK,sBAAsB;gBAC5D,CAAC,CAAC,kBAAkB,OAAO,+BAA+B,sBAAsB,yFAAyF;gBACzK,CAAC,CAAC,IAAI,CAAC;YACX,uEAAuE;YACvE,iEAAiE;YACjE,wEAAwE;YACxE,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,aAAa,GAAG,0BAA0B,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC;YACxC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,gBAAgB,EAAE,CAAC;gBAC1E,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE;wBACN,OAAO,KAAK,IAAI;4BACd,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE;4BAC9D,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;wBACvE;4BACE,EAAE,EAAE,aAAa;4BACjB,MAAM,EAAE,MAAM;4BACd,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;oBACD,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,oCAAoC,eAAe,EAAE,CAAC;oBAChE,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,eAAe;4BACvB,YAAY,EAAE,aAAa;4BAC3B,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,wBAAwB,eAAe,EAAE;yBAClD;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,uBAAuB,CAAC,KAAK,CAAC;oBACnC,UAAU,EAAE,KAAK;oBACjB,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;oBACtE,eAAe,EAAE,EAAE;oBACnB,gBAAgB,EAAE,mBAAmB;oBACrC,OAAO,EAAE,CAAC,kEAAkE,CAAC;oBAC7E,YAAY,EAAE;wBACZ;4BACE,MAAM,EAAE,gBAAgB;4BACxB,YAAY,EAAE,SAAS;4BACvB,YAAY,EAAE,SAAS;4BACvB,MAAM,EAAE,0BAA0B;yBACnC;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,OAAO,uBAAuB,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE;oBACN,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE;oBACnE;wBACE,EAAE,EAAE,oBAAoB;wBACxB,MAAM,EAAE,MAAM;wBACd,MAAM,EAAE,6EAA6E;qBACtF;oBACD,GAAG,CAAC,YAAY;wBACd,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;wBACxE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;oBACrF,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAe,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;wBAChF,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,eAAe,EAAE,EAAE;gBACnB,gBAAgB,EAAE,mBAAmB;gBACrC,OAAO,EAAE;oBACP,kJAAkJ;oBAClJ,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1C;gBACD,YAAY,EAAE;oBACZ;wBACE,MAAM,EAAE,gBAAgB;wBACxB,YAAY,EAAE,aAAa;wBAC3B,YAAY,EAAE,SAAS;wBACvB,MAAM,EAAE,0DAA0D;qBACnE;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,IAAoB;YACtB,OAAO,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,CAAC,IAAoB;YACzB,OAAO,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,yEAAyE;QACzE,2CAA2C;QAC3C,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE,WAAW;YAC/C,oEAAoE;YACpE,wDAAwD;YACxD,OAAO,yBAAyB,CAC9B,OAAO,EACP;gBACE,aAAa,EAAE,oBAAoB;gBACnC,sBAAsB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC;aAC/D,EACD,WAAW,CACZ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,MAAM,CACpB,IAAoB,EACpB,sBAA0E;IAE1E,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACxC,yEAAyE;IACzE,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM;YACJ,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,MAAM,EAAE;YACZ,KAAK,EACH,6GAA6G;SAChH,CAAC;QACF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACzF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACvE,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,CAAC;QACH,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM;gBACJ,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,EAAE,EAAE,MAAM,EAAE;gBACZ,KAAK,EAAE,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAC3F,CAAC;YACF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,8DAA8D;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACpF,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,uEAAuE;IACvE,IAAI,IAAI,CAAC,iBAAiB;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEhF,KAAK,CAAC,CAAC,aAAa,CAAC;QACnB,GAAG,EAAE,OAAO,EAAE;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;oBACrB,EAAE,CAAC,gBAAgB,GAAG,eAAe,CAAC;oBACtC,EAAE,CAAC,iBAAiB,GAAG,gBAAgB,CAAC;oBACxC,EAAE,CAAC,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC;gBAChD,CAAC;YACH,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/keychain.d.ts

@@ -0,0 +1,41 @@
+export interface AgySecurityResult {
+    status: number | null;
+    detail?: string;
+}
+export type AgySecurityRunner = (args: readonly string[], env: NodeJS.ProcessEnv) => AgySecurityResult;
+export interface AgyKeychainOptions {
+    platform?: NodeJS.Platform;
+    runSecurity?: AgySecurityRunner;
+}
+/**
+ * Typed, bounded setup result. `unsafe` means the profile path or target
+ * identity is not proven and callers must refuse the vendor child; a false
+ * value is a recoverable security-tool miss where agy's file fallback may
+ * still keep authentication working.
+ */
+export declare class AgyProfileKeychainError extends Error {
+    readonly code: "agy_profile_keychain_unavailable";
+    readonly unsafe: boolean;
+    constructor(detail: string, options?: {
+        unsafe?: boolean;
+    });
+}
+export declare function isAgyProfileKeychainUnsafe(error: unknown): boolean;
+/** The only keychain path agy may use for one named profile. */
+export declare function agyProfileKeychainPath(profileHome: string): string;
+/**
+ * Prepare the private Darwin keychain declared by the agy capability profile.
+ * Other platforms deliberately do nothing: Linux and Windows retain their
+ * vendor-owned credential behavior. The helper never reads, copies, or
+ * removes credential items; agy itself remains the only item owner. Creation
+ * uses a neutral bootstrap filename before adopting login.keychain-db because
+ * Apple's create operation treats the latter name as a user-list entry on the
+ * supported Darwin path.
+ */
+export declare function prepareAgyProfileKeychain(profileHome: string, options?: AgyKeychainOptions): void;
+/**
+ * Low-level Darwin ensure used by the adapter's production seams and tests.
+ * The caller has already established that this is the private agy route.
+ */
+export declare function ensureAgyProfileKeychain(profileHome: string, options?: AgyKeychainOptions): void;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,iBAAiB,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,kCAAkC,CAAU;IAC5D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,YAAY,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,EAI7D;CACF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElE;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAIN;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,IAAI,CAqHN"}

package/dist/keychain.js

@@ -0,0 +1,354 @@
+import { execFileSync } from "node:child_process";
+import { closeSync, constants, fchmodSync, fstatSync, linkSync, lstatSync, openSync, realpathSync, unlinkSync, } from "node:fs";
+import { join, resolve } from "node:path";
+import { canonicalIsolationLocator } from "@claudexor/core";
+import { ensureCanonicalPrivateDirectory, redactSecrets } from "@claudexor/util";
+const SECURITY_BINARY = "/usr/bin/security";
+const SECURITY_TIMEOUT_MS = 5_000;
+const configuredKeychains = new Set();
+/**
+ * Typed, bounded setup result. `unsafe` means the profile path or target
+ * identity is not proven and callers must refuse the vendor child; a false
+ * value is a recoverable security-tool miss where agy's file fallback may
+ * still keep authentication working.
+ */
+export class AgyProfileKeychainError extends Error {
+    code = "agy_profile_keychain_unavailable";
+    unsafe;
+    constructor(detail, options = {}) {
+        super(`agy profile keychain setup failed: ${redactSecrets(detail).slice(0, 300)}`);
+        this.name = "AgyProfileKeychainError";
+        this.unsafe = options.unsafe === true;
+    }
+}
+export function isAgyProfileKeychainUnsafe(error) {
+    return error instanceof AgyProfileKeychainError && error.unsafe;
+}
+/** The only keychain path agy may use for one named profile. */
+export function agyProfileKeychainPath(profileHome) {
+    const home = canonicalIsolationLocator(profileHome, "credential profile Antigravity HOME");
+    return join(home, "Library", "Keychains", "login.keychain-db");
+}
+/**
+ * Prepare the private Darwin keychain declared by the agy capability profile.
+ * Other platforms deliberately do nothing: Linux and Windows retain their
+ * vendor-owned credential behavior. The helper never reads, copies, or
+ * removes credential items; agy itself remains the only item owner. Creation
+ * uses a neutral bootstrap filename before adopting login.keychain-db because
+ * Apple's create operation treats the latter name as a user-list entry on the
+ * supported Darwin path.
+ */
+export function prepareAgyProfileKeychain(profileHome, options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "darwin")
+        return;
+    ensureAgyProfileKeychain(profileHome, { ...options, platform });
+}
+/**
+ * Low-level Darwin ensure used by the adapter's production seams and tests.
+ * The caller has already established that this is the private agy route.
+ */
+export function ensureAgyProfileKeychain(profileHome, options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform !== "darwin")
+        return;
+    let home;
+    let keychain;
+    try {
+        home = canonicalIsolationLocator(profileHome, "credential profile Antigravity HOME");
+        keychain = agyProfileKeychainPath(home);
+    }
+    catch (error) {
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    try {
+        try {
+            ensureOwnedDirectory(home, platform);
+            ensureOwnedDirectory(join(home, "Library"), platform);
+            ensureOwnedDirectory(join(home, "Library", "Keychains"), platform);
+        }
+        catch (error) {
+            throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+                unsafe: true,
+            });
+        }
+        let exists = validateKeychainFile(keychain, home, false);
+        const runSecurity = options.runSecurity ?? defaultSecurityRunner;
+        const env = securityEnv(home);
+        if (!exists) {
+            const bootstrap = temporaryKeychainPath(join(home, "Library", "Keychains"));
+            if (bootstrap.includes("/login.keychain")) {
+                throw new AgyProfileKeychainError("profile keychain path would match Apple's login-keychain search-list heuristic", { unsafe: true });
+            }
+            const bootstrapExists = validateKeychainFile(bootstrap, home, false);
+            const created = bootstrapExists
+                ? { status: 48, detail: "bootstrap keychain already exists" }
+                : runSecurity(["create-keychain", "-p", "", bootstrap], env);
+            const canonicalAfterCreate = validateKeychainFile(keychain, home, false);
+            if (!canonicalAfterCreate) {
+                let bootstrapReady = false;
+                if (created.status !== 0) {
+                    // A concurrent process may have won creation with a
+                    // platform-specific already-exists status. Revalidation, not a
+                    // numeric status guess, is the idempotence authority.
+                    try {
+                        validateKeychainFile(bootstrap, home, true);
+                        bootstrapReady = true;
+                    }
+                    catch (error) {
+                        // A peer can adopt and remove the bootstrap file between our
+                        // status check and this validation. Recheck the canonical winner
+                        // only for that missing-file race; identity failures remain hard
+                        // refusals.
+                        if (pathIsMissing(bootstrap) && validateKeychainFile(keychain, home, false)) {
+                            exists = true;
+                        }
+                        else {
+                            // A failed create with no usable target is unsafe: spawning agy
+                            // would return to the missing-keychain prompt. Explicit security
+                            // errors remain recoverable only when a valid file exists.
+                            if (error instanceof AgyProfileKeychainError)
+                                throw error;
+                            throw new AgyProfileKeychainError(created.detail ?? "create-keychain failed", {
+                                unsafe: true,
+                            });
+                        }
+                    }
+                }
+                else {
+                    validateKeychainFile(bootstrap, home, true);
+                    bootstrapReady = true;
+                }
+                if (bootstrapReady) {
+                    adoptBootstrapKeychain(bootstrap, keychain, home);
+                    exists = true;
+                }
+            }
+            else {
+                // Another process completed the canonical rename while this process
+                // was creating its neutral bootstrap file. The neutral file is ours;
+                // remove it only after the canonical target is identity-checked.
+                removeBootstrapKeychain(bootstrap, home);
+                exists = true;
+            }
+            configuredKeychains.delete(keychain);
+        }
+        let unlockedBeforeSettings = false;
+        if (!configuredKeychains.has(keychain)) {
+            const unlocked = runSecurity(["unlock-keychain", "-p", "", keychain], env);
+            if (unlocked.status !== 0) {
+                throw new AgyProfileKeychainError(unlocked.detail ?? "unlock-keychain failed");
+            }
+            unlockedBeforeSettings = true;
+            const settings = runSecurity(["set-keychain-settings", keychain], env);
+            if (settings.status !== 0) {
+                throw new AgyProfileKeychainError(settings.detail ?? "set-keychain-settings failed");
+            }
+            configuredKeychains.add(keychain);
+        }
+        // A login keychain can still be locked by sleep, logout, or an explicit
+        // user action. Re-open it at every vendor-spawn boundary; the first-call
+        // unlock above also makes set-keychain-settings safe on a locked file.
+        if (!unlockedBeforeSettings) {
+            const unlocked = runSecurity(["unlock-keychain", "-p", "", keychain], env);
+            if (unlocked.status !== 0) {
+                throw new AgyProfileKeychainError(unlocked.detail ?? "unlock-keychain failed");
+            }
+        }
+        validateKeychainFile(keychain, home, true);
+    }
+    catch (error) {
+        configuredKeychains.delete(keychain);
+        if (error instanceof AgyProfileKeychainError)
+            throw error;
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+}
+function securityEnv(home) {
+    return {
+        HOME: home,
+        USERPROFILE: home,
+        PATH: "/usr/bin:/bin",
+        ...(process.env.TMPDIR ? { TMPDIR: process.env.TMPDIR } : {}),
+        ...(process.env.LANG ? { LANG: process.env.LANG } : {}),
+        ...(process.env.LC_ALL ? { LC_ALL: process.env.LC_ALL } : {}),
+    };
+}
+function defaultSecurityRunner(args, env) {
+    try {
+        execFileSync(SECURITY_BINARY, [...args], {
+            env,
+            stdio: "ignore",
+            timeout: SECURITY_TIMEOUT_MS,
+            windowsHide: true,
+        });
+        return { status: 0 };
+    }
+    catch (error) {
+        const status = typeof error === "object" && error !== null && "status" in error
+            ? error.status
+            : null;
+        return {
+            status: typeof status === "number" ? status : null,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+function ensureOwnedDirectory(path, platform) {
+    try {
+        ensureCanonicalPrivateDirectory(path, platform);
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !/EEXIST|already exists/i.test(error.message))
+            throw error;
+        // Another process won the mkdir race. Re-run the full identity proof.
+        ensureCanonicalPrivateDirectory(path, platform);
+    }
+}
+function temporaryKeychainPath(directory) {
+    // Keep one deterministic neutral name so a crash between create and adopt
+    // is recoverable on the next preparation rather than accumulating orphan
+    // keychain databases. It deliberately does not contain "login.keychain",
+    // the Apple Security heuristic that updates the user search list.
+    return join(directory, ".agy-profile-bootstrap.keychain-db");
+}
+/**
+ * Install the neutral-name keychain without calling a user-domain list
+ * mutation. A hard link gives us an atomic no-replace destination on the
+ * same APFS directory; the source is then removed, so the vendor sees one
+ * canonical login.keychain-db path and no bootstrap alias remains.
+ */
+function adoptBootstrapKeychain(source, destination, home) {
+    try {
+        linkSync(source, destination);
+    }
+    catch (error) {
+        if (isAlreadyExists(error)) {
+            validateKeychainFile(destination, home, true);
+            removeBootstrapKeychain(source, home);
+            return;
+        }
+        if (isMissing(error) && validateKeychainFile(destination, home, false)) {
+            // A peer may have adopted and removed the bootstrap between our
+            // identity check and this no-replace link. The canonical winner is
+            // authoritative; do not turn that benign race into a profile refusal.
+            return;
+        }
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    try {
+        unlinkSync(source);
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            validateKeychainFile(destination, home, true);
+            return;
+        }
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    validateKeychainFile(destination, home, true);
+}
+function removeBootstrapKeychain(path, home) {
+    let exists = false;
+    try {
+        exists = validateKeychainFile(path, home, false);
+    }
+    catch (error) {
+        if (error instanceof AgyProfileKeychainError)
+            throw error;
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+    if (!exists)
+        return;
+    try {
+        unlinkSync(path);
+    }
+    catch (error) {
+        if (isMissing(error))
+            return;
+        throw new AgyProfileKeychainError(error instanceof Error ? error.message : String(error), {
+            unsafe: true,
+        });
+    }
+}
+function validateKeychainFile(path, home, required) {
+    const absolute = resolve(path);
+    let named;
+    try {
+        named = lstatSync(absolute);
+    }
+    catch (error) {
+        if (!required && isMissing(error))
+            return false;
+        throw new AgyProfileKeychainError("private keychain path is missing or unreadable", {
+            unsafe: true,
+        });
+    }
+    if (named.isSymbolicLink() || !named.isFile()) {
+        throw new AgyProfileKeychainError("private keychain path is not a regular file", {
+            unsafe: true,
+        });
+    }
+    let fd;
+    try {
+        fd = openSync(absolute, constants.O_RDWR | constants.O_NOFOLLOW);
+    }
+    catch {
+        throw new AgyProfileKeychainError("private keychain path cannot be opened safely", {
+            unsafe: true,
+        });
+    }
+    try {
+        const opened = fstatSync(fd);
+        const current = lstatSync(absolute);
+        if (!opened.isFile() ||
+            current.isSymbolicLink() ||
+            !current.isFile() ||
+            opened.dev !== current.dev ||
+            opened.ino !== current.ino ||
+            realpathSync.native(absolute) !== absolute ||
+            (typeof process.getuid === "function" && opened.uid !== process.getuid()) ||
+            !absolute.startsWith(resolve(home) + "/")) {
+            throw new AgyProfileKeychainError("private keychain identity is not canonical", {
+                unsafe: true,
+            });
+        }
+        fchmodSync(fd, 0o600);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return true;
+}
+function isMissing(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? error.code === "ENOENT"
+        : false;
+}
+function pathIsMissing(path) {
+    try {
+        lstatSync(path);
+        return false;
+    }
+    catch (error) {
+        if (isMissing(error))
+            return true;
+        throw error;
+    }
+}
+function isAlreadyExists(error) {
+    return typeof error === "object" && error !== null && "code" in error
+        ? error.code === "EEXIST"
+        : false;
+}
+//# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,+BAA+B,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEjF,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAiB9C;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,kCAA2C,CAAC;IACnD,MAAM,CAAU;IAEzB,YAAY,MAAc,EAAE,OAAO,GAAyB,EAAE;QAC5D,KAAK,CAAC,sCAAsC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IACxC,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,KAAK,YAAY,uBAAuB,IAAI,KAAK,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,MAAM,IAAI,GAAG,yBAAyB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC3F,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAAmB,EACnB,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAClC,wBAAwB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAElC,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,yBAAyB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;QACrF,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;YACtD,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACxF,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;QACjE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAC5E,IAAI,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,uBAAuB,CAC/B,gFAAgF,EAChF,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,eAAe;gBAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE;gBAC7D,CAAC,CAAC,WAAW,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;gBAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,oDAAoD;oBACpD,+DAA+D;oBAC/D,sDAAsD;oBACtD,IAAI,CAAC;wBACH,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;wBAC5C,cAAc,GAAG,IAAI,CAAC;oBACxB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,6DAA6D;wBAC7D,iEAAiE;wBACjE,iEAAiE;wBACjE,YAAY;wBACZ,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;4BAC5E,MAAM,GAAG,IAAI,CAAC;wBAChB,CAAC;6BAAM,CAAC;4BACN,gEAAgE;4BAChE,iEAAiE;4BACjE,2DAA2D;4BAC3D,IAAI,KAAK,YAAY,uBAAuB;gCAAE,MAAM,KAAK,CAAC;4BAC1D,MAAM,IAAI,uBAAuB,CAAC,OAAO,CAAC,MAAM,IAAI,wBAAwB,EAAE;gCAC5E,MAAM,EAAE,IAAI;6BACb,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC5C,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;gBACD,IAAI,cAAc,EAAE,CAAC;oBACnB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;oBAClD,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,qEAAqE;gBACrE,iEAAiE;gBACjE,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBACzC,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YACD,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,sBAAsB,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC;YACjF,CAAC;YACD,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,uBAAuB,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,IAAI,8BAA8B,CAAC,CAAC;YACvF,CAAC;YACD,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO;QACL,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,eAAe;QACrB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAuB,EAAE,GAAsB;IAC5E,IAAI,CAAC;QACH,YAAY,CAAC,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACvC,GAAG;YACH,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK;YAC9D,CAAC,CAAE,KAA8B,CAAC,MAAM;YACxC,CAAC,CAAC,IAAI,CAAC;QACX,OAAO;YACL,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAClD,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAAyB;IACnE,IAAI,CAAC;QACH,+BAA+B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,KAAK,CAAC;QAC5F,sEAAsE;QACtE,+BAA+B,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,kEAAkE;IAClE,OAAO,IAAI,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY;IAC/E,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACvE,gEAAgE;YAChE,mEAAmE;YACnE,sEAAsE;YACtE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,IAAY;IACzD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO;QAC7B,MAAM,IAAI,uBAAuB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,IAAY,EAAE,QAAiB;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC,gDAAgD,EAAE;YAClF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,EAAE;YAC/E,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,EAAE;YACjF,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;YAChB,OAAO,CAAC,cAAc,EAAE;YACxB,CAAC,OAAO,CAAC,MAAM,EAAE;YACjB,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAC1B,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;YAC1B,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;YAC1C,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACzE,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EACzC,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,EAAE;gBAC9E,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC;QACD,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAE,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACjD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAE,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACjD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC"}

package/dist/profile.d.ts

@@ -46,6 +46,8 @@ export declare function resolveAgyProfileRoute(profile: Pick<CredentialProfile,
 export interface AgyProfileProbeDeps {
     /** Injectable live probe (tests): print-mode `/model` under the profile env. */
     runModelProbe: (env: EnvMap, abortSignal?: AbortSignal) => Promise<AgyModelProbe>;
+    /** Production adapter seam: prepare the profile before the vendor probe. */
+    prepareProfileKeychain?: (home: string) => void;
 }
 export type AgyModelProbe = {
     kind: "authenticated";

package/dist/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAKpF,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAExD,eAAO,MAAM,OAAO,cAA+C,CAAC;AAEpE,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;kFAEkF;AAClF,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,MAAW,GAAG,MAAM,CASlF;AAED,MAAM,MAAM,uBAAuB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,GAAG,mBAAmB,CAAC,EACxF,OAAO,GAAE,MAAW,GACnB,uBAAuB,CAWzB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CACnF;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,iBAAiB,EAC1B,IAAI,GAAE,mBAA6D,EACnE,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAkClC"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAMpF,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAExD,eAAO,MAAM,OAAO,cAA+C,CAAC;AAEpE,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;kFAEkF;AAClF,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,MAAW,GAAG,MAAM,CASlF;AAED,MAAM,MAAM,uBAAuB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,GAAG,mBAAmB,CAAC,EACxF,OAAO,GAAE,MAAW,GACnB,uBAAuB,CAWzB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAClF,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,iBAAiB,EAC1B,IAAI,GAAE,mBAA6D,EACnE,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAyDlC"}

package/dist/profile.js

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import { canonicalIsolationLocator, providerScrubEnv } from "@claudexor/core";
 import { CredentialProfileStatus as CredentialProfileStatusSchema } from "@claudexor/schema";
 import { nowIso, redactSecrets } from "@claudexor/util";
+import { isAgyProfileKeychainUnsafe } from "./keychain.js";
 import { classifyAgyPrintResult, runAgyPrintCommand } from "./print-command.js";
 export const AGY_BIN = () => process.env.CLAUDEXOR_AGY_BIN || "agy";
 /** Canonical, Claudexor-owned HOME for one named Antigravity binding. */
@@ -114,6 +115,24 @@ export async function probeAgyCredentialProfile(profile, deps = { runModelProbe:
             verification: "not_run",
             detail: route.refusal,
         });
+    let keychainSetupWarning = null;
+    try {
+        deps.prepareProfileKeychain?.(route.home);
+    }
+    catch (error) {
+        if (isAgyProfileKeychainUnsafe(error)) {
+            return CredentialProfileStatusSchema.parse({
+                ...base,
+                availability: "unavailable",
+                verification: "not_run",
+                detail: redactSecrets(error instanceof Error ? error.message : String(error)).slice(0, 300),
+            });
+        }
+        // A custom operational seam may model a recoverable security-tool miss.
+        // Keep the vendor file fallback and disclose the degraded container on
+        // the profile status rather than presenting a completely clean proof.
+        keychainSetupWarning = redactSecrets(error instanceof Error ? error.message : String(error)).slice(0, 300);
+    }
     const probe = await deps.runModelProbe(route.env, abortSignal);
     if (probe.kind === "authenticated")
         return CredentialProfileStatusSchema.parse({
@@ -121,7 +140,10 @@ export async function probeAgyCredentialProfile(profile, deps = { runModelProbe:
             availability: "available",
             verification: "passed",
             verification_source: "vendor",
-            detail: `Antigravity accepted the named binding${probe.modelId ? ` (model ${probe.modelId})` : ""}; whether the credential is backed by a keyring or file is not inferred`,
+            detail: `Antigravity accepted the named binding${probe.modelId ? ` (model ${probe.modelId})` : ""}; whether the credential is backed by a keyring or file is not inferred` +
+                (keychainSetupWarning
+                    ? `; private profile keychain setup degraded: ${keychainSetupWarning}`
+                    : ""),
             last_verified_at: nowIso(),
         });
     if (probe.kind === "unauthenticated")

package/dist/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EAAE,uBAAuB,IAAI,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIhF,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC;AAEpE,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,yBAAyB,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;AACnF,CAAC;AAED;;kFAEkF;AAClF,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,OAAO,GAAW,EAAE;IACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO;QACL,GAAG,OAAO;QACV,GAAG,gBAAgB,EAAE;QACrB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,2BAA2B,EAAE,MAAM;KACpC,CAAC;AACJ,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwF,EACxF,OAAO,GAAW,EAAE;IAEpB,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB;QAChD,OAAO;YACL,OAAO,EAAE,uBAAuB,OAAO,CAAC,UAAU,4EAA4E;SAC/H,CAAC;IACJ,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;AACH,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,WAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,sBAAsB,CACvC,MAAM,kBAAkB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CACpE,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,UAAU,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,UAAU,CAAC;QAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,IAAI,GACR,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAE,OAAmC,CAAC,MAAM,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,EAAE,GACN,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACtD,CAAC,CAAE,IAAgC,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA0B,EAC1B,IAAI,GAAwB,EAAE,aAAa,EAAE,oBAAoB,EAAE,EACnE,WAAyB;IAEzB,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,SAAS,IAAI,KAAK;QACpB,OAAO,6BAA6B,CAAC,KAAK,CAAC;YACzC,GAAG,IAAI;YACP,YAAY,EAAE,aAAa;YAC3B,YAAY,EAAE,SAAS;YACvB,MAAM,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;QAChC,OAAO,6BAA6B,CAAC,KAAK,CAAC;YACzC,GAAG,IAAI;YACP,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,QAAQ;YACtB,mBAAmB,EAAE,QAAQ;YAC7B,MAAM,EAAE,yCAAyC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,yEAAyE;YAC1K,gBAAgB,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAClC,OAAO,6BAA6B,CAAC,KAAK,CAAC;YACzC,GAAG,IAAI;YACP,YAAY,EAAE,aAAa;YAC3B,YAAY,EAAE,QAAQ;YACtB,mBAAmB,EAAE,QAAQ;YAC7B,MAAM,EAAE,sDAAsD,KAAK,CAAC,MAAM,EAAE;SAC7E,CAAC,CAAC;IACL,OAAO,6BAA6B,CAAC,KAAK,CAAC;QACzC,GAAG,IAAI;QACP,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,SAAS;QACvB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,EAAE,uBAAuB,IAAI,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIhF,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC;AAEpE,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,yBAAyB,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;AACnF,CAAC;AAED;;kFAEkF;AAClF,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,OAAO,GAAW,EAAE;IACxE,MAAM,IAAI,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO;QACL,GAAG,OAAO;QACV,GAAG,gBAAgB,EAAE;QACrB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI;QACjB,2BAA2B,EAAE,MAAM;KACpC,CAAC;AACJ,CAAC;AAID;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwF,EACxF,OAAO,GAAW,EAAE;IAEpB,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB;QAChD,OAAO;YACL,OAAO,EAAE,uBAAuB,OAAO,CAAC,UAAU,4EAA4E;SAC/H,CAAC;IACJ,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,CAAC;AACH,CAAC;AAcD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,WAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,sBAAsB,CACvC,MAAM,kBAAkB,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CACpE,CAAC;QACF,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,UAAU,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,UAAU,CAAC;QAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,IAAI,GACR,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC/D,CAAC,CAAE,OAAmC,CAAC,MAAM,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,EAAE,GACN,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACtD,CAAC,CAAE,IAAgC,CAAC,IAAI,CAAC;YACzC,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QACpF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA0B,EAC1B,IAAI,GAAwB,EAAE,aAAa,EAAE,oBAAoB,EAAE,EACnE,WAAyB;IAEzB,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,SAAS,IAAI,KAAK;QACpB,OAAO,6BAA6B,CAAC,KAAK,CAAC;YACzC,GAAG,IAAI;YACP,YAAY,EAAE,aAAa;YAC3B,YAAY,EAAE,SAAS;YACvB,MAAM,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,IAAI,oBAAoB,GAAkB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,6BAA6B,CAAC,KAAK,CAAC;gBACzC,GAAG,IAAI;gBACP,YAAY,EAAE,aAAa;gBAC3B,YAAY,EAAE,SAAS;gBACvB,MAAM,EAAE,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAC5F,CAAC,CAAC;QACL,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,oBAAoB,GAAG,aAAa,CAClC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;QAChC,OAAO,6BAA6B,CAAC,KAAK,CAAC;YACzC,GAAG,IAAI;YACP,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,QAAQ;YACtB,mBAAmB,EAAE,QAAQ;YAC7B,MAAM,EACJ,yCAAyC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,yEAAyE;gBAClK,CAAC,oBAAoB;oBACnB,CAAC,CAAC,8CAA8C,oBAAoB,EAAE;oBACtE,CAAC,CAAC,EAAE,CAAC;YACT,gBAAgB,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;IACL,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAClC,OAAO,6BAA6B,CAAC,KAAK,CAAC;YACzC,GAAG,IAAI;YACP,YAAY,EAAE,aAAa;YAC3B,YAAY,EAAE,QAAQ;YACtB,mBAAmB,EAAE,QAAQ;YAC7B,MAAM,EAAE,sDAAsD,KAAK,CAAC,MAAM,EAAE;SAC7E,CAAC,CAAC;IACL,OAAO,6BAA6B,CAAC,KAAK,CAAC;QACzC,GAAG,IAAI;QACP,YAAY,EAAE,SAAS;QACvB,YAAY,EAAE,SAAS;QACvB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC"}

package/dist/vendor-cli-version.d.ts

@@ -7,9 +7,12 @@ import type { PinnedVendorCliVersion } from "@claudexor/util";
  * uses the vendor's official script, cursor-style, `human_observed`). It IS
  * the verification stamp: `known_models_verified_against` reads it, fixture
  * provenance records it, and the doctor discloses drift when the installed
- * binary self-updates past it. The profile file-token fallback (the whole
- * multi-account mechanism) is re-proven per bump of this constant — it is a
- * vendor ERROR path, not a documented mode (PLAN Л-15/R-2').
+ * binary self-updates past it. The profile file-token fallback is re-proven
+ * per bump of this constant. On Darwin a private profile keychain is prepared
+ * through a neutral bootstrap/adoption step before the vendor child; the file
+ * fallback remains vendor-owned recovery behavior. This Darwin exception
+ * supersedes the historical file-only lock in PLAN Л-15/R-2' under
+ * CONCEPT-CHANGE(INV-067, INV-135).
  */
 export declare const AGY_VENDOR_CLI_VERSION: PinnedVendorCliVersion;
 //# sourceMappingURL=vendor-cli-version.d.ts.map

package/dist/vendor-cli-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendor-cli-version.d.ts","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,sBAAiC,CAAC"}
+{"version":3,"file":"vendor-cli-version.d.ts","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,EAAE,sBAAiC,CAAC"}

package/dist/vendor-cli-version.js

@@ -6,9 +6,12 @@
  * uses the vendor's official script, cursor-style, `human_observed`). It IS
  * the verification stamp: `known_models_verified_against` reads it, fixture
  * provenance records it, and the doctor discloses drift when the installed
- * binary self-updates past it. The profile file-token fallback (the whole
- * multi-account mechanism) is re-proven per bump of this constant — it is a
- * vendor ERROR path, not a documented mode (PLAN Л-15/R-2').
+ * binary self-updates past it. The profile file-token fallback is re-proven
+ * per bump of this constant. On Darwin a private profile keychain is prepared
+ * through a neutral bootstrap/adoption step before the vendor child; the file
+ * fallback remains vendor-owned recovery behavior. This Darwin exception
+ * supersedes the historical file-only lock in PLAN Л-15/R-2' under
+ * CONCEPT-CHANGE(INV-067, INV-135).
  */
 export const AGY_VENDOR_CLI_VERSION = "1.1.13";
 //# sourceMappingURL=vendor-cli-version.js.map

package/dist/vendor-cli-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendor-cli-version.js","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2B,QAAQ,CAAC"}
+{"version":3,"file":"vendor-cli-version.js","sourceRoot":"","sources":["../src/vendor-cli-version.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2B,QAAQ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/harness-agy",
-  "version": "3.8.0",
+  "version": "3.8.1",
   "license": "MIT",
   "description": "Google Antigravity CLI adapter (agy -p --output-format stream-json).",
   "type": "module",
@@ -16,9 +16,9 @@
     "dist"
   ],
   "dependencies": {
-    "@claudexor/core": "3.8.0",
-    "@claudexor/util": "3.8.0",
-    "@claudexor/schema": "3.8.0"
+    "@claudexor/core": "3.8.1",
+    "@claudexor/util": "3.8.1",
+    "@claudexor/schema": "3.8.1"
   },
   "repository": {
     "type": "git",