@code-yeongyu/senpi 2026.9.10 → 2026.9.11

package/dist/core/auth-storage.d.ts

@@ -66,6 +66,8 @@ export declare class AuthStorage implements CredentialStore {
     static fromStorage(storage: AuthStorageBackend): AuthStorage;
     static inMemory(data?: AuthStorageData): AuthStorage;
     private parseStorageData;
+    /** Reports whether the parse had to heal poisoned pool slots, so a load can write the repair back once. */
+    private parseStorageContent;
     private recordError;
     private updateReadState;
     /**

package/dist/core/auth-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACX,gBAAgB,EAGhB,oBAAoB,EAEpB,UAAU,EACV,cAAc,EACd,eAAe,EACf,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEN,KAAK,cAAc,EAKnB,MAAM,uCAAuC,CAAC;AAoB/C,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,KAAK,UAAU,CAAC,CAAC,IAAI;IACpB,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAmBF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,wBAAwB;IAwBhC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAkBjE;YAEa,gBAAgB;IAwCxB,aAAa,CAAC,CAAC,EACpB,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAwCZ;CACD;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,IAAI;IA+CN,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAS9F;IAEK,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAQ7E;IAEK,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACzE,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEjC;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;CACD;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACpE,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,UAAU,CAAuC;IAEzD,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAMjE;IAED,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAcZ;CACD;AAED;;GAEG;AACH,qBAAa,WAAY,YAAW,eAAe;IAClD,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IACxE,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,SAAS,CAAoB;IAErC,OAAO,eAaN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAE,MAAyC,GAAG,WAAW,CAG9E;IAED,cAAc,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,eAAe;IAMvB;;OAEG;IACH,MAAM,IAAI,IAAI,CAcb;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAEvD;IAED,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5C;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAGnE;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAQlD;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAO7B;IAED,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAE5C;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAQpD;IAED,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAU/C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjC;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAM1C;IAED,MAAM,IAAI,eAAe,CAExB;IAED,WAAW,IAAI,KAAK,EAAE,CAIrB;YAEa,sBAAsB;YAStB,cAAc;IAkDtB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAS5F;IAEK,MAAM,CACX,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAkBjC;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5E;IAED,wEAAwE;IAClE,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAY7E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB/F;IAED,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAEhE;IAED,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEhD;IAED,iBAAiB,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAWvD;IAEK,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa7E;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAG7B;IAED,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,iBAAiB;CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAyC,GACjD,UAAU,GAAG,SAAS,CAOxB"}
+{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACX,gBAAgB,EAGhB,oBAAoB,EAEpB,UAAU,EACV,cAAc,EACd,eAAe,EACf,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEN,KAAK,cAAc,EAMnB,MAAM,uCAAuC,CAAC;AAoB/C,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAsBlD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,KAAK,UAAU,CAAC,CAAC,IAAI;IACpB,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAmBF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,wBAAwB;IAwBhC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAkBjE;YAEa,gBAAgB;IAwCxB,aAAa,CAAC,CAAC,EACpB,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAwCZ;CACD;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAE,MAAyC,EAE9D;IAED,OAAO,CAAC,IAAI;IA+CN,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAS9F;IAEK,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAQ7E;IAEK,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACzE,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEjC;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;CACD;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACpE,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,UAAU,CAAuC;IAEzD,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAMjE;IAED,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAcZ;CACD;AAED;;GAEG;AACH,qBAAa,WAAY,YAAW,eAAe;IAClD,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;IACxE,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,SAAS,CAAoB;IAErC,OAAO,eAaN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAE,MAAyC,GAAG,WAAW,CAG9E;IAED,cAAc,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED,OAAO,CAAC,gBAAgB;IAIxB,2GAA2G;IAC3G,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,eAAe;IAMvB;;OAEG;IACH,MAAM,IAAI,IAAI,CAmBb;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAEvD;IAED,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5C;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAGnE;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAQlD;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAO7B;IAED,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAE5C;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAQpD;IAED,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAU/C;IAED,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjC;IAED,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAM1C;IAED,MAAM,IAAI,eAAe,CAExB;IAED,WAAW,IAAI,KAAK,EAAE,CAIrB;YAEa,sBAAsB;YAWtB,cAAc;IAkDtB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAS5F;IAEK,MAAM,CACX,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAkBjC;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5E;IAED,wEAAwE;IAClE,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAY7E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqB/F;IAED,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,CAEhE;IAED,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAEhD;IAED,iBAAiB,IAAI,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAWvD;IAEK,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa7E;IAED,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAG7B;IAED,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,iBAAiB;CAgBzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAyC,GACjD,UAAU,GAAG,SAAS,CAOxB"}

package/dist/core/auth-storage.js

@@ -3,17 +3,38 @@
  * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
 import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai";
-import { appendLoginSlot, listSlots, removeSlot, upsertSlot, } from "@earendil-works/pi-ai/auth/pool/slots";
+import { appendLoginSlot, listSlots, removeSlot, repairManagedSentinelSlots, upsertSlot, } from "@earendil-works/pi-ai/auth/pool/slots";
 import { builtinProviders } from "@earendil-works/pi-ai/providers/all";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import lockfile from "proper-lockfile";
 import { getAgentDir } from "../config.js";
 import { raceWithAbortSignal } from "../utils/abort.js";
-import { getFileRevision, normalizePath } from "../utils/paths.js";
+import { getFileContentRevision, normalizePath } from "../utils/paths.js";
 import { stripBom } from "../utils/text.js";
 import { CredentialStoreBusyError, FILE_STORAGE_LOCK_OPTIONS, FILE_STORAGE_LOCK_RETRY_BUDGET_MS, FILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS, FILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS, FILE_STORAGE_SYNC_LOCK_BUDGET_MS, isLockError, } from "./lockfile-policy.js";
 import { isCommandConfigValue, resolveConfigValue } from "./resolve-config-value.js";
+/**
+ * Heals pools poisoned by a shipped build that stored a provider-owned pool's
+ * flat sentinel as a generated `login-N` slot. Such a slot resolves to sentinel
+ * material, fails the provider's auth `check`, and hard-errors every request
+ * whose affinity picks it - deterministically, for the lifetime of the entry -
+ * so it is dropped the moment auth.json is read and the repair is written back
+ * once by the mutable store.
+ */
+function repairPoisonedPoolSlots(data) {
+    let repaired;
+    for (const [providerId, credential] of Object.entries(data)) {
+        if (typeof credential !== "object" || credential === null)
+            continue;
+        const healed = repairManagedSentinelSlots(providerId, credential);
+        if (!healed)
+            continue;
+        repaired ??= { ...data };
+        repaired[providerId] = healed;
+    }
+    return repaired ? { data: repaired, repaired: true } : { data, repaired: false };
+}
 // The mode applies only on creation so administrator-managed modes and ACLs remain intact.
 const AUTH_FILE_WRITE_OPTIONS = { encoding: "utf-8", mode: 0o600 };
 let sharedAuthFileReadState;
@@ -192,7 +213,7 @@ export class ReadOnlyAuthStorage {
             }
             throw new Error(`Invalid auth.json credential for provider "${providerId}"`);
         }
-        this.data = parsed;
+        this.data = repairPoisonedPoolSlots(parsed).data;
         return this.data;
     }
     async read(providerId, options) {
@@ -266,7 +287,7 @@ export class AuthStorage {
             sharedAuthFileReadState = { authPath, readState: this.readState };
         }
         if (authPath) {
-            const revision = getFileRevision(authPath);
+            const revision = getFileContentRevision(authPath);
             if (revision !== undefined && revision === this.readState.revision)
                 return;
         }
@@ -288,10 +309,14 @@ export class AuthStorage {
         return AuthStorage.fromStorage(storage);
     }
     parseStorageData(content) {
+        return this.parseStorageContent(content).data;
+    }
+    /** Reports whether the parse had to heal poisoned pool slots, so a load can write the repair back once. */
+    parseStorageContent(content) {
         if (!content) {
-            return {};
+            return { data: {}, repaired: false };
         }
-        return JSON.parse(stripBom(content));
+        return repairPoisonedPoolSlots(JSON.parse(stripBom(content)));
     }
     recordError(error) {
         this.errors.push(error instanceof Error ? error : new Error(String(error)));
@@ -305,15 +330,20 @@ export class AuthStorage {
      * Reload credentials from storage.
      */
     reload() {
-        let content;
+        let data = {};
         let revision;
         try {
             this.storage.withLock((current) => {
-                content = current;
-                revision = this.authPath ? getFileRevision(this.authPath) : undefined;
-                return { result: undefined };
+                const parsed = this.parseStorageContent(current);
+                data = parsed.data;
+                // A written repair invalidates the revision read before it; leaving it
+                // unset makes the next reader re-read instead of trusting a stale stamp.
+                revision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);
+                return parsed.repaired
+                    ? { result: undefined, next: JSON.stringify(parsed.data, null, 2) }
+                    : { result: undefined };
             });
-            this.updateReadState(this.parseStorageData(content), revision);
+            this.updateReadState(data, revision);
         }
         catch (error) {
             // Preserve the last valid in-memory snapshot.
@@ -402,10 +432,12 @@ export class AuthStorage {
     }
     async reloadFromStorageAsync(options) {
         return this.storage.withLockAsync(async (content) => {
-            const currentData = this.parseStorageData(content);
-            const revision = this.authPath ? getFileRevision(this.authPath) : undefined;
-            this.updateReadState(currentData, revision);
-            return { result: currentData };
+            const parsed = this.parseStorageContent(content);
+            const revision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);
+            this.updateReadState(parsed.data, revision);
+            return parsed.repaired
+                ? { result: parsed.data, next: JSON.stringify(parsed.data, null, 2) }
+                : { result: parsed.data };
         }, options);
     }
     async readLatestData(options) {
@@ -420,7 +452,7 @@ export class AuthStorage {
                 return this.readState.data;
             }
         }
-        const revision = getFileRevision(this.authPath);
+        const revision = getFileContentRevision(this.authPath);
         if (revision !== undefined && revision === this.readState.revision)
             return this.readState.data;
         if (!this.readState.reload) {
@@ -481,7 +513,7 @@ export class AuthStorage {
             const next = await fn(currentData[provider]);
             if (next === undefined) {
                 latestData = currentData;
-                revision = this.authPath ? getFileRevision(this.authPath) : undefined;
+                revision = this.authPath ? getFileContentRevision(this.authPath) : undefined;
                 return { result: currentData[provider] };
             }
             const merged = { ...currentData, [provider]: next };

package/dist/core/auth-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACN,eAAe,EAEf,SAAS,EAET,UAAU,EACV,UAAU,GACV,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,gCAAgC,EAChC,WAAW,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAqBrF,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAc5E,IAAI,uBAAuF,CAAC;AAU5F,MAAM,OAAO,sBAAsB;IAGlC,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,eAAe;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAEO,gBAAgB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IAEO,wBAAwB,CAAC,IAAY;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,yBAAyB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,gCAAgC,EAAE,CAAC;oBAClD,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,gCAAgC,GAAG,QAAQ,CAC3C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAI,EAAkD;QAC7D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAA+B,EAC/B,aAAqC;QAErC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,4EAA4E;QAC5E,2EAA2E;QAC3E,4DAA4D;QAC5D,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAClD,GAAG,yBAAyB;oBAC5B,OAAO,EAAE,CAAC;oBACV,aAAa;iBACb,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACrB,MAAM,OAAO,EAAE,CAAC;oBAChB,MAAM,CAAC,cAAc,EAAE,CAAC;gBACzB,CAAC;gBACD,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,iCAAiC,EAAE,CAAC;oBACnD,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,iCAAiC,GAAG,QAAQ,CAC5C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,mBAAmB,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,EAA2D,EAC3D,OAA8B;QAE9B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAA0C,CAAC;QAC/C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,oBAAuC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC/B,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,oBAAoB,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9E,CAAC;QACF,CAAC,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChE,eAAe,GAAG,IAAI,CAAC;gBACvB,oBAAoB,GAAG,KAAK,CAAC;YAC9B,CAAC,CAAC,CAAC;YAEH,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,OAAO,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,iDAAiD;gBAClD,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,mBAAmB;IAI/B,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,IAAI;QACX,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAEhC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAG,UAAqC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC;gBAC1E,MAAM,QAAQ,GACb,KAAK,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAC7B,KAAK,CAAC,GAAG,KAAK,IAAI;wBAClB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;wBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACxE,IAAI,QAAQ,IAAI,QAAQ;oBAAE,SAAS;YACpC,CAAC;iBAAM,IACN,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAChC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,CAAC;gBACF,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,MAAyB,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,UAAU;YACV,IAAI,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,GAAyE,EACzE,QAA+B;QAE/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAA+B;QAChE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;CACD;AAED,MAAM,OAAO,0BAA0B;IAAvC;QAES,eAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IA4B1D,CAAC;IA1BA,QAAQ,CAAI,EAAkD;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,aAAa,CACZ,EAA2D,EAC3D,OAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IASvB,YAAoB,OAA2B,EAAE,QAAiB;QAR1D,SAAI,GAAoB,EAAE,CAAC;QAClB,qBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,4BAAuB,GAAG,IAAI,GAAG,EAAqB,CAAC;QAChE,WAAM,GAAY,EAAE,CAAC;QAM5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS;YACb,QAAQ,IAAI,uBAAuB,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/G,IAAI,QAAQ,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1C,uBAAuB,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,OAAO;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAChE,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5F,CAAC;IAED,cAAc;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB,CAAC;IACzD,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,eAAe,CAAC,IAAqB,EAAE,QAAiB;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,OAA2B,CAAC;QAChC,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACjC,OAAO,GAAG,OAAO,CAAC;gBAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,8CAA8C;YAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAgB,EAAE,MAAc;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,mBAAmB,CAAC,QAAgB;QACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,cAAc,CAAC,QAAgB;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,UAAU,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,UAAsB;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAAgB;QACzB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAiC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,IAAoB;QAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,IAAY;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;;gBAC7C,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAC1G,CAAC;IAED,aAAa,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5G,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACxG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,WAAW;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,OAA8B;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,EAAE,OAAO,CAAC,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,MAAM,GAAmB;gBAC9B,UAAU;gBACV,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;aACV,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CACvB,GAAG,EAAE;gBACJ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,CACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,CAAC;gBACJ,OAAO,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;gBAClC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACpD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,MAAM,CACX,QAAgB,EAChB,EAAwE,EACxE,OAA8B;QAE9B,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,IAAI,QAA4B,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,GAAG,WAAW,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACrE,UAAU,GAAG,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YACpF,UAAU;YACV,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;SACrC,CAAC,CACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAO,GAAqB,EAAE;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC;QAC1D,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YAC5F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,OAAO,GAAG,UAAU,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBAChE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO;wBAAE,OAAO,MAAM,CAAC;oBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBACnG,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,IAAI,KAAK,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAClD,OAAO,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,qBAAqB,CAAC,UAAkB,EAAE,KAAgB;QACzD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,uBAAuB,CAAC,UAAkB;QACzC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,iBAAiB;QAChB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;SAChB,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CACL,CAAC;QACF,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,SAA8B;QAC7D,MAAM,KAAK,GACV,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC5C,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;QAChE,MAAM,WAAW,GAA8C;YAC9D,MAAM;YACN,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9D,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;SAC3D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAEO,kBAAkB,CAAC,MAAkB,EAAE,SAA8B;QAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,aAAa;gBACjB,OAAO,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,KAAK,QAAQ;gBACZ,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChD,IAAI,KAAK,KAAK,SAAS;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC5D,OAAO,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;YACJ,KAAK,QAAQ,CAAC;YACd,KAAK,MAAM;gBACV,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAEO,iBAAiB,CAAC,KAAgB,EAAE,SAA8B;QACzE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,UAAU;gBACd,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,MAAM;YACP,KAAK,aAAa;gBACjB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM;YACP,KAAK,MAAM;gBACV,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;QACR,CAAC;IACF,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAAkB,EAClB,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;IAEnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAoB,CAAC;QACrG,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type {\n\tApiKeyCredential,\n\tAuthEvent,\n\tAuthInteraction,\n\tAuthOperationOptions,\n\tAuthPrompt,\n\tCredential,\n\tCredentialInfo,\n\tCredentialStore,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthLoginCallbacks,\n} from \"@earendil-works/pi-ai\";\nimport { findEnvKeys, getEnvApiKey } from \"@earendil-works/pi-ai\";\nimport {\n\tappendLoginSlot,\n\ttype CredentialSlot,\n\tlistSlots,\n\ttype PooledCredential,\n\tremoveSlot,\n\tupsertSlot,\n} from \"@earendil-works/pi-ai/auth/pool/slots\";\nimport { builtinProviders } from \"@earendil-works/pi-ai/providers/all\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\nimport { dirname, join } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { getAgentDir } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileRevision, normalizePath } from \"../utils/paths.ts\";\nimport { stripBom } from \"../utils/text.ts\";\nimport {\n\tCredentialStoreBusyError,\n\tFILE_STORAGE_LOCK_OPTIONS,\n\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS,\n\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS,\n\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS,\n\tisLockError,\n} from \"./lockfile-policy.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\nexport type AuthCredential = Credential;\nexport type { ApiKeyCredential, OAuthCredential };\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport interface GetApiKeyOptions {\n\tincludeFallback?: boolean;\n}\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\n// The mode applies only on creation so administrator-managed modes and ACLs remain intact.\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { ...FILE_STORAGE_LOCK_OPTIONS, retries: 0 });\n\t\t\t} catch (error) {\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_SYNC_LOCK_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(path, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tconst sleeper = new Int32Array(new SharedArrayBuffer(4));\n\t\t\t\tAtomics.wait(sleeper, 0, 0, delayMs);\n\t\t\t}\n\t\t}\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tsignal?.throwIfAborted();\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\t// The retry loop stays here rather than delegating to proper-lockfile's own\n\t\t// `retries`, so an abort is observed between attempts instead of after the\n\t\t// whole budget, and `onCompromised` is rebound per attempt.\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\tconst release = await lockfile.lock(this.authPath, {\n\t\t\t\t\t...FILE_STORAGE_LOCK_OPTIONS,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t\tif (signal?.aborted) {\n\t\t\t\t\tawait release();\n\t\t\t\t\tsignal.throwIfAborted();\n\t\t\t\t}\n\t\t\t\treturn release;\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_LOCK_RETRY_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(this.authPath, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tawait raceWithAbortSignal(new Promise<void>((resolve) => setTimeout(resolve, delayMs)), signal);\n\t\t\t}\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(stripBom(readFileSync(this.authPath, \"utf-8\")));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = parsed as AuthStorageData;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credential = this.load()[providerId];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (credential.type !== \"api_key\" || !credential.key || isCommandConfigValue(credential.key)) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate data: AuthStorageData = {};\n\tprivate readonly runtimeOverrides = new Map<string, string>();\n\tprivate readonly extensionOAuthProviders = new Map<string, OAuthAuth>();\n\tprivate errors: Error[] = [];\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = join(getAgentDir(), \"auth.json\")): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tgetStoragePath(): string | undefined {\n\t\treturn this.authPath;\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(stripBom(content)) as AuthStorageData;\n\t}\n\n\tprivate recordError(error: unknown): void {\n\t\tthis.errors.push(error instanceof Error ? error : new Error(String(error)));\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.data = data;\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet content: string | undefined;\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tcontent = current;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(this.parseStorageData(content), revision);\n\t\t} catch (error) {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t\tthis.recordError(error instanceof Error ? error : new Error(String(error)));\n\t\t}\n\t}\n\n\t/** Set a non-persistent API key used ahead of stored credentials. */\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\n\t\tthis.runtimeOverrides.set(provider, apiKey);\n\t}\n\n\tremoveRuntimeApiKey(provider: string): void {\n\t\tthis.runtimeOverrides.delete(provider);\n\t}\n\n\tget(provider: string): Credential | undefined {\n\t\treturn this.data[provider];\n\t}\n\n\tgetProviderEnv(provider: string): Record<string, string> | undefined {\n\t\tconst credential = this.data[provider];\n\t\treturn credential?.type === \"api_key\" && credential.env ? { ...credential.env } : undefined;\n\t}\n\n\tset(provider: string, credential: Credential): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = appendLoginSlot(currentData[provider], credential);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremove(provider: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst nextData = { ...this.parseStorageData(content) };\n\t\t\tdelete nextData[provider];\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tlistSlots(provider: string): CredentialSlot[] {\n\t\treturn listSlots(this.data[provider] as PooledCredential | undefined);\n\t}\n\n\tsetSlot(provider: string, slot: CredentialSlot): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = upsertSlot(currentData[provider] as PooledCredential | undefined, slot);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremoveSlot(provider: string, name: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = removeSlot(currentData[provider] as PooledCredential | undefined, name);\n\t\t\tconst nextData = { ...currentData };\n\t\t\tif (next === undefined) delete nextData[provider];\n\t\t\telse nextData[provider] = next;\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\thas(provider: string): boolean {\n\t\treturn provider in this.data;\n\t}\n\n\thasAuth(provider: string): boolean {\n\t\treturn this.runtimeOverrides.has(provider) || this.has(provider) || getEnvApiKey(provider) !== undefined;\n\t}\n\n\tgetAuthStatus(provider: string): AuthStatus {\n\t\tif (this.has(provider)) return { configured: true, source: \"stored\" };\n\t\tif (this.runtimeOverrides.has(provider)) return { configured: true, source: \"runtime\", label: \"--api-key\" };\n\t\tconst envName = findEnvKeys(provider)?.[0];\n\t\tif (envName && process.env[envName]) return { configured: true, source: \"environment\", label: envName };\n\t\treturn { configured: false };\n\t}\n\n\tgetAll(): AuthStorageData {\n\t\treturn { ...this.data };\n\t}\n\n\tdrainErrors(): Error[] {\n\t\tconst errors = this.errors;\n\t\tthis.errors = [];\n\t\treturn errors;\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst revision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\tthis.updateReadState(currentData, revision);\n\t\t\treturn { result: currentData };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\ttry {\n\t\t\t\treturn await this.reloadFromStorageAsync(options);\n\t\t\t} catch (error) {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\tthis.recordError(error);\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t}\n\t\tconst revision = getFileRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t(error: unknown) => {\n\t\t\t\t\tif (!controller.signal.aborted) this.recordError(error);\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\ttry {\n\t\t\t\treturn await raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\t} catch {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst runtimeKey = this.runtimeOverrides.get(provider);\n\t\tif (runtimeKey) return { type: \"api_key\", key: runtimeKey };\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.runtimeOverrides.delete(provider);\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = new Map(\n\t\t\tObject.entries(await this.readLatestData(options)).map(([providerId, credential]) => [\n\t\t\t\tproviderId,\n\t\t\t\t{ providerId, type: credential.type },\n\t\t\t]),\n\t\t);\n\t\toptions?.signal?.throwIfAborted();\n\t\tfor (const providerId of this.runtimeOverrides.keys()) {\n\t\t\tentries.set(providerId, { providerId, type: \"api_key\" });\n\t\t}\n\t\treturn [...entries.values()];\n\t}\n\n\tasync getApiKey(providerId: string, options: GetApiKeyOptions = {}): Promise<string | undefined> {\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\n\t\tif (runtimeKey) return runtimeKey;\n\t\tconst credential = await this.read(providerId);\n\t\tif (credential?.type === \"api_key\") return credential.key;\n\t\tif (credential?.type === \"oauth\") {\n\t\t\tconst oauth = builtinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\t\tif (!oauth) return undefined;\n\t\t\tlet current = credential;\n\t\t\tif (Date.now() >= current.expires) {\n\t\t\t\tconst refreshed = await this.modify(providerId, async (stored) => {\n\t\t\t\t\tif (stored?.type !== \"oauth\") return stored;\n\t\t\t\t\treturn Date.now() < stored.expires ? stored : oauth.refresh(stored, new AbortController().signal);\n\t\t\t\t});\n\t\t\t\tif (refreshed?.type !== \"oauth\") return undefined;\n\t\t\t\tcurrent = refreshed;\n\t\t\t}\n\t\t\treturn (await oauth.toAuth(current)).apiKey;\n\t\t}\n\t\tif (options.includeFallback === false) return undefined;\n\t\treturn getEnvApiKey(providerId);\n\t}\n\n\tregisterOAuthProvider(providerId: string, oauth: OAuthAuth): void {\n\t\tthis.extensionOAuthProviders.set(providerId, oauth);\n\t}\n\n\tunregisterOAuthProvider(providerId: string): void {\n\t\tthis.extensionOAuthProviders.delete(providerId);\n\t}\n\n\tgetOAuthProviders(): Array<{ id: string; name: string }> {\n\t\tconst dynamic = [...this.extensionOAuthProviders.entries()].map(([id, oauth]) => ({\n\t\t\tid,\n\t\t\tname: oauth.name,\n\t\t}));\n\t\tconst builtin = builtinProviders().flatMap((provider) =>\n\t\t\tprovider.auth.oauth && !this.extensionOAuthProviders.has(provider.id)\n\t\t\t\t? [{ id: provider.id, name: provider.auth.oauth.name }]\n\t\t\t\t: [],\n\t\t);\n\t\treturn [...dynamic, ...builtin];\n\t}\n\n\tasync login(providerId: string, callbacks: OAuthLoginCallbacks): Promise<void> {\n\t\tconst oauth =\n\t\t\tthis.extensionOAuthProviders.get(providerId) ??\n\t\t\tbuiltinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\tif (!oauth) throw new Error(`Unknown OAuth provider: ${providerId}`);\n\t\tconst signal = callbacks.signal ?? new AbortController().signal;\n\t\tconst interaction: AuthInteraction & { signal: AbortSignal } = {\n\t\t\tsignal,\n\t\t\tprompt: (prompt) => this.handleLegacyPrompt(prompt, callbacks),\n\t\t\tnotify: (event) => this.handleLegacyEvent(event, callbacks),\n\t\t};\n\t\tconst credential = await oauth.login(interaction);\n\t\tthis.set(providerId, credential);\n\t}\n\n\tlogout(provider: string): void {\n\t\tthis.removeRuntimeApiKey(provider);\n\t\tthis.remove(provider);\n\t}\n\n\tprivate handleLegacyPrompt(prompt: AuthPrompt, callbacks: OAuthLoginCallbacks): Promise<string> {\n\t\tswitch (prompt.type) {\n\t\t\tcase \"manual_code\":\n\t\t\t\treturn callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);\n\t\t\tcase \"select\":\n\t\t\t\treturn callbacks.onSelect(prompt).then((value) => {\n\t\t\t\t\tif (value === undefined) throw new Error(\"Login cancelled\");\n\t\t\t\t\treturn value;\n\t\t\t\t});\n\t\t\tcase \"secret\":\n\t\t\tcase \"text\":\n\t\t\t\treturn callbacks.onPrompt(prompt);\n\t\t}\n\t}\n\n\tprivate handleLegacyEvent(event: AuthEvent, callbacks: OAuthLoginCallbacks): void {\n\t\tswitch (event.type) {\n\t\t\tcase \"auth_url\":\n\t\t\t\tcallbacks.onAuth(event);\n\t\t\t\tbreak;\n\t\t\tcase \"device_code\":\n\t\t\t\tcallbacks.onDeviceCode(event);\n\t\t\t\tbreak;\n\t\t\tcase \"info\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t\tcase \"progress\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(\n\tproviderId: string,\n\tauthPath: string = join(getAgentDir(), \"auth.json\"),\n): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), \"utf-8\"))) as AuthStorageData;\n\t\treturn data[providerId];\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}
+{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACN,eAAe,EAEf,SAAS,EAET,UAAU,EACV,0BAA0B,EAC1B,UAAU,GACV,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,gCAAgC,EAChC,WAAW,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIrF;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,IAAqB;IACrD,IAAI,QAAqC,CAAC;IAC1C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QACpE,MAAM,MAAM,GAAG,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,QAAQ,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClF,CAAC;AAmBD,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAc5E,IAAI,uBAAuF,CAAC;AAU5F,MAAM,OAAO,sBAAsB;IAGlC,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,eAAe;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAEO,gBAAgB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IAEO,wBAAwB,CAAC,IAAY;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,yBAAyB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,gCAAgC,EAAE,CAAC;oBAClD,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,gCAAgC,GAAG,QAAQ,CAC3C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAI,EAAkD;QAC7D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAA+B,EAC/B,aAAqC;QAErC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,4EAA4E;QAC5E,2EAA2E;QAC3E,4DAA4D;QAC5D,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAClD,GAAG,yBAAyB;oBAC5B,OAAO,EAAE,CAAC;oBACV,aAAa;iBACb,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACrB,MAAM,OAAO,EAAE,CAAC;oBAChB,MAAM,CAAC,cAAc,EAAE,CAAC;gBACzB,CAAC;gBACD,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,iCAAiC,EAAE,CAAC;oBACnD,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,iCAAiC,GAAG,QAAQ,CAC5C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,mBAAmB,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,EAA2D,EAC3D,OAA8B;QAE9B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAA0C,CAAC;QAC/C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,oBAAuC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC/B,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,oBAAoB,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9E,CAAC;QACF,CAAC,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChE,eAAe,GAAG,IAAI,CAAC;gBACvB,oBAAoB,GAAG,KAAK,CAAC;YAC9B,CAAC,CAAC,CAAC;YAEH,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,OAAO,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,iDAAiD;gBAClD,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,mBAAmB;IAI/B,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,IAAI;QACX,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAEhC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAG,UAAqC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC;gBAC1E,MAAM,QAAQ,GACb,KAAK,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAC7B,KAAK,CAAC,GAAG,KAAK,IAAI;wBAClB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;wBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACxE,IAAI,QAAQ,IAAI,QAAQ;oBAAE,SAAS;YACpC,CAAC;iBAAM,IACN,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAChC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,CAAC;gBACF,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,MAAyB,CAAC,CAAC,IAAI,CAAC;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,UAAU;YACV,IAAI,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,GAAyE,EACzE,QAA+B;QAE/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAA+B;QAChE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;CACD;AAED,MAAM,OAAO,0BAA0B;IAAvC;QAES,eAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IA4B1D,CAAC;IA1BA,QAAQ,CAAI,EAAkD;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,aAAa,CACZ,EAA2D,EAC3D,OAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IASvB,YAAoB,OAA2B,EAAE,QAAiB;QAR1D,SAAI,GAAoB,EAAE,CAAC;QAClB,qBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,4BAAuB,GAAG,IAAI,GAAG,EAAqB,CAAC;QAChE,WAAM,GAAY,EAAE,CAAC;QAM5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS;YACb,QAAQ,IAAI,uBAAuB,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/G,IAAI,QAAQ,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1C,uBAAuB,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,OAAO;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAChE,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5F,CAAC;IAED,cAAc;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,2GAA2G;IACnG,mBAAmB,CAAC,OAA2B;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB,CAAC,CAAC;IAClF,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,eAAe,CAAC,IAAqB,EAAE,QAAiB;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,IAAI,GAAoB,EAAE,CAAC;QAC/B,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACnB,uEAAuE;gBACvE,yEAAyE;gBACzE,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjG,OAAO,MAAM,CAAC,QAAQ;oBACrB,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;oBACnE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,8CAA8C;YAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAgB,EAAE,MAAc;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,mBAAmB,CAAC,QAAgB;QACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,cAAc,CAAC,QAAgB;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,UAAU,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,UAAsB;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAAgB;QACzB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAiC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,IAAoB;QAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,IAAY;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;;gBAC7C,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAC1G,CAAC;IAED,aAAa,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5G,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACxG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,WAAW;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,OAA8B;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ;gBACrB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACrE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,EAAE,OAAO,CAAC,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,MAAM,GAAmB;gBAC9B,UAAU;gBACV,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;aACV,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CACvB,GAAG,EAAE;gBACJ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,CACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,CAAC;gBACJ,OAAO,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;gBAClC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACpD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,MAAM,CACX,QAAgB,EAChB,EAAwE,EACxE,OAA8B;QAE9B,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,IAAI,QAA4B,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,GAAG,WAAW,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACrE,UAAU,GAAG,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YACpF,UAAU;YACV,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;SACrC,CAAC,CACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAO,GAAqB,EAAE;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC;QAC1D,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YAC5F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,OAAO,GAAG,UAAU,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBAChE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO;wBAAE,OAAO,MAAM,CAAC;oBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBACnG,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,IAAI,KAAK,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAClD,OAAO,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,qBAAqB,CAAC,UAAkB,EAAE,KAAgB;QACzD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,uBAAuB,CAAC,UAAkB;QACzC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,iBAAiB;QAChB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;SAChB,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CACL,CAAC;QACF,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,SAA8B;QAC7D,MAAM,KAAK,GACV,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC5C,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;QAChE,MAAM,WAAW,GAA8C;YAC9D,MAAM;YACN,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9D,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;SAC3D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAEO,kBAAkB,CAAC,MAAkB,EAAE,SAA8B;QAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,aAAa;gBACjB,OAAO,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,KAAK,QAAQ;gBACZ,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChD,IAAI,KAAK,KAAK,SAAS;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC5D,OAAO,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;YACJ,KAAK,QAAQ,CAAC;YACd,KAAK,MAAM;gBACV,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAEO,iBAAiB,CAAC,KAAgB,EAAE,SAA8B;QACzE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,UAAU;gBACd,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,MAAM;YACP,KAAK,aAAa;gBACjB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM;YACP,KAAK,MAAM;gBACV,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;QACR,CAAC;IACF,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAAkB,EAClB,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;IAEnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAoB,CAAC;QACrG,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type {\n\tApiKeyCredential,\n\tAuthEvent,\n\tAuthInteraction,\n\tAuthOperationOptions,\n\tAuthPrompt,\n\tCredential,\n\tCredentialInfo,\n\tCredentialStore,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthLoginCallbacks,\n} from \"@earendil-works/pi-ai\";\nimport { findEnvKeys, getEnvApiKey } from \"@earendil-works/pi-ai\";\nimport {\n\tappendLoginSlot,\n\ttype CredentialSlot,\n\tlistSlots,\n\ttype PooledCredential,\n\tremoveSlot,\n\trepairManagedSentinelSlots,\n\tupsertSlot,\n} from \"@earendil-works/pi-ai/auth/pool/slots\";\nimport { builtinProviders } from \"@earendil-works/pi-ai/providers/all\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\nimport { dirname, join } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { getAgentDir } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileContentRevision, normalizePath } from \"../utils/paths.ts\";\nimport { stripBom } from \"../utils/text.ts\";\nimport {\n\tCredentialStoreBusyError,\n\tFILE_STORAGE_LOCK_OPTIONS,\n\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS,\n\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS,\n\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS,\n\tisLockError,\n} from \"./lockfile-policy.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\n/**\n * Heals pools poisoned by a shipped build that stored a provider-owned pool's\n * flat sentinel as a generated `login-N` slot. Such a slot resolves to sentinel\n * material, fails the provider's auth `check`, and hard-errors every request\n * whose affinity picks it - deterministically, for the lifetime of the entry -\n * so it is dropped the moment auth.json is read and the repair is written back\n * once by the mutable store.\n */\nfunction repairPoisonedPoolSlots(data: AuthStorageData): { data: AuthStorageData; repaired: boolean } {\n\tlet repaired: AuthStorageData | undefined;\n\tfor (const [providerId, credential] of Object.entries(data)) {\n\t\tif (typeof credential !== \"object\" || credential === null) continue;\n\t\tconst healed = repairManagedSentinelSlots(providerId, credential);\n\t\tif (!healed) continue;\n\t\trepaired ??= { ...data };\n\t\trepaired[providerId] = healed;\n\t}\n\treturn repaired ? { data: repaired, repaired: true } : { data, repaired: false };\n}\n\nexport type AuthCredential = Credential;\nexport type { ApiKeyCredential, OAuthCredential };\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport interface GetApiKeyOptions {\n\tincludeFallback?: boolean;\n}\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\n// The mode applies only on creation so administrator-managed modes and ACLs remain intact.\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { ...FILE_STORAGE_LOCK_OPTIONS, retries: 0 });\n\t\t\t} catch (error) {\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_SYNC_LOCK_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(path, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tconst sleeper = new Int32Array(new SharedArrayBuffer(4));\n\t\t\t\tAtomics.wait(sleeper, 0, 0, delayMs);\n\t\t\t}\n\t\t}\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tsignal?.throwIfAborted();\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\t// The retry loop stays here rather than delegating to proper-lockfile's own\n\t\t// `retries`, so an abort is observed between attempts instead of after the\n\t\t// whole budget, and `onCompromised` is rebound per attempt.\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\tconst release = await lockfile.lock(this.authPath, {\n\t\t\t\t\t...FILE_STORAGE_LOCK_OPTIONS,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t\tif (signal?.aborted) {\n\t\t\t\t\tawait release();\n\t\t\t\t\tsignal.throwIfAborted();\n\t\t\t\t}\n\t\t\t\treturn release;\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_LOCK_RETRY_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(this.authPath, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tawait raceWithAbortSignal(new Promise<void>((resolve) => setTimeout(resolve, delayMs)), signal);\n\t\t\t}\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(stripBom(readFileSync(this.authPath, \"utf-8\")));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = repairPoisonedPoolSlots(parsed as AuthStorageData).data;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credential = this.load()[providerId];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (credential.type !== \"api_key\" || !credential.key || isCommandConfigValue(credential.key)) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate data: AuthStorageData = {};\n\tprivate readonly runtimeOverrides = new Map<string, string>();\n\tprivate readonly extensionOAuthProviders = new Map<string, OAuthAuth>();\n\tprivate errors: Error[] = [];\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileContentRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = join(getAgentDir(), \"auth.json\")): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tgetStoragePath(): string | undefined {\n\t\treturn this.authPath;\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\treturn this.parseStorageContent(content).data;\n\t}\n\n\t/** Reports whether the parse had to heal poisoned pool slots, so a load can write the repair back once. */\n\tprivate parseStorageContent(content: string | undefined): { data: AuthStorageData; repaired: boolean } {\n\t\tif (!content) {\n\t\t\treturn { data: {}, repaired: false };\n\t\t}\n\t\treturn repairPoisonedPoolSlots(JSON.parse(stripBom(content)) as AuthStorageData);\n\t}\n\n\tprivate recordError(error: unknown): void {\n\t\tthis.errors.push(error instanceof Error ? error : new Error(String(error)));\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.data = data;\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet data: AuthStorageData = {};\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tconst parsed = this.parseStorageContent(current);\n\t\t\t\tdata = parsed.data;\n\t\t\t\t// A written repair invalidates the revision read before it; leaving it\n\t\t\t\t// unset makes the next reader re-read instead of trusting a stale stamp.\n\t\t\t\trevision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);\n\t\t\t\treturn parsed.repaired\n\t\t\t\t\t? { result: undefined, next: JSON.stringify(parsed.data, null, 2) }\n\t\t\t\t\t: { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(data, revision);\n\t\t} catch (error) {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t\tthis.recordError(error instanceof Error ? error : new Error(String(error)));\n\t\t}\n\t}\n\n\t/** Set a non-persistent API key used ahead of stored credentials. */\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\n\t\tthis.runtimeOverrides.set(provider, apiKey);\n\t}\n\n\tremoveRuntimeApiKey(provider: string): void {\n\t\tthis.runtimeOverrides.delete(provider);\n\t}\n\n\tget(provider: string): Credential | undefined {\n\t\treturn this.data[provider];\n\t}\n\n\tgetProviderEnv(provider: string): Record<string, string> | undefined {\n\t\tconst credential = this.data[provider];\n\t\treturn credential?.type === \"api_key\" && credential.env ? { ...credential.env } : undefined;\n\t}\n\n\tset(provider: string, credential: Credential): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = appendLoginSlot(currentData[provider], credential);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremove(provider: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst nextData = { ...this.parseStorageData(content) };\n\t\t\tdelete nextData[provider];\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tlistSlots(provider: string): CredentialSlot[] {\n\t\treturn listSlots(this.data[provider] as PooledCredential | undefined);\n\t}\n\n\tsetSlot(provider: string, slot: CredentialSlot): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = upsertSlot(currentData[provider] as PooledCredential | undefined, slot);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremoveSlot(provider: string, name: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = removeSlot(currentData[provider] as PooledCredential | undefined, name);\n\t\t\tconst nextData = { ...currentData };\n\t\t\tif (next === undefined) delete nextData[provider];\n\t\t\telse nextData[provider] = next;\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\thas(provider: string): boolean {\n\t\treturn provider in this.data;\n\t}\n\n\thasAuth(provider: string): boolean {\n\t\treturn this.runtimeOverrides.has(provider) || this.has(provider) || getEnvApiKey(provider) !== undefined;\n\t}\n\n\tgetAuthStatus(provider: string): AuthStatus {\n\t\tif (this.has(provider)) return { configured: true, source: \"stored\" };\n\t\tif (this.runtimeOverrides.has(provider)) return { configured: true, source: \"runtime\", label: \"--api-key\" };\n\t\tconst envName = findEnvKeys(provider)?.[0];\n\t\tif (envName && process.env[envName]) return { configured: true, source: \"environment\", label: envName };\n\t\treturn { configured: false };\n\t}\n\n\tgetAll(): AuthStorageData {\n\t\treturn { ...this.data };\n\t}\n\n\tdrainErrors(): Error[] {\n\t\tconst errors = this.errors;\n\t\tthis.errors = [];\n\t\treturn errors;\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst parsed = this.parseStorageContent(content);\n\t\t\tconst revision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);\n\t\t\tthis.updateReadState(parsed.data, revision);\n\t\t\treturn parsed.repaired\n\t\t\t\t? { result: parsed.data, next: JSON.stringify(parsed.data, null, 2) }\n\t\t\t\t: { result: parsed.data };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\ttry {\n\t\t\t\treturn await this.reloadFromStorageAsync(options);\n\t\t\t} catch (error) {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\tthis.recordError(error);\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t}\n\t\tconst revision = getFileContentRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t(error: unknown) => {\n\t\t\t\t\tif (!controller.signal.aborted) this.recordError(error);\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\ttry {\n\t\t\t\treturn await raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\t} catch {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst runtimeKey = this.runtimeOverrides.get(provider);\n\t\tif (runtimeKey) return { type: \"api_key\", key: runtimeKey };\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileContentRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.runtimeOverrides.delete(provider);\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = new Map(\n\t\t\tObject.entries(await this.readLatestData(options)).map(([providerId, credential]) => [\n\t\t\t\tproviderId,\n\t\t\t\t{ providerId, type: credential.type },\n\t\t\t]),\n\t\t);\n\t\toptions?.signal?.throwIfAborted();\n\t\tfor (const providerId of this.runtimeOverrides.keys()) {\n\t\t\tentries.set(providerId, { providerId, type: \"api_key\" });\n\t\t}\n\t\treturn [...entries.values()];\n\t}\n\n\tasync getApiKey(providerId: string, options: GetApiKeyOptions = {}): Promise<string | undefined> {\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\n\t\tif (runtimeKey) return runtimeKey;\n\t\tconst credential = await this.read(providerId);\n\t\tif (credential?.type === \"api_key\") return credential.key;\n\t\tif (credential?.type === \"oauth\") {\n\t\t\tconst oauth = builtinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\t\tif (!oauth) return undefined;\n\t\t\tlet current = credential;\n\t\t\tif (Date.now() >= current.expires) {\n\t\t\t\tconst refreshed = await this.modify(providerId, async (stored) => {\n\t\t\t\t\tif (stored?.type !== \"oauth\") return stored;\n\t\t\t\t\treturn Date.now() < stored.expires ? stored : oauth.refresh(stored, new AbortController().signal);\n\t\t\t\t});\n\t\t\t\tif (refreshed?.type !== \"oauth\") return undefined;\n\t\t\t\tcurrent = refreshed;\n\t\t\t}\n\t\t\treturn (await oauth.toAuth(current)).apiKey;\n\t\t}\n\t\tif (options.includeFallback === false) return undefined;\n\t\treturn getEnvApiKey(providerId);\n\t}\n\n\tregisterOAuthProvider(providerId: string, oauth: OAuthAuth): void {\n\t\tthis.extensionOAuthProviders.set(providerId, oauth);\n\t}\n\n\tunregisterOAuthProvider(providerId: string): void {\n\t\tthis.extensionOAuthProviders.delete(providerId);\n\t}\n\n\tgetOAuthProviders(): Array<{ id: string; name: string }> {\n\t\tconst dynamic = [...this.extensionOAuthProviders.entries()].map(([id, oauth]) => ({\n\t\t\tid,\n\t\t\tname: oauth.name,\n\t\t}));\n\t\tconst builtin = builtinProviders().flatMap((provider) =>\n\t\t\tprovider.auth.oauth && !this.extensionOAuthProviders.has(provider.id)\n\t\t\t\t? [{ id: provider.id, name: provider.auth.oauth.name }]\n\t\t\t\t: [],\n\t\t);\n\t\treturn [...dynamic, ...builtin];\n\t}\n\n\tasync login(providerId: string, callbacks: OAuthLoginCallbacks): Promise<void> {\n\t\tconst oauth =\n\t\t\tthis.extensionOAuthProviders.get(providerId) ??\n\t\t\tbuiltinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\tif (!oauth) throw new Error(`Unknown OAuth provider: ${providerId}`);\n\t\tconst signal = callbacks.signal ?? new AbortController().signal;\n\t\tconst interaction: AuthInteraction & { signal: AbortSignal } = {\n\t\t\tsignal,\n\t\t\tprompt: (prompt) => this.handleLegacyPrompt(prompt, callbacks),\n\t\t\tnotify: (event) => this.handleLegacyEvent(event, callbacks),\n\t\t};\n\t\tconst credential = await oauth.login(interaction);\n\t\tthis.set(providerId, credential);\n\t}\n\n\tlogout(provider: string): void {\n\t\tthis.removeRuntimeApiKey(provider);\n\t\tthis.remove(provider);\n\t}\n\n\tprivate handleLegacyPrompt(prompt: AuthPrompt, callbacks: OAuthLoginCallbacks): Promise<string> {\n\t\tswitch (prompt.type) {\n\t\t\tcase \"manual_code\":\n\t\t\t\treturn callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);\n\t\t\tcase \"select\":\n\t\t\t\treturn callbacks.onSelect(prompt).then((value) => {\n\t\t\t\t\tif (value === undefined) throw new Error(\"Login cancelled\");\n\t\t\t\t\treturn value;\n\t\t\t\t});\n\t\t\tcase \"secret\":\n\t\t\tcase \"text\":\n\t\t\t\treturn callbacks.onPrompt(prompt);\n\t\t}\n\t}\n\n\tprivate handleLegacyEvent(event: AuthEvent, callbacks: OAuthLoginCallbacks): void {\n\t\tswitch (event.type) {\n\t\t\tcase \"auth_url\":\n\t\t\t\tcallbacks.onAuth(event);\n\t\t\t\tbreak;\n\t\t\tcase \"device_code\":\n\t\t\t\tcallbacks.onDeviceCode(event);\n\t\t\t\tbreak;\n\t\t\tcase \"info\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t\tcase \"progress\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(\n\tproviderId: string,\n\tauthPath: string = join(getAgentDir(), \"auth.json\"),\n): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), \"utf-8\"))) as AuthStorageData;\n\t\treturn data[providerId];\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/core/brand.d.ts

@@ -25,6 +25,10 @@ export interface BrandUpdateChannel {
     /** Release notes URL; `{version}` is replaced with the available version. */
     readonly changelogUrl?: string;
 }
+export interface BrandChangelog {
+    readonly path: string;
+    readonly version?: string;
+}
 export interface BrandProfile {
     /** Product name shown to users and to the model. */
     readonly name: string;
@@ -44,6 +48,7 @@ export interface BrandProfile {
     readonly originator?: string;
     /** Update channel of the branded product; absent means the product manages updates itself. */
     readonly update?: BrandUpdateChannel;
+    readonly changelog?: BrandChangelog;
 }
 /**
  * Parses a brand profile. Returns undefined for absent, malformed, or nameless input; a

package/dist/core/brand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brand.d.ts","sourceRoot":"","sources":["../../src/core/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAE3C;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAiCD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAwCnF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,GAAG,SAAS,CAElG;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAEpF;AAWD;;GAEG;AACH,wBAAgB,YAAY,IAAI,YAAY,GAAG,SAAS,CAMvD;AAED,8BAA8B;AAC9B,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,2BAAiB,GAAG,MAAM,EAAE,CAKhF;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAMjG"}
+{"version":3,"file":"brand.d.ts","sourceRoot":"","sources":["../../src/core/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,4DAA4D;AAC5D,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAE3C;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;CACpC;AA2CD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CA0CnF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,YAAY,GAAG,SAAS,CAElG;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAEpF;AAWD;;GAEG;AACH,wBAAgB,YAAY,IAAI,YAAY,GAAG,SAAS,CAMvD;AAED,8BAA8B;AAC9B,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,2BAAiB,GAAG,MAAM,EAAE,CAKhF;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAMjG"}

package/dist/core/brand.js

@@ -11,6 +11,17 @@
  */
 /** Environment variable carrying the JSON brand profile. */
 export const BRAND_ENV_VAR = "SENPI_BRAND";
+function readChangelog(source) {
+    const value = source.changelog;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const changelog = value;
+    const path = readString(changelog, "path");
+    if (!path?.startsWith("/") || path.includes("\0"))
+        return undefined;
+    const version = readString(changelog, "version");
+    return { path, ...(version ? { version } : {}) };
+}
 function readUpdateChannel(source) {
     const update = source.update;
     if (typeof update !== "object" || update === null || Array.isArray(update))
@@ -70,6 +81,7 @@ export function parseBrandProfile(raw) {
         process.stderr.write(`warning: ignoring ${BRAND_ENV_VAR} with an unsafe "configDir"\n`);
         return undefined;
     }
+    const changelog = readChangelog(source);
     return {
         name,
         command: readString(source, "command"),
@@ -80,6 +92,7 @@ export function parseBrandProfile(raw) {
         userAgent: readString(source, "userAgent") || name,
         originator: readString(source, "originator"),
         update: readUpdateChannel(source),
+        ...(changelog ? { changelog } : {}),
     };
 }
 /**

package/dist/core/brand.js.map

@@ -1 +1 @@
-{"version":3,"file":"brand.js","sourceRoot":"","sources":["../../src/core/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAsC3C,SAAS,iBAAiB,CAAC,MAA+B;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7F,MAAM,OAAO,GAAG,MAAiC,CAAC;IAClD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/C,OAAO;QACN,WAAW;QACX,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,QAAQ;QACnD,OAAO;QACP,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC;KACjD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACzC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACxD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,aAAa,oBAAoB,CAAC,CAAC;QACvF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,aAAa,6BAA6B,CAAC,CAAC;QAChG,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,aAAa,qBAAqB,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,aAAa,+BAA+B,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,OAAO;QACN,IAAI;QACJ,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC;QACtC,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACpD,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,IAAI;QACtC,SAAS,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;QAClE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI;QAClD,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC;KACjC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,OAAO,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7E,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,IAAI,CAAU,CAAC;AAErD,IAAI,aAAuC,CAAC;AAC5C,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B;;GAEG;AACH,MAAM,UAAU,YAAY;IAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,aAAa,GAAG,mBAAmB,EAAE,CAAC;QACtC,eAAe,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,yBAAyB;IACxC,aAAa,GAAG,SAAS,CAAC;IAC1B,eAAe,GAAG,KAAK,CAAC;AACzB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAO,GAAG,YAAY,EAAE;IACrE,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,CAAC,MAAM,CACnE,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7E,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC5E,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Brand profile resolution.\n *\n * A distribution that repackages this engine (for example the `omo-ai` package) injects a\n * single JSON environment variable describing how the product presents itself. The engine\n * parses it once at startup and then REMOVES it from the environment, so nested processes\n * spawned by tools inherit a clean environment and keep the engine's own identity.\n *\n * Absent or malformed input leaves every brand-derived value at its standalone default, so a\n * plain install behaves exactly as it did before this module existed.\n */\n\n/** Environment variable carrying the JSON brand profile. */\nexport const BRAND_ENV_VAR = \"SENPI_BRAND\";\n\n/**\n * Where a repackaging distribution publishes itself. Without this the engine keeps checking\n * its own package, which would advertise an update the branded product cannot install.\n */\nexport interface BrandUpdateChannel {\n\t/** Registry package that ships the branded product, e.g. `omo-ai`. */\n\treadonly packageName: string;\n\t/** Dist-tag the product publishes on, e.g. `beta`. */\n\treadonly distTag: string;\n\t/** Command shown to the user, e.g. `npm i -g omo-ai@beta`. */\n\treadonly command: string;\n\t/** Release notes URL; `{version}` is replaced with the available version. */\n\treadonly changelogUrl?: string;\n}\n\nexport interface BrandProfile {\n\t/** Product name shown to users and to the model. */\n\treadonly name: string;\n\t/** Executable name used in shell-command contexts when it differs from the display name. */\n\treadonly command?: string;\n\t/** Version shown in the header, terminal titles and `--version`. */\n\treadonly displayVersion?: string;\n\t/** Config directory name, e.g. `.omo`. */\n\treadonly configDir: string;\n\t/** When true the agent state lives directly under the config directory, with no `agent` segment. */\n\treadonly flatLayout: boolean;\n\t/** Prefix for the product's environment variables, e.g. `OMO`. */\n\treadonly envPrefix: string;\n\t/** Product token used in the outgoing user agent. */\n\treadonly userAgent: string;\n\t/** Product token used as the provider-side originator, when the distribution overrides it. */\n\treadonly originator?: string;\n\t/** Update channel of the branded product; absent means the product manages updates itself. */\n\treadonly update?: BrandUpdateChannel;\n}\n\nfunction readUpdateChannel(source: Record<string, unknown>): BrandUpdateChannel | undefined {\n\tconst update = source.update;\n\tif (typeof update !== \"object\" || update === null || Array.isArray(update)) return undefined;\n\n\tconst channel = update as Record<string, unknown>;\n\tconst packageName = readString(channel, \"packageName\");\n\tconst command = readString(channel, \"command\");\n\tif (!packageName || !command) return undefined;\n\n\treturn {\n\t\tpackageName,\n\t\tdistTag: readString(channel, \"distTag\") || \"latest\",\n\t\tcommand,\n\t\tchangelogUrl: readString(channel, \"changelogUrl\"),\n\t};\n}\n\n/**\n * A config directory names ONE entry inside the home directory. Anything carrying a separator or\n * a parent reference would move agent state - and the migration that copies into it - somewhere\n * the user never agreed to, so such a profile is rejected rather than sanitised.\n */\nfunction isSafeConfigDirName(value: string): boolean {\n\treturn value !== \".\" && value !== \"..\" && !/[\\\\/]/.test(value);\n}\n\nfunction readString(source: Record<string, unknown>, key: string): string | undefined {\n\tconst value = source[key];\n\treturn typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\n/**\n * Parses a brand profile. Returns undefined for absent, malformed, or nameless input; a\n * malformed profile is reported once on stderr and never throws, because a broken brand\n * must not stop the agent from starting.\n */\nexport function parseBrandProfile(raw: string | undefined): BrandProfile | undefined {\n\tif (!raw?.trim()) return undefined;\n\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch {\n\t\tprocess.stderr.write(`warning: ignoring malformed ${BRAND_ENV_VAR} (expected JSON)\\n`);\n\t\treturn undefined;\n\t}\n\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\tprocess.stderr.write(`warning: ignoring malformed ${BRAND_ENV_VAR} (expected a JSON object)\\n`);\n\t\treturn undefined;\n\t}\n\n\tconst source = parsed as Record<string, unknown>;\n\tconst name = readString(source, \"name\");\n\tif (!name) {\n\t\tprocess.stderr.write(`warning: ignoring ${BRAND_ENV_VAR} without a \"name\"\\n`);\n\t\treturn undefined;\n\t}\n\n\tconst configDir = readString(source, \"configDir\") || `.${name}`;\n\tif (!isSafeConfigDirName(configDir)) {\n\t\tprocess.stderr.write(`warning: ignoring ${BRAND_ENV_VAR} with an unsafe \"configDir\"\\n`);\n\t\treturn undefined;\n\t}\n\n\treturn {\n\t\tname,\n\t\tcommand: readString(source, \"command\"),\n\t\tdisplayVersion: readString(source, \"displayVersion\"),\n\t\tconfigDir,\n\t\tflatLayout: source.flatLayout === true,\n\t\tenvPrefix: (readString(source, \"envPrefix\") || name).toUpperCase(),\n\t\tuserAgent: readString(source, \"userAgent\") || name,\n\t\toriginator: readString(source, \"originator\"),\n\t\tupdate: readUpdateChannel(source),\n\t};\n}\n\n/**\n * Parses the brand profile without touching the environment.\n *\n * The CLI entrypoint re-spawns the real agent as a child process and hands it `process.env`,\n * so the variable has to survive that hop. Scrubbing therefore happens explicitly in the\n * process that actually runs the agent - see `scrubBrandFromEnvironment`.\n */\nexport function consumeBrandProfile(env: NodeJS.ProcessEnv = process.env): BrandProfile | undefined {\n\treturn parseBrandProfile(env[BRAND_ENV_VAR]);\n}\n\n/**\n * Removes the brand variable so tools spawning the engine again inherit a clean environment\n * and keep the engine's own identity. Called once the profile has been resolved by the\n * process that runs the agent loop.\n */\nexport function scrubBrandFromEnvironment(env: NodeJS.ProcessEnv = process.env): void {\n\tdelete env[BRAND_ENV_VAR];\n}\n\n/**\n * Environment prefixes read after the brand's own prefix, so a machine configured before the\n * rebrand keeps working unchanged.\n */\nconst LEGACY_ENV_PREFIXES = [\"SENPI\", \"PI\"] as const;\n\nlet cachedProfile: BrandProfile | undefined;\nlet profileResolved = false;\n\n/**\n * The active brand profile, resolved (and scrubbed from the environment) on first use.\n */\nexport function brandProfile(): BrandProfile | undefined {\n\tif (!profileResolved) {\n\t\tcachedProfile = consumeBrandProfile();\n\t\tprofileResolved = true;\n\t}\n\treturn cachedProfile;\n}\n\n/** exported for tests only */\nexport function resetBrandProfileForTests(): void {\n\tcachedProfile = undefined;\n\tprofileResolved = false;\n}\n\n/** Environment variable names for one setting, most specific first. */\nexport function brandEnvNames(suffix: string, profile = brandProfile()): string[] {\n\tconst prefixes = [profile?.envPrefix, ...LEGACY_ENV_PREFIXES].filter(\n\t\t(prefix): prefix is string => typeof prefix === \"string\" && prefix.length > 0,\n\t);\n\treturn [...new Set(prefixes)].map((prefix) => `${prefix}_${suffix}`);\n}\n\n/**\n * Reads one setting across the brand's prefix and the legacy prefixes, returning the first\n * DEFINED value so that an explicitly empty value keeps its existing meaning.\n */\nexport function envValue(suffix: string, env: NodeJS.ProcessEnv = process.env): string | undefined {\n\tfor (const name of brandEnvNames(suffix)) {\n\t\tconst value = env[name];\n\t\tif (value !== undefined) return value;\n\t}\n\treturn undefined;\n}\n"]}
+{"version":3,"file":"brand.js","sourceRoot":"","sources":["../../src/core/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AA4C3C,SAAS,aAAa,CAAC,MAA+B;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA+B;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7F,MAAM,OAAO,GAAG,MAAiC,CAAC;IAClD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/C,OAAO;QACN,WAAW;QACX,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,QAAQ;QACnD,OAAO;QACP,YAAY,EAAE,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC;KACjD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACzC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACxD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,aAAa,oBAAoB,CAAC,CAAC;QACvF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,aAAa,6BAA6B,CAAC,CAAC;QAChG,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,aAAa,qBAAqB,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,aAAa,+BAA+B,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACN,IAAI;QACJ,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC;QACtC,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACpD,SAAS;QACT,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,IAAI;QACtC,SAAS,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;QAClE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI;QAClD,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;QAC5C,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACvE,OAAO,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC7E,OAAO,GAAG,CAAC,aAAa,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,IAAI,CAAU,CAAC;AAErD,IAAI,aAAuC,CAAC;AAC5C,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B;;GAEG;AACH,MAAM,UAAU,YAAY;IAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,aAAa,GAAG,mBAAmB,EAAE,CAAC;QACtC,eAAe,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,yBAAyB;IACxC,aAAa,GAAG,SAAS,CAAC;IAC1B,eAAe,GAAG,KAAK,CAAC;AACzB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAO,GAAG,YAAY,EAAE;IACrE,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,CAAC,MAAM,CACnE,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7E,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC5E,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Brand profile resolution.\n *\n * A distribution that repackages this engine (for example the `omo-ai` package) injects a\n * single JSON environment variable describing how the product presents itself. The engine\n * parses it once at startup and then REMOVES it from the environment, so nested processes\n * spawned by tools inherit a clean environment and keep the engine's own identity.\n *\n * Absent or malformed input leaves every brand-derived value at its standalone default, so a\n * plain install behaves exactly as it did before this module existed.\n */\n\n/** Environment variable carrying the JSON brand profile. */\nexport const BRAND_ENV_VAR = \"SENPI_BRAND\";\n\n/**\n * Where a repackaging distribution publishes itself. Without this the engine keeps checking\n * its own package, which would advertise an update the branded product cannot install.\n */\nexport interface BrandUpdateChannel {\n\t/** Registry package that ships the branded product, e.g. `omo-ai`. */\n\treadonly packageName: string;\n\t/** Dist-tag the product publishes on, e.g. `beta`. */\n\treadonly distTag: string;\n\t/** Command shown to the user, e.g. `npm i -g omo-ai@beta`. */\n\treadonly command: string;\n\t/** Release notes URL; `{version}` is replaced with the available version. */\n\treadonly changelogUrl?: string;\n}\n\nexport interface BrandChangelog {\n\treadonly path: string;\n\treadonly version?: string;\n}\n\nexport interface BrandProfile {\n\t/** Product name shown to users and to the model. */\n\treadonly name: string;\n\t/** Executable name used in shell-command contexts when it differs from the display name. */\n\treadonly command?: string;\n\t/** Version shown in the header, terminal titles and `--version`. */\n\treadonly displayVersion?: string;\n\t/** Config directory name, e.g. `.omo`. */\n\treadonly configDir: string;\n\t/** When true the agent state lives directly under the config directory, with no `agent` segment. */\n\treadonly flatLayout: boolean;\n\t/** Prefix for the product's environment variables, e.g. `OMO`. */\n\treadonly envPrefix: string;\n\t/** Product token used in the outgoing user agent. */\n\treadonly userAgent: string;\n\t/** Product token used as the provider-side originator, when the distribution overrides it. */\n\treadonly originator?: string;\n\t/** Update channel of the branded product; absent means the product manages updates itself. */\n\treadonly update?: BrandUpdateChannel;\n\treadonly changelog?: BrandChangelog;\n}\n\nfunction readChangelog(source: Record<string, unknown>): BrandChangelog | undefined {\n\tconst value = source.changelog;\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n\tconst changelog = value as Record<string, unknown>;\n\tconst path = readString(changelog, \"path\");\n\tif (!path?.startsWith(\"/\") || path.includes(\"\\0\")) return undefined;\n\tconst version = readString(changelog, \"version\");\n\treturn { path, ...(version ? { version } : {}) };\n}\n\nfunction readUpdateChannel(source: Record<string, unknown>): BrandUpdateChannel | undefined {\n\tconst update = source.update;\n\tif (typeof update !== \"object\" || update === null || Array.isArray(update)) return undefined;\n\n\tconst channel = update as Record<string, unknown>;\n\tconst packageName = readString(channel, \"packageName\");\n\tconst command = readString(channel, \"command\");\n\tif (!packageName || !command) return undefined;\n\n\treturn {\n\t\tpackageName,\n\t\tdistTag: readString(channel, \"distTag\") || \"latest\",\n\t\tcommand,\n\t\tchangelogUrl: readString(channel, \"changelogUrl\"),\n\t};\n}\n\n/**\n * A config directory names ONE entry inside the home directory. Anything carrying a separator or\n * a parent reference would move agent state - and the migration that copies into it - somewhere\n * the user never agreed to, so such a profile is rejected rather than sanitised.\n */\nfunction isSafeConfigDirName(value: string): boolean {\n\treturn value !== \".\" && value !== \"..\" && !/[\\\\/]/.test(value);\n}\n\nfunction readString(source: Record<string, unknown>, key: string): string | undefined {\n\tconst value = source[key];\n\treturn typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\n/**\n * Parses a brand profile. Returns undefined for absent, malformed, or nameless input; a\n * malformed profile is reported once on stderr and never throws, because a broken brand\n * must not stop the agent from starting.\n */\nexport function parseBrandProfile(raw: string | undefined): BrandProfile | undefined {\n\tif (!raw?.trim()) return undefined;\n\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(raw);\n\t} catch {\n\t\tprocess.stderr.write(`warning: ignoring malformed ${BRAND_ENV_VAR} (expected JSON)\\n`);\n\t\treturn undefined;\n\t}\n\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\tprocess.stderr.write(`warning: ignoring malformed ${BRAND_ENV_VAR} (expected a JSON object)\\n`);\n\t\treturn undefined;\n\t}\n\n\tconst source = parsed as Record<string, unknown>;\n\tconst name = readString(source, \"name\");\n\tif (!name) {\n\t\tprocess.stderr.write(`warning: ignoring ${BRAND_ENV_VAR} without a \"name\"\\n`);\n\t\treturn undefined;\n\t}\n\n\tconst configDir = readString(source, \"configDir\") || `.${name}`;\n\tif (!isSafeConfigDirName(configDir)) {\n\t\tprocess.stderr.write(`warning: ignoring ${BRAND_ENV_VAR} with an unsafe \"configDir\"\\n`);\n\t\treturn undefined;\n\t}\n\n\tconst changelog = readChangelog(source);\n\treturn {\n\t\tname,\n\t\tcommand: readString(source, \"command\"),\n\t\tdisplayVersion: readString(source, \"displayVersion\"),\n\t\tconfigDir,\n\t\tflatLayout: source.flatLayout === true,\n\t\tenvPrefix: (readString(source, \"envPrefix\") || name).toUpperCase(),\n\t\tuserAgent: readString(source, \"userAgent\") || name,\n\t\toriginator: readString(source, \"originator\"),\n\t\tupdate: readUpdateChannel(source),\n\t\t...(changelog ? { changelog } : {}),\n\t};\n}\n\n/**\n * Parses the brand profile without touching the environment.\n *\n * The CLI entrypoint re-spawns the real agent as a child process and hands it `process.env`,\n * so the variable has to survive that hop. Scrubbing therefore happens explicitly in the\n * process that actually runs the agent - see `scrubBrandFromEnvironment`.\n */\nexport function consumeBrandProfile(env: NodeJS.ProcessEnv = process.env): BrandProfile | undefined {\n\treturn parseBrandProfile(env[BRAND_ENV_VAR]);\n}\n\n/**\n * Removes the brand variable so tools spawning the engine again inherit a clean environment\n * and keep the engine's own identity. Called once the profile has been resolved by the\n * process that runs the agent loop.\n */\nexport function scrubBrandFromEnvironment(env: NodeJS.ProcessEnv = process.env): void {\n\tdelete env[BRAND_ENV_VAR];\n}\n\n/**\n * Environment prefixes read after the brand's own prefix, so a machine configured before the\n * rebrand keeps working unchanged.\n */\nconst LEGACY_ENV_PREFIXES = [\"SENPI\", \"PI\"] as const;\n\nlet cachedProfile: BrandProfile | undefined;\nlet profileResolved = false;\n\n/**\n * The active brand profile, resolved (and scrubbed from the environment) on first use.\n */\nexport function brandProfile(): BrandProfile | undefined {\n\tif (!profileResolved) {\n\t\tcachedProfile = consumeBrandProfile();\n\t\tprofileResolved = true;\n\t}\n\treturn cachedProfile;\n}\n\n/** exported for tests only */\nexport function resetBrandProfileForTests(): void {\n\tcachedProfile = undefined;\n\tprofileResolved = false;\n}\n\n/** Environment variable names for one setting, most specific first. */\nexport function brandEnvNames(suffix: string, profile = brandProfile()): string[] {\n\tconst prefixes = [profile?.envPrefix, ...LEGACY_ENV_PREFIXES].filter(\n\t\t(prefix): prefix is string => typeof prefix === \"string\" && prefix.length > 0,\n\t);\n\treturn [...new Set(prefixes)].map((prefix) => `${prefix}_${suffix}`);\n}\n\n/**\n * Reads one setting across the brand's prefix and the legacy prefixes, returning the first\n * DEFINED value so that an explicitly empty value keeps its existing meaning.\n */\nexport function envValue(suffix: string, env: NodeJS.ProcessEnv = process.env): string | undefined {\n\tfor (const name of brandEnvNames(suffix)) {\n\t\tconst value = env[name];\n\t\tif (value !== undefined) return value;\n\t}\n\treturn undefined;\n}\n"]}

package/dist/core/changelog-source.d.ts

@@ -0,0 +1,8 @@
+export interface ChangelogSource {
+    readonly id: string;
+    readonly path: string;
+    readonly version: string | undefined;
+    readonly rewriteLinks: boolean;
+}
+export declare function resolveChangelogSource(): ChangelogSource;
+//# sourceMappingURL=changelog-source.d.ts.map

package/dist/core/changelog-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changelog-source.d.ts","sourceRoot":"","sources":["../../src/core/changelog-source.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAeD,wBAAgB,sBAAsB,IAAI,eAAe,CAGxD"}

package/dist/core/changelog-source.js

@@ -0,0 +1,19 @@
+import { BRAND, getChangelogPath, VERSION } from "../config.js";
+function brandSource(brand) {
+    const configured = brand.changelog;
+    if (!configured) {
+        return { id: brand.name.toLowerCase(), path: getChangelogPath(), version: undefined, rewriteLinks: false };
+    }
+    return {
+        id: brand.name.toLowerCase(),
+        path: configured.path,
+        version: configured.version,
+        rewriteLinks: false,
+    };
+}
+export function resolveChangelogSource() {
+    if (BRAND)
+        return brandSource(BRAND);
+    return { id: "engine", path: getChangelogPath(), version: VERSION, rewriteLinks: true };
+}
+//# sourceMappingURL=changelog-source.js.map

package/dist/core/changelog-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changelog-source.js","sourceRoot":"","sources":["../../src/core/changelog-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAUhE,SAAS,WAAW,CAAC,KAAmB;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;IACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC5G,CAAC;IACD,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE;QAC5B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,YAAY,EAAE,KAAK;KACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB;IACrC,IAAI,KAAK;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AACzF,CAAC","sourcesContent":["import { BRAND, getChangelogPath, VERSION } from \"../config.ts\";\nimport type { BrandProfile } from \"./brand.ts\";\n\nexport interface ChangelogSource {\n\treadonly id: string;\n\treadonly path: string;\n\treadonly version: string | undefined;\n\treadonly rewriteLinks: boolean;\n}\n\nfunction brandSource(brand: BrandProfile): ChangelogSource {\n\tconst configured = brand.changelog;\n\tif (!configured) {\n\t\treturn { id: brand.name.toLowerCase(), path: getChangelogPath(), version: undefined, rewriteLinks: false };\n\t}\n\treturn {\n\t\tid: brand.name.toLowerCase(),\n\t\tpath: configured.path,\n\t\tversion: configured.version,\n\t\trewriteLinks: false,\n\t};\n}\n\nexport function resolveChangelogSource(): ChangelogSource {\n\tif (BRAND) return brandSource(BRAND);\n\treturn { id: \"engine\", path: getChangelogPath(), version: VERSION, rewriteLinks: true };\n}\n"]}

package/dist/core/credential-accounts.d.ts

@@ -5,6 +5,7 @@ export type CredentialAccountSource = "login" | "import" | "env";
 /** Account metadata safe to surface: names and health only, never key material. */
 export type CredentialAccountSummary = {
     readonly name: string;
+    readonly displayName?: string;
     readonly source: CredentialAccountSource;
     readonly blocked: boolean;
     readonly pinned: boolean;
@@ -20,6 +21,8 @@ export declare function assertValidAccountName(name: string): void;
 export declare function getCredentialAccounts(storage: AuthStorage, provider: string, env?: NodeJS.ProcessEnv, repository?: CredentialSlotRepository): Promise<CredentialAccountSummary[]>;
 /** Storage-free variant for callers that already hold the credential (e.g. auth check). */
 export declare function summarizeCredentialAccounts(provider: string, stored: Credential | undefined, env?: NodeJS.ProcessEnv, repository?: CredentialSlotRepository): Promise<CredentialAccountSummary[]>;
+/** Atomically rename/clear stored metadata without changing identity, health or environment state. */
+export declare function renameCredentialAccount(storage: AuthStorage, provider: string, name: string, displayName: string | null): Promise<void>;
 /** Pins one slot, or clears the pin when `name` is null. */
 export declare function pinCredentialAccount(storage: AuthStorage, provider: string, name: string | null, env?: NodeJS.ProcessEnv, repository?: CredentialSlotRepository): Promise<void>;
 /**