@code-yeongyu/senpi 2026.9.22-2 → 2026.9.22-3

package/dist/core/auth-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACN,eAAe,EAEf,SAAS,EAET,UAAU,EACV,0BAA0B,EAC1B,UAAU,GACV,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,gCAAgC,EAChC,WAAW,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIrF;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,IAAqB;IACrD,IAAI,QAAqC,CAAC;IAC1C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QACpE,MAAM,MAAM,GAAG,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,QAAQ,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClF,CAAC;AAmBD,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAc5E,IAAI,uBAAuF,CAAC;AAU5F,MAAM,OAAO,sBAAsB;IAGlC,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,eAAe;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAEO,gBAAgB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IAEO,wBAAwB,CAAC,IAAY;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,yBAAyB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,gCAAgC,EAAE,CAAC;oBAClD,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,gCAAgC,GAAG,QAAQ,CAC3C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAI,EAAkD;QAC7D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAA+B,EAC/B,aAAqC;QAErC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,4EAA4E;QAC5E,2EAA2E;QAC3E,4DAA4D;QAC5D,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAClD,GAAG,yBAAyB;oBAC5B,OAAO,EAAE,CAAC;oBACV,aAAa;iBACb,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACrB,MAAM,OAAO,EAAE,CAAC;oBAChB,MAAM,CAAC,cAAc,EAAE,CAAC;gBACzB,CAAC;gBACD,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,iCAAiC,EAAE,CAAC;oBACnD,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,iCAAiC,GAAG,QAAQ,CAC5C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,mBAAmB,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,EAA2D,EAC3D,OAA8B;QAE9B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAA0C,CAAC;QAC/C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,oBAAuC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC/B,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,oBAAoB,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9E,CAAC;QACF,CAAC,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChE,eAAe,GAAG,IAAI,CAAC;gBACvB,oBAAoB,GAAG,KAAK,CAAC;YAC9B,CAAC,CAAC,CAAC;YAEH,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,OAAO,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,iDAAiD;gBAClD,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,mBAAmB;IAI/B,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,IAAI;QACX,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAEhC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAG,UAAqC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC;gBAC1E,MAAM,QAAQ,GACb,KAAK,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAC7B,KAAK,CAAC,GAAG,KAAK,IAAI;wBAClB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;wBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACxE,IAAI,QAAQ,IAAI,QAAQ;oBAAE,SAAS;YACpC,CAAC;iBAAM,IACN,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAChC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,CAAC;gBACF,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,MAAyB,CAAC,CAAC,IAAI,CAAC;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,UAAU;YACV,IAAI,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,GAAyE,EACzE,QAA+B;QAE/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAA+B;QAChE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;CACD;AAED,MAAM,OAAO,0BAA0B;IAAvC;QAES,eAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IA4B1D,CAAC;IA1BA,QAAQ,CAAI,EAAkD;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,aAAa,CACZ,EAA2D,EAC3D,OAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IASvB,YAAoB,OAA2B,EAAE,QAAiB;QAR1D,SAAI,GAAoB,EAAE,CAAC;QAClB,qBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,4BAAuB,GAAG,IAAI,GAAG,EAAqB,CAAC;QAChE,WAAM,GAAY,EAAE,CAAC;QAM5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS;YACb,QAAQ,IAAI,uBAAuB,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/G,IAAI,QAAQ,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1C,uBAAuB,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,OAAO;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAChE,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5F,CAAC;IAED,cAAc;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,2GAA2G;IACnG,mBAAmB,CAAC,OAA2B;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB,CAAC,CAAC;IAClF,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAEO,eAAe,CAAC,IAAqB,EAAE,QAAiB;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,IAAI,GAAoB,EAAE,CAAC;QAC/B,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACnB,uEAAuE;gBACvE,yEAAyE;gBACzE,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjG,OAAO,MAAM,CAAC,QAAQ;oBACrB,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;oBACnE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,8CAA8C;YAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAgB,EAAE,MAAc;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,mBAAmB,CAAC,QAAgB;QACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,cAAc,CAAC,QAAgB;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,UAAU,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,UAAsB;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAAgB;QACzB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAiC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,IAAoB;QAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,IAAY;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;;gBAC7C,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAC1G,CAAC;IAED,aAAa,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5G,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACxG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,WAAW;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,OAA8B;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,MAAM,CAAC,QAAQ;gBACrB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACrE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,EAAE,OAAO,CAAC,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,MAAM,GAAmB;gBAC9B,UAAU;gBACV,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;aACV,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CACvB,GAAG,EAAE;gBACJ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,CACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,CAAC;gBACJ,OAAO,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;gBAClC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACpD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,MAAM,CACX,QAAgB,EAChB,EAAwE,EACxE,OAA8B;QAE9B,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,IAAI,QAA4B,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,GAAG,WAAW,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACrE,UAAU,GAAG,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YACpF,UAAU;YACV,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;SACrC,CAAC,CACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAO,GAAqB,EAAE;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC;QAC1D,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YAC5F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,OAAO,GAAG,UAAU,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBAChE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO;wBAAE,OAAO,MAAM,CAAC;oBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBACnG,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,IAAI,KAAK,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAClD,OAAO,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,qBAAqB,CAAC,UAAkB,EAAE,KAAgB;QACzD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,uBAAuB,CAAC,UAAkB;QACzC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,iBAAiB;QAChB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;SAChB,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CACL,CAAC;QACF,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,SAA8B;QAC7D,MAAM,KAAK,GACV,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC5C,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;QAChE,MAAM,WAAW,GAA8C;YAC9D,MAAM;YACN,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9D,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;SAC3D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAEO,kBAAkB,CAAC,MAAkB,EAAE,SAA8B;QAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,aAAa;gBACjB,OAAO,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,KAAK,QAAQ;gBACZ,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChD,IAAI,KAAK,KAAK,SAAS;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC5D,OAAO,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;YACJ,KAAK,QAAQ,CAAC;YACd,KAAK,MAAM;gBACV,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAEO,iBAAiB,CAAC,KAAgB,EAAE,SAA8B;QACzE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,UAAU;gBACd,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,MAAM;YACP,KAAK,aAAa;gBACjB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM;YACP,KAAK,MAAM;gBACV,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;QACR,CAAC;IACF,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAAkB,EAClB,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;IAEnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAoB,CAAC;QACrG,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type {\n\tApiKeyCredential,\n\tAuthEvent,\n\tAuthInteraction,\n\tAuthOperationOptions,\n\tAuthPrompt,\n\tCredential,\n\tCredentialInfo,\n\tCredentialStore,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthLoginCallbacks,\n} from \"@earendil-works/pi-ai\";\nimport { findEnvKeys, getEnvApiKey } from \"@earendil-works/pi-ai\";\nimport {\n\tappendLoginSlot,\n\ttype CredentialSlot,\n\tlistSlots,\n\ttype PooledCredential,\n\tremoveSlot,\n\trepairManagedSentinelSlots,\n\tupsertSlot,\n} from \"@earendil-works/pi-ai/auth/pool/slots\";\nimport { builtinProviders } from \"@earendil-works/pi-ai/providers/all\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\nimport { dirname, join } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { getAgentDir } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileContentRevision, normalizePath } from \"../utils/paths.ts\";\nimport { stripBom } from \"../utils/text.ts\";\nimport {\n\tCredentialStoreBusyError,\n\tFILE_STORAGE_LOCK_OPTIONS,\n\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS,\n\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS,\n\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS,\n\tisLockError,\n} from \"./lockfile-policy.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\n/**\n * Heals pools poisoned by a shipped build that stored a provider-owned pool's\n * flat sentinel as a generated `login-N` slot. Such a slot resolves to sentinel\n * material, fails the provider's auth `check`, and hard-errors every request\n * whose affinity picks it - deterministically, for the lifetime of the entry -\n * so it is dropped the moment auth.json is read and the repair is written back\n * once by the mutable store.\n */\nfunction repairPoisonedPoolSlots(data: AuthStorageData): { data: AuthStorageData; repaired: boolean } {\n\tlet repaired: AuthStorageData | undefined;\n\tfor (const [providerId, credential] of Object.entries(data)) {\n\t\tif (typeof credential !== \"object\" || credential === null) continue;\n\t\tconst healed = repairManagedSentinelSlots(providerId, credential);\n\t\tif (!healed) continue;\n\t\trepaired ??= { ...data };\n\t\trepaired[providerId] = healed;\n\t}\n\treturn repaired ? { data: repaired, repaired: true } : { data, repaired: false };\n}\n\nexport type AuthCredential = Credential;\nexport type { ApiKeyCredential, OAuthCredential };\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport interface GetApiKeyOptions {\n\tincludeFallback?: boolean;\n}\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\n// The mode applies only on creation so administrator-managed modes and ACLs remain intact.\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { ...FILE_STORAGE_LOCK_OPTIONS, retries: 0 });\n\t\t\t} catch (error) {\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_SYNC_LOCK_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(path, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tconst sleeper = new Int32Array(new SharedArrayBuffer(4));\n\t\t\t\tAtomics.wait(sleeper, 0, 0, delayMs);\n\t\t\t}\n\t\t}\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tsignal?.throwIfAborted();\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\t// The retry loop stays here rather than delegating to proper-lockfile's own\n\t\t// `retries`, so an abort is observed between attempts instead of after the\n\t\t// whole budget, and `onCompromised` is rebound per attempt.\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\tconst release = await lockfile.lock(this.authPath, {\n\t\t\t\t\t...FILE_STORAGE_LOCK_OPTIONS,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t\tif (signal?.aborted) {\n\t\t\t\t\tawait release();\n\t\t\t\t\tsignal.throwIfAborted();\n\t\t\t\t}\n\t\t\t\treturn release;\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_LOCK_RETRY_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(this.authPath, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tawait raceWithAbortSignal(new Promise<void>((resolve) => setTimeout(resolve, delayMs)), signal);\n\t\t\t}\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(stripBom(readFileSync(this.authPath, \"utf-8\")));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = repairPoisonedPoolSlots(parsed as AuthStorageData).data;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credential = this.load()[providerId];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (credential.type !== \"api_key\" || !credential.key || isCommandConfigValue(credential.key)) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: await resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate data: AuthStorageData = {};\n\tprivate readonly runtimeOverrides = new Map<string, string>();\n\tprivate readonly extensionOAuthProviders = new Map<string, OAuthAuth>();\n\tprivate errors: Error[] = [];\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileContentRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = join(getAgentDir(), \"auth.json\")): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tgetStoragePath(): string | undefined {\n\t\treturn this.authPath;\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\treturn this.parseStorageContent(content).data;\n\t}\n\n\t/** Reports whether the parse had to heal poisoned pool slots, so a load can write the repair back once. */\n\tprivate parseStorageContent(content: string | undefined): { data: AuthStorageData; repaired: boolean } {\n\t\tif (!content) {\n\t\t\treturn { data: {}, repaired: false };\n\t\t}\n\t\treturn repairPoisonedPoolSlots(JSON.parse(stripBom(content)) as AuthStorageData);\n\t}\n\n\tprivate recordError(error: unknown): void {\n\t\tthis.errors.push(error instanceof Error ? error : new Error(String(error)));\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.data = data;\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet data: AuthStorageData = {};\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tconst parsed = this.parseStorageContent(current);\n\t\t\t\tdata = parsed.data;\n\t\t\t\t// A written repair invalidates the revision read before it; leaving it\n\t\t\t\t// unset makes the next reader re-read instead of trusting a stale stamp.\n\t\t\t\trevision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);\n\t\t\t\treturn parsed.repaired\n\t\t\t\t\t? { result: undefined, next: JSON.stringify(parsed.data, null, 2) }\n\t\t\t\t\t: { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(data, revision);\n\t\t} catch (error) {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t\tthis.recordError(error instanceof Error ? error : new Error(String(error)));\n\t\t}\n\t}\n\n\t/** Set a non-persistent API key used ahead of stored credentials. */\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\n\t\tthis.runtimeOverrides.set(provider, apiKey);\n\t}\n\n\tremoveRuntimeApiKey(provider: string): void {\n\t\tthis.runtimeOverrides.delete(provider);\n\t}\n\n\tget(provider: string): Credential | undefined {\n\t\treturn this.data[provider];\n\t}\n\n\tgetProviderEnv(provider: string): Record<string, string> | undefined {\n\t\tconst credential = this.data[provider];\n\t\treturn credential?.type === \"api_key\" && credential.env ? { ...credential.env } : undefined;\n\t}\n\n\tset(provider: string, credential: Credential): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = appendLoginSlot(currentData[provider], credential);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremove(provider: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst nextData = { ...this.parseStorageData(content) };\n\t\t\tdelete nextData[provider];\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tlistSlots(provider: string): CredentialSlot[] {\n\t\treturn listSlots(this.data[provider] as PooledCredential | undefined);\n\t}\n\n\tsetSlot(provider: string, slot: CredentialSlot): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = upsertSlot(currentData[provider] as PooledCredential | undefined, slot);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremoveSlot(provider: string, name: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = removeSlot(currentData[provider] as PooledCredential | undefined, name);\n\t\t\tconst nextData = { ...currentData };\n\t\t\tif (next === undefined) delete nextData[provider];\n\t\t\telse nextData[provider] = next;\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\thas(provider: string): boolean {\n\t\treturn provider in this.data;\n\t}\n\n\thasAuth(provider: string): boolean {\n\t\treturn this.runtimeOverrides.has(provider) || this.has(provider) || getEnvApiKey(provider) !== undefined;\n\t}\n\n\tgetAuthStatus(provider: string): AuthStatus {\n\t\tif (this.has(provider)) return { configured: true, source: \"stored\" };\n\t\tif (this.runtimeOverrides.has(provider)) return { configured: true, source: \"runtime\", label: \"--api-key\" };\n\t\tconst envName = findEnvKeys(provider)?.[0];\n\t\tif (envName && process.env[envName]) return { configured: true, source: \"environment\", label: envName };\n\t\treturn { configured: false };\n\t}\n\n\tgetAll(): AuthStorageData {\n\t\treturn { ...this.data };\n\t}\n\n\tdrainErrors(): Error[] {\n\t\tconst errors = this.errors;\n\t\tthis.errors = [];\n\t\treturn errors;\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst parsed = this.parseStorageContent(content);\n\t\t\tconst revision = parsed.repaired || !this.authPath ? undefined : getFileContentRevision(this.authPath);\n\t\t\tthis.updateReadState(parsed.data, revision);\n\t\t\treturn parsed.repaired\n\t\t\t\t? { result: parsed.data, next: JSON.stringify(parsed.data, null, 2) }\n\t\t\t\t: { result: parsed.data };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\ttry {\n\t\t\t\treturn await this.reloadFromStorageAsync(options);\n\t\t\t} catch (error) {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\tthis.recordError(error);\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t}\n\t\tconst revision = getFileContentRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t(error: unknown) => {\n\t\t\t\t\tif (!controller.signal.aborted) this.recordError(error);\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\ttry {\n\t\t\t\treturn await raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\t} catch {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst runtimeKey = this.runtimeOverrides.get(provider);\n\t\tif (runtimeKey) return { type: \"api_key\", key: runtimeKey };\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: await resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileContentRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.runtimeOverrides.delete(provider);\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = new Map(\n\t\t\tObject.entries(await this.readLatestData(options)).map(([providerId, credential]) => [\n\t\t\t\tproviderId,\n\t\t\t\t{ providerId, type: credential.type },\n\t\t\t]),\n\t\t);\n\t\toptions?.signal?.throwIfAborted();\n\t\tfor (const providerId of this.runtimeOverrides.keys()) {\n\t\t\tentries.set(providerId, { providerId, type: \"api_key\" });\n\t\t}\n\t\treturn [...entries.values()];\n\t}\n\n\tasync getApiKey(providerId: string, options: GetApiKeyOptions = {}): Promise<string | undefined> {\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\n\t\tif (runtimeKey) return runtimeKey;\n\t\tconst credential = await this.read(providerId);\n\t\tif (credential?.type === \"api_key\") return credential.key;\n\t\tif (credential?.type === \"oauth\") {\n\t\t\tconst oauth = builtinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\t\tif (!oauth) return undefined;\n\t\t\tlet current = credential;\n\t\t\tif (Date.now() >= current.expires) {\n\t\t\t\tconst refreshed = await this.modify(providerId, async (stored) => {\n\t\t\t\t\tif (stored?.type !== \"oauth\") return stored;\n\t\t\t\t\treturn Date.now() < stored.expires ? stored : oauth.refresh(stored, new AbortController().signal);\n\t\t\t\t});\n\t\t\t\tif (refreshed?.type !== \"oauth\") return undefined;\n\t\t\t\tcurrent = refreshed;\n\t\t\t}\n\t\t\treturn (await oauth.toAuth(current)).apiKey;\n\t\t}\n\t\tif (options.includeFallback === false) return undefined;\n\t\treturn getEnvApiKey(providerId);\n\t}\n\n\tregisterOAuthProvider(providerId: string, oauth: OAuthAuth): void {\n\t\tthis.extensionOAuthProviders.set(providerId, oauth);\n\t}\n\n\tunregisterOAuthProvider(providerId: string): void {\n\t\tthis.extensionOAuthProviders.delete(providerId);\n\t}\n\n\tgetOAuthProviders(): Array<{ id: string; name: string }> {\n\t\tconst dynamic = [...this.extensionOAuthProviders.entries()].map(([id, oauth]) => ({\n\t\t\tid,\n\t\t\tname: oauth.name,\n\t\t}));\n\t\tconst builtin = builtinProviders().flatMap((provider) =>\n\t\t\tprovider.auth.oauth && !this.extensionOAuthProviders.has(provider.id)\n\t\t\t\t? [{ id: provider.id, name: provider.auth.oauth.name }]\n\t\t\t\t: [],\n\t\t);\n\t\treturn [...dynamic, ...builtin];\n\t}\n\n\tasync login(providerId: string, callbacks: OAuthLoginCallbacks): Promise<void> {\n\t\tconst oauth =\n\t\t\tthis.extensionOAuthProviders.get(providerId) ??\n\t\t\tbuiltinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\tif (!oauth) throw new Error(`Unknown OAuth provider: ${providerId}`);\n\t\tconst signal = callbacks.signal ?? new AbortController().signal;\n\t\tconst interaction: AuthInteraction & { signal: AbortSignal } = {\n\t\t\tsignal,\n\t\t\tprompt: (prompt) => this.handleLegacyPrompt(prompt, callbacks),\n\t\t\tnotify: (event) => this.handleLegacyEvent(event, callbacks),\n\t\t};\n\t\tconst credential = await oauth.login(interaction);\n\t\tthis.set(providerId, credential);\n\t}\n\n\tlogout(provider: string): void {\n\t\tthis.removeRuntimeApiKey(provider);\n\t\tthis.remove(provider);\n\t}\n\n\tprivate handleLegacyPrompt(prompt: AuthPrompt, callbacks: OAuthLoginCallbacks): Promise<string> {\n\t\tswitch (prompt.type) {\n\t\t\tcase \"manual_code\":\n\t\t\t\treturn callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);\n\t\t\tcase \"select\":\n\t\t\t\treturn callbacks.onSelect(prompt).then((value) => {\n\t\t\t\t\tif (value === undefined) throw new Error(\"Login cancelled\");\n\t\t\t\t\treturn value;\n\t\t\t\t});\n\t\t\tcase \"secret\":\n\t\t\tcase \"text\":\n\t\t\t\treturn callbacks.onPrompt(prompt);\n\t\t}\n\t}\n\n\tprivate handleLegacyEvent(event: AuthEvent, callbacks: OAuthLoginCallbacks): void {\n\t\tswitch (event.type) {\n\t\t\tcase \"auth_url\":\n\t\t\t\tcallbacks.onAuth(event);\n\t\t\t\tbreak;\n\t\t\tcase \"device_code\":\n\t\t\t\tcallbacks.onDeviceCode(event);\n\t\t\t\tbreak;\n\t\t\tcase \"info\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t\tcase \"progress\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(\n\tproviderId: string,\n\tauthPath: string = join(getAgentDir(), \"auth.json\"),\n): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), \"utf-8\"))) as AuthStorageData;\n\t\treturn data[providerId];\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}
+{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACN,eAAe,EAEf,SAAS,EAET,UAAU,EACV,0BAA0B,EAC1B,UAAU,GACV,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACjH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,iCAAiC,EACjC,oCAAoC,EACpC,oCAAoC,EACpC,gCAAgC,EAChC,WAAW,GACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIrF;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,IAAqB;IACrD,IAAI,QAAqC,CAAC;IAC1C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QACpE,MAAM,MAAM,GAAG,0BAA0B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,QAAQ,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClF,CAAC;AAmBD,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAc5E,IAAI,uBAAuF,CAAC;AAU5F,MAAM,OAAO,sBAAsB;IAGlC,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,eAAe;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAEO,gBAAgB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IAED;;;;;;;;;OASG;IACK,aAAa,CAAC,OAAe;QACpC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACxD,IAAI,CAAC;YACJ,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YAC5D,CAAC;YACD,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACJ,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACR,8CAA8C;YAC/C,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAEO,wBAAwB,CAAC,IAAY;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,yBAAyB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,gCAAgC,EAAE,CAAC;oBAClD,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,gCAAgC,GAAG,QAAQ,CAC3C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAI,EAAkD;QAC7D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAA+B,EAC/B,aAAqC;QAErC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,4EAA4E;QAC5E,2EAA2E;QAC3E,4DAA4D;QAC5D,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAClD,GAAG,yBAAyB;oBAC5B,OAAO,EAAE,CAAC;oBACV,aAAa;iBACb,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACrB,MAAM,OAAO,EAAE,CAAC;oBAChB,MAAM,CAAC,cAAc,EAAE,CAAC;gBACzB,CAAC;gBACD,OAAO,OAAO,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,IAAI,QAAQ,IAAI,iCAAiC,EAAE,CAAC;oBACnD,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,oCAAoC,GAAG,CAAC,IAAI,OAAO,EACnD,oCAAoC,EACpC,iCAAiC,GAAG,QAAQ,CAC5C,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,MAAM,mBAAmB,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACjG,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,EAA2D,EAC3D,OAA8B;QAE9B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAA0C,CAAC;QAC/C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,oBAAuC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC/B,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,oBAAoB,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9E,CAAC;QACF,CAAC,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChE,eAAe,GAAG,IAAI,CAAC;gBACvB,oBAAoB,GAAG,KAAK,CAAC;YAC9B,CAAC,CAAC,CAAC;YAEH,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,OAAO,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,iDAAiD;gBAClD,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,mBAAmB;IAI/B,YAAY,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAC9D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAEO,IAAI;QACX,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAEhC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAG,UAAqC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC;gBAC1E,MAAM,QAAQ,GACb,KAAK,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAC7B,KAAK,CAAC,GAAG,KAAK,IAAI;wBAClB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;wBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACxE,IAAI,QAAQ,IAAI,QAAQ;oBAAE,SAAS;YACpC,CAAC;iBAAM,IACN,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAChC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,CAAC;gBACF,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,MAAyB,CAAC,CAAC,IAAI,CAAC;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,4EAA4E;QAC5E,yEAAyE;QACzE,uEAAuE;QACvE,qCAAqC;QACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,UAAU;YACV,IAAI,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,GAAyE,EACzE,QAA+B;QAE/B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAA+B;QAChE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;CACD;AAED,MAAM,OAAO,0BAA0B;IAAvC;QAES,eAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IA4B1D,CAAC;IA1BA,QAAQ,CAAI,EAAkD;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,aAAa,CACZ,EAA2D,EAC3D,OAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC5C,OAAO,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IASvB,YAAoB,OAA2B,EAAE,QAAiB;QAR1D,SAAI,GAAoB,EAAE,CAAC;QAClB,qBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,4BAAuB,GAAG,IAAI,GAAG,EAAqB,CAAC;QAChE,WAAM,GAAY,EAAE,CAAC;QAM5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS;YACb,QAAQ,IAAI,uBAAuB,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/G,IAAI,QAAQ,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1C,uBAAuB,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,OAAO;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;QAChE,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5F,CAAC;IAED,cAAc;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,wEAAwE;QACxE,0EAA0E;QAC1E,qDAAqD;QACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB,CAAC,OAA2B;QAKtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC1F,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IACK,cAAc,CAAC,OAA2B;QACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QACpD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7D,IAAI,UAAU,GAAG,GAAG,IAAI,CAAC,QAAQ,WAAW,KAAK,EAAE,CAAC;QACpD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YACzD,UAAU,GAAG,GAAG,IAAI,CAAC,QAAQ,WAAW,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IAEO,eAAe,CAAC,IAAqB,EAAE,QAAiB;QAC/D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,IAAI,GAAoB,EAAE,CAAC;QAC/B,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;gBACjD,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACnB,qEAAqE;gBACrE,gEAAgE;gBAChE,0BAA0B;gBAC1B,QAAQ;oBACP,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1G,IAAI,MAAM,CAAC,QAAQ;oBAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;gBAClD,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;oBACxC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;oBACnE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1B,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,8CAA8C;YAC9C,IAAI,CAAC,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;IACF,CAAC;IAED,qEAAqE;IACrE,gBAAgB,CAAC,QAAgB,EAAE,MAAc;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,mBAAmB,CAAC,QAAgB;QACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,cAAc,CAAC,QAAgB;QAC9B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzD,OAAO,UAAU,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,UAAsB;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAAgB;QACzB,OAAO,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAiC,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,IAAoB;QAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,QAAgB,EAAE,IAAY;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAiC,EAAE,IAAI,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;YACpC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;;gBAC7C,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,QAAgB;QACnB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAgB;QACvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;IAC1G,CAAC;IAED,aAAa,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5G,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACxG,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,WAAW;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,MAAM,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,OAA8B;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,QAAQ,GACb,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1G,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,QAAQ;gBAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;gBACxC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACrE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,EAAE,OAAO,CAAC,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,MAAM,GAAmB;gBAC9B,UAAU;gBACV,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;aACV,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CACvB,GAAG,EAAE;gBACJ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YACzE,CAAC,CACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,CAAC;gBACJ,OAAO,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC5B,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;gBAClC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAA8B;QAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACpD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,MAAM,CACX,QAAgB,EAChB,EAAwE,EACxE,OAA8B;QAE9B,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,IAAI,QAA4B,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,GAAG,WAAW,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7E,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACrE,UAAU,GAAG,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA8B;QAC5D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,OAA8B;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YACpF,UAAU;YACV,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE;SACrC,CAAC,CACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAO,GAAqB,EAAE;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAClC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC;QAC1D,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YAC5F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC7B,IAAI,OAAO,GAAG,UAAU,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBAChE,IAAI,MAAM,EAAE,IAAI,KAAK,OAAO;wBAAE,OAAO,MAAM,CAAC;oBAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;gBACnG,CAAC,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,IAAI,KAAK,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAClD,OAAO,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7C,CAAC;QACD,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,qBAAqB,CAAC,UAAkB,EAAE,KAAgB;QACzD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,uBAAuB,CAAC,UAAkB;QACzC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,iBAAiB;QAChB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,IAAI;SAChB,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvD,CAAC,CAAC,EAAE,CACL,CAAC;QACF,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,SAA8B;QAC7D,MAAM,KAAK,GACV,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;YAC5C,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;QAChE,MAAM,WAAW,GAA8C;YAC9D,MAAM;YACN,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;YAC9D,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;SAC3D,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAEO,kBAAkB,CAAC,MAAkB,EAAE,SAA8B;QAC5E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,aAAa;gBACjB,OAAO,SAAS,CAAC,iBAAiB,EAAE,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,KAAK,QAAQ;gBACZ,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBAChD,IAAI,KAAK,KAAK,SAAS;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC5D,OAAO,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;YACJ,KAAK,QAAQ,CAAC;YACd,KAAK,MAAM;gBACV,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAEO,iBAAiB,CAAC,KAAgB,EAAE,SAA8B;QACzE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,UAAU;gBACd,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxB,MAAM;YACP,KAAK,aAAa;gBACjB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM;YACP,KAAK,MAAM;gBACV,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;YACP,KAAK,UAAU;gBACd,SAAS,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,MAAM;QACR,CAAC;IACF,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAAkB,EAClB,QAAQ,GAAW,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC;IAEnD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAoB,CAAC;QACrG,uEAAuE;QACvE,OAAO,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type {\n\tApiKeyCredential,\n\tAuthEvent,\n\tAuthInteraction,\n\tAuthOperationOptions,\n\tAuthPrompt,\n\tCredential,\n\tCredentialInfo,\n\tCredentialStore,\n\tOAuthAuth,\n\tOAuthCredential,\n\tOAuthLoginCallbacks,\n} from \"@earendil-works/pi-ai\";\nimport { findEnvKeys, getEnvApiKey, readByProviderId } from \"@earendil-works/pi-ai\";\nimport {\n\tappendLoginSlot,\n\ttype CredentialSlot,\n\tlistSlots,\n\ttype PooledCredential,\n\tremoveSlot,\n\trepairManagedSentinelSlots,\n\tupsertSlot,\n} from \"@earendil-works/pi-ai/auth/pool/slots\";\nimport { builtinProviders } from \"@earendil-works/pi-ai/providers/all\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from \"fs\";\nimport { dirname, join } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { getAgentDir } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileContentRevision, normalizePath } from \"../utils/paths.ts\";\nimport { stripBom } from \"../utils/text.ts\";\nimport { migrateLegacyProviderKeys } from \"./auth-provider-key-migration.ts\";\nimport {\n\tCredentialStoreBusyError,\n\tFILE_STORAGE_LOCK_OPTIONS,\n\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS,\n\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS,\n\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS,\n\tisLockError,\n} from \"./lockfile-policy.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\n/**\n * Heals pools poisoned by a shipped build that stored a provider-owned pool's\n * flat sentinel as a generated `login-N` slot. Such a slot resolves to sentinel\n * material, fails the provider's auth `check`, and hard-errors every request\n * whose affinity picks it - deterministically, for the lifetime of the entry -\n * so it is dropped the moment auth.json is read and the repair is written back\n * once by the mutable store.\n */\nfunction repairPoisonedPoolSlots(data: AuthStorageData): { data: AuthStorageData; repaired: boolean } {\n\tlet repaired: AuthStorageData | undefined;\n\tfor (const [providerId, credential] of Object.entries(data)) {\n\t\tif (typeof credential !== \"object\" || credential === null) continue;\n\t\tconst healed = repairManagedSentinelSlots(providerId, credential);\n\t\tif (!healed) continue;\n\t\trepaired ??= { ...data };\n\t\trepaired[providerId] = healed;\n\t}\n\treturn repaired ? { data: repaired, repaired: true } : { data, repaired: false };\n}\n\nexport type AuthCredential = Credential;\nexport type { ApiKeyCredential, OAuthCredential };\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport interface GetApiKeyOptions {\n\tincludeFallback?: boolean;\n}\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\n// Every write stages a fresh 0o600 file and renames it over the store, so the\n// credential file is never briefly world-readable and never half-written; the\n// restrictive mode also wins over any wider mode an earlier direct write left.\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t}\n\t}\n\n\t/**\n\t * Atomic credential write: stage a 0o600 temp file beside the store and\n\t * rename it over the target. An existing store may carry an\n\t * administrator-set mode; it is copied onto the temp before the rename, so\n\t * preservation matches the previous in-place write (whose mode applied only\n\t * on creation) and the staged bytes are never wider than the file already\n\t * was. Cross-process writers are serialized by the proper-lockfile lock the\n\t * caller already holds, so the pid-suffixed temp cannot collide; a crashed\n\t * write leaves at worst a 0o600 temp behind.\n\t */\n\tprivate writeAuthFile(content: string): void {\n\t\tconst temporary = `${this.authPath}.${process.pid}.tmp`;\n\t\ttry {\n\t\t\twriteFileSync(temporary, content, AUTH_FILE_WRITE_OPTIONS);\n\t\t\tif (existsSync(this.authPath)) {\n\t\t\t\tchmodSync(temporary, statSync(this.authPath).mode & 0o777);\n\t\t\t}\n\t\t\trenameSync(temporary, this.authPath);\n\t\t} catch (error) {\n\t\t\ttry {\n\t\t\t\trmSync(temporary, { force: true });\n\t\t\t} catch {\n\t\t\t\t// Best effort; a stale temp is already 0o600.\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { ...FILE_STORAGE_LOCK_OPTIONS, retries: 0 });\n\t\t\t} catch (error) {\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_SYNC_LOCK_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(path, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_SYNC_LOCK_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tconst sleeper = new Int32Array(new SharedArrayBuffer(4));\n\t\t\t\tAtomics.wait(sleeper, 0, 0, delayMs);\n\t\t\t}\n\t\t}\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.writeAuthFile(next);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tsignal?.throwIfAborted();\n\t\tconst startedAt = Date.now();\n\t\tlet attempt = 0;\n\t\t// The retry loop stays here rather than delegating to proper-lockfile's own\n\t\t// `retries`, so an abort is observed between attempts instead of after the\n\t\t// whole budget, and `onCompromised` is rebound per attempt.\n\t\twhile (true) {\n\t\t\ttry {\n\t\t\t\tconst release = await lockfile.lock(this.authPath, {\n\t\t\t\t\t...FILE_STORAGE_LOCK_OPTIONS,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t\tif (signal?.aborted) {\n\t\t\t\t\tawait release();\n\t\t\t\t\tsignal.throwIfAborted();\n\t\t\t\t}\n\t\t\t\treturn release;\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tif (!isLockError(error)) throw error;\n\t\t\t\tconst waitedMs = Date.now() - startedAt;\n\t\t\t\tif (waitedMs >= FILE_STORAGE_LOCK_RETRY_BUDGET_MS) {\n\t\t\t\t\tthrow new CredentialStoreBusyError(this.authPath, waitedMs, error);\n\t\t\t\t}\n\t\t\t\tconst delayMs = Math.min(\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MIN_DELAY_MS * 2 ** attempt,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_MAX_DELAY_MS,\n\t\t\t\t\tFILE_STORAGE_LOCK_RETRY_BUDGET_MS - waitedMs,\n\t\t\t\t);\n\t\t\t\tattempt++;\n\t\t\t\tawait raceWithAbortSignal(new Promise<void>((resolve) => setTimeout(resolve, delayMs)), signal);\n\t\t\t}\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.writeAuthFile(next);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = join(getAgentDir(), \"auth.json\")) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(stripBom(readFileSync(this.authPath, \"utf-8\")));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = repairPoisonedPoolSlots(parsed as AuthStorageData).data;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\t// Read boundary (senpi#1989): an auth.json written by an earlier version is\n\t\t// keyed by the legacy provider id. Try the canonical key first, then the\n\t\t// legacy spelling, so a credential is never reported missing after the\n\t\t// rename. Nothing is rewritten here.\n\t\tconst credential = readByProviderId(this.load(), providerId);\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (credential.type !== \"api_key\" || !credential.key || isCommandConfigValue(credential.key)) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: await resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate data: AuthStorageData = {};\n\tprivate readonly runtimeOverrides = new Map<string, string>();\n\tprivate readonly extensionOAuthProviders = new Map<string, OAuthAuth>();\n\tprivate errors: Error[] = [];\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileContentRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = join(getAgentDir(), \"auth.json\")): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tgetStoragePath(): string | undefined {\n\t\treturn this.authPath;\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) return {};\n\t\t// Mutation paths keep the stored keys as-is: the key migration (and its\n\t\t// pre-write backup) belongs to the load seam, so a write can never drop a\n\t\t// legacy entry without the backup that preserves it.\n\t\treturn repairPoisonedPoolSlots(JSON.parse(stripBom(content)) as AuthStorageData).data;\n\t}\n\n\t/**\n\t * Reports whether the parse healed poisoned pool slots or moved legacy\n\t * provider keys, so a load can write the result back exactly once. Repair\n\t * runs FIRST, while the entry still sits under its legacy key, so poisoned\n\t * sentinel slots heal with old-key derivation semantics; the sentinel\n\t * matcher accepts legacy materials too, so a later load of an already\n\t * migrated credential heals the same way.\n\t */\n\tprivate parseStorageContent(content: string | undefined): {\n\t\tdata: AuthStorageData;\n\t\trepaired: boolean;\n\t\tmigrated: boolean;\n\t} {\n\t\tif (!content) {\n\t\t\treturn { data: {}, repaired: false, migrated: false };\n\t\t}\n\t\tconst repaired = repairPoisonedPoolSlots(JSON.parse(stripBom(content)) as AuthStorageData);\n\t\tconst migrated = migrateLegacyProviderKeys(repaired.data);\n\t\treturn { data: migrated.data, repaired: repaired.repaired, migrated: migrated.migrated };\n\t}\n\n\tprivate recordError(error: unknown): void {\n\t\tthis.errors.push(error instanceof Error ? error : new Error(String(error)));\n\t}\n\n\t/**\n\t * Timestamped 0o600 copy of the pre-migration bytes, written inside the\n\t * held store lock before the migrated document replaces them. A migration\n\t * re-run after a crash between backup and rewrite writes another backup;\n\t * the loop suffix keeps same-millisecond names from overwriting each other.\n\t */\n\tprivate backupAuthFile(content: string | undefined): void {\n\t\tif (!this.authPath || content === undefined) return;\n\t\tconst stamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n\t\tlet backupPath = `${this.authPath}.backup-${stamp}`;\n\t\tfor (let attempt = 1; existsSync(backupPath); attempt++) {\n\t\t\tbackupPath = `${this.authPath}.backup-${stamp}-${attempt}`;\n\t\t}\n\t\twriteFileSync(backupPath, content, AUTH_FILE_WRITE_OPTIONS);\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.data = data;\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet data: AuthStorageData = {};\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tconst parsed = this.parseStorageContent(current);\n\t\t\t\tdata = parsed.data;\n\t\t\t\t// A written repair or migration invalidates the revision read before\n\t\t\t\t// it; leaving it unset makes the next reader re-read instead of\n\t\t\t\t// trusting a stale stamp.\n\t\t\t\trevision =\n\t\t\t\t\tparsed.repaired || parsed.migrated || !this.authPath ? undefined : getFileContentRevision(this.authPath);\n\t\t\t\tif (parsed.migrated) this.backupAuthFile(current);\n\t\t\t\treturn parsed.repaired || parsed.migrated\n\t\t\t\t\t? { result: undefined, next: JSON.stringify(parsed.data, null, 2) }\n\t\t\t\t\t: { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(data, revision);\n\t\t} catch (error) {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t\tthis.recordError(error instanceof Error ? error : new Error(String(error)));\n\t\t}\n\t}\n\n\t/** Set a non-persistent API key used ahead of stored credentials. */\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\n\t\tthis.runtimeOverrides.set(provider, apiKey);\n\t}\n\n\tremoveRuntimeApiKey(provider: string): void {\n\t\tthis.runtimeOverrides.delete(provider);\n\t}\n\n\tget(provider: string): Credential | undefined {\n\t\treturn readByProviderId(this.data, provider);\n\t}\n\n\tgetProviderEnv(provider: string): Record<string, string> | undefined {\n\t\tconst credential = readByProviderId(this.data, provider);\n\t\treturn credential?.type === \"api_key\" && credential.env ? { ...credential.env } : undefined;\n\t}\n\n\tset(provider: string, credential: Credential): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = appendLoginSlot(currentData[provider], credential);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremove(provider: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst nextData = { ...this.parseStorageData(content) };\n\t\t\tdelete nextData[provider];\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tlistSlots(provider: string): CredentialSlot[] {\n\t\treturn listSlots(readByProviderId(this.data, provider) as PooledCredential | undefined);\n\t}\n\n\tsetSlot(provider: string, slot: CredentialSlot): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = upsertSlot(currentData[provider] as PooledCredential | undefined, slot);\n\t\t\tconst nextData = { ...currentData, [provider]: next };\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\tremoveSlot(provider: string, name: string): void {\n\t\tthis.storage.withLock((content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = removeSlot(currentData[provider] as PooledCredential | undefined, name);\n\t\t\tconst nextData = { ...currentData };\n\t\t\tif (next === undefined) delete nextData[provider];\n\t\t\telse nextData[provider] = next;\n\t\t\tthis.data = nextData;\n\t\t\treturn { result: undefined, next: JSON.stringify(nextData, null, 2) };\n\t\t});\n\t}\n\n\thas(provider: string): boolean {\n\t\treturn provider in this.data;\n\t}\n\n\thasAuth(provider: string): boolean {\n\t\treturn this.runtimeOverrides.has(provider) || this.has(provider) || getEnvApiKey(provider) !== undefined;\n\t}\n\n\tgetAuthStatus(provider: string): AuthStatus {\n\t\tif (this.has(provider)) return { configured: true, source: \"stored\" };\n\t\tif (this.runtimeOverrides.has(provider)) return { configured: true, source: \"runtime\", label: \"--api-key\" };\n\t\tconst envName = findEnvKeys(provider)?.[0];\n\t\tif (envName && process.env[envName]) return { configured: true, source: \"environment\", label: envName };\n\t\treturn { configured: false };\n\t}\n\n\tgetAll(): AuthStorageData {\n\t\treturn { ...this.data };\n\t}\n\n\tdrainErrors(): Error[] {\n\t\tconst errors = this.errors;\n\t\tthis.errors = [];\n\t\treturn errors;\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst parsed = this.parseStorageContent(content);\n\t\t\tconst revision =\n\t\t\t\tparsed.repaired || parsed.migrated || !this.authPath ? undefined : getFileContentRevision(this.authPath);\n\t\t\tthis.updateReadState(parsed.data, revision);\n\t\t\tif (parsed.migrated) this.backupAuthFile(content);\n\t\t\treturn parsed.repaired || parsed.migrated\n\t\t\t\t? { result: parsed.data, next: JSON.stringify(parsed.data, null, 2) }\n\t\t\t\t: { result: parsed.data };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\ttry {\n\t\t\t\treturn await this.reloadFromStorageAsync(options);\n\t\t\t} catch (error) {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\tthis.recordError(error);\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t}\n\t\tconst revision = getFileContentRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t(error: unknown) => {\n\t\t\t\t\tif (!controller.signal.aborted) this.recordError(error);\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\ttry {\n\t\t\t\treturn await raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\t} catch {\n\t\t\t\toptions?.signal?.throwIfAborted();\n\t\t\t\treturn this.readState.data;\n\t\t\t}\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst runtimeKey = this.runtimeOverrides.get(provider);\n\t\tif (runtimeKey) return { type: \"api_key\", key: runtimeKey };\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: await resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileContentRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.runtimeOverrides.delete(provider);\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = new Map(\n\t\t\tObject.entries(await this.readLatestData(options)).map(([providerId, credential]) => [\n\t\t\t\tproviderId,\n\t\t\t\t{ providerId, type: credential.type },\n\t\t\t]),\n\t\t);\n\t\toptions?.signal?.throwIfAborted();\n\t\tfor (const providerId of this.runtimeOverrides.keys()) {\n\t\t\tentries.set(providerId, { providerId, type: \"api_key\" });\n\t\t}\n\t\treturn [...entries.values()];\n\t}\n\n\tasync getApiKey(providerId: string, options: GetApiKeyOptions = {}): Promise<string | undefined> {\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\n\t\tif (runtimeKey) return runtimeKey;\n\t\tconst credential = await this.read(providerId);\n\t\tif (credential?.type === \"api_key\") return credential.key;\n\t\tif (credential?.type === \"oauth\") {\n\t\t\tconst oauth = builtinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\t\tif (!oauth) return undefined;\n\t\t\tlet current = credential;\n\t\t\tif (Date.now() >= current.expires) {\n\t\t\t\tconst refreshed = await this.modify(providerId, async (stored) => {\n\t\t\t\t\tif (stored?.type !== \"oauth\") return stored;\n\t\t\t\t\treturn Date.now() < stored.expires ? stored : oauth.refresh(stored, new AbortController().signal);\n\t\t\t\t});\n\t\t\t\tif (refreshed?.type !== \"oauth\") return undefined;\n\t\t\t\tcurrent = refreshed;\n\t\t\t}\n\t\t\treturn (await oauth.toAuth(current)).apiKey;\n\t\t}\n\t\tif (options.includeFallback === false) return undefined;\n\t\treturn getEnvApiKey(providerId);\n\t}\n\n\tregisterOAuthProvider(providerId: string, oauth: OAuthAuth): void {\n\t\tthis.extensionOAuthProviders.set(providerId, oauth);\n\t}\n\n\tunregisterOAuthProvider(providerId: string): void {\n\t\tthis.extensionOAuthProviders.delete(providerId);\n\t}\n\n\tgetOAuthProviders(): Array<{ id: string; name: string }> {\n\t\tconst dynamic = [...this.extensionOAuthProviders.entries()].map(([id, oauth]) => ({\n\t\t\tid,\n\t\t\tname: oauth.name,\n\t\t}));\n\t\tconst builtin = builtinProviders().flatMap((provider) =>\n\t\t\tprovider.auth.oauth && !this.extensionOAuthProviders.has(provider.id)\n\t\t\t\t? [{ id: provider.id, name: provider.auth.oauth.name }]\n\t\t\t\t: [],\n\t\t);\n\t\treturn [...dynamic, ...builtin];\n\t}\n\n\tasync login(providerId: string, callbacks: OAuthLoginCallbacks): Promise<void> {\n\t\tconst oauth =\n\t\t\tthis.extensionOAuthProviders.get(providerId) ??\n\t\t\tbuiltinProviders().find((provider) => provider.id === providerId)?.auth.oauth;\n\t\tif (!oauth) throw new Error(`Unknown OAuth provider: ${providerId}`);\n\t\tconst signal = callbacks.signal ?? new AbortController().signal;\n\t\tconst interaction: AuthInteraction & { signal: AbortSignal } = {\n\t\t\tsignal,\n\t\t\tprompt: (prompt) => this.handleLegacyPrompt(prompt, callbacks),\n\t\t\tnotify: (event) => this.handleLegacyEvent(event, callbacks),\n\t\t};\n\t\tconst credential = await oauth.login(interaction);\n\t\tthis.set(providerId, credential);\n\t}\n\n\tlogout(provider: string): void {\n\t\tthis.removeRuntimeApiKey(provider);\n\t\tthis.remove(provider);\n\t}\n\n\tprivate handleLegacyPrompt(prompt: AuthPrompt, callbacks: OAuthLoginCallbacks): Promise<string> {\n\t\tswitch (prompt.type) {\n\t\t\tcase \"manual_code\":\n\t\t\t\treturn callbacks.onManualCodeInput?.() ?? callbacks.onPrompt(prompt);\n\t\t\tcase \"select\":\n\t\t\t\treturn callbacks.onSelect(prompt).then((value) => {\n\t\t\t\t\tif (value === undefined) throw new Error(\"Login cancelled\");\n\t\t\t\t\treturn value;\n\t\t\t\t});\n\t\t\tcase \"secret\":\n\t\t\tcase \"text\":\n\t\t\t\treturn callbacks.onPrompt(prompt);\n\t\t}\n\t}\n\n\tprivate handleLegacyEvent(event: AuthEvent, callbacks: OAuthLoginCallbacks): void {\n\t\tswitch (event.type) {\n\t\t\tcase \"auth_url\":\n\t\t\t\tcallbacks.onAuth(event);\n\t\t\t\tbreak;\n\t\t\tcase \"device_code\":\n\t\t\t\tcallbacks.onDeviceCode(event);\n\t\t\t\tbreak;\n\t\t\tcase \"info\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t\tcase \"progress\":\n\t\t\t\tcallbacks.onProgress?.(event.message);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(\n\tproviderId: string,\n\tauthPath: string = join(getAgentDir(), \"auth.json\"),\n): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), \"utf-8\"))) as AuthStorageData;\n\t\t// Read boundary (senpi#1989): try canonical, then the legacy spelling.\n\t\treturn readByProviderId(data, providerId);\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/core/credential-accounts.d.ts

@@ -1,4 +1,4 @@
-import type { Credential } from "@earendil-works/pi-ai";
+import { type Credential } from "@earendil-works/pi-ai";
 import type { AuthStorage } from "./auth-storage.ts";
 import { CredentialSlotRepository } from "./credential-pool/state-store.ts";
 export type CredentialAccountSource = "login" | "import" | "env";

package/dist/core/credential-accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-accounts.d.ts","sourceRoot":"","sources":["../../src/core/credential-accounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AASxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAwC,MAAM,kCAAkC,CAAC;AAIlH,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,mFAAmF;AACnF,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CACzB,CAAC;AAIF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzD;AAuCD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAErC;AAED,2FAA2F;AAC3F,wBAAsB,2BAA2B,CAChD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,GAAE,wBAAyD,GACnE,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAiDrC;AAED,sGAAsG;AACtG,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,4DAA4D;AAC5D,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"credential-accounts.d.ts","sourceRoot":"","sources":["../../src/core/credential-accounts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAuB,MAAM,uBAAuB,CAAC;AAS7E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAwC,MAAM,kCAAkC,CAAC;AAIlH,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,mFAAmF;AACnF,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CACzB,CAAC;AAIF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMzD;AAuCD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAErC;AAED,2FAA2F;AAC3F,wBAAsB,2BAA2B,CAChD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,GAAE,wBAAyD,GACnE,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAmDrC;AAED,sGAAsG;AACtG,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,4DAA4D;AAC5D,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,UAAU,CAAC,EAAE,wBAAwB,GACnC,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/core/credential-accounts.js

@@ -1,9 +1,10 @@
 import { dirname, join } from "node:path";
+import { normalizeProviderId } from "@earendil-works/pi-ai";
 import { accountDisplayName, listSlots, pinSlot, removeSlot, renameSlotDisplayName, } from "@earendil-works/pi-ai/auth/pool/slots";
 import { discoverEnvSlots } from "./credential-pool/env-slots.js";
 import { CredentialSlotRepository, slotHealth } from "./credential-pool/state-store.js";
-import { emitProviderAccountsChanged } from "./extensions/builtin/claude-sdk-oauth/account-events.js";
-import { SENTINEL_OAUTH_FIELDS } from "./extensions/builtin/claude-sdk-oauth/accounts.js";
+import { emitProviderAccountsChanged } from "./extensions/builtin/anthropic-subscription/account-events.js";
+import { SENTINEL_OAUTH_FIELDS } from "./extensions/builtin/anthropic-subscription/accounts.js";
 const ACCOUNT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;
 export function assertValidAccountName(name) {
     if (!ACCOUNT_NAME_PATTERN.test(name)) {
@@ -61,7 +62,9 @@ export async function summarizeCredentialAccounts(provider, stored, env = proces
     const summaries = [];
     if (credential) {
         const state = await repository.listSlots(provider, "stored");
-        const storedAccounts = provider === "claude-sdk-oauth"
+        // Read boundary (senpi#1989): a caller may still pass the legacy provider
+        // id (an older session, a stored account payload), so compare normalized.
+        const storedAccounts = normalizeProviderId(provider) === "anthropic-subscription"
             ? Array.isArray(credential.accounts)
                 ? listSlots(credential)
                 : []
@@ -84,7 +87,7 @@ export async function summarizeCredentialAccounts(provider, stored, env = proces
                 pinned: pinned === slot.name,
             });
         }
-        if (provider !== "claude-sdk-oauth")
+        if (normalizeProviderId(provider) !== "anthropic-subscription")
             return summaries;
     }
     const state = await repository.listSlots(provider, "env");
@@ -131,7 +134,7 @@ export async function pinCredentialAccount(storage, provider, name, env = proces
     }
     await storage.modify(provider, async (current) => {
         if (current === undefined) {
-            if (provider !== "claude-sdk-oauth" || name === null) {
+            if (normalizeProviderId(provider) !== "anthropic-subscription" || name === null) {
                 throw new Error(`No stored credential for provider: ${provider}`);
             }
             return pinSlot({ type: "oauth", ...SENTINEL_OAUTH_FIELDS, accounts: [] }, name);

package/dist/core/credential-accounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-accounts.js","sourceRoot":"","sources":["../../src/core/credential-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACN,kBAAkB,EAClB,SAAS,EAET,OAAO,EACP,UAAU,EACV,qBAAqB,GACrB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAA4B,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAa1F,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACd,yBAAyB,IAAI,qEAAqE,CAClG,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,UAAkC;IACrD,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,UAAwC;IAC3D,OAAO,UAAU,EAAE,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAC1C,OAAO,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,OAAwC,EAAE,GAAW;IACvF,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACvD,OAAO,YAAY,KAAK,SAAS,IAAI,YAAY,GAAG,GAAG,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAoB,EACpB,QAAgB,EAChB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAqC;IAErC,OAAO,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AACpH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,QAAgB,EAChB,MAA8B,EAC9B,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAU,GAA6B,IAAI,wBAAwB,EAAE;IAErE,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,SAAS,GAA+B,EAAE,CAAC;IAEjD,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,cAAc,GACnB,QAAQ,KAAK,kBAAkB;YAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACnC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;gBACvB,CAAC,CAAC,EAAE;YACL,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC/E,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,2EAA2E;YAC3E,MAAM,UAAU,GAAG,SAAS,EAAE,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,SAAS,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO;gBAC9B,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC;gBAC3C,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,IAAI;aAC5B,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,kBAAkB;YAAE,OAAO,SAAS,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACnF,+EAA+E;QAC/E,MAAM,UAAU,GAAG,SAAS,EAAE,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,SAAS,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,SAAS;YAClD,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,IAAI;SAC5B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAoB,EACpB,QAAgB,EAChB,IAAY,EACZ,WAA0B;IAE1B,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;QAChF,2FAA2F;QAC3F,sGAAsG;QACtG,IACC,OAAO,CAAC,IAAI,KAAK,OAAO;YACxB,CAAC,KAAK,CAAC,OAAO,CAAE,OAAkC,CAAC,QAAQ,CAAC;YAC5D,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO;YAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAClC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAoB,EACpB,QAAgB,EAChB,IAAmB,EACnB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAqC;IAErC,MAAM,IAAI,GAAG,UAAU,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IACD,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,KAAK,kBAAkB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACtD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC3E,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,+EAA+E;IAC/E,gDAAgD;IAChD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAoB,EACpB,QAAgB,EAChB,IAAY,EACZ,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAqC;IAErC,MAAM,IAAI,GAAG,UAAU,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;;QACvD,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC","sourcesContent":["import { dirname, join } from \"node:path\";\nimport type { Credential } from \"@earendil-works/pi-ai\";\nimport {\n\taccountDisplayName,\n\tlistSlots,\n\ttype PooledCredential,\n\tpinSlot,\n\tremoveSlot,\n\trenameSlotDisplayName,\n} from \"@earendil-works/pi-ai/auth/pool/slots\";\nimport type { AuthStorage } from \"./auth-storage.ts\";\nimport { discoverEnvSlots } from \"./credential-pool/env-slots.ts\";\nimport { CredentialSlotRepository, type CredentialSlotState, slotHealth } from \"./credential-pool/state-store.ts\";\nimport { emitProviderAccountsChanged } from \"./extensions/builtin/claude-sdk-oauth/account-events.ts\";\nimport { SENTINEL_OAUTH_FIELDS } from \"./extensions/builtin/claude-sdk-oauth/accounts.ts\";\n\nexport type CredentialAccountSource = \"login\" | \"import\" | \"env\";\n\n/** Account metadata safe to surface: names and health only, never key material. */\nexport type CredentialAccountSummary = {\n\treadonly name: string;\n\treadonly displayName?: string;\n\treadonly source: CredentialAccountSource;\n\treadonly blocked: boolean;\n\treadonly pinned: boolean;\n};\n\nconst ACCOUNT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;\n\nexport function assertValidAccountName(name: string): void {\n\tif (!ACCOUNT_NAME_PATTERN.test(name)) {\n\t\tthrow new Error(\n\t\t\t`Invalid account name '${name}': use letters, digits, '-' or '_', starting with a letter or digit`,\n\t\t);\n\t}\n}\n\nfunction pooledFrom(credential: Credential | undefined): PooledCredential | undefined {\n\treturn credential === undefined ? undefined : credential;\n}\n\nfunction pinnedName(credential: PooledCredential | undefined): string | undefined {\n\treturn credential?.pinned;\n}\n\nfunction numberField(value: object, key: string): number | undefined {\n\tconst found = Object.entries(value).find(([candidate]) => candidate === key)?.[1];\n\treturn typeof found === \"number\" ? found : undefined;\n}\n\nfunction defaultRepository(storage: AuthStorage): CredentialSlotRepository {\n\tconst authPath = storage.getStoragePath();\n\treturn new CredentialSlotRepository(authPath ? join(dirname(authPath), \"credential-pool-state.json\") : undefined);\n}\n\nfunction stringField(value: object, key: string): string | undefined {\n\tconst found = Object.entries(value).find(([candidate]) => candidate === key)?.[1];\n\treturn typeof found === \"string\" ? found : undefined;\n}\n\n/**\n * Block state has two sources and both are authoritative: a slot persisted by an\n * existing provider lane carries its own `blockedUntil`/`blockReason` inside\n * auth.json, while generic pool failover records health in the sidecar. Reading\n * only one would silently downgrade a real block to \"available\".\n */\nfunction slotBlocked(slot: object, sidecar: CredentialSlotState | undefined, now: number): boolean {\n\tif (slotHealth(sidecar, now) === \"blocked\") return true;\n\tconst reason = stringField(slot, \"blockReason\");\n\tif (reason === \"auth_error\" || reason === \"account_disabled\") return true;\n\tconst blockedUntil = numberField(slot, \"blockedUntil\");\n\treturn blockedUntil !== undefined && blockedUntil > now;\n}\n\n/**\n * Lists a provider's credential accounts for ANY provider, not just one lane.\n * Stored slots own the listing when a credential exists; env slots are listed\n * only when nothing is stored, mirroring resolution precedence exactly. Health\n * comes from the pool sidecar, so a cooldown persisted by a failover shows up\n * here without auth.json ever carrying block state.\n */\nexport async function getCredentialAccounts(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository?: CredentialSlotRepository,\n): Promise<CredentialAccountSummary[]> {\n\treturn summarizeCredentialAccounts(provider, storage.get(provider), env, repository ?? defaultRepository(storage));\n}\n\n/** Storage-free variant for callers that already hold the credential (e.g. auth check). */\nexport async function summarizeCredentialAccounts(\n\tprovider: string,\n\tstored: Credential | undefined,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository: CredentialSlotRepository = new CredentialSlotRepository(),\n): Promise<CredentialAccountSummary[]> {\n\tconst credential = pooledFrom(stored);\n\tconst now = Date.now();\n\tconst pinned = pinnedName(credential);\n\tconst summaries: CredentialAccountSummary[] = [];\n\n\tif (credential) {\n\t\tconst state = await repository.listSlots(provider, \"stored\");\n\t\tconst storedAccounts =\n\t\t\tprovider === \"claude-sdk-oauth\"\n\t\t\t\t? Array.isArray(credential.accounts)\n\t\t\t\t\t? listSlots(credential)\n\t\t\t\t\t: []\n\t\t\t\t: listSlots(credential);\n\t\tfor (const slot of storedAccounts) {\n\t\t\tconst displayName = accountDisplayName(slot.displayName);\n\t\t\tconst persisted = state[slot.name];\n\t\t\tconst revision = await repository.storedCredentialRevision(provider, slot.name, {\n\t\t\t\tkey: slot.key,\n\t\t\t\taccess: slot.access,\n\t\t\t\trefresh: slot.refresh,\n\t\t\t});\n\t\t\t// A block belongs to the material that earned it; a re-login starts clean.\n\t\t\tconst applicable = persisted?.credentialRevision === revision ? persisted : undefined;\n\t\t\tsummaries.push({\n\t\t\t\tname: slot.name,\n\t\t\t\t...(displayName === undefined ? {} : { displayName }),\n\t\t\t\tsource: slot.source ?? \"login\",\n\t\t\t\tblocked: slotBlocked(slot, applicable, now),\n\t\t\t\tpinned: pinned === slot.name,\n\t\t\t});\n\t\t}\n\t\tif (provider !== \"claude-sdk-oauth\") return summaries;\n\t}\n\n\tconst state = await repository.listSlots(provider, \"env\");\n\tfor (const slot of discoverEnvSlots(provider, (name) => env[name])) {\n\t\tconst persisted = state[slot.name];\n\t\tconst revision = await repository.envCredentialRevision(slot.envVarName, slot.key);\n\t\t// A block belongs to the value that earned it; a rotated env key starts clean.\n\t\tconst applicable = persisted?.credentialRevision === revision ? persisted : undefined;\n\t\tsummaries.push({\n\t\t\tname: slot.name,\n\t\t\tsource: \"env\",\n\t\t\tblocked: slotHealth(applicable, now) === \"blocked\",\n\t\t\tpinned: pinned === slot.name,\n\t\t});\n\t}\n\treturn summaries;\n}\n\n/** Atomically rename/clear stored metadata without changing identity, health or environment state. */\nexport async function renameCredentialAccount(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tname: string,\n\tdisplayName: string | null,\n): Promise<void> {\n\tawait storage.modify(provider, async (current) => {\n\t\tif (!current) throw new Error(`No stored credential for provider: ${provider}`);\n\t\t// Provider-managed OAuth sentinels without an accounts array are not legacy flat accounts.\n\t\t// Key this on the credential shape, not one provider id, so sibling managed lanes cannot be promoted.\n\t\tif (\n\t\t\tcurrent.type === \"oauth\" &&\n\t\t\t!Array.isArray((current as { accounts?: unknown }).accounts) &&\n\t\t\tcurrent.access === current.refresh &&\n\t\t\tcurrent.access.endsWith(\"-managed\")\n\t\t) {\n\t\t\tthrow new Error(`Stored provider account not found: ${name}`);\n\t\t}\n\t\treturn renameSlotDisplayName(current, name, displayName);\n\t});\n\temitProviderAccountsChanged(provider);\n}\n\n/** Pins one slot, or clears the pin when `name` is null. */\nexport async function pinCredentialAccount(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tname: string | null,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository?: CredentialSlotRepository,\n): Promise<void> {\n\tconst repo = repository ?? defaultRepository(storage);\n\tif (name !== null) {\n\t\tassertValidAccountName(name);\n\t\tconst accounts = await getCredentialAccounts(storage, provider, env, repo);\n\t\tif (!accounts.some((account) => account.name === name)) {\n\t\t\tthrow new Error(`Provider account not found: ${name}`);\n\t\t}\n\t}\n\tawait storage.modify(provider, async (current) => {\n\t\tif (current === undefined) {\n\t\t\tif (provider !== \"claude-sdk-oauth\" || name === null) {\n\t\t\t\tthrow new Error(`No stored credential for provider: ${provider}`);\n\t\t\t}\n\t\t\treturn pinSlot({ type: \"oauth\", ...SENTINEL_OAUTH_FIELDS, accounts: [] }, name);\n\t\t}\n\t\tif (name === null) {\n\t\t\tif (pinnedName(current) === undefined) return current;\n\t\t\tconst { pinned: _pinned, ...unpinned } = { ...current, pinned: undefined };\n\t\t\treturn unpinned;\n\t\t}\n\t\treturn pinSlot(current, name);\n\t});\n\t// Subscribed clients re-read the list after any mutation; skipping this leaves\n\t// a desktop account picker showing a stale pin.\n\temitProviderAccountsChanged(provider);\n}\n\n/**\n * Removes one stored slot. Env-backed accounts are refused: they are owned by\n * the environment, and deleting one here would silently disagree with the\n * variable that still defines it.\n */\nexport async function removeCredentialAccount(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tname: string,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository?: CredentialSlotRepository,\n): Promise<void> {\n\tconst repo = repository ?? defaultRepository(storage);\n\tconst accounts = await getCredentialAccounts(storage, provider, env, repo);\n\tconst account = accounts.find((candidate) => candidate.name === name);\n\tif (!account) throw new Error(`Provider account not found: ${name}`);\n\tif (account.source === \"env\") {\n\t\tthrow new Error(`Environment provider account cannot be removed: ${name}`);\n\t}\n\tconst next = await storage.read(provider);\n\tif (next === undefined) throw new Error(`No stored credential for provider: ${provider}`);\n\tconst remaining = removeSlot(next, name);\n\tif (remaining === undefined) await storage.delete(provider);\n\telse await storage.modify(provider, async () => remaining);\n\tawait repo.mutateSlotState(provider, \"stored\", name, () => undefined);\n\temitProviderAccountsChanged(provider);\n}\n"]}
+{"version":3,"file":"credential-accounts.js","sourceRoot":"","sources":["../../src/core/credential-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAmB,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACN,kBAAkB,EAClB,SAAS,EAET,OAAO,EACP,UAAU,EACV,qBAAqB,GACrB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAA4B,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAClH,OAAO,EAAE,2BAA2B,EAAE,MAAM,+DAA+D,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,yDAAyD,CAAC;AAahG,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACd,yBAAyB,IAAI,qEAAqE,CAClG,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,UAAkC;IACrD,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,UAAwC;IAC3D,OAAO,UAAU,EAAE,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAoB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAC1C,OAAO,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,GAAW;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,OAAwC,EAAE,GAAW;IACvF,IAAI,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACvD,OAAO,YAAY,KAAK,SAAS,IAAI,YAAY,GAAG,GAAG,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAoB,EACpB,QAAgB,EAChB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAqC;IAErC,OAAO,2BAA2B,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AACpH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,QAAgB,EAChB,MAA8B,EAC9B,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAU,GAA6B,IAAI,wBAAwB,EAAE;IAErE,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,SAAS,GAA+B,EAAE,CAAC;IAEjD,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7D,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,cAAc,GACnB,mBAAmB,CAAC,QAAQ,CAAC,KAAK,wBAAwB;YACzD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACnC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC;gBACvB,CAAC,CAAC,EAAE;YACL,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC/E,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,2EAA2E;YAC3E,MAAM,UAAU,GAAG,SAAS,EAAE,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,SAAS,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;gBACrD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO;gBAC9B,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC;gBAC3C,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,IAAI;aAC5B,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,wBAAwB;YAAE,OAAO,SAAS,CAAC;IAClF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACnF,+EAA+E;QAC/E,MAAM,UAAU,GAAG,SAAS,EAAE,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,SAAS,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,SAAS;YAClD,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,IAAI;SAC5B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAoB,EACpB,QAAgB,EAChB,IAAY,EACZ,WAA0B;IAE1B,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;QAChF,2FAA2F;QAC3F,sGAAsG;QACtG,IACC,OAAO,CAAC,IAAI,KAAK,OAAO;YACxB,CAAC,KAAK,CAAC,OAAO,CAAE,OAAkC,CAAC,QAAQ,CAAC;YAC5D,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO;YAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAClC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,qBAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAoB,EACpB,QAAgB,EAChB,IAAmB,EACnB,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAqC;IAErC,MAAM,IAAI,GAAG,UAAU,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACnB,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACF,CAAC;IACD,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,wBAAwB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACjF,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,qBAAqB,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YACtD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC3E,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,+EAA+E;IAC/E,gDAAgD;IAChD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAoB,EACpB,QAAgB,EAChB,IAAY,EACZ,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,UAAqC;IAErC,MAAM,IAAI,GAAG,UAAU,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;;QACvD,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC","sourcesContent":["import { dirname, join } from \"node:path\";\nimport { type Credential, normalizeProviderId } from \"@earendil-works/pi-ai\";\nimport {\n\taccountDisplayName,\n\tlistSlots,\n\ttype PooledCredential,\n\tpinSlot,\n\tremoveSlot,\n\trenameSlotDisplayName,\n} from \"@earendil-works/pi-ai/auth/pool/slots\";\nimport type { AuthStorage } from \"./auth-storage.ts\";\nimport { discoverEnvSlots } from \"./credential-pool/env-slots.ts\";\nimport { CredentialSlotRepository, type CredentialSlotState, slotHealth } from \"./credential-pool/state-store.ts\";\nimport { emitProviderAccountsChanged } from \"./extensions/builtin/anthropic-subscription/account-events.ts\";\nimport { SENTINEL_OAUTH_FIELDS } from \"./extensions/builtin/anthropic-subscription/accounts.ts\";\n\nexport type CredentialAccountSource = \"login\" | \"import\" | \"env\";\n\n/** Account metadata safe to surface: names and health only, never key material. */\nexport type CredentialAccountSummary = {\n\treadonly name: string;\n\treadonly displayName?: string;\n\treadonly source: CredentialAccountSource;\n\treadonly blocked: boolean;\n\treadonly pinned: boolean;\n};\n\nconst ACCOUNT_NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/;\n\nexport function assertValidAccountName(name: string): void {\n\tif (!ACCOUNT_NAME_PATTERN.test(name)) {\n\t\tthrow new Error(\n\t\t\t`Invalid account name '${name}': use letters, digits, '-' or '_', starting with a letter or digit`,\n\t\t);\n\t}\n}\n\nfunction pooledFrom(credential: Credential | undefined): PooledCredential | undefined {\n\treturn credential === undefined ? undefined : credential;\n}\n\nfunction pinnedName(credential: PooledCredential | undefined): string | undefined {\n\treturn credential?.pinned;\n}\n\nfunction numberField(value: object, key: string): number | undefined {\n\tconst found = Object.entries(value).find(([candidate]) => candidate === key)?.[1];\n\treturn typeof found === \"number\" ? found : undefined;\n}\n\nfunction defaultRepository(storage: AuthStorage): CredentialSlotRepository {\n\tconst authPath = storage.getStoragePath();\n\treturn new CredentialSlotRepository(authPath ? join(dirname(authPath), \"credential-pool-state.json\") : undefined);\n}\n\nfunction stringField(value: object, key: string): string | undefined {\n\tconst found = Object.entries(value).find(([candidate]) => candidate === key)?.[1];\n\treturn typeof found === \"string\" ? found : undefined;\n}\n\n/**\n * Block state has two sources and both are authoritative: a slot persisted by an\n * existing provider lane carries its own `blockedUntil`/`blockReason` inside\n * auth.json, while generic pool failover records health in the sidecar. Reading\n * only one would silently downgrade a real block to \"available\".\n */\nfunction slotBlocked(slot: object, sidecar: CredentialSlotState | undefined, now: number): boolean {\n\tif (slotHealth(sidecar, now) === \"blocked\") return true;\n\tconst reason = stringField(slot, \"blockReason\");\n\tif (reason === \"auth_error\" || reason === \"account_disabled\") return true;\n\tconst blockedUntil = numberField(slot, \"blockedUntil\");\n\treturn blockedUntil !== undefined && blockedUntil > now;\n}\n\n/**\n * Lists a provider's credential accounts for ANY provider, not just one lane.\n * Stored slots own the listing when a credential exists; env slots are listed\n * only when nothing is stored, mirroring resolution precedence exactly. Health\n * comes from the pool sidecar, so a cooldown persisted by a failover shows up\n * here without auth.json ever carrying block state.\n */\nexport async function getCredentialAccounts(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository?: CredentialSlotRepository,\n): Promise<CredentialAccountSummary[]> {\n\treturn summarizeCredentialAccounts(provider, storage.get(provider), env, repository ?? defaultRepository(storage));\n}\n\n/** Storage-free variant for callers that already hold the credential (e.g. auth check). */\nexport async function summarizeCredentialAccounts(\n\tprovider: string,\n\tstored: Credential | undefined,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository: CredentialSlotRepository = new CredentialSlotRepository(),\n): Promise<CredentialAccountSummary[]> {\n\tconst credential = pooledFrom(stored);\n\tconst now = Date.now();\n\tconst pinned = pinnedName(credential);\n\tconst summaries: CredentialAccountSummary[] = [];\n\n\tif (credential) {\n\t\tconst state = await repository.listSlots(provider, \"stored\");\n\t\t// Read boundary (senpi#1989): a caller may still pass the legacy provider\n\t\t// id (an older session, a stored account payload), so compare normalized.\n\t\tconst storedAccounts =\n\t\t\tnormalizeProviderId(provider) === \"anthropic-subscription\"\n\t\t\t\t? Array.isArray(credential.accounts)\n\t\t\t\t\t? listSlots(credential)\n\t\t\t\t\t: []\n\t\t\t\t: listSlots(credential);\n\t\tfor (const slot of storedAccounts) {\n\t\t\tconst displayName = accountDisplayName(slot.displayName);\n\t\t\tconst persisted = state[slot.name];\n\t\t\tconst revision = await repository.storedCredentialRevision(provider, slot.name, {\n\t\t\t\tkey: slot.key,\n\t\t\t\taccess: slot.access,\n\t\t\t\trefresh: slot.refresh,\n\t\t\t});\n\t\t\t// A block belongs to the material that earned it; a re-login starts clean.\n\t\t\tconst applicable = persisted?.credentialRevision === revision ? persisted : undefined;\n\t\t\tsummaries.push({\n\t\t\t\tname: slot.name,\n\t\t\t\t...(displayName === undefined ? {} : { displayName }),\n\t\t\t\tsource: slot.source ?? \"login\",\n\t\t\t\tblocked: slotBlocked(slot, applicable, now),\n\t\t\t\tpinned: pinned === slot.name,\n\t\t\t});\n\t\t}\n\t\tif (normalizeProviderId(provider) !== \"anthropic-subscription\") return summaries;\n\t}\n\n\tconst state = await repository.listSlots(provider, \"env\");\n\tfor (const slot of discoverEnvSlots(provider, (name) => env[name])) {\n\t\tconst persisted = state[slot.name];\n\t\tconst revision = await repository.envCredentialRevision(slot.envVarName, slot.key);\n\t\t// A block belongs to the value that earned it; a rotated env key starts clean.\n\t\tconst applicable = persisted?.credentialRevision === revision ? persisted : undefined;\n\t\tsummaries.push({\n\t\t\tname: slot.name,\n\t\t\tsource: \"env\",\n\t\t\tblocked: slotHealth(applicable, now) === \"blocked\",\n\t\t\tpinned: pinned === slot.name,\n\t\t});\n\t}\n\treturn summaries;\n}\n\n/** Atomically rename/clear stored metadata without changing identity, health or environment state. */\nexport async function renameCredentialAccount(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tname: string,\n\tdisplayName: string | null,\n): Promise<void> {\n\tawait storage.modify(provider, async (current) => {\n\t\tif (!current) throw new Error(`No stored credential for provider: ${provider}`);\n\t\t// Provider-managed OAuth sentinels without an accounts array are not legacy flat accounts.\n\t\t// Key this on the credential shape, not one provider id, so sibling managed lanes cannot be promoted.\n\t\tif (\n\t\t\tcurrent.type === \"oauth\" &&\n\t\t\t!Array.isArray((current as { accounts?: unknown }).accounts) &&\n\t\t\tcurrent.access === current.refresh &&\n\t\t\tcurrent.access.endsWith(\"-managed\")\n\t\t) {\n\t\t\tthrow new Error(`Stored provider account not found: ${name}`);\n\t\t}\n\t\treturn renameSlotDisplayName(current, name, displayName);\n\t});\n\temitProviderAccountsChanged(provider);\n}\n\n/** Pins one slot, or clears the pin when `name` is null. */\nexport async function pinCredentialAccount(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tname: string | null,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository?: CredentialSlotRepository,\n): Promise<void> {\n\tconst repo = repository ?? defaultRepository(storage);\n\tif (name !== null) {\n\t\tassertValidAccountName(name);\n\t\tconst accounts = await getCredentialAccounts(storage, provider, env, repo);\n\t\tif (!accounts.some((account) => account.name === name)) {\n\t\t\tthrow new Error(`Provider account not found: ${name}`);\n\t\t}\n\t}\n\tawait storage.modify(provider, async (current) => {\n\t\tif (current === undefined) {\n\t\t\tif (normalizeProviderId(provider) !== \"anthropic-subscription\" || name === null) {\n\t\t\t\tthrow new Error(`No stored credential for provider: ${provider}`);\n\t\t\t}\n\t\t\treturn pinSlot({ type: \"oauth\", ...SENTINEL_OAUTH_FIELDS, accounts: [] }, name);\n\t\t}\n\t\tif (name === null) {\n\t\t\tif (pinnedName(current) === undefined) return current;\n\t\t\tconst { pinned: _pinned, ...unpinned } = { ...current, pinned: undefined };\n\t\t\treturn unpinned;\n\t\t}\n\t\treturn pinSlot(current, name);\n\t});\n\t// Subscribed clients re-read the list after any mutation; skipping this leaves\n\t// a desktop account picker showing a stale pin.\n\temitProviderAccountsChanged(provider);\n}\n\n/**\n * Removes one stored slot. Env-backed accounts are refused: they are owned by\n * the environment, and deleting one here would silently disagree with the\n * variable that still defines it.\n */\nexport async function removeCredentialAccount(\n\tstorage: AuthStorage,\n\tprovider: string,\n\tname: string,\n\tenv: NodeJS.ProcessEnv = process.env,\n\trepository?: CredentialSlotRepository,\n): Promise<void> {\n\tconst repo = repository ?? defaultRepository(storage);\n\tconst accounts = await getCredentialAccounts(storage, provider, env, repo);\n\tconst account = accounts.find((candidate) => candidate.name === name);\n\tif (!account) throw new Error(`Provider account not found: ${name}`);\n\tif (account.source === \"env\") {\n\t\tthrow new Error(`Environment provider account cannot be removed: ${name}`);\n\t}\n\tconst next = await storage.read(provider);\n\tif (next === undefined) throw new Error(`No stored credential for provider: ${provider}`);\n\tconst remaining = removeSlot(next, name);\n\tif (remaining === undefined) await storage.delete(provider);\n\telse await storage.modify(provider, async () => remaining);\n\tawait repo.mutateSlotState(provider, \"stored\", name, () => undefined);\n\temitProviderAccountsChanged(provider);\n}\n"]}

package/dist/core/credential-pool/env-slots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-slots.d.ts","sourceRoot":"","sources":["../../../src/core/credential-pool/env-slots.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,MAAM,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKpE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAYnH"}
+{"version":3,"file":"env-slots.d.ts","sourceRoot":"","sources":["../../../src/core/credential-pool/env-slots.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,MAAM,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC;CACd,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQpE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAYnH"}

package/dist/core/credential-pool/env-slots.js

@@ -1,4 +1,4 @@
-import { getApiKeyEnvVars } from "@earendil-works/pi-ai";
+import { getApiKeyEnvVars, normalizeProviderId } from "@earendil-works/pi-ai";
 export const MAX_ENV_SLOT_INDEX = 16;
 /**
  * Anthropic maps to bearer/OAuth token vars ahead of its API-key var; numbered
@@ -6,7 +6,10 @@ export const MAX_ENV_SLOT_INDEX = 16;
  * canonical mapping lists several variables.
  */
 export function primaryEnvVar(providerId) {
-    if (providerId === "claude-sdk-oauth")
+    // Read boundary (senpi#1989): a caller may still pass the legacy provider id,
+    // so compare normalized. CLAUDE_CODE_OAUTH_TOKEN is a frozen env-var name and
+    // is deliberately unchanged.
+    if (normalizeProviderId(providerId) === "anthropic-subscription")
         return "CLAUDE_CODE_OAUTH_TOKEN";
     const envVars = getApiKeyEnvVars(providerId);
     if (!envVars || envVars.length === 0)

package/dist/core/credential-pool/env-slots.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-slots.js","sourceRoot":"","sources":["../../../src/core/credential-pool/env-slots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AASrC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC/C,IAAI,UAAU,KAAK,kBAAkB;QAAE,OAAO,yBAAyB,CAAC;IACxE,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,GAAyC;IAC7F,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC","sourcesContent":["import { getApiKeyEnvVars } from \"@earendil-works/pi-ai\";\n\nexport const MAX_ENV_SLOT_INDEX = 16;\n\nexport type EnvCredentialSlot = {\n\tname: string;\n\tenvVarName: string;\n\tkey: string;\n\tsource: \"env\";\n};\n\n/**\n * Anthropic maps to bearer/OAuth token vars ahead of its API-key var; numbered\n * slots must extend the API-key lane, so prefer the `*_API_KEY` entry when the\n * canonical mapping lists several variables.\n */\nexport function primaryEnvVar(providerId: string): string | undefined {\n\tif (providerId === \"claude-sdk-oauth\") return \"CLAUDE_CODE_OAUTH_TOKEN\";\n\tconst envVars = getApiKeyEnvVars(providerId);\n\tif (!envVars || envVars.length === 0) return undefined;\n\treturn envVars.find((name) => name.endsWith(\"_API_KEY\")) ?? envVars[0];\n}\n\n/**\n * Discovers numbered env credential slots: the primary var yields slot `env`,\n * and `<VAR>_2` .. `<VAR>_16` yield `env-2` .. `env-16`. Discovery is\n * gap-tolerant - a configured `<VAR>_3` with no `<VAR>_2` is still found and no\n * slot is invented for the gap. Stored credentials keep outranking every env\n * slot because resolution consults env only when nothing is stored.\n */\nexport function discoverEnvSlots(providerId: string, env: (name: string) => string | undefined): EnvCredentialSlot[] {\n\tconst primary = primaryEnvVar(providerId);\n\tif (!primary) return [];\n\tconst slots: EnvCredentialSlot[] = [];\n\tconst base = env(primary);\n\tif (base) slots.push({ name: \"env\", envVarName: primary, key: base, source: \"env\" });\n\tfor (let index = 2; index <= MAX_ENV_SLOT_INDEX; index++) {\n\t\tconst envVarName = `${primary}_${index}`;\n\t\tconst value = env(envVarName);\n\t\tif (value) slots.push({ name: `env-${index}`, envVarName, key: value, source: \"env\" });\n\t}\n\treturn slots;\n}\n"]}
+{"version":3,"file":"env-slots.js","sourceRoot":"","sources":["../../../src/core/credential-pool/env-slots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AASrC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC/C,8EAA8E;IAC9E,8EAA8E;IAC9E,6BAA6B;IAC7B,IAAI,mBAAmB,CAAC,UAAU,CAAC,KAAK,wBAAwB;QAAE,OAAO,yBAAyB,CAAC;IACnG,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,GAAyC;IAC7F,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC","sourcesContent":["import { getApiKeyEnvVars, normalizeProviderId } from \"@earendil-works/pi-ai\";\n\nexport const MAX_ENV_SLOT_INDEX = 16;\n\nexport type EnvCredentialSlot = {\n\tname: string;\n\tenvVarName: string;\n\tkey: string;\n\tsource: \"env\";\n};\n\n/**\n * Anthropic maps to bearer/OAuth token vars ahead of its API-key var; numbered\n * slots must extend the API-key lane, so prefer the `*_API_KEY` entry when the\n * canonical mapping lists several variables.\n */\nexport function primaryEnvVar(providerId: string): string | undefined {\n\t// Read boundary (senpi#1989): a caller may still pass the legacy provider id,\n\t// so compare normalized. CLAUDE_CODE_OAUTH_TOKEN is a frozen env-var name and\n\t// is deliberately unchanged.\n\tif (normalizeProviderId(providerId) === \"anthropic-subscription\") return \"CLAUDE_CODE_OAUTH_TOKEN\";\n\tconst envVars = getApiKeyEnvVars(providerId);\n\tif (!envVars || envVars.length === 0) return undefined;\n\treturn envVars.find((name) => name.endsWith(\"_API_KEY\")) ?? envVars[0];\n}\n\n/**\n * Discovers numbered env credential slots: the primary var yields slot `env`,\n * and `<VAR>_2` .. `<VAR>_16` yield `env-2` .. `env-16`. Discovery is\n * gap-tolerant - a configured `<VAR>_3` with no `<VAR>_2` is still found and no\n * slot is invented for the gap. Stored credentials keep outranking every env\n * slot because resolution consults env only when nothing is stored.\n */\nexport function discoverEnvSlots(providerId: string, env: (name: string) => string | undefined): EnvCredentialSlot[] {\n\tconst primary = primaryEnvVar(providerId);\n\tif (!primary) return [];\n\tconst slots: EnvCredentialSlot[] = [];\n\tconst base = env(primary);\n\tif (base) slots.push({ name: \"env\", envVarName: primary, key: base, source: \"env\" });\n\tfor (let index = 2; index <= MAX_ENV_SLOT_INDEX; index++) {\n\t\tconst envVarName = `${primary}_${index}`;\n\t\tconst value = env(envVarName);\n\t\tif (value) slots.push({ name: `env-${index}`, envVarName, key: value, source: \"env\" });\n\t}\n\treturn slots;\n}\n"]}

package/dist/core/dynamic-prompt/build.js

@@ -65,7 +65,7 @@ export function buildDynamicSystemPrompt(options) {
         selectedTools: options.selectedTools,
         dialect: options.workstationDialect ?? "default",
     }));
-    // The claude-sdk-oauth lane appends these dynamic lines after the stable sections so the composed
+    // The anthropic-subscription lane appends these dynamic lines after the stable sections so the composed
     // prompt is a single string. An earlier draft split at this point for prompt-cache scoping, but a
     // wire-level probe proved the installed CLI joins array elements into one system block, so the
     // split was removed (the sentinel leaked to the model as literal text).

package/dist/core/dynamic-prompt/build.js.map

@@ -1 +1 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/core/dynamic-prompt/build.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kBAAkB,CAAC;AA+BpF,SAAS,wBAAwB,CAAC,YAAsD;IACvF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG;QACb,oBAAoB;QACpB,EAAE;QACF,sMAAsM;QACtM,EAAE;KACF,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAwC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,gBAAgB,CAAC;QACpC,KAAK;QACL,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;QAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC;YACA,oBAAoB,EAAE;YACtB,EAAE;YACF,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;YAC1B,EAAE;YACF,uBAAuB,EAAE;YACzB,EAAE;YACF,wBAAwB,EAAE;YAC1B,EAAE;YACF,WAAW;YACX,EAAE;YACF,oBAAoB,EAAE;YACtB,EAAE;YACF,iBAAiB,EAAE;SACnB,CAAC;IAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,mBAAmB,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,IAAI,CACZ,EAAE,EACF,uBAAuB,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,kBAAkB,IAAI,SAAS;KAChD,CAAC,CACF,CAAC;IAEF,kGAAkG;IAClG,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,IAAI,EAAE,EAAE,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC","sourcesContent":["import type { Skill } from \"../skills.ts\";\nimport { formatSkillsForPrompt } from \"../skills.ts\";\nimport { buildIdentitySection } from \"./identity.ts\";\nimport { buildIntentGate } from \"./intent-gate.ts\";\nimport { buildPoliciesSection } from \"./policies.ts\";\nimport { buildStyleSection } from \"./style.ts\";\nimport { categorizeTools } from \"./tool-categorization.ts\";\nimport { buildToolSection } from \"./tool-section.ts\";\nimport type { AvailableTool } from \"./types.ts\";\nimport { buildVerificationSection } from \"./verification.ts\";\nimport { buildWorkingTaskSection } from \"./working-task.ts\";\nimport { buildWorkstationSection, type WorkstationDialect } from \"./workstation.ts\";\n\n/** Context handed to a `corePrompt` override so it can reuse the dynamic pieces. */\nexport interface DynamicPromptCoreContext {\n\ttools: AvailableTool[];\n\t/** Rendered \"## Available Tools\" (+ \"## Tool Guidelines\") section. */\n\ttoolSection: string;\n}\n\nexport interface BuildDynamicSystemPromptOptions {\n\tcwd: string;\n\tselectedTools: string[];\n\ttoolSnippets: Record<string, string>;\n\tpromptGuidelines: string[];\n\tcontextFiles: Array<{ path: string; content: string }>;\n\tskills: Skill[];\n\ttuningSection?: string;\n\t/**\n\t * Replaces the default core sections (identity through style) with a\n\t * model-specific full rewrite. Tool section, tuning, context files, skills,\n\t * date, and cwd assembly stay in this builder.\n\t */\n\tcorePrompt?: (context: DynamicPromptCoreContext) => string;\n\t/**\n\t * Wording dialect for the workstation execution-context instruction.\n\t * Presets pass their model family; the fallback prompt uses `default`\n\t * (maximum emphasis).\n\t */\n\tworkstationDialect?: WorkstationDialect;\n}\n\nfunction buildContextFilesSection(contextFiles: Array<{ path: string; content: string }>): string {\n\tif (contextFiles.length === 0) {\n\t\treturn \"\";\n\t}\n\n\tconst lines = [\n\t\t\"## Project Context\",\n\t\t\"\",\n\t\t\"Project instruction files (below, and in [Directory Context: ...] blocks injected during reads) bind files under their directory; deeper files win on conflict; explicit user instructions override.\",\n\t\t\"\",\n\t];\n\tfor (const contextFile of contextFiles) {\n\t\tlines.push(`### ${contextFile.path}`, \"\", contextFile.content.trimEnd(), \"\");\n\t}\n\treturn lines.join(\"\\n\").trimEnd();\n}\n\nexport function buildDynamicSystemPrompt(options: BuildDynamicSystemPromptOptions): string {\n\tconst promptCwd = options.cwd.replace(/\\\\/g, \"/\");\n\tconst tools = categorizeTools(options.selectedTools);\n\tconst date = new Date().toISOString().slice(0, 10);\n\n\tconst toolSection = buildToolSection({\n\t\ttools,\n\t\ttoolSnippets: options.toolSnippets,\n\t\tpromptGuidelines: options.promptGuidelines,\n\t});\n\n\tconst sections = options.corePrompt\n\t\t? [options.corePrompt({ tools, toolSection })]\n\t\t: [\n\t\t\t\tbuildIdentitySection(),\n\t\t\t\t\"\",\n\t\t\t\tbuildIntentGate({ tools }),\n\t\t\t\t\"\",\n\t\t\t\tbuildWorkingTaskSection(),\n\t\t\t\t\"\",\n\t\t\t\tbuildVerificationSection(),\n\t\t\t\t\"\",\n\t\t\t\ttoolSection,\n\t\t\t\t\"\",\n\t\t\t\tbuildPoliciesSection(),\n\t\t\t\t\"\",\n\t\t\t\tbuildStyleSection(),\n\t\t\t];\n\n\tconst tuning = options.tuningSection?.trim();\n\tif (tuning) {\n\t\tsections.push(\"\", tuning);\n\t}\n\n\tconst contextFilesSection = buildContextFilesSection(options.contextFiles);\n\tif (contextFilesSection) {\n\t\tsections.push(\"\", contextFilesSection);\n\t}\n\n\tconst skillsSection = formatSkillsForPrompt(options.skills);\n\tif (skillsSection) {\n\t\tsections.push(skillsSection);\n\t}\n\n\tsections.push(\n\t\t\"\",\n\t\tbuildWorkstationSection({\n\t\t\tselectedTools: options.selectedTools,\n\t\t\tdialect: options.workstationDialect ?? \"default\",\n\t\t}),\n\t);\n\n\t// The claude-sdk-oauth lane appends these dynamic lines after the stable sections so the composed\n\t// prompt is a single string. An earlier draft split at this point for prompt-cache scoping, but a\n\t// wire-level probe proved the installed CLI joins array elements into one system block, so the\n\t// split was removed (the sentinel leaked to the model as literal text).\n\tsections.push(\"\", `Current date: ${date}`, `Current working directory: ${promptCwd}`);\n\n\treturn sections.join(\"\\n\");\n}\n"]}
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/core/dynamic-prompt/build.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAA2B,MAAM,kBAAkB,CAAC;AA+BpF,SAAS,wBAAwB,CAAC,YAAsD;IACvF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG;QACb,oBAAoB;QACpB,EAAE;QACF,sMAAsM;QACtM,EAAE;KACF,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAwC;IAChF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEnD,MAAM,WAAW,GAAG,gBAAgB,CAAC;QACpC,KAAK;QACL,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU;QAClC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC;YACA,oBAAoB,EAAE;YACtB,EAAE;YACF,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC;YAC1B,EAAE;YACF,uBAAuB,EAAE;YACzB,EAAE;YACF,wBAAwB,EAAE;YAC1B,EAAE;YACF,WAAW;YACX,EAAE;YACF,oBAAoB,EAAE;YACtB,EAAE;YACF,iBAAiB,EAAE;SACnB,CAAC;IAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,mBAAmB,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,IAAI,CACZ,EAAE,EACF,uBAAuB,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,kBAAkB,IAAI,SAAS;KAChD,CAAC,CACF,CAAC;IAEF,wGAAwG;IACxG,kGAAkG;IAClG,+FAA+F;IAC/F,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,IAAI,EAAE,EAAE,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAEtF,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC","sourcesContent":["import type { Skill } from \"../skills.ts\";\nimport { formatSkillsForPrompt } from \"../skills.ts\";\nimport { buildIdentitySection } from \"./identity.ts\";\nimport { buildIntentGate } from \"./intent-gate.ts\";\nimport { buildPoliciesSection } from \"./policies.ts\";\nimport { buildStyleSection } from \"./style.ts\";\nimport { categorizeTools } from \"./tool-categorization.ts\";\nimport { buildToolSection } from \"./tool-section.ts\";\nimport type { AvailableTool } from \"./types.ts\";\nimport { buildVerificationSection } from \"./verification.ts\";\nimport { buildWorkingTaskSection } from \"./working-task.ts\";\nimport { buildWorkstationSection, type WorkstationDialect } from \"./workstation.ts\";\n\n/** Context handed to a `corePrompt` override so it can reuse the dynamic pieces. */\nexport interface DynamicPromptCoreContext {\n\ttools: AvailableTool[];\n\t/** Rendered \"## Available Tools\" (+ \"## Tool Guidelines\") section. */\n\ttoolSection: string;\n}\n\nexport interface BuildDynamicSystemPromptOptions {\n\tcwd: string;\n\tselectedTools: string[];\n\ttoolSnippets: Record<string, string>;\n\tpromptGuidelines: string[];\n\tcontextFiles: Array<{ path: string; content: string }>;\n\tskills: Skill[];\n\ttuningSection?: string;\n\t/**\n\t * Replaces the default core sections (identity through style) with a\n\t * model-specific full rewrite. Tool section, tuning, context files, skills,\n\t * date, and cwd assembly stay in this builder.\n\t */\n\tcorePrompt?: (context: DynamicPromptCoreContext) => string;\n\t/**\n\t * Wording dialect for the workstation execution-context instruction.\n\t * Presets pass their model family; the fallback prompt uses `default`\n\t * (maximum emphasis).\n\t */\n\tworkstationDialect?: WorkstationDialect;\n}\n\nfunction buildContextFilesSection(contextFiles: Array<{ path: string; content: string }>): string {\n\tif (contextFiles.length === 0) {\n\t\treturn \"\";\n\t}\n\n\tconst lines = [\n\t\t\"## Project Context\",\n\t\t\"\",\n\t\t\"Project instruction files (below, and in [Directory Context: ...] blocks injected during reads) bind files under their directory; deeper files win on conflict; explicit user instructions override.\",\n\t\t\"\",\n\t];\n\tfor (const contextFile of contextFiles) {\n\t\tlines.push(`### ${contextFile.path}`, \"\", contextFile.content.trimEnd(), \"\");\n\t}\n\treturn lines.join(\"\\n\").trimEnd();\n}\n\nexport function buildDynamicSystemPrompt(options: BuildDynamicSystemPromptOptions): string {\n\tconst promptCwd = options.cwd.replace(/\\\\/g, \"/\");\n\tconst tools = categorizeTools(options.selectedTools);\n\tconst date = new Date().toISOString().slice(0, 10);\n\n\tconst toolSection = buildToolSection({\n\t\ttools,\n\t\ttoolSnippets: options.toolSnippets,\n\t\tpromptGuidelines: options.promptGuidelines,\n\t});\n\n\tconst sections = options.corePrompt\n\t\t? [options.corePrompt({ tools, toolSection })]\n\t\t: [\n\t\t\t\tbuildIdentitySection(),\n\t\t\t\t\"\",\n\t\t\t\tbuildIntentGate({ tools }),\n\t\t\t\t\"\",\n\t\t\t\tbuildWorkingTaskSection(),\n\t\t\t\t\"\",\n\t\t\t\tbuildVerificationSection(),\n\t\t\t\t\"\",\n\t\t\t\ttoolSection,\n\t\t\t\t\"\",\n\t\t\t\tbuildPoliciesSection(),\n\t\t\t\t\"\",\n\t\t\t\tbuildStyleSection(),\n\t\t\t];\n\n\tconst tuning = options.tuningSection?.trim();\n\tif (tuning) {\n\t\tsections.push(\"\", tuning);\n\t}\n\n\tconst contextFilesSection = buildContextFilesSection(options.contextFiles);\n\tif (contextFilesSection) {\n\t\tsections.push(\"\", contextFilesSection);\n\t}\n\n\tconst skillsSection = formatSkillsForPrompt(options.skills);\n\tif (skillsSection) {\n\t\tsections.push(skillsSection);\n\t}\n\n\tsections.push(\n\t\t\"\",\n\t\tbuildWorkstationSection({\n\t\t\tselectedTools: options.selectedTools,\n\t\t\tdialect: options.workstationDialect ?? \"default\",\n\t\t}),\n\t);\n\n\t// The anthropic-subscription lane appends these dynamic lines after the stable sections so the composed\n\t// prompt is a single string. An earlier draft split at this point for prompt-cache scoping, but a\n\t// wire-level probe proved the installed CLI joins array elements into one system block, so the\n\t// split was removed (the sentinel leaked to the model as literal text).\n\tsections.push(\"\", `Current date: ${date}`, `Current working directory: ${promptCwd}`);\n\n\treturn sections.join(\"\\n\");\n}\n"]}

package/dist/core/extensions/builtin/{claude-sdk-oauth → anthropic-subscription}/account-command.d.ts

@@ -1,8 +1,8 @@
 import type { ExtensionAPI } from "../../types.ts";
-import { type ClaudeSdkOauthProviderSettings } from "./settings.ts";
+import { type AnthropicSubscriptionProviderSettings } from "./settings.ts";
 type CommandEnvironment = (name: string) => string | undefined;
 export interface ClaudeAccountCommandDeps {
-    loadSettings?: (cwd: string) => ClaudeSdkOauthProviderSettings;
+    loadSettings?: (cwd: string) => AnthropicSubscriptionProviderSettings;
     environment?: CommandEnvironment;
     /** Browser launcher for the OAuth authorize URL; tests inject a recorder. */
     openBrowser?: ((url: string) => void) | undefined;

package/dist/core/extensions/builtin/anthropic-subscription/account-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-command.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/anthropic-subscription/account-command.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAA2B,MAAM,gBAAgB,CAAC;AAO5E,OAAO,EACN,KAAK,qCAAqC,EAE1C,MAAM,eAAe,CAAC;AAIvB,KAAK,kBAAkB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,wBAAwB;IACxC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,qCAAqC,CAAC;IACtE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAClD;AAsCD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE5F;AAED,8FAA8F;AAC9F,wBAAgB,uBAAuB,CACtC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,qBAAqB,EAAE,MAAM,GAAG,SAAS,EACzC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GACrC,MAAM,GAAG,SAAS,CAEpB;AAED,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,GAAE,wBAA6B,GAAG,IAAI,CAkDxG"}