@moxxy/sdk 0.33.0 → 0.35.0

package/dist/redact.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Secret redaction for anything that leaves the process: an audit record, a
+ * terminal prompt, a support paste.
+ *
+ * Two independent passes, because they catch different things and either alone
+ * leaves a real hole:
+ *
+ *   - by KEY NAME, for `{ apiKey: 'sk-…' }`, where the value is opaque.
+ *   - by VALUE SHAPE, for a secret embedded in an ordinary-looking field. The
+ *     motivating case is a Bash tool call: its `command` is not a secret-named
+ *     key, so a key-name pass alone prints
+ *     `curl -H "Authorization: Bearer sk-ant-…"` verbatim.
+ *
+ * Deliberately NOT a guarantee. A redactor that claims completeness invites
+ * treating redacted output as safe to publish; treat it as reducing accidental
+ * exposure, not as sanitisation.
+ */
+export declare const REDACTED_PLACEHOLDER = "[redacted]";
+/** True when a field name reads as secret-bearing. */
+export declare function isSecretKey(key: string): boolean;
+/**
+ * Mask secret-shaped substrings inside a free-text value. This is the pass that
+ * covers shell commands, URLs, and headers, where the carrier field has an
+ * innocuous name.
+ */
+export declare function redactSecretText(text: string): string;
+/**
+ * Redact a structured value: secret-named fields lose their value entirely,
+ * every other string is scanned for secret-shaped content.
+ *
+ * `maxDepth` bounds the walk so a pathologically nested input cannot blow the
+ * stack; anything deeper is returned unredacted, which is why callers that
+ * accept untrusted shapes should also cap size before display.
+ */
+export declare function redactSecrets(value: unknown, maxDepth?: number, depth?: number): unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAqCH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMrD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAI,EAAE,KAAK,SAAI,GAAG,OAAO,CAS9E"}

package/dist/redact.js

@@ -0,0 +1,88 @@
+/**
+ * Secret redaction for anything that leaves the process: an audit record, a
+ * terminal prompt, a support paste.
+ *
+ * Two independent passes, because they catch different things and either alone
+ * leaves a real hole:
+ *
+ *   - by KEY NAME, for `{ apiKey: 'sk-…' }`, where the value is opaque.
+ *   - by VALUE SHAPE, for a secret embedded in an ordinary-looking field. The
+ *     motivating case is a Bash tool call: its `command` is not a secret-named
+ *     key, so a key-name pass alone prints
+ *     `curl -H "Authorization: Bearer sk-ant-…"` verbatim.
+ *
+ * Deliberately NOT a guarantee. A redactor that claims completeness invites
+ * treating redacted output as safe to publish; treat it as reducing accidental
+ * exposure, not as sanitisation.
+ */
+/** Field names whose VALUES are secret material regardless of shape. */
+const SECRET_KEY = /(?:api[_-]?key|secret|token|password|passwd|passphrase|authorization|auth[_-]?token|bearer|credential|private[_-]?key|access[_-]?key)/i;
+/**
+ * Value shapes that are secrets wherever they appear. Ordered vendor prefixes
+ * first (precise, no false positives) then generic bearer/assignment forms.
+ *
+ * Each pattern keeps any leading context in a capture group so the replacement
+ * can preserve it: masking `Authorization: Bearer X` down to just `[redacted]`
+ * would lose the fact that a header was there at all, which matters when the
+ * point is auditing what was attempted.
+ */
+const SECRET_VALUE_PATTERNS = [
+    // Vendor-issued key formats.
+    [/\b(sk-ant-)[A-Za-z0-9_-]{8,}/g, '$1[redacted]'],
+    [/\b(sk-)[A-Za-z0-9_-]{16,}/g, '$1[redacted]'],
+    [/\b(gh[pousr]_)[A-Za-z0-9]{16,}/g, '$1[redacted]'],
+    [/\b(xox[baprs]-)[A-Za-z0-9-]{8,}/g, '$1[redacted]'],
+    [/\b(AKIA)[0-9A-Z]{12,}/g, '$1[redacted]'],
+    [/\b(AIza)[A-Za-z0-9_-]{20,}/g, '$1[redacted]'],
+    // JWTs: three base64url segments.
+    [/\b(ey[A-Za-z0-9_-]{8,})\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, 'eyJ[redacted-jwt]'],
+    // `Authorization: Bearer <anything>` in a header or a shell command.
+    [/\b(authorization\s*[:=]\s*(?:bearer|basic|token)\s+)\S+/gi, '$1[redacted]'],
+    [/\b(bearer\s+)[A-Za-z0-9._~+/=-]{12,}/gi, '$1[redacted]'],
+    // `FOO_TOKEN=value` / `--api-key value` style assignments.
+    [
+        /\b([A-Za-z0-9_-]*(?:key|token|secret|password|passwd)[A-Za-z0-9_-]*\s*[:=]\s*)(?!\s)["']?[^\s"'&;|]{6,}["']?/gi,
+        '$1[redacted]',
+    ],
+    // Credentials embedded in a URL.
+    [/\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@]+(@)/gi, '$1[redacted]$2'],
+];
+export const REDACTED_PLACEHOLDER = '[redacted]';
+/** True when a field name reads as secret-bearing. */
+export function isSecretKey(key) {
+    return SECRET_KEY.test(key);
+}
+/**
+ * Mask secret-shaped substrings inside a free-text value. This is the pass that
+ * covers shell commands, URLs, and headers, where the carrier field has an
+ * innocuous name.
+ */
+export function redactSecretText(text) {
+    let out = text;
+    for (const [pattern, replacement] of SECRET_VALUE_PATTERNS) {
+        out = out.replace(pattern, replacement);
+    }
+    return out;
+}
+/**
+ * Redact a structured value: secret-named fields lose their value entirely,
+ * every other string is scanned for secret-shaped content.
+ *
+ * `maxDepth` bounds the walk so a pathologically nested input cannot blow the
+ * stack; anything deeper is returned unredacted, which is why callers that
+ * accept untrusted shapes should also cap size before display.
+ */
+export function redactSecrets(value, maxDepth = 6, depth = 0) {
+    if (typeof value === 'string')
+        return redactSecretText(value);
+    if (depth >= maxDepth || value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => redactSecrets(v, maxDepth, depth + 1));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] = SECRET_KEY.test(k) ? REDACTED_PLACEHOLDER : redactSecrets(v, maxDepth, depth + 1);
+    }
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,wEAAwE;AACxE,MAAM,UAAU,GACd,wIAAwI,CAAC;AAE3I;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAA6C;IACtE,6BAA6B;IAC7B,CAAC,+BAA+B,EAAE,cAAc,CAAC;IACjD,CAAC,4BAA4B,EAAE,cAAc,CAAC;IAC9C,CAAC,iCAAiC,EAAE,cAAc,CAAC;IACnD,CAAC,kCAAkC,EAAE,cAAc,CAAC;IACpD,CAAC,wBAAwB,EAAE,cAAc,CAAC;IAC1C,CAAC,6BAA6B,EAAE,cAAc,CAAC;IAC/C,kCAAkC;IAClC,CAAC,gEAAgE,EAAE,mBAAmB,CAAC;IACvF,qEAAqE;IACrE,CAAC,2DAA2D,EAAE,cAAc,CAAC;IAC7E,CAAC,wCAAwC,EAAE,cAAc,CAAC;IAC1D,2DAA2D;IAC3D;QACE,gHAAgH;QAChH,cAAc;KACf;IACD,iCAAiC;IACjC,CAAC,kDAAkD,EAAE,gBAAgB,CAAC;CACvE,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,qBAAqB,EAAE,CAAC;QAC3D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,QAAQ,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/schemas.d.ts

@@ -177,18 +177,18 @@ export declare const pluginSetupFieldSchema: z.ZodObject<{
     key: string;
     kind: "string" | "boolean" | "secret" | "select";
     label: string;
+    description?: string | undefined;
     required?: boolean | undefined;
     options?: string[] | undefined;
-    description?: string | undefined;
     vaultKey?: string | undefined;
     placeholder?: string | undefined;
 }, {
     key: string;
     kind: "string" | "boolean" | "secret" | "select";
     label: string;
+    description?: string | undefined;
     required?: boolean | undefined;
     options?: string[] | undefined;
-    description?: string | undefined;
     vaultKey?: string | undefined;
     placeholder?: string | undefined;
 }>;
@@ -218,18 +218,18 @@ export declare const pluginSetupSchema: z.ZodObject<{
         key: string;
         kind: "string" | "boolean" | "secret" | "select";
         label: string;
+        description?: string | undefined;
         required?: boolean | undefined;
         options?: string[] | undefined;
-        description?: string | undefined;
         vaultKey?: string | undefined;
         placeholder?: string | undefined;
     }, {
         key: string;
         kind: "string" | "boolean" | "secret" | "select";
         label: string;
+        description?: string | undefined;
         required?: boolean | undefined;
         options?: string[] | undefined;
-        description?: string | undefined;
         vaultKey?: string | undefined;
         placeholder?: string | undefined;
     }>, "many">;
@@ -239,28 +239,28 @@ export declare const pluginSetupSchema: z.ZodObject<{
         key: string;
         kind: "string" | "boolean" | "secret" | "select";
         label: string;
+        description?: string | undefined;
         required?: boolean | undefined;
         options?: string[] | undefined;
-        description?: string | undefined;
         vaultKey?: string | undefined;
         placeholder?: string | undefined;
     }[];
-    required?: boolean | undefined;
     description?: string | undefined;
+    required?: boolean | undefined;
 }, {
     title: string;
     fields: {
         key: string;
         kind: "string" | "boolean" | "secret" | "select";
         label: string;
+        description?: string | undefined;
         required?: boolean | undefined;
         options?: string[] | undefined;
-        description?: string | undefined;
         vaultKey?: string | undefined;
         placeholder?: string | undefined;
     }[];
-    required?: boolean | undefined;
     description?: string | undefined;
+    required?: boolean | undefined;
 }>;
 export declare const moxxyPackageSchema: z.ZodObject<{
     plugin: z.ZodOptional<z.ZodObject<{
@@ -322,18 +322,18 @@ export declare const moxxyPackageSchema: z.ZodObject<{
             key: string;
             kind: "string" | "boolean" | "secret" | "select";
             label: string;
+            description?: string | undefined;
             required?: boolean | undefined;
             options?: string[] | undefined;
-            description?: string | undefined;
             vaultKey?: string | undefined;
             placeholder?: string | undefined;
         }, {
             key: string;
             kind: "string" | "boolean" | "secret" | "select";
             label: string;
+            description?: string | undefined;
             required?: boolean | undefined;
             options?: string[] | undefined;
-            description?: string | undefined;
             vaultKey?: string | undefined;
             placeholder?: string | undefined;
         }>, "many">;
@@ -343,28 +343,28 @@ export declare const moxxyPackageSchema: z.ZodObject<{
             key: string;
             kind: "string" | "boolean" | "secret" | "select";
             label: string;
+            description?: string | undefined;
             required?: boolean | undefined;
             options?: string[] | undefined;
-            description?: string | undefined;
             vaultKey?: string | undefined;
             placeholder?: string | undefined;
         }[];
-        required?: boolean | undefined;
         description?: string | undefined;
+        required?: boolean | undefined;
     }, {
         title: string;
         fields: {
             key: string;
             kind: "string" | "boolean" | "secret" | "select";
             label: string;
+            description?: string | undefined;
             required?: boolean | undefined;
             options?: string[] | undefined;
-            description?: string | undefined;
             vaultKey?: string | undefined;
             placeholder?: string | undefined;
         }[];
-        required?: boolean | undefined;
         description?: string | undefined;
+        required?: boolean | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     plugin?: {
@@ -387,14 +387,14 @@ export declare const moxxyPackageSchema: z.ZodObject<{
             key: string;
             kind: "string" | "boolean" | "secret" | "select";
             label: string;
+            description?: string | undefined;
             required?: boolean | undefined;
             options?: string[] | undefined;
-            description?: string | undefined;
             vaultKey?: string | undefined;
             placeholder?: string | undefined;
         }[];
-        required?: boolean | undefined;
         description?: string | undefined;
+        required?: boolean | undefined;
     } | undefined;
 }, {
     plugin?: {
@@ -417,14 +417,14 @@ export declare const moxxyPackageSchema: z.ZodObject<{
             key: string;
             kind: "string" | "boolean" | "secret" | "select";
             label: string;
+            description?: string | undefined;
             required?: boolean | undefined;
             options?: string[] | undefined;
-            description?: string | undefined;
             vaultKey?: string | undefined;
             placeholder?: string | undefined;
         }[];
-        required?: boolean | undefined;
         description?: string | undefined;
+        required?: boolean | undefined;
     } | undefined;
 }>;
 export type PluginSetupField = z.infer<typeof pluginSetupFieldSchema>;

package/dist/secret-provider.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Where a named secret comes from: a swappable block, like every other.
+ *
+ * The built-in vault (AES-256-GCM under `~/.moxxy/vault.json`, unlocked via the
+ * OS keychain) is a good design for one machine and unusable for a fleet: there
+ * is no central issuance, no rotation, and no way to revoke a single
+ * workstation. Every organisation already runs something that does those three
+ * things, so the answer is to let them plug it in rather than to reimplement it.
+ *
+ * Deliberately ONE block rather than two. A host-scoped credential (a token for
+ * an internal registry or a GitHub Enterprise host) is a named secret with a
+ * naming convention on top; splitting it into a second `CredentialProvider`
+ * registry would leave two overlapping abstractions to keep in sync for no
+ * gain.
+ */
+export interface SecretProviderScope {
+    readonly cwd: string;
+}
+export interface SecretProviderSession {
+    /**
+     * Resolve a secret by name, or null when this provider does not hold it.
+     *
+     * Returning null rather than throwing is what makes providers composable: the
+     * host tries the active provider and falls back to the local vault, so
+     * adopting an external store does not require migrating every secret on day
+     * one.
+     *
+     * MUST NOT throw for an ordinary miss. A genuine failure (the store is
+     * unreachable, the token expired) SHOULD throw, because silently reporting
+     * "no such secret" for an outage would send the caller down a
+     * missing-credential path and hide the real cause.
+     */
+    get(name: string): Promise<string | null>;
+    close(): Promise<void>;
+}
+export interface SecretProviderDef {
+    readonly name: string;
+    readonly description?: string;
+    open(scope: SecretProviderScope): SecretProviderSession;
+}
+/** Freeze a secret-provider spec, mirroring the other `defineX` factories. */
+export declare function defineSecretProvider(def: SecretProviderDef): SecretProviderDef;
+/**
+ * The canonical secret name holding a credential for `host`.
+ *
+ * A host credential is a named secret plus a convention, which is exactly why
+ * there is no separate `CredentialProvider` registry: whatever store an
+ * organisation already plugged in for secrets serves these too.
+ *
+ * `github.example.com` becomes `MOXXY_CREDENTIAL_GITHUB_EXAMPLE_COM`. The
+ * derivation mirrors the provider-key convention (upper-snake, non-alphanumerics
+ * to `_`) so an operator who has seen one can predict the other, and a port is
+ * dropped because a credential belongs to the host, not to a socket.
+ *
+ * Accepts a bare host or a full URL; anything unparseable yields null rather
+ * than a name derived from garbage, so a caller cannot accidentally look up a
+ * secret keyed on a typo.
+ */
+export declare function hostCredentialName(hostOrUrl: string): string | null;
+//# sourceMappingURL=secret-provider.d.ts.map

package/dist/secret-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-provider.d.ts","sourceRoot":"","sources":["../src/secret-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,qBAAqB,CAAC;CACzD;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,iBAAiB,GAAG,iBAAiB,CAE9E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBnE"}

package/dist/secret-provider.js

@@ -0,0 +1,59 @@
+/**
+ * Where a named secret comes from: a swappable block, like every other.
+ *
+ * The built-in vault (AES-256-GCM under `~/.moxxy/vault.json`, unlocked via the
+ * OS keychain) is a good design for one machine and unusable for a fleet: there
+ * is no central issuance, no rotation, and no way to revoke a single
+ * workstation. Every organisation already runs something that does those three
+ * things, so the answer is to let them plug it in rather than to reimplement it.
+ *
+ * Deliberately ONE block rather than two. A host-scoped credential (a token for
+ * an internal registry or a GitHub Enterprise host) is a named secret with a
+ * naming convention on top; splitting it into a second `CredentialProvider`
+ * registry would leave two overlapping abstractions to keep in sync for no
+ * gain.
+ */
+/** Freeze a secret-provider spec, mirroring the other `defineX` factories. */
+export function defineSecretProvider(def) {
+    return Object.freeze({ ...def });
+}
+/**
+ * The canonical secret name holding a credential for `host`.
+ *
+ * A host credential is a named secret plus a convention, which is exactly why
+ * there is no separate `CredentialProvider` registry: whatever store an
+ * organisation already plugged in for secrets serves these too.
+ *
+ * `github.example.com` becomes `MOXXY_CREDENTIAL_GITHUB_EXAMPLE_COM`. The
+ * derivation mirrors the provider-key convention (upper-snake, non-alphanumerics
+ * to `_`) so an operator who has seen one can predict the other, and a port is
+ * dropped because a credential belongs to the host, not to a socket.
+ *
+ * Accepts a bare host or a full URL; anything unparseable yields null rather
+ * than a name derived from garbage, so a caller cannot accidentally look up a
+ * secret keyed on a typo.
+ */
+export function hostCredentialName(hostOrUrl) {
+    const raw = hostOrUrl.trim();
+    if (raw.length === 0)
+        return null;
+    let host = raw;
+    if (raw.includes('://')) {
+        try {
+            host = new URL(raw).hostname;
+        }
+        catch {
+            return null;
+        }
+    }
+    else {
+        // Strip a port or a path if the caller passed `host:443/x`.
+        host = raw.split('/')[0].split(':')[0];
+    }
+    host = host.replace(/^\[|\]$/g, '').trim();
+    if (host.length === 0 || /\s/.test(host))
+        return null;
+    const slug = host.toUpperCase().replace(/[^A-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');
+    return slug.length > 0 ? `MOXXY_CREDENTIAL_${slug}` : null;
+}
+//# sourceMappingURL=secret-provider.js.map

package/dist/secret-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-provider.js","sourceRoot":"","sources":["../src/secret-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA8BH,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,GAAsB;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,4DAA4D;QAC5D,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC3C,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC"}

package/dist/server.d.ts

@@ -14,7 +14,9 @@
  * on the main barrel because types are erased at build time and never reach a
  * bundle.
  */
-export { writeFileAtomic, writeFileAtomicSync, moxxyHome, moxxyPath, } from './fs-utils.js';
+export { writeFileAtomic, writeFileAtomicSync, moxxyHome, moxxyPath, ensurePrivateDir, ensurePrivateFile, pruneStaleTempFiles, PRIVATE_DIR_MODE, PRIVATE_FILE_MODE, } from './fs-utils.js';
+export { resolveOsPrincipal } from './principal-os.js';
+export { installEgressProxy, readProxyEnv, parseNoProxy, shouldBypassProxy, redactProxyUrl, hasProxy, } from './egress.js';
 export { CrossProcessFireLock } from './cross-process-lock.js';
 export { readRequestBody, bearerTokenMatches } from './http-utils.js';
 export { channelStatusPath, writeChannelStatus, readChannelStatus, clearChannelStatus, } from './channel-status.js';

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,SAAS,GACV,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAItE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,QAAQ,GACT,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAItE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC"}

package/dist/server.js

@@ -14,7 +14,12 @@
  * on the main barrel because types are erased at build time and never reach a
  * bundle.
  */
-export { writeFileAtomic, writeFileAtomicSync, moxxyHome, moxxyPath, } from './fs-utils.js';
+export { writeFileAtomic, writeFileAtomicSync, moxxyHome, moxxyPath, ensurePrivateDir, ensurePrivateFile, pruneStaleTempFiles, PRIVATE_DIR_MODE, PRIVATE_FILE_MODE, } from './fs-utils.js';
+// The local OS account as a Principal (node:os). The type and its pure helpers
+// ride the main barrel.
+export { resolveOsPrincipal } from './principal-os.js';
+// Outbound proxy support for global `fetch` (dynamic `undici` import). Node-only.
+export { installEgressProxy, readProxyEnv, parseNoProxy, shouldBypassProxy, redactProxyUrl, hasProxy, } from './egress.js';
 // Cross-process "fire exactly once" lock (node:fs). Value lives here; its
 // options type is re-exported from the main barrel like other erased types.
 export { CrossProcessFireLock } from './cross-process-lock.js';

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,0EAA0E;AAC1E,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACtE,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,+EAA+E;AAC/E,wBAAwB;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,kFAAkF;AAClF,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,0EAA0E;AAC1E,4EAA4E;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACtE,gFAAgF;AAChF,gFAAgF;AAChF,kFAAkF;AAClF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,+BAA+B,GAChC,MAAM,mBAAmB,CAAC"}

package/dist/session-like.d.ts

@@ -6,6 +6,7 @@ import type { ApprovalResolver, ModeBadge } from './mode.js';
 import type { PermissionResolver } from './permission.js';
 import type { ModelDescriptor, ProviderKeyValidation } from './provider.js';
 import type { PluginSetupSpec } from './schemas.js';
+import type { ToolIcon } from './tool-icon.js';
 import type { ToolCompactPresentation } from './tool.js';
 /**
  * Options accepted by `SessionLike.runTurn`. Defined here (rather than in
@@ -75,6 +76,8 @@ export interface ToolInfo {
     readonly description: string;
     /** Compact presentation hint (plain data - crosses the wire intact). */
     readonly compact?: ToolCompactPresentation;
+    /** Declared icon, so a surface renders the tool's own choice, not a guess. */
+    readonly icon?: ToolIcon;
 }
 /** Serializable skill metadata. */
 export interface SkillInfo {

package/dist/session-like.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-like.d.ts","sourceRoot":"","sources":["../src/session-like.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,SAAS,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC;CACxE;AAED;uDACuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnD;mBACmB;AACnB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAChD;;wCAEoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC;;6DAEyD;IACzD,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;CAC5C;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;kFAC8E;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5F,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACpF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzG;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACpD,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,uDAAuD;IACvD,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE,oEAAoE;IACpE,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACvI;;;;;;;OAOG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACjE;AAED,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;wEACoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1C,wFAAwF;IACxF,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,iFAAiF;IACjF,iBAAiB,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,OAAO,IAAI,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAChD,iFAAiF;IACjF,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,UAAU,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC;IAC1C;;;OAGG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;;OAQG;IACH,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E;;;;;;WAMG;QACH,QAAQ,CAAC,YAAY,CAAC,EAAE;YACtB,6CAA6C;YAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,oCAAoC;YACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,+CAA+C;YAC/C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;YACjC,sEAAsE;YACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SAClD,CAAC;QACF,0EAA0E;QAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC;KAC9E,CAAC,CAAC;IACH;;;;OAIG;IACH,SAAS,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,CACT,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GACjD,OAAO,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CACrF;AAED;;;;eAIe;AACf,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACjE;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,+EAA+E;IAC/E,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzE;oDACgD;IAChD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD;;;;;;;OAOG;IACH,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,EAAE,CAAC,EAAE,iBAAiB,EACtB,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GACrC,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1D,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC7D,qDAAqD;IACrD,OAAO,IAAI,WAAW,CAAC;IACvB,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB;;;;;OAKG;IACH,yEAAyE;IACzE,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,yEAAyE;IACzE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,sDAAsD;IACtD,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,gFAAgF;IAChF,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QACZ,KAAK,IAAI,OAAO,CAAC;YACf,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SACzC,CAAC,CAAC;KACJ,CAAC;CACH"}
+{"version":3,"file":"session-like.d.ts","sourceRoot":"","sources":["../src/session-like.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,SAAS,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC;CACxE;AAED;uDACuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnD;mBACmB;AACnB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAChD;;wCAEoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC;;6DAEyD;IACzD,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;CAC1B;AAED,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,wDAAwD;IACxD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;kFAC8E;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5F,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACpF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzG;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACpD,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,uDAAuD;IACvD,aAAa,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtE,oEAAoE;IACpE,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACvI;;;;;;;OAOG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACjE;AAED,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;wEACoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,MAAM,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAC1C,wFAAwF;IACxF,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAClC,iFAAiF;IACjF,iBAAiB,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,OAAO,IAAI,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAChD,iFAAiF;IACjF,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,UAAU,IAAI,aAAa,CAAC,YAAY,CAAC,CAAC;IAC1C;;;OAGG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;;;;OAQG;IACH,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E;;;;;;WAMG;QACH,QAAQ,CAAC,YAAY,CAAC,EAAE;YACtB,6CAA6C;YAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,oCAAoC;YACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,+CAA+C;YAC/C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;YACjC,sEAAsE;YACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SAClD,CAAC;QACF,0EAA0E;QAC1E,QAAQ,CAAC,UAAU,CAAC,EAAE;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC;KAC9E,CAAC,CAAC;IACH;;;;OAIG;IACH,SAAS,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;OAKG;IACH,UAAU,CAAC,CACT,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GACjD,OAAO,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;CACrF;AAED;;;;eAIe;AACf,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC;IACjE;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,+EAA+E;IAC/E,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACzE;oDACgD;IAChD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD;;;;;;;OAOG;IACH,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,EAAE,CAAC,EAAE,iBAAiB,EACtB,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GACrC,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1D,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;IAC7D,qDAAqD;IACrD,OAAO,IAAI,WAAW,CAAC;IACvB,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB;;;;;OAKG;IACH,yEAAyE;IACzE,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,yEAAyE;IACzE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,sDAAsD;IACtD,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,6DAA6D;IAC7D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,gFAAgF;IAChF,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC;;;;;OAKG;IACH,WAAW,CAAC,EAAE;QACZ,KAAK,IAAI,OAAO,CAAC;YACf,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SACzC,CAAC,CAAC;KACJ,CAAC;CACH"}

package/dist/signature.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Ed25519 detached-signature verification over exact bytes.
+ *
+ * Lives in the SDK rather than beside its first caller because two different
+ * things now depend on it, and one of them is policy. Policy has to bind on a
+ * machine with no plugins installed at all, so the verifier it uses cannot sit
+ * inside a plugin: a control that a user can disable by uninstalling something
+ * is not a control.
+ *
+ * Verifies over the bytes as received, never over a re-serialisation of the
+ * parsed object. Canonicalising first would let two different documents share a
+ * signature whenever the parser and the serialiser disagree about anything,
+ * which is how signature-verification bypasses usually happen.
+ *
+ * Returns false rather than throwing on a malformed key or signature: to a
+ * caller "this did not verify" and "this could not be parsed" warrant the same
+ * response, and a throw here would tempt a try/catch that swallows both into a
+ * success path.
+ */
+export declare function verifyEd25519(bytes: Uint8Array, signatureB64: string, publicKeyPem: string): boolean;
+//# sourceMappingURL=signature.d.ts.map

package/dist/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAQT"}

package/dist/signature.js

@@ -0,0 +1,32 @@
+import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
+/**
+ * Ed25519 detached-signature verification over exact bytes.
+ *
+ * Lives in the SDK rather than beside its first caller because two different
+ * things now depend on it, and one of them is policy. Policy has to bind on a
+ * machine with no plugins installed at all, so the verifier it uses cannot sit
+ * inside a plugin: a control that a user can disable by uninstalling something
+ * is not a control.
+ *
+ * Verifies over the bytes as received, never over a re-serialisation of the
+ * parsed object. Canonicalising first would let two different documents share a
+ * signature whenever the parser and the serialiser disagree about anything,
+ * which is how signature-verification bypasses usually happen.
+ *
+ * Returns false rather than throwing on a malformed key or signature: to a
+ * caller "this did not verify" and "this could not be parsed" warrant the same
+ * response, and a throw here would tempt a try/catch that swallows both into a
+ * success path.
+ */
+export function verifyEd25519(bytes, signatureB64, publicKeyPem) {
+    if (!publicKeyPem || !signatureB64)
+        return false;
+    try {
+        const key = createPublicKey(publicKeyPem);
+        return cryptoVerify(null, Buffer.from(bytes), key, Buffer.from(signatureB64, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=signature.js.map

package/dist/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAiB,EACjB,YAAoB,EACpB,YAAoB;IAEpB,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAC1C,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/tool-icon.d.ts

@@ -0,0 +1,22 @@
+/**
+ * What a tool looks like, as a semantic name rather than a glyph.
+ *
+ * A CLOSED vocabulary on purpose. Surfaces render wildly differently: the
+ * desktop draws SVG, the TUI prints a character, a future web surface might do
+ * something else again. If this were a free string, a plugin could name an icon
+ * no surface owns and every surface would have to guess, so in practice
+ * everything would fall back and the field would be decorative. A fixed set
+ * means each surface maps it exhaustively and a plugin's choice actually
+ * survives to the screen.
+ *
+ * The names describe WHAT THE TOOL TOUCHES, not what it looks like, so a
+ * surface is free to change its artwork without every plugin becoming wrong.
+ *
+ * Adding a member is a breaking change for surfaces (their maps stop being
+ * exhaustive and stop compiling), which is the intended cost: a new icon should
+ * be a deliberate decision across surfaces, not a silent fallback to a wrench.
+ */
+export declare const TOOL_ICONS: readonly ["file", "folder", "search", "edit", "diff", "terminal", "globe", "chat", "workflow", "agent", "settings", "lock", "plug", "mic", "speaker", "smartphone", "workspace", "clipboard", "spark", "wrench"];
+export type ToolIcon = (typeof TOOL_ICONS)[number];
+export declare function isToolIcon(value: unknown): value is ToolIcon;
+//# sourceMappingURL=tool-icon.d.ts.map

package/dist/tool-icon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-icon.d.ts","sourceRoot":"","sources":["../src/tool-icon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,UAAU,kNAqBb,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D"}