@nac3/forge-cli 0.2.0-alpha.5 → 0.2.0-alpha.59z.118

package/dist/core/limits_config.js

@@ -0,0 +1,297 @@
+/**
+ * limits_config.ts -- runtime limits Pablo (or any operator) can
+ * tune without rebuilding the CLI (alpha.59c).
+ *
+ * Pablo rule: NADA hardcode. Every limit a turn enforces lives
+ * here and the panel + CLI expose it for editing. Defaults are
+ * conservative; the user widens them when they hit a wall (e.g.
+ * reader-heavy turn exhausts the default 5 rounds -> bump the
+ * reader_family cap).
+ *
+ * Storage:
+ *   $YF_CONFIG_DIR/limits.json (or ~/.yujin-forge/limits.json)
+ *
+ * Shape:
+ *   {
+ *     "version": 1,
+ *     "max_tool_rounds": {
+ *       "default":          5,
+ *       "reader_family":   25,
+ *       "search_family":   15,
+ *       "writer_family":   10
+ *     },
+ *     "request_timeout_ms": {
+ *       "managed_proxy":   60000,
+ *       "byok_anthropic":  60000,
+ *       "byok_openai":     60000,
+ *       "byok_gemini":     30000
+ *     },
+ *     "classifier_timeout_ms": 2500,
+ *     "managed_max_tokens_per_turn": 8192
+ *   }
+ *
+ * Verb-family detection: each turn the LLM may invoke verbs
+ * from different families. We look at the FIRST verb the LLM
+ * tries to call and the family it belongs to to pick the cap.
+ * If subsequent verbs are from different families, the cap
+ * stays at whatever the first family suggested -- this avoids
+ * mid-turn cap shifts that would surprise the model.
+ *
+ * Families:
+ *   reader_family : yujin.reader.* + yujin.fs.read-*
+ *                   + yujin.docs.read-*
+ *   search_family : yujin.reader.search + future search verbs
+ *   writer_family : yujin.fs.write-* + yujin.fs.append-*
+ *   default       : everything else (cap = 5 -- short tool
+ *                   loops, chats, single-action verbs)
+ *
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+export function defaultLimitsConfig() {
+    return {
+        version: 1,
+        max_tool_rounds: {
+            default: 5,
+            reader_family: 25,
+            search_family: 15,
+            writer_family: 10,
+            autonomous: 50,
+        },
+        request_timeout_ms: {
+            managed_proxy: 60000,
+            byok_anthropic: 60000,
+            byok_openai: 60000,
+            byok_gemini: 30000,
+        },
+        classifier_timeout_ms: 2500,
+        managed_max_tokens_per_turn: 8192,
+        shell: {
+            timeout_ms_default: 30000,
+            timeout_ms_max: 300000,
+            max_output_bytes: 1048576,
+            cwd_boundary_strict: true,
+        },
+        danger_zone: {
+            auto_approve_all: false,
+        },
+    };
+}
+function limitsConfigPath() {
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const base = process.env.YF_CONFIG_DIR || path.join(home, '.yujin-forge');
+    return path.join(base, 'limits.json');
+}
+function clamp(v, min, max, fallback) {
+    if (typeof v !== 'number' || !Number.isFinite(v))
+        return fallback;
+    if (v < min)
+        return min;
+    if (v > max)
+        return max;
+    return Math.floor(v);
+}
+/** Apply per-field validation + clamping when reading from
+ *  disk. Out-of-range values silently snap to safe bounds so a
+ *  fat-fingered edit doesn't brick the CLI. */
+function normaliseLimitsConfig(raw) {
+    const def = defaultLimitsConfig();
+    if (!raw || typeof raw !== 'object')
+        return def;
+    const j = raw;
+    const rounds = j.max_tool_rounds || {};
+    const timeouts = j.request_timeout_ms || {};
+    const shell = j.shell || {};
+    const danger = j.danger_zone || {};
+    return {
+        version: 1,
+        max_tool_rounds: {
+            default: clamp(rounds.default, 1, 100, def.max_tool_rounds.default),
+            reader_family: clamp(rounds.reader_family, 1, 100, def.max_tool_rounds.reader_family),
+            search_family: clamp(rounds.search_family, 1, 100, def.max_tool_rounds.search_family),
+            writer_family: clamp(rounds.writer_family, 1, 100, def.max_tool_rounds.writer_family),
+            autonomous: clamp(rounds.autonomous, 1, 200, def.max_tool_rounds.autonomous),
+        },
+        request_timeout_ms: {
+            managed_proxy: clamp(timeouts.managed_proxy, 1000, 300000, def.request_timeout_ms.managed_proxy),
+            byok_anthropic: clamp(timeouts.byok_anthropic, 1000, 300000, def.request_timeout_ms.byok_anthropic),
+            byok_openai: clamp(timeouts.byok_openai, 1000, 300000, def.request_timeout_ms.byok_openai),
+            byok_gemini: clamp(timeouts.byok_gemini, 1000, 300000, def.request_timeout_ms.byok_gemini),
+        },
+        classifier_timeout_ms: clamp(j.classifier_timeout_ms, 250, 30000, def.classifier_timeout_ms),
+        managed_max_tokens_per_turn: clamp(j.managed_max_tokens_per_turn, 64, 64000, def.managed_max_tokens_per_turn),
+        shell: {
+            timeout_ms_default: clamp(shell.timeout_ms_default, 1000, 600000, def.shell.timeout_ms_default),
+            timeout_ms_max: clamp(shell.timeout_ms_max, 1000, 600000, def.shell.timeout_ms_max),
+            max_output_bytes: clamp(shell.max_output_bytes, 1024, 16 * 1024 * 1024, def.shell.max_output_bytes),
+            cwd_boundary_strict: typeof shell.cwd_boundary_strict === 'boolean'
+                ? shell.cwd_boundary_strict
+                : def.shell.cwd_boundary_strict,
+        },
+        danger_zone: {
+            auto_approve_all: typeof danger.auto_approve_all === 'boolean'
+                ? danger.auto_approve_all
+                : def.danger_zone.auto_approve_all,
+        },
+    };
+}
+let _cache = null;
+let _cacheMTime = 0;
+/** Read the active config. Cached for ~3 seconds to avoid
+ *  hammering the FS on every router call. Use forceRefresh=true
+ *  in tests / CLI after a setValue. */
+export async function readLimitsConfig(forceRefresh = false) {
+    if (!forceRefresh && _cache && Date.now() - _cacheMTime < 3000) {
+        return _cache;
+    }
+    try {
+        const raw = await fs.readFile(limitsConfigPath(), 'utf-8');
+        const j = JSON.parse(raw);
+        _cache = normaliseLimitsConfig(j);
+    }
+    catch {
+        _cache = defaultLimitsConfig();
+    }
+    _cacheMTime = Date.now();
+    return _cache;
+}
+export async function writeLimitsConfig(cfg) {
+    const p = limitsConfigPath();
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    const tmp = p + '.tmp';
+    const normalised = normaliseLimitsConfig(cfg);
+    await fs.writeFile(tmp, JSON.stringify(normalised, null, 2), 'utf-8');
+    await fs.rename(tmp, p);
+    _cache = normalised;
+    _cacheMTime = Date.now();
+}
+export async function resetLimitsConfig() {
+    const def = defaultLimitsConfig();
+    await writeLimitsConfig(def);
+    return def;
+}
+/** Reset the in-memory cache. Tests use this between specs. */
+export function _resetLimitsCache() {
+    _cache = null;
+    _cacheMTime = 0;
+}
+/* ----- Verb family detection ------------------------------- */
+const READER_VERB_PATTERNS = [
+    /^yujin\.reader\.(open|next-block|read-section|recap|bookmark-set|bookmark-jump|list-docs)$/,
+    /^yujin\.fs\.read-/,
+    /^yujin\.docs\.read-/,
+];
+const SEARCH_VERB_PATTERNS = [
+    /^yujin\.reader\.search$/,
+    /^yujin\.search\./,
+    /^yujin\.web\.search/,
+];
+const WRITER_VERB_PATTERNS = [
+    /^yujin\.fs\.write-/,
+    /^yujin\.fs\.append-/,
+];
+export function classifyVerbFamily(verbId) {
+    if (!verbId)
+        return 'default';
+    for (const p of READER_VERB_PATTERNS)
+        if (p.test(verbId))
+            return 'reader_family';
+    for (const p of SEARCH_VERB_PATTERNS)
+        if (p.test(verbId))
+            return 'search_family';
+    for (const p of WRITER_VERB_PATTERNS)
+        if (p.test(verbId))
+            return 'writer_family';
+    return 'default';
+}
+/**
+ * Pick the max_tool_rounds limit for a turn based on the verb
+ * family the LLM is using. The family is derived from the
+ * FIRST nac3 verb the LLM emits in this turn -- once decided,
+ * the cap stays for the rest of the turn (no mid-turn shifts).
+ *
+ * Callers track the first verb invoked + pass it here.
+ */
+export function getMaxToolRoundsForFamily(cfg, family) {
+    switch (family) {
+        case 'reader_family': return cfg.reader_family;
+        case 'search_family': return cfg.search_family;
+        case 'writer_family': return cfg.writer_family;
+        case 'default': return cfg.default;
+    }
+}
+/* ----- Field-path API for CLI setter ----------------------- */
+/** All settable field paths in dotted notation, used by `yf
+ *  limits set <field> <value>`. */
+export const LIMITS_FIELD_PATHS = [
+    'max_tool_rounds.default',
+    'max_tool_rounds.reader_family',
+    'max_tool_rounds.search_family',
+    'max_tool_rounds.writer_family',
+    'max_tool_rounds.autonomous',
+    'request_timeout_ms.managed_proxy',
+    'request_timeout_ms.byok_anthropic',
+    'request_timeout_ms.byok_openai',
+    'request_timeout_ms.byok_gemini',
+    'classifier_timeout_ms',
+    'managed_max_tokens_per_turn',
+    'shell.timeout_ms_default',
+    'shell.timeout_ms_max',
+    'shell.max_output_bytes',
+];
+export function isLimitsFieldPath(p) {
+    return LIMITS_FIELD_PATHS.includes(p);
+}
+/* alpha.59d -- boolean settings live apart so setLimitsField
+ *  can stay numeric-only. */
+export const LIMITS_BOOLEAN_FIELD_PATHS = [
+    'shell.cwd_boundary_strict',
+    'danger_zone.auto_approve_all',
+];
+export function isLimitsBooleanFieldPath(p) {
+    return LIMITS_BOOLEAN_FIELD_PATHS.includes(p);
+}
+export async function setLimitsBooleanField(field, value) {
+    if (!isLimitsBooleanFieldPath(field)) {
+        throw new Error('limits: unknown boolean field path "' + field + '"');
+    }
+    if (typeof value !== 'boolean') {
+        throw new Error('limits: boolean field value must be a boolean');
+    }
+    const cur = await readLimitsConfig(true);
+    const parts = field.split('.');
+    if (parts.length === 2 && parts[0] && parts[1]) {
+        const root = cur[parts[0]];
+        if (!root)
+            throw new Error('limits: parent field missing: ' + parts[0]);
+        root[parts[1]] = value;
+    }
+    await writeLimitsConfig(cur);
+    return cur;
+}
+/** Apply a single setValue. Returns the updated config. Throws
+ *  on invalid path or non-numeric value. */
+export async function setLimitsField(field, value) {
+    if (!isLimitsFieldPath(field)) {
+        throw new Error('limits: unknown field path "' + field + '". Run `yf limits list-fields` to see options.');
+    }
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw new Error('limits: value must be a finite number, got ' + String(value));
+    }
+    const cur = await readLimitsConfig(true);
+    const parts = field.split('.');
+    if (parts.length === 1 && parts[0]) {
+        cur[parts[0]] = value;
+    }
+    else if (parts.length === 2 && parts[0] && parts[1]) {
+        const root = cur[parts[0]];
+        if (!root)
+            throw new Error('limits: parent field missing: ' + parts[0]);
+        root[parts[1]] = value;
+    }
+    await writeLimitsConfig(cur);
+    return cur;
+}
+//# sourceMappingURL=limits_config.js.map

package/dist/core/limits_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits_config.js","sourceRoot":"","sources":["../../src/core/limits_config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAwDzB,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,eAAe,EAAE;YACf,OAAO,EAAE,CAAC;YACV,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,EAAE;SACf;QACD,kBAAkB,EAAE;YAClB,aAAa,EAAE,KAAK;YACpB,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,KAAK;YAClB,WAAW,EAAE,KAAK;SACnB;QACD,qBAAqB,EAAE,IAAI;QAC3B,2BAA2B,EAAE,IAAI;QACjC,KAAK,EAAE;YACL,kBAAkB,EAAE,KAAK;YACzB,cAAc,EAAM,MAAM;YAC1B,gBAAgB,EAAI,OAAO;YAC3B,mBAAmB,EAAE,IAAI;SAC1B;QACD,WAAW,EAAE;YACX,gBAAgB,EAAE,KAAK;SACxB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,KAAK,CAAC,CAAU,EAAE,GAAW,EAAE,GAAW,EAAE,QAAgB;IACnE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClE,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IACxB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED;;+CAE+C;AAC/C,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAChD,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,eAAe,EAAE;YACf,OAAO,EAAS,KAAK,CAAE,MAA8B,CAAC,OAAO,EAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC;YAC1G,aAAa,EAAG,KAAK,CAAE,MAA8B,CAAC,aAAa,EAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC;YAChH,aAAa,EAAG,KAAK,CAAE,MAA8B,CAAC,aAAa,EAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC;YAChH,aAAa,EAAG,KAAK,CAAE,MAA8B,CAAC,aAAa,EAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC;YAChH,UAAU,EAAM,KAAK,CAAE,MAA8B,CAAC,UAAU,EAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC;SAC9G;QACD,kBAAkB,EAAE;YAClB,aAAa,EAAG,KAAK,CAAE,QAAkC,CAAC,aAAa,EAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,CAAC,aAAa,CAAC;YAC7H,cAAc,EAAE,KAAK,CAAE,QAAkC,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,CAAC,cAAc,CAAC;YAC9H,WAAW,EAAK,KAAK,CAAE,QAAkC,CAAC,WAAW,EAAK,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,CAAC,WAAW,CAAC;YAC3H,WAAW,EAAK,KAAK,CAAE,QAAkC,CAAC,WAAW,EAAK,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,kBAAkB,CAAC,WAAW,CAAC;SAC5H;QACD,qBAAqB,EAAQ,KAAK,CAAC,CAAC,CAAC,qBAAqB,EAAQ,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,qBAAqB,CAAC;QACxG,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAC,2BAA2B,EAAE,EAAE,EAAG,KAAK,EAAE,GAAG,CAAC,2BAA2B,CAAC;QAC9G,KAAK,EAAE;YACL,kBAAkB,EAAE,KAAK,CAAE,KAA2B,CAAC,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACtH,cAAc,EAAM,KAAK,CAAE,KAA2B,CAAC,cAAc,EAAM,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC;YAClH,gBAAgB,EAAI,KAAK,CAAE,KAA2B,CAAC,gBAAgB,EAAI,IAAI,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAC9H,mBAAmB,EAAE,OAAQ,KAA2B,CAAC,mBAAmB,KAAK,SAAS;gBACxF,CAAC,CAAE,KAA2B,CAAC,mBAAmB;gBAClD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB;SAClC;QACD,WAAW,EAAE;YACX,gBAAgB,EAAE,OAAQ,MAA2B,CAAC,gBAAgB,KAAK,SAAS;gBAClF,CAAC,CAAE,MAA2B,CAAC,gBAAgB;gBAC/C,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,gBAAgB;SACrC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,MAAM,GAAwB,IAAI,CAAC;AACvC,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB;;uCAEuC;AACvC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,YAAY,GAAG,KAAK;IACzD,IAAI,CAAC,YAAY,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACjC,CAAC;IACD,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAiB;IACvD,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,GAAG,UAAU,CAAC;IACpB,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,IAAI,CAAC;IACd,WAAW,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,iEAAiE;AAEjE,MAAM,oBAAoB,GAAsB;IAC9C,4FAA4F;IAC5F,mBAAmB;IACnB,qBAAqB;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAAsB;IAC9C,yBAAyB;IACzB,kBAAkB;IAClB,qBAAqB;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAAsB;IAC9C,oBAAoB;IACpB,qBAAqB;CACtB,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,oBAAoB;QAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,eAAe,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,oBAAoB;QAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,eAAe,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,oBAAoB;QAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,eAAe,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAwB,EACxB,MAAwB;IAExB,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,eAAe,CAAC,CAAC,OAAO,GAAG,CAAC,aAAa,CAAC;QAC/C,KAAK,eAAe,CAAC,CAAC,OAAO,GAAG,CAAC,aAAa,CAAC;QAC/C,KAAK,eAAe,CAAC,CAAC,OAAO,GAAG,CAAC,aAAa,CAAC;QAC/C,KAAK,SAAS,CAAC,CAAO,OAAO,GAAG,CAAC,OAAO,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,iEAAiE;AAEjE;mCACmC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,yBAAyB;IACzB,+BAA+B;IAC/B,+BAA+B;IAC/B,+BAA+B;IAC/B,4BAA4B;IAC5B,kCAAkC;IAClC,mCAAmC;IACnC,gCAAgC;IAChC,gCAAgC;IAChC,uBAAuB;IACvB,6BAA6B;IAC7B,0BAA0B;IAC1B,sBAAsB;IACtB,wBAAwB;CACzB,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;6BAC6B;AAC7B,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,2BAA2B;IAC3B,8BAA8B;CAC/B,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,CAAS;IAChD,OAAO,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,KAAc;IACvE,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAI,GAA0D,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;4CAC4C;AAC5C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,KAAa;IAC/D,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,KAAK,GAAG,gDAAgD,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAA0C,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IAChE,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAI,GAA0D,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/provider_keys.d.ts

@@ -0,0 +1,35 @@
+declare const ALLOWED_SLOTS: readonly ["anthropic_api_key", "openai_api_key", "google_ai_key", "deepseek_api_key", "xai_api_key", "mistral_api_key", "cohere_api_key", "google_stt_key", "google_tts_key", "whisper_api_key", "elevenlabs_api_key", "yujin_admin_key"];
+export type ProviderSlot = (typeof ALLOWED_SLOTS)[number];
+export declare function listAllowedSlots(): readonly string[];
+export declare function isAllowedSlot(s: string): s is ProviderSlot;
+/** Force a re-open (tests). */
+export declare function _resetVaultCache(): void;
+/** Run once per process. Imports legacy plaintext JSON keys +
+ *  any vault slots stored under the non-prefixed slot name
+ *  (legacy from before alpha.44 OR from users following an old
+ *  yf vault set instruction). Idempotent + tolerant of partial
+ *  imports. */
+export declare function migrateLegacyIfNeeded(): Promise<{
+    imported: string[];
+    skipped: string[];
+    legacy_present: boolean;
+    vault_slots_migrated: string[];
+}>;
+/** Read a BYOK key plaintext. Returns null when the slot is not
+ *  set or the slot name is invalid. Migrates legacy storage on
+ *  first call. */
+export declare function getKey(slot: string): Promise<string | null>;
+/** Set a BYOK key. Empty / null value clears the slot. */
+export declare function setKey(slot: string, value: string | null | undefined): Promise<void>;
+/** Has-check (no plaintext leak). */
+export declare function hasKey(slot: string): Promise<boolean>;
+/** Status snapshot of all allowed slots -- booleans, not values. */
+export declare function listStatus(): Promise<Record<string, boolean>>;
+/** Convenience: synchronous-ish wrappers for the legacy code paths
+ *  that did `readKeys(): Record<string, unknown>` and expected a
+ *  full snapshot. Returns plaintext values for set slots; null
+ *  for unset. Keep call sites aware this DECRYPTS everything --
+ *  do not log the return. */
+export declare function readAllPlaintext(): Promise<Record<string, string | null>>;
+export {};
+//# sourceMappingURL=provider_keys.d.ts.map

package/dist/core/provider_keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_keys.d.ts","sourceRoot":"","sources":["../../src/core/provider_keys.ts"],"names":[],"mappings":"AAkCA,QAAA,MAAM,aAAa,2OAyBT,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,wBAAgB,gBAAgB,IAAI,SAAS,MAAM,EAAE,CAEpD;AAgBD,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,YAAY,CAM1D;AAqBD,+BAA+B;AAC/B,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC;AAID;;;;eAIe;AACf,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC,CAAC,CA4DD;AAED;;kBAEkB;AAClB,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOjE;AAED,0DAA0D;AAC1D,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAa1F;AAED,qCAAqC;AACrC,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAK3D;AAED,oEAAoE;AACpE,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQnE;AAED;;;;6BAI6B;AAC7B,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAY/E"}

package/dist/core/provider_keys.js

@@ -0,0 +1,260 @@
+/**
+ * core/provider_keys.ts -- BYOK API key storage (alpha.44 C1).
+ *
+ * Single source of truth for read / write / list of BYOK provider
+ * keys (Anthropic, OpenAI, Google AI, Google STT, Google TTS,
+ * Whisper, ElevenLabs).
+ *
+ * Storage: encrypted Vault (AES-256-GCM, derived from machine
+ * fingerprint -- see src/vault/crypto.ts). Slots are namespaced
+ * `byok.<slot>` so they cannot collide with other vault tenants.
+ *
+ * Migration: on first call the helper checks for the legacy file
+ * `~/.yujin-forge/provider_keys.json` (plaintext, mode 0600 only).
+ * If present:
+ *   1. Imports every recognised slot value into the vault.
+ *   2. Renames the legacy file to `provider_keys.json.legacy.bak`
+ *      so a fresh chat session does not re-import it. The backup
+ *      stays so the user can grep for emergency recovery if the
+ *      vault somehow gets corrupted before the next chat turn.
+ *
+ * All callers (chat tool, server endpoints, voice providers,
+ * claude client init, CLI commands, license sync, etc) MUST go
+ * through this module. Direct reads of provider_keys.json are
+ * forbidden from alpha.44 onward; the audit_consumers tool will
+ * flag any re-introduction.
+ *
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { Vault } from '../vault/store.js';
+import { configDir } from '../license/index.js';
+const ALLOWED_SLOTS = [
+    /* Brain provider keys (one of these resolves the active tier
+     *  in src/core/brain_config.ts). */
+    'anthropic_api_key',
+    'openai_api_key',
+    'google_ai_key',
+    /* alpha.51 -- added brain providers reachable from
+     *  cost_router. Slots registered so the BYOK CLI + vault
+     *  recognise them; runtime wire happens in alpha.51b/52. */
+    'deepseek_api_key',
+    'xai_api_key',
+    'mistral_api_key',
+    'cohere_api_key',
+    /* Voice providers (decoupled from brain selection). */
+    'google_stt_key',
+    'google_tts_key',
+    'whisper_api_key',
+    'elevenlabs_api_key',
+    /* alpha.59z.17 HITO 6.4 -- F103 admin key. Stored locally so
+     *  Pablo does not have to paste it for every promote/demote/
+     *  reject/doctrine-update command. Matches the YUJIN_ADMIN_KEY
+     *  secret configured in the HITO 4 worker. */
+    'yujin_admin_key',
+];
+export function listAllowedSlots() {
+    return ALLOWED_SLOTS;
+}
+/* alpha.59z.34 F101 slice 5 sub-slice 2 -- dynamic slot patterns
+ * for per-bridge MCP credentials. The bridge_id is user-controlled
+ * but the slot shape is constrained:
+ *   mcp_<bridge_id>_token  where bridge_id is [a-z0-9_-]{1,80}
+ *
+ * The regex is anchored + length-limited so a malformed bridge_id
+ * cannot exfiltrate into other vault keys via setKey('../foo').
+ * Vault.set itself also enforces ^[a-z][a-z0-9_-]*$ on the prefixed
+ * key, but defence-in-depth: we validate here too.
+ */
+const DYNAMIC_SLOT_PATTERNS = [
+    /^mcp_[a-z0-9][a-z0-9_-]{0,78}_token$/,
+];
+export function isAllowedSlot(s) {
+    if (ALLOWED_SLOTS.includes(s))
+        return true;
+    /* Type guard widening: dynamic slots are not in the ProviderSlot
+     * union, but for runtime callers passing `string` the guard still
+     * narrows enough at the static-known callsites. */
+    return DYNAMIC_SLOT_PATTERNS.some((re) => re.test(s));
+}
+/* Slot prefix in the vault. The Vault enforces
+ * ^[a-z][a-z0-9_-]*$ so we use an underscore, not a dot. */
+const VAULT_PREFIX = 'byok_';
+function legacyKeysFile() {
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const base = process.env.YF_CONFIG_DIR || path.join(home, '.yujin-forge');
+    return path.join(base, 'provider_keys.json');
+}
+/** Cache the Vault open. Each ProviderKeys API call reuses the
+ *  same instance so we don't re-derive the AES key on every read. */
+let _vaultCache = null;
+async function openVault() {
+    if (_vaultCache)
+        return _vaultCache;
+    _vaultCache = await Vault.open({ configDir: configDir() });
+    return _vaultCache;
+}
+/** Force a re-open (tests). */
+export function _resetVaultCache() {
+    _vaultCache = null;
+    _migrationDone = false;
+}
+let _migrationDone = false;
+/** Run once per process. Imports legacy plaintext JSON keys +
+ *  any vault slots stored under the non-prefixed slot name
+ *  (legacy from before alpha.44 OR from users following an old
+ *  yf vault set instruction). Idempotent + tolerant of partial
+ *  imports. */
+export async function migrateLegacyIfNeeded() {
+    if (_migrationDone)
+        return { imported: [], skipped: [], legacy_present: false, vault_slots_migrated: [] };
+    _migrationDone = true;
+    const vault = await openVault();
+    const imported = [];
+    const skipped = [];
+    const vaultSlotsMigrated = [];
+    /* alpha.54 -- migrate vault slots that exist WITHOUT the
+     * byok_ prefix into the canonical prefixed slot. Happens when
+     * users follow an old guide ("yf vault set google_ai_key").
+     * Each migrated row also clears the source slot so the vault
+     * inventory stays clean. */
+    for (const slot of ALLOWED_SLOTS) {
+        const prefixed = VAULT_PREFIX + slot;
+        if (vault.has(prefixed))
+            continue; // already in canonical place
+        if (!vault.has(slot))
+            continue; // nothing in legacy slot either
+        try {
+            const v = vault.get(slot);
+            if (typeof v === 'string' && v.length >= 4) {
+                await vault.set(prefixed, v);
+                await vault.remove(slot);
+                vaultSlotsMigrated.push(slot);
+            }
+        }
+        catch {
+            /* if read fails (vault corruption on that row), skip */
+        }
+    }
+    /* Existing JSON legacy migration (alpha.44). */
+    const legacyFile = legacyKeysFile();
+    let raw;
+    try {
+        raw = await fs.readFile(legacyFile, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            return { imported, skipped, legacy_present: false, vault_slots_migrated: vaultSlotsMigrated };
+        }
+        throw err;
+    }
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch {
+        return { imported, skipped, legacy_present: true, vault_slots_migrated: vaultSlotsMigrated };
+    }
+    for (const slot of ALLOWED_SLOTS) {
+        const val = json[slot];
+        if (typeof val !== 'string' || val.length < 4)
+            continue;
+        const vaultKey = VAULT_PREFIX + slot;
+        if (vault.has(vaultKey)) {
+            skipped.push(slot);
+            continue;
+        }
+        try {
+            await vault.set(vaultKey, val);
+            imported.push(slot);
+        }
+        catch {
+            skipped.push(slot);
+        }
+    }
+    /* Rename legacy file so next session doesn't re-import. */
+    try {
+        await fs.rename(legacyFile, legacyFile + '.legacy.bak');
+    }
+    catch { /* ignore */ }
+    return { imported, skipped, legacy_present: true, vault_slots_migrated: vaultSlotsMigrated };
+}
+/** Read a BYOK key plaintext. Returns null when the slot is not
+ *  set or the slot name is invalid. Migrates legacy storage on
+ *  first call. */
+export async function getKey(slot) {
+    if (!isAllowedSlot(slot))
+        return null;
+    await migrateLegacyIfNeeded();
+    const vault = await openVault();
+    const vaultKey = VAULT_PREFIX + slot;
+    if (!vault.has(vaultKey))
+        return null;
+    try {
+        return vault.get(vaultKey);
+    }
+    catch {
+        return null;
+    }
+}
+/** Set a BYOK key. Empty / null value clears the slot. */
+export async function setKey(slot, value) {
+    if (!isAllowedSlot(slot))
+        throw new Error('provider_keys: slot not allowed: ' + slot);
+    await migrateLegacyIfNeeded();
+    const vault = await openVault();
+    const vaultKey = VAULT_PREFIX + slot;
+    if (value == null || value === '') {
+        await vault.remove(vaultKey);
+        return;
+    }
+    if (typeof value !== 'string' || value.length < 8) {
+        throw new Error('provider_keys: value must be a string >= 8 chars (got ' + (typeof value) + ', length=' + (typeof value === 'string' ? value.length : 0) + ')');
+    }
+    await vault.set(vaultKey, value);
+}
+/** Has-check (no plaintext leak). */
+export async function hasKey(slot) {
+    if (!isAllowedSlot(slot))
+        return false;
+    await migrateLegacyIfNeeded();
+    const vault = await openVault();
+    return vault.has(VAULT_PREFIX + slot);
+}
+/** Status snapshot of all allowed slots -- booleans, not values. */
+export async function listStatus() {
+    await migrateLegacyIfNeeded();
+    const vault = await openVault();
+    const out = {};
+    for (const slot of ALLOWED_SLOTS) {
+        out[slot] = vault.has(VAULT_PREFIX + slot);
+    }
+    return out;
+}
+/** Convenience: synchronous-ish wrappers for the legacy code paths
+ *  that did `readKeys(): Record<string, unknown>` and expected a
+ *  full snapshot. Returns plaintext values for set slots; null
+ *  for unset. Keep call sites aware this DECRYPTS everything --
+ *  do not log the return. */
+export async function readAllPlaintext() {
+    await migrateLegacyIfNeeded();
+    const vault = await openVault();
+    const out = {};
+    for (const slot of ALLOWED_SLOTS) {
+        if (vault.has(VAULT_PREFIX + slot)) {
+            try {
+                out[slot] = vault.get(VAULT_PREFIX + slot);
+            }
+            catch {
+                out[slot] = null;
+            }
+        }
+        else {
+            out[slot] = null;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=provider_keys.js.map

package/dist/core/provider_keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider_keys.js","sourceRoot":"","sources":["../../src/core/provider_keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,aAAa,GAAG;IACpB;wCACoC;IACpC,mBAAmB;IACnB,gBAAgB;IAChB,eAAe;IACf;;gEAE4D;IAC5D,kBAAkB;IAClB,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAEhB,uDAAuD;IACvD,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IAEpB;;;kDAG8C;IAC9C,iBAAiB;CACT,CAAC;AAGX,MAAM,UAAU,gBAAgB;IAC9B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,sCAAsC;CACvC,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,IAAK,aAAmC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE;;uDAEmD;IACnD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;4DAC4D;AAC5D,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC/C,CAAC;AAED;qEACqE;AACrE,IAAI,WAAW,GAAiB,IAAI,CAAC;AACrC,KAAK,UAAU,SAAS;IACtB,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,WAAW,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,gBAAgB;IAC9B,WAAW,GAAG,IAAI,CAAC;IACnB,cAAc,GAAG,KAAK,CAAC;AACzB,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B;;;;eAIe;AACf,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAMzC,IAAI,cAAc;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC;IAC1G,cAAc,GAAG,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,kBAAkB,GAAa,EAAE,CAAC;IAExC;;;;gCAI4B;IAC5B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS,CAAE,6BAA6B;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAK,gCAAgC;QACpE,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAC/B,MAAM,CAAC;QAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;IAAC,CAAC;IACvG,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;QACrC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,CAAC;AAC/F,CAAC;AAED;;kBAEkB;AAClB,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY;IACvC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC5D,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,KAAgC;IACzE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;IACtF,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAC;IACrC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,WAAW,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAClK,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,qCAAqC;AACrC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAY;IACvC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;6BAI6B;AAC7B,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}