@namzu/cli 12.1.0 → 14.0.0

package/dist/integrations/providers/discover.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAA;AACzF,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,EAAE,iBAAiB,EAA+C,MAAM,eAAe,CAAA;AAkE9F,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACnC,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE;IACF,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mCAAmC;IACnC,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,oDAAoD;IACpD,4EAA4E;IAC5E,uEAAuE;IACvE,sDAAsD;IACtD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,0EAA0E;IAC1E,YAAY;IACZ,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;IAEnF,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAA0B,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,OAAO,GAAsB,EAAE,CAAA;QACrC,IAAI,MAA0B,CAAA;QAC9B,IAAI,KAAgC,CAAA;QACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACvC,CAAC;QACF,CAAC;QACD,IAAI,EAAE,KAAK,WAAW,IAAI,gBAAgB,EAAE,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAA;YAC/D,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACtE,CAAC,CAAA;YACF,+DAA+D;YAC/D,2DAA2D;YAC3D,IAAI,MAAM,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAAC;gBAC7C,KAAK,GAAG;oBACP,YAAY,EAAE,gBAAgB,CAAC,YAAY;oBAC3C,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,MAAM,EAAE,QAAQ;iBAChB,CAAA;YACF,CAAC;QACF,CAAC;QACD,IAAI,EAAE,KAAK,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,GAAG,kBAAkB,CAAC,WAAW,CAAA;YACjE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC7D,IAAI,MAAM,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;gBAC/C,KAAK,GAAG;oBACP,YAAY,EAAE,kBAAkB,CAAC,YAAY;oBAC7C,SAAS,EAAE,kBAAkB,CAAC,SAAS;oBACvC,MAAM,EAAE,UAAU;iBAClB,CAAA;YACF,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAoB;gBACrC,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;aAC9B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAqB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAC/C,CAAA;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;QAC5E,OAAO,GAAG,CAAC,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC3B,IAAiC,EACjC,EAAc;IAEd,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;AACnD,CAAC"}
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../../../src/integrations/providers/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAElD,OAAO,EACN,eAAe,EACf,yBAAyB,EACzB,gCAAgC,GAChC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,EAAE,iBAAiB,EAA+C,MAAM,eAAe,CAAA;AA4E9F,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAA;IACnC,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,mEAAmE;IACnE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE;IACF,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mCAAmC;IACnC,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,oDAAoD;IACpD,4EAA4E;IAC5E,uEAAuE;IACvE,sDAAsD;IACtD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;QACvC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,gCAAgC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpF,MAAM,qBAAqB,GAAG,IAAI,CAAC,UAAU;QAC5C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7E,0EAA0E;IAC1E,YAAY;IACZ,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAA;IACnF,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChE,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACnE,MAAM,yBAAyB,GAC9B,mBAAmB,EAAE,SAAS,KAAK,SAAS;QAC5C,mBAAmB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;QAClD,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,IAAI,CAAA;IAER,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAA0B,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,OAAO,GAAsB,EAAE,CAAA;QACrC,IAAI,MAA0B,CAAA;QAC9B,IAAI,KAAgC,CAAA;QACpC,IAAI,KAAgC,CAAA;QAEpC,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAA;YAClF,MAAM,cAAc,GACnB,QAAQ,EAAE,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBAC5E,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,CAAA;YACR,MAAM,cAAc,GACnB,cAAc,KAAK,oBAAoB,IAAI,cAAc;gBACxD,CAAC,CAAC;oBACA,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;iBACtC;gBACF,CAAC,CAAC,cAAc;oBACf,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBACjD,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,cAAc,IAAI,cAAc,EAAE,CAAC;gBACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,cAAc,CAAC,WAAW,CAAA;oBACnC,KAAK,GAAG;wBACP,YAAY,EAAE,cAAc,CAAC,YAAY;wBACzC,SAAS,EAAE,cAAc,CAAC,SAAS;wBACnC,MAAM,EAAE,cAAc,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU;qBAC1E,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YAC7B,CAAC;YACD,MAAM,mBAAmB,GACxB,cAAc,IAAI,cAAc,KAAK,oBAAoB,IAAI,kBAAkB;gBAC9E,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE;gBACjD,CAAC,CAAC,cAAc,IAAI,cAAc,KAAK,kBAAkB,IAAI,oBAAoB;oBAChF,CAAC,CAAC;wBACA,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;qBACtC;oBACF,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,mBAAmB;gBAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;YAC1D,IAAI,gBAAgB,EAAE,CAAC;gBACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAA;oBACrC,KAAK,GAAG;wBACP,YAAY,EAAE,gBAAgB,CAAC,YAAY;wBAC3C,SAAS,EAAE,gBAAgB,CAAC,SAAS;wBACrC,MAAM,EAAE,QAAQ;qBAChB,CAAA;gBACF,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;QACF,CAAC;QAED,IAAI,EAAE,KAAK,OAAO,IAAI,CAAC,qBAAqB,IAAI,yBAAyB,CAAC,EAAE,CAAC;YAC5E,MAAM,UAAU,GAAG,yBAAyB,IAAI,qBAAqB,CAAA;YACrE,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;YAC/C,MAAM,GAAG,UAAU,CAAC,WAAW,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;gBACzD,IAAI,EAAE,yBAAyB;oBAC9B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;oBACtC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;aACnE,CAAC,CAAA;YACF,KAAK,GAAG;gBACP,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;aAC3D,CAAA;YACD,IAAI,qBAAqB,IAAI,yBAAyB,EAAE,CAAC;gBACxD,OAAO,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBACtE,CAAC,CAAA;YACH,CAAC;QACF,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,kEAAkE;YAClE,mEAAmE;YACnE,iEAAiE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACvC,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;YACrD,CAAC;QACF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACb,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,CAAC,CAAoB;gBACrC,MAAM;gBACN,OAAO,EAAE,KAAK,CAAC,cAAc;gBAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;aAC9B,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAqB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CACvB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EACxB,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAC/C,CAAA;IACD,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAC3B,IAAiC,EACjC,EAAc;IAEd,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;AACnD,CAAC"}

package/dist/integrations/providers/harness-credentials.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Read-only adapters for credentials owned by co-installed agent harnesses.
+ *
+ * These files are authorities, not migration inputs. Namzu reads the whole
+ * record, validates only the fields its provider wire needs, and never writes
+ * either file. In particular, refresh tokens remain owned by the harness that
+ * obtained them; consuming a single-use refresh grant here would race that
+ * owner and could log it out.
+ */
+import type { AgentOAuthCredential } from './keychain.js';
+export interface CodexOAuthCredential extends AgentOAuthCredential {
+    readonly accountId: string;
+}
+export declare function claudeCredentialsPath(home?: string): string;
+export declare function codexCredentialsPath(home?: string, env?: NodeJS.ProcessEnv): string;
+export declare function readClaudeFileCredential(home?: string): AgentOAuthCredential | null;
+/** Read a Claude-owned credential from the exact path discovery admitted. */
+export declare function readClaudeCredentialFile(path: string): AgentOAuthCredential | null;
+export declare function codexCredentialFromTokens(tokens: {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly accountId?: string;
+}): CodexOAuthCredential | null;
+/**
+ * Read the ChatGPT subscription record produced by Codex CLI.
+ *
+ * `OPENAI_API_KEY` is intentionally ignored: it belongs to the ordinary
+ * OpenAI provider. This reader admits only the `tokens` envelope used by the
+ * Codex Responses backend and requires the account id that backend routes on.
+ */
+export declare function readCodexFileCredential(home?: string, env?: NodeJS.ProcessEnv): CodexOAuthCredential | null;
+/** Read a Codex-owned credential from the exact path discovery admitted. */
+export declare function readCodexCredentialFile(path: string): CodexOAuthCredential | null;
+/** Prefer the credential whose access token remains valid for longer. */
+export declare function preferFresherCredential<T extends AgentOAuthCredential>(left: T | null, right: T | null, now?: number): T | null;
+//# sourceMappingURL=harness-credentials.d.ts.map

package/dist/integrations/providers/harness-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAIzD,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEtE;AAED,wBAAgB,oBAAoB,CACnC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAQR;AA6BD,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,MAAkB,GAAG,oBAAoB,GAAG,IAAI,CAE9F;AAED,6EAA6E;AAC7E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAWlF;AAOD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IACjD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,oBAAoB,GAAG,IAAI,CAW9B;AAoBD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,oBAAoB,GAAG,IAAI,CAE7B;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAkBjF;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,oBAAoB,EACrE,IAAI,EAAE,CAAC,GAAG,IAAI,EACd,KAAK,EAAE,CAAC,GAAG,IAAI,EACf,GAAG,SAAa,GACd,CAAC,GAAG,IAAI,CASV"}

package/dist/integrations/providers/harness-credentials.js

@@ -0,0 +1,146 @@
+/**
+ * Read-only adapters for credentials owned by co-installed agent harnesses.
+ *
+ * These files are authorities, not migration inputs. Namzu reads the whole
+ * record, validates only the fields its provider wire needs, and never writes
+ * either file. In particular, refresh tokens remain owned by the harness that
+ * obtained them; consuming a single-use refresh grant here would race that
+ * owner and could log it out.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+const MAX_CREDENTIAL_FILE_BYTES = 1024 * 1024;
+export function claudeCredentialsPath(home = homedir()) {
+    return join(home, '.claude', '.credentials.json');
+}
+export function codexCredentialsPath(home = homedir(), env = process.env) {
+    const configured = env.CODEX_HOME?.trim();
+    const root = configured
+        ? isAbsolute(configured)
+            ? configured
+            : resolve(configured)
+        : join(home, '.codex');
+    return join(root, 'auth.json');
+}
+function readCredentialJson(path) {
+    try {
+        const stat = statSync(path);
+        if (!stat.isFile() || stat.size <= 0 || stat.size > MAX_CREDENTIAL_FILE_BYTES)
+            return null;
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function record(value) {
+    return typeof value === 'object' && value !== null ? value : null;
+}
+function optionalString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function optionalFiniteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function optionalStringArray(value) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string'))
+        return undefined;
+    return value;
+}
+export function readClaudeFileCredential(home = homedir()) {
+    return readClaudeCredentialFile(claudeCredentialsPath(home));
+}
+/** Read a Claude-owned credential from the exact path discovery admitted. */
+export function readClaudeCredentialFile(path) {
+    const root = record(readCredentialJson(path));
+    const oauth = record(root?.claudeAiOauth);
+    const accessToken = optionalString(oauth?.accessToken);
+    if (!accessToken)
+        return null;
+    return {
+        accessToken,
+        refreshToken: optionalString(oauth?.refreshToken),
+        expiresAt: optionalFiniteNumber(oauth?.expiresAt),
+        scopes: optionalStringArray(oauth?.scopes),
+    };
+}
+export function codexCredentialFromTokens(tokens) {
+    if (tokens.accessToken.length === 0)
+        return null;
+    const claims = jwtClaims(tokens.accessToken);
+    const accountId = tokens.accountId ?? claims.accountId;
+    if (!accountId)
+        return null;
+    return {
+        accessToken: tokens.accessToken,
+        ...(tokens.refreshToken ? { refreshToken: tokens.refreshToken } : {}),
+        accountId,
+        ...(claims.expiresAt === undefined ? {} : { expiresAt: claims.expiresAt }),
+    };
+}
+function jwtClaims(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3 || !parts[1])
+        return {};
+    try {
+        const payload = record(JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')));
+        const auth = record(payload?.['https://api.openai.com/auth']);
+        const exp = optionalFiniteNumber(payload?.exp);
+        return {
+            ...(exp === undefined ? {} : { expiresAt: exp * 1000 }),
+            ...(optionalString(auth?.chatgpt_account_id)
+                ? { accountId: optionalString(auth?.chatgpt_account_id) }
+                : {}),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Read the ChatGPT subscription record produced by Codex CLI.
+ *
+ * `OPENAI_API_KEY` is intentionally ignored: it belongs to the ordinary
+ * OpenAI provider. This reader admits only the `tokens` envelope used by the
+ * Codex Responses backend and requires the account id that backend routes on.
+ */
+export function readCodexFileCredential(home = homedir(), env = process.env) {
+    return readCodexCredentialFile(codexCredentialsPath(home, env));
+}
+/** Read a Codex-owned credential from the exact path discovery admitted. */
+export function readCodexCredentialFile(path) {
+    const root = record(readCredentialJson(path));
+    const tokens = record(root?.tokens);
+    const accessToken = optionalString(tokens?.access_token);
+    if (!accessToken)
+        return null;
+    const accessClaims = jwtClaims(accessToken);
+    const idToken = optionalString(tokens?.id_token);
+    const idClaims = idToken ? jwtClaims(idToken) : {};
+    const accountId = optionalString(tokens?.account_id) ?? accessClaims.accountId ?? idClaims.accountId;
+    if (!accountId)
+        return null;
+    return codexCredentialFromTokens({
+        accessToken,
+        ...(optionalString(tokens?.refresh_token)
+            ? { refreshToken: optionalString(tokens?.refresh_token) }
+            : {}),
+        accountId,
+    });
+}
+/** Prefer the credential whose access token remains valid for longer. */
+export function preferFresherCredential(left, right, now = Date.now()) {
+    if (!left)
+        return right;
+    if (!right)
+        return left;
+    const leftExpiry = left.expiresAt ?? Number.POSITIVE_INFINITY;
+    const rightExpiry = right.expiresAt ?? Number.POSITIVE_INFINITY;
+    const leftFresh = leftExpiry > now + 60_000;
+    const rightFresh = rightExpiry > now + 60_000;
+    if (leftFresh !== rightFresh)
+        return leftFresh ? left : right;
+    return leftExpiry >= rightExpiry ? left : right;
+}
+//# sourceMappingURL=harness-credentials.js.map

package/dist/integrations/providers/harness-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-credentials.js","sourceRoot":"","sources":["../../../src/integrations/providers/harness-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAIrD,MAAM,yBAAyB,GAAG,IAAI,GAAG,IAAI,CAAA;AAM7C,MAAM,UAAU,qBAAqB,CAAC,OAAe,OAAO,EAAE;IAC7D,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,IAAI,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YACvB,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACtB,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB;YAAE,OAAO,IAAI,CAAA;QAC1F,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/F,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,KAAiB,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,OAAO,EAAE;IAChE,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IACtD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO;QACN,WAAW;QACX,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC;QACjD,SAAS,EAAE,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC;QACjD,MAAM,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;KAC1C,CAAA;AACF,CAAC;AAOD,MAAM,UAAU,yBAAyB,CAAC,MAIzC;IACA,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAA;IACtD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;KAC1E,CAAA;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAC9C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO;YACN,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;YACvD,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAC3C,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACtC,OAAe,OAAO,EAAE,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;AAChE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB,CAAC,IAAY;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACxD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,MAAM,SAAS,GACd,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,YAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAA;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,yBAAyB,CAAC;QAChC,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC;YACxC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,SAAS;KACT,CAAC,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACtC,IAAc,EACd,KAAe,EACf,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,iBAAiB,CAAA;IAC/D,MAAM,SAAS,GAAG,UAAU,GAAG,GAAG,GAAG,MAAM,CAAA;IAC3C,MAAM,UAAU,GAAG,WAAW,GAAG,GAAG,GAAG,MAAM,CAAA;IAC7C,IAAI,SAAS,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;IAC7D,OAAO,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AAChD,CAAC"}

package/dist/integrations/providers/identity.d.ts

@@ -55,21 +55,14 @@ export declare const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
 export declare const SUBSCRIPTION_REDIRECT_PORT = 53692;
 export declare const REDIRECT_URI = "http://localhost:53692/callback";
 /**
- * Asked for at sign-in.
+ * The smallest source-verified scope set used by the current Claude harness.
  *
- * This is WIDER than namzu needs, and that is a knowing compromise rather
- * than an oversight. Least privilege would ask for an identity and the right
- * to run inference, and stop; this set also admits key creation and file
- * upload. It is the set the client identity above is exercised with by the
- * implementations that are known to work, and a narrower request cannot be
- * tested from here — nobody on this side of the flow holds a plan-backed
- * account to try it against. Guessing narrow fails in the worst place: the
- * sign-in succeeds, and inference is refused afterwards with an error about
- * scope that the operator cannot act on.
- *
- * So it is recorded as debt with the measurement that would settle it: sign
- * in with `user:profile user:inference` alone and send one message. If that
- * works, this shrinks to those two.
+ * Do not copy every scope a historical client happened to request. Unknown
+ * scopes make the authorization page reject the whole request before the
+ * operator can sign in, and key creation is not inference authority. These
+ * three are the live harness contract: identify the account, run inference,
+ * and retain the ability to create an API key from that harness when the
+ * account permits it.
  */
-export declare const OAUTH_SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+export declare const OAUTH_SCOPES = "org:create_api_key user:profile user:inference";
 //# sourceMappingURL=identity.d.ts.map

package/dist/integrations/providers/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,iDAAiD,CAAA;AAC7E,eAAO,MAAM,aAAa,sCAAsC,CAAA;AAEhE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,QAAQ,CAAA;AAC/C,eAAO,MAAM,YAAY,oCAA4D,CAAA;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,+GACoF,CAAA"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,eAAO,MAAM,eAAe,yCAAyC,CAAA;AACrE,eAAO,MAAM,eAAe,iDAAiD,CAAA;AAC7E,eAAO,MAAM,aAAa,sCAAsC,CAAA;AAEhE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,QAAQ,CAAA;AAC/C,eAAO,MAAM,YAAY,oCAA4D,CAAA;AAErF;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,mDAAmD,CAAA"}

package/dist/integrations/providers/identity.js

@@ -55,21 +55,14 @@ export const AUTHORIZE_URL = 'https://claude.ai/oauth/authorize';
 export const SUBSCRIPTION_REDIRECT_PORT = 53692;
 export const REDIRECT_URI = `http://localhost:${SUBSCRIPTION_REDIRECT_PORT}/callback`;
 /**
- * Asked for at sign-in.
+ * The smallest source-verified scope set used by the current Claude harness.
  *
- * This is WIDER than namzu needs, and that is a knowing compromise rather
- * than an oversight. Least privilege would ask for an identity and the right
- * to run inference, and stop; this set also admits key creation and file
- * upload. It is the set the client identity above is exercised with by the
- * implementations that are known to work, and a narrower request cannot be
- * tested from here — nobody on this side of the flow holds a plan-backed
- * account to try it against. Guessing narrow fails in the worst place: the
- * sign-in succeeds, and inference is refused afterwards with an error about
- * scope that the operator cannot act on.
- *
- * So it is recorded as debt with the measurement that would settle it: sign
- * in with `user:profile user:inference` alone and send one message. If that
- * works, this shrinks to those two.
+ * Do not copy every scope a historical client happened to request. Unknown
+ * scopes make the authorization page reject the whole request before the
+ * operator can sign in, and key creation is not inference authority. These
+ * three are the live harness contract: identify the account, run inference,
+ * and retain the ability to create an API key from that harness when the
+ * account permits it.
  */
-export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload';
+export const OAUTH_SCOPES = 'org:create_api_key user:profile user:inference';
 //# sourceMappingURL=identity.js.map

package/dist/integrations/providers/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,8CAA8C,CAAA;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAA;AAEhE,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,0BAA0B,WAAW,CAAA;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GACxB,4GAA4G,CAAA"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/integrations/providers/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAA;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,8CAA8C,CAAA;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,mCAAmC,CAAA;AAEhE,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,0BAA0B,WAAW,CAAA;AAErF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,gDAAgD,CAAA"}

package/dist/integrations/providers/index.d.ts

@@ -1,11 +1,14 @@
 export { type DetectedProvider, type DetectionSource, type DiscoverOptions, discoverProviders, findDetected, } from './discover.js';
+export { type CodexOAuthCredential, claudeCredentialsPath, codexCredentialsPath, readClaudeCredentialFile, readClaudeFileCredential, readCodexCredentialFile, readCodexFileCredential, } from './harness-credentials.js';
 export { type AgentOAuthCredential, isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.js';
-export { clearStoredSubscriptionCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
+export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, type CodexDeviceLogin, type CodexDeviceLoginOptions, type CodexDeviceLoginOutcome, } from './codex-device-login.js';
+export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, type StoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
+export { ensureFreshStoredCodexCredential, type StoredCodexRefreshOptions, } from './codex-oauth.js';
 export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
-export { type CredentialOrigin, ensureFreshAnthropicToken, type OAuthMetadata, readSubscriptionCredential, refreshAgentOAuthToken, } from './oauth.js';
+export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, type CredentialOrigin, ensureFreshAnthropicToken, type OAuthMetadata, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, type LoginOutcome, parsePastedInput, type SubscriptionLogin, type SubscriptionLoginOptions, subscriptionDetectedProvider, } from './subscription-login.js';
 export { type CapabilityDisagreement, chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, type MemberCapabilities, unresolvedMembers, } from './chain-capabilities.js';
 export { chainPositionName, type Preferences, PREFERENCES_FILE_VERSION, PreferencesError, preferencesPath, primaryProvider, type ProviderChoice, type ReadResult, readPreferences, writePreferences, } from './preferences.js';
-export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, type ProviderId, type ProviderRegistryEntry, type SdkProviderType, unsupportedProviderMessage, } from './registry.js';
-export { ensureRegistered, isRegistered, resolveChainCapabilities } from './register.js';
+export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, type ProviderId, type ProviderRegistryEntry, type SubscriptionProviderId, type SdkProviderType, unsupportedProviderMessage, } from './registry.js';
+export { ensureRegistered, isRegistered, resolveChainCapabilities, } from './register.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/integrations/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,GACtB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACN,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,EAChC,KAAK,yBAAyB,GAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,aAAa,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,KAAK,sBAAsB,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,KAAK,WAAW,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/index.js

@@ -1,11 +1,14 @@
 export { discoverProviders, findDetected, } from './discover.js';
+export { claudeCredentialsPath, codexCredentialsPath, readClaudeCredentialFile, readClaudeFileCredential, readCodexCredentialFile, readCodexFileCredential, } from './harness-credentials.js';
 export { isAnthropicOAuthToken, readAgentKeychainCredential, } from './keychain.js';
-export { clearStoredSubscriptionCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, writeStoredSubscriptionCredential, } from './credential-store.js';
+export { beginCodexDeviceLogin, CODEX_AUTH_ORIGIN, CODEX_OAUTH_CLIENT_ID, } from './codex-device-login.js';
+export { clearAllStoredCredentials, clearStoredSubscriptionCredential, clearStoredCodexCredential, CREDENTIALS_FILE_VERSION, CredentialStoreError, credentialsPath, readStoredSubscriptionCredential, readStoredCodexCredential, replaceStoredCodexCredential, writeStoredSubscriptionCredential, writeStoredCodexCredential, } from './credential-store.js';
+export { ensureFreshStoredCodexCredential, } from './codex-oauth.js';
 export { OAUTH_SCOPES, REDIRECT_URI } from './identity.js';
-export { ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, } from './oauth.js';
+export { CredentialPublicationError, CredentialRefreshRejectedError, CredentialWithdrawnError, ensureFreshAnthropicToken, readSubscriptionCredential, refreshAgentOAuthToken, sameOAuthCredential, } from './oauth.js';
 export { beginSubscriptionLogin, parsePastedInput, subscriptionDetectedProvider, } from './subscription-login.js';
 export { chainCapabilityDisagreements, describeAcceptedMismatch, describeCapabilityRefusal, unresolvedMembers, } from './chain-capabilities.js';
 export { chainPositionName, PREFERENCES_FILE_VERSION, PreferencesError, preferencesPath, primaryProvider, readPreferences, writePreferences, } from './preferences.js';
 export { ALL_PROVIDER_IDS, missingCredentialMessage, PROVIDER_REGISTRY, unsupportedProviderMessage, } from './registry.js';
-export { ensureRegistered, isRegistered, resolveChainCapabilities } from './register.js';
+export { ensureRegistered, isRegistered, resolveChainCapabilities, } from './register.js';
 //# sourceMappingURL=index.js.map

package/dist/integrations/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,iCAAiC,EACjC,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,iCAAiC,GACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAEN,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,GACtB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAIjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/integrations/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,iBAAiB,EACjB,YAAY,GACZ,MAAM,eAAe,CAAA;AACtB,OAAO,EAEN,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,GACvB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEN,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,GAIrB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,yBAAyB,EACzB,iCAAiC,EACjC,0BAA0B,EAC1B,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gCAAgC,EAChC,yBAAyB,EACzB,4BAA4B,EAE5B,iCAAiC,EACjC,0BAA0B,GAC1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACN,gCAAgC,GAEhC,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EACN,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EAExB,yBAAyB,EAEzB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,GACnB,MAAM,YAAY,CAAA;AACnB,OAAO,EACN,sBAAsB,EAEtB,gBAAgB,EAGhB,4BAA4B,GAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAEN,4BAA4B,EAC5B,wBAAwB,EACxB,yBAAyB,EAEzB,iBAAiB,GACjB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EAEjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,eAAe,EAGf,eAAe,EACf,gBAAgB,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACN,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,EAKjB,0BAA0B,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,wBAAwB,GACxB,MAAM,eAAe,CAAA"}

package/dist/integrations/providers/keychain.d.ts

@@ -23,19 +23,6 @@ export interface AgentOAuthCredential {
     readonly scopes?: readonly string[];
 }
 export declare function readAgentKeychainCredential(): AgentOAuthCredential | null;
-/**
- * Persist a refreshed OAuth credential back into the same Keychain entry so
- * the new access token survives across launches and the other CLI stays in
- * sync. The full envelope is re-read and merged (only the OAuth sub-fields
- * change) so any extra keys it stores are preserved. Non-throwing:
- * returns `false` (not-darwin, no entry, missing account, write denied) and
- * the caller falls back to using the refreshed token only in memory.
- *
- * Note: `security` takes the secret as an argv (`-w`), so it is briefly
- * visible to `ps` — acceptable for a local dev CLI updating a credential that
- * already lives on this machine.
- */
-export declare function writeAgentKeychainCredential(cred: AgentOAuthCredential): boolean;
 /**
  * Detect whether a credential value is an OAuth-style token
  * (must be sent via `Authorization: Bearer`) vs a console API key (sent

package/dist/integrations/providers/keychain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,4BAA4B,CAAA;AAEzD,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,wBAAgB,2BAA2B,IAAI,oBAAoB,GAAG,IAAI,CAmCzE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAiDhF;AAiBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM5D"}
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,4BAA4B,CAAA;AAEzD,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,wBAAgB,2BAA2B,IAAI,oBAAoB,GAAG,IAAI,CAmCzE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM5D"}

package/dist/integrations/providers/keychain.js

@@ -59,82 +59,6 @@ export function readAgentKeychainCredential() {
             : undefined,
     };
 }
-/**
- * Persist a refreshed OAuth credential back into the same Keychain entry so
- * the new access token survives across launches and the other CLI stays in
- * sync. The full envelope is re-read and merged (only the OAuth sub-fields
- * change) so any extra keys it stores are preserved. Non-throwing:
- * returns `false` (not-darwin, no entry, missing account, write denied) and
- * the caller falls back to using the refreshed token only in memory.
- *
- * Note: `security` takes the secret as an argv (`-w`), so it is briefly
- * visible to `ps` — acceptable for a local dev CLI updating a credential that
- * already lives on this machine.
- */
-export function writeAgentKeychainCredential(cred) {
-    if (platform() !== 'darwin')
-        return false;
-    // `add-generic-password -U` matches an existing item by service + account,
-    // so we must reuse the original account or we'd create a duplicate entry.
-    const account = readKeychainAccount();
-    if (!account)
-        return false;
-    let envelope = {};
-    try {
-        const raw = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {
-            encoding: 'utf8',
-            timeout: 5_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        }).trim();
-        const parsed = JSON.parse(raw);
-        if (typeof parsed === 'object' && parsed !== null)
-            envelope = parsed;
-    }
-    catch {
-        // Fall back to a fresh envelope below.
-    }
-    const prev = typeof envelope.claudeAiOauth === 'object' && envelope.claudeAiOauth !== null
-        ? envelope.claudeAiOauth
-        : {};
-    envelope.claudeAiOauth = {
-        ...prev,
-        accessToken: cred.accessToken,
-        ...(cred.refreshToken ? { refreshToken: cred.refreshToken } : {}),
-        ...(cred.expiresAt ? { expiresAt: cred.expiresAt } : {}),
-        ...(cred.scopes ? { scopes: cred.scopes } : {}),
-    };
-    try {
-        execFileSync('security', [
-            'add-generic-password',
-            '-U',
-            '-s',
-            KEYCHAIN_SERVICE,
-            '-a',
-            account,
-            '-w',
-            JSON.stringify(envelope),
-        ], { timeout: 5_000, stdio: ['ignore', 'ignore', 'ignore'] });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** Read the account (`acct`) of the Keychain entry, for updates. */
-function readKeychainAccount() {
-    try {
-        const out = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE], {
-            encoding: 'utf8',
-            timeout: 5_000,
-            stdio: ['ignore', 'pipe', 'ignore'],
-        });
-        const m = out.match(/"acct"<blob>="((?:[^"\\]|\\.)*)"/);
-        return m?.[1] ?? null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Detect whether a credential value is an OAuth-style token
  * (must be sent via `Authorization: Bearer`) vs a console API key (sent

package/dist/integrations/providers/keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AASzD,MAAM,UAAU,2BAA2B;IAC1C,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAExC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAsC,CAAC,aAAa,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACrF,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,CAAC,CAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YACjE,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACtE,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACzC,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAA;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,IAAI,QAAQ,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YAC7F,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;QACT,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,QAAQ,GAAG,MAAiC,CAAA;IAChG,CAAC;IAAC,MAAM,CAAC;QACR,uCAAuC;IACxC,CAAC;IACD,MAAM,IAAI,GACT,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI;QAC5E,CAAC,CAAE,QAAQ,CAAC,aAAyC;QACrD,CAAC,CAAC,EAAE,CAAA;IACN,QAAQ,CAAC,aAAa,GAAG;QACxB,GAAG,IAAI;QACP,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAA;IACD,IAAI,CAAC;QACJ,YAAY,CACX,UAAU,EACV;YACC,sBAAsB;YACtB,IAAI;YACJ,IAAI;YACJ,gBAAgB;YAChB,IAAI;YACJ,OAAO;YACP,IAAI;YACJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;SACxB,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACzD,CAAA;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB;IAC3B,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACvD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,kBAAkB;IACnE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;IACpE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,MAAM;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,8CAA8C;IACvF,OAAO,KAAK,CAAA;AACb,CAAC"}
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/integrations/providers/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAElC,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AASzD,MAAM,UAAU,2BAA2B;IAC1C,IAAI,QAAQ,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAExC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACvF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACnC,CAAC,CAAC,IAAI,EAAE,CAAA;IACV,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,GAAG,GAAI,MAAsC,CAAC,aAAa,CAAA;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,OAAO;QACN,WAAW;QACX,YAAY,EAAE,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;QACrF,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,CAAC,CAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAc;YACjE,CAAC,CAAC,SAAS;KACZ,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA,CAAC,kBAAkB;IACnE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;IACpE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,MAAM;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,8CAA8C;IACvF,OAAO,KAAK,CAAA;AACb,CAAC"}

package/dist/integrations/providers/oauth.d.ts

@@ -7,27 +7,29 @@
  * stale token before the session starts instead of surfacing it as an
  * authentication error.
  *
- * Non-throwing: any failure (no refresh token, network down, endpoint error)
- * returns the existing token unchanged — at worst the caller hits the same
- * 401 it would have hit anyway, never a crash.
+ * Best-effort for transient refresh failures: no refresh token, a network
+ * failure, an ordinary endpoint refusal or the private deadline all return the
+ * existing token. `invalid_grant` is different: the authorization grant is no
+ * longer usable, so sending the expired access token or retrying the same
+ * refresh on every turn cannot recover. It is a typed refusal. Caller
+ * cancellation also escapes with its exact cause.
  *
  * ## Where a refreshed token is written back
  *
  * There are two places a subscription credential can live and they are not
  * interchangeable, so `origin` says which one this credential came from and
- * the refreshed value goes back to the same place:
+ * therefore which publication rule applies:
  *
  *  - `'stored'` — namzu's own store, written by the login flow, present on
- *    every platform.
+ *    every platform. A refresh replaces only the exact credential it used.
  *  - `'keychain'` — a co-installed tool's macOS entry, which namzu reads but
- *    does not own.
+ *    does not own. A refresh is session-local and never writes that entry.
  *
  * `origin` is optional and defaults to `'keychain'` because that is the only
- * source that existed when this file was written, and a caller compiled
- * against the old shape must keep behaving as it did. Every namzu-owned
- * caller passes it explicitly; a credential that came from the login flow and
- * was written back to the Keychain would be a no-op off macOS, leaving the
- * real store holding a token that is refreshed again on every launch.
+ * source that existed when this file was written. Every namzu-owned caller
+ * passes it explicitly; a credential from the login flow misclassified as
+ * Keychain-origin would remain stale on disk and refresh again on every
+ * launch.
  */
 import { type AgentOAuthCredential } from './keychain.js';
 /**
@@ -49,20 +51,47 @@ import { type AgentOAuthCredential } from './keychain.js';
  * at detection; everything after that is told, not asked.
  */
 export declare function readSubscriptionCredential(origin: CredentialOrigin): AgentOAuthCredential | null;
-/** Which store a subscription credential came from, and goes back to. */
-export type CredentialOrigin = 'stored' | 'keychain';
+/** Which store a subscription credential came from and therefore who owns publication. */
+export type CredentialOrigin = 'stored' | 'keychain' | 'claude-file';
 export interface OAuthMetadata {
     readonly refreshToken?: string;
     readonly expiresAt?: number;
+    readonly scopes?: readonly string[];
     /** Defaults to `'keychain'` — see the note at the top of this file. */
     readonly origin?: CredentialOrigin;
 }
+/** The credential that authorized a refresh was removed before publication. */
+export declare class CredentialWithdrawnError extends Error {
+    readonly name = "CredentialWithdrawnError";
+    constructor(message?: string);
+}
+/** The store could not prove whether the refresh still owned publication. */
+export declare class CredentialPublicationError extends Error {
+    readonly name = "CredentialPublicationError";
+    constructor(options?: ErrorOptions);
+}
+/** The authorization server says this exact refresh grant cannot be used again. */
+export declare class CredentialRefreshRejectedError extends Error {
+    readonly name = "CredentialRefreshRejectedError";
+    readonly code: "invalid_grant";
+    constructor();
+}
 /**
  * Return a non-expired access token, refreshing first if the current one is
  * lapsed/about-to-lapse and a refresh token is available. On a successful
- * refresh the new credential is persisted back to its own store (best-effort).
+ * refresh a Namzu-owned credential is conditionally persisted. A borrowed
+ * Keychain credential is used only in memory because its owner cannot
+ * participate in our conditional-write boundary.
+ */
+export declare function ensureFreshAnthropicToken(accessToken: string, oauth: OAuthMetadata, signal?: AbortSignal): Promise<string>;
+/** Exact credential identity used by refresh publication and the live-session refusal cache. */
+export declare function sameOAuthCredential(left: AgentOAuthCredential, right: AgentOAuthCredential): boolean;
+/**
+ * Exchange a refresh token for a new credential.
+ *
+ * Transient/unclassified failures return `null`. A standards-defined
+ * `400 invalid_grant` throws {@link CredentialRefreshRejectedError}; retrying
+ * the same grant is not recovery.
  */
-export declare function ensureFreshAnthropicToken(accessToken: string, oauth: OAuthMetadata): Promise<string>;
-/** Exchange a refresh token for a new credential, or `null` on any failure. */
-export declare function refreshAgentOAuthToken(refreshToken: string): Promise<AgentOAuthCredential | null>;
+export declare function refreshAgentOAuthToken(refreshToken: string, signal?: AbortSignal): Promise<AgentOAuthCredential | null>;
 //# sourceMappingURL=oauth.d.ts.map

package/dist/integrations/providers/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAWH,OAAO,EACN,KAAK,oBAAoB,EAGzB,MAAM,eAAe,CAAA;AAKtB;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAEhG;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAClC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,GAClB,OAAO,CAAC,MAAM,CAAC,CASjB;AAgDD,+EAA+E;AAC/E,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA2BtC"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAYH,OAAO,EAAE,KAAK,oBAAoB,EAA+B,MAAM,eAAe,CAAA;AAsCtF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,GAAG,IAAI,CAGhG;AAED,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,aAAa,CAAA;AAEpE,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAClC;AAED,+EAA+E;AAC/E,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAkB,IAAI,8BAA6B;gBAEvC,OAAO,SAA0E;CAG7F;AAED,6EAA6E;AAC7E,qBAAa,0BAA2B,SAAQ,KAAK;IACpD,SAAkB,IAAI,gCAA+B;gBAEzC,OAAO,CAAC,EAAE,YAAY;CAGlC;AAED,mFAAmF;AACnF,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,SAAkB,IAAI,oCAAmC;IACzD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAS;;CAKxC;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AA8DD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GACzB,OAAO,CAcT;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA6DtC"}