@namzu/cli 34.1.1 → 36.0.0

package/dist/integrations/providers/oauth.js

@@ -1,302 +0,0 @@
-/**
- * OAuth token refresh for a subscription credential.
- *
- * A subscription access token is short-lived (~8h). When it lapses the
- * provider answers 401 and the agent stream dies. Refreshing proactively
- * against the token endpoint, using the long-lived refresh token, renews a
- * stale token before the session starts instead of surfacing it as an
- * authentication error.
- *
- * Best-effort for transient refresh failures: no refresh token, a network
- * failure, an ordinary endpoint refusal or the private deadline all return the
- * existing token. `invalid_grant` is different: the authorization grant is no
- * longer usable, so sending the expired access token or retrying the same
- * refresh on every turn cannot recover. It is a typed refusal. Caller
- * cancellation also escapes with its exact cause.
- *
- * ## Where a refreshed token is written back
- *
- * There are three places a subscription credential can live and they are not
- * interchangeable, so `origin` says which one this credential came from and
- * therefore which publication rule applies:
- *
- *  - `'stored'` — namzu's own store, written by the login flow, present on
- *    every platform. A refresh replaces only the exact credential it used.
- *  - `'keychain'` — a co-installed tool's macOS entry, which namzu reads but
- *    does not own. A refresh is session-local and never writes that entry.
- *  - `'claude-file'` — Claude's device-session file. A rotating refresh grant
- *    must publish its successor back to the exact admitted file or it would
- *    log the owner out, so publication preserves Claude's full envelope.
- *
- * `origin` is optional and defaults to `'keychain'` because that is the only
- * source that existed when this file was written. Every namzu-owned caller
- * passes it explicitly; a credential from the login flow misclassified as
- * Keychain-origin would remain stale on disk and refresh again on every
- * launch.
- */
-import { buildProbeContext, probe } from '@namzu/sdk';
-import { SUBSCRIPTION_CREDENTIAL_REF } from './credential-provider.js';
-import { credentialsPath, readStoredSubscriptionCredential, replaceStoredSubscriptionCredential, } from './credential-store.js';
-import { readClaudeCredentialFile, replaceClaudeCredentialFile } from './harness-credentials.js';
-import { OAUTH_CLIENT_ID, OAUTH_SCOPES, OAUTH_TOKEN_URL } from './identity.js';
-import { readAgentKeychainCredential } from './keychain.js';
-/** Refresh a few seconds early so an about-to-expire token isn't used. */
-const EXPIRY_SKEW_MS = 60_000;
-/** One refresh request, including its response body, may hold a caller this long. */
-const REFRESH_DEADLINE_MS = 30_000;
-class RefreshDeadlineError extends Error {
-    constructor() {
-        super(`The token endpoint did not answer within ${REFRESH_DEADLINE_MS}ms.`);
-        this.name = 'RefreshDeadlineError';
-    }
-}
-/**
- * Settle independently of a foreign promise that may ignore its signal.
- *
- * Passing `signal` to fetch is cooperative. This race is the host-owned
- * boundary that makes cancellation and the refresh deadline true even for a
- * custom transport or response body that never settles.
- */
-async function awaitWithSignal(operation, signal) {
-    signal.throwIfAborted();
-    let rejectAbort = () => { };
-    const aborted = new Promise((_resolve, reject) => {
-        rejectAbort = reject;
-    });
-    const onAbort = () => rejectAbort(signal.reason);
-    signal.addEventListener('abort', onAbort, { once: true });
-    if (signal.aborted)
-        onAbort();
-    try {
-        return await Promise.race([operation, aborted]);
-    }
-    finally {
-        signal.removeEventListener('abort', onAbort);
-    }
-}
-/**
- * Re-read the current credential from the store it lives in.
- *
- * The session layer calls this between turns because another process may have
- * rotated the token since launch. Pairing it with `origin` is what stops a
- * long-running session reading one store and writing the other.
- *
- * **It takes an origin rather than searching, and that is the point.** A
- * version that tried both and returned the first hit would look more helpful
- * and would silently break the pairing: a session that started on namzu's own
- * credential would, on the machine where both exist, quietly begin refreshing
- * a co-installed tool's credential instead — writing namzu's refreshed token
- * into somebody else's envelope, and leaving the store the operator actually
- * signed into holding a token that lapses again on every launch.
- *
- * One credential, one store, for its whole life. `discover.ts` decides which
- * at detection; everything after that is told, not asked.
- */
-export function readSubscriptionCredential(origin, sourcePath) {
-    if (origin === 'stored')
-        return readStoredSubscriptionCredential();
-    if (origin === 'claude-file') {
-        return sourcePath ? readClaudeCredentialFile(sourcePath) : null;
-    }
-    return readAgentKeychainCredential();
-}
-/** The credential that authorized a refresh was removed before publication. */
-export class CredentialWithdrawnError extends Error {
-    name = 'CredentialWithdrawnError';
-    constructor(message = 'The subscription credential was removed while it was being refreshed.') {
-        super(message);
-    }
-}
-/** The store could not prove whether the refresh still owned publication. */
-export class CredentialPublicationError extends Error {
-    name = 'CredentialPublicationError';
-    constructor(options) {
-        super('The refreshed subscription credential could not be published safely.', options);
-    }
-}
-/** The authorization server says this exact refresh grant cannot be used again. */
-export class CredentialRefreshRejectedError extends Error {
-    name = 'CredentialRefreshRejectedError';
-    code = 'invalid_grant';
-    constructor() {
-        super('The subscription refresh token is no longer usable. Sign in again with /login.');
-    }
-}
-/**
- * Return a non-expired access token, refreshing first if the current one is
- * lapsed/about-to-lapse and a refresh token is available. On a successful
- * refresh a Namzu-owned credential is conditionally persisted. A borrowed
- * Keychain credential is used only in memory because its owner cannot
- * participate in our conditional-write boundary.
- */
-export async function ensureFreshAnthropicToken(accessToken, oauth, signal) {
-    signal?.throwIfAborted();
-    const fresh = oauth.expiresAt === undefined || oauth.expiresAt - Date.now() > EXPIRY_SKEW_MS;
-    if (fresh)
-        return accessToken;
-    if (!oauth.refreshToken)
-        return accessToken;
-    const refreshed = await refreshAgentOAuthToken(oauth.refreshToken, signal, oauth.scopes);
-    if (!refreshed)
-        return accessToken;
-    // The response body was the final foreign await. Re-check immediately at
-    // the durable boundary so a stopped run cannot rotate a credential later.
-    signal?.throwIfAborted();
-    const expected = {
-        accessToken,
-        refreshToken: oauth.refreshToken,
-        expiresAt: oauth.expiresAt,
-        scopes: oauth.scopes,
-    };
-    return publishRefreshed(expected, refreshed, oauth.origin ?? 'keychain', oauth.sourcePath)
-        .accessToken;
-}
-/**
- * Say that a credential turned over, without saying what it turned into.
- *
- * Through the probe registry that already carries `vault_lookup`, because a
- * second bus means a subscriber that sees lookups and not rotations, or the
- * reverse, depending on which one it happened to find.
- */
-function announceRotation(replaced) {
-    probe.dispatch({
-        type: 'vault_credential_changed',
-        kind: replaced ? 'rotated' : 'set',
-        source: credentialsPath(),
-        // The NAME. This event exists to be logged and retained, which is
-        // exactly what the value must not be.
-        ref: SUBSCRIPTION_CREDENTIAL_REF,
-    }, buildProbeContext());
-}
-function publishRefreshed(expected, refreshed, origin, sourcePath) {
-    if (origin === 'keychain') {
-        // This entry belongs to another product, whose writer cannot participate
-        // in a Namzu lock or conditional update. Never overwrite it. A rotation
-        // that landed while the request was pending wins for this session; when it
-        // is unchanged, the refreshed token remains session-local.
-        const current = readAgentKeychainCredential();
-        if (!current)
-            throw new CredentialWithdrawnError();
-        return !sameOAuthCredential(current, expected) ? current : refreshed;
-    }
-    if (origin === 'claude-file') {
-        if (!sourcePath)
-            throw new CredentialPublicationError();
-        let result;
-        try {
-            result = replaceClaudeCredentialFile(sourcePath, expected, refreshed);
-        }
-        catch (error) {
-            throw new CredentialPublicationError({ cause: error });
-        }
-        if (!result.replaced) {
-            if (!result.current)
-                throw new CredentialWithdrawnError();
-            return result.current;
-        }
-        return refreshed;
-    }
-    let result;
-    try {
-        result = replaceStoredSubscriptionCredential(expected, refreshed);
-    }
-    catch (error) {
-        // A busy lock may be an external rotation in progress. Falling back to
-        // A' here would turn a failed CAS into permission to ignore its winner.
-        throw new CredentialPublicationError({ cause: error });
-    }
-    if (!result.replaced) {
-        if (!result.current)
-            throw new CredentialWithdrawnError();
-        return result.current;
-    }
-    // Announced only after the store proved the file private. A rotation event
-    // for a write that refused would have a reader chasing a turn-over that
-    // never happened. Probe failure is observability failure, not permission to
-    // undo a credential that is already durably committed.
-    try {
-        announceRotation(refreshed.accessToken !== undefined);
-    }
-    catch {
-        // The credential is already committed. Telemetry cannot roll it back.
-    }
-    return refreshed;
-}
-/** Exact credential identity used by refresh publication and the live-session refusal cache. */
-export function sameOAuthCredential(left, right) {
-    if (left.accessToken !== right.accessToken ||
-        left.refreshToken !== right.refreshToken ||
-        left.expiresAt !== right.expiresAt) {
-        return false;
-    }
-    const leftScopes = left.scopes ?? [];
-    const rightScopes = right.scopes ?? [];
-    return (leftScopes.length === rightScopes.length &&
-        leftScopes.every((scope, index) => scope === rightScopes[index]));
-}
-/**
- * Exchange a refresh token for a new credential.
- *
- * Transient/unclassified failures return `null`. A standards-defined
- * `400 invalid_grant` throws {@link CredentialRefreshRejectedError}; retrying
- * the same grant is not recovery.
- */
-export async function refreshAgentOAuthToken(refreshToken, signal, scopes = OAUTH_SCOPES.split(' ')) {
-    signal?.throwIfAborted();
-    const requestController = new AbortController();
-    const timeoutCause = new RefreshDeadlineError();
-    const onCallerAbort = () => requestController.abort(signal?.reason);
-    signal?.addEventListener('abort', onCallerAbort, { once: true });
-    if (signal?.aborted)
-        onCallerAbort();
-    const timer = setTimeout(() => requestController.abort(timeoutCause), REFRESH_DEADLINE_MS);
-    try {
-        const res = await awaitWithSignal(fetch(OAUTH_TOKEN_URL, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({
-                grant_type: 'refresh_token',
-                refresh_token: refreshToken,
-                client_id: OAUTH_CLIENT_ID,
-                scope: scopes.join(' '),
-            }),
-            signal: requestController.signal,
-        }), requestController.signal);
-        signal?.throwIfAborted();
-        if (!res.ok) {
-            if (res.status === 400) {
-                const failure = (await awaitWithSignal(res.json(), requestController.signal));
-                if (typeof failure?.error === 'string' && failure.error.toLowerCase() === 'invalid_grant') {
-                    throw new CredentialRefreshRejectedError();
-                }
-            }
-            return null;
-        }
-        const data = (await awaitWithSignal(res.json(), requestController.signal));
-        if (typeof data.access_token !== 'string' || data.access_token.length === 0)
-            return null;
-        return {
-            accessToken: data.access_token,
-            refreshToken: typeof data.refresh_token === 'string' ? data.refresh_token : refreshToken,
-            expiresAt: typeof data.expires_in === 'number' ? Date.now() + data.expires_in * 1_000 : undefined,
-            scopes: typeof data.scope === 'string' ? data.scope.split(' ').filter(Boolean) : [...scopes],
-        };
-    }
-    catch (error) {
-        if (error instanceof CredentialRefreshRejectedError)
-            throw error;
-        // A cooperative transport may replace the request cause with a generic
-        // AbortError. The fused controller is the first-cause latch: only a caller
-        // reason that actually won is allowed to escape as cancellation. A later
-        // caller abort cannot relabel the private deadline.
-        if (signal?.aborted && requestController.signal.reason === signal.reason) {
-            throw signal.reason;
-        }
-        return null;
-    }
-    finally {
-        clearTimeout(timer);
-        signal?.removeEventListener('abort', onCallerAbort);
-    }
-}
-//# sourceMappingURL=oauth.js.map

package/dist/integrations/providers/oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/integrations/providers/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,EACN,eAAe,EACf,gCAAgC,EAChC,mCAAmC,GACnC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAChG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EAA6B,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAEtF,0EAA0E;AAC1E,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B,qFAAqF;AACrF,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAElC,MAAM,oBAAqB,SAAQ,KAAK;IACvC;QACC,KAAK,CAAC,4CAA4C,mBAAmB,KAAK,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACnC,CAAC;CACD;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAI,SAAyB,EAAE,MAAmB;IAC/E,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,IAAI,WAAW,GAA8B,GAAG,EAAE,GAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,WAAW,GAAG,MAAM,CAAA;IACrB,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC7B,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAChD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,gCAAgC,EAAE,CAAA;IAClE,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChE,CAAC;IACD,OAAO,2BAA2B,EAAE,CAAA;AACrC,CAAC;AAeD,+EAA+E;AAC/E,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAChC,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAO,GAAG,uEAAuE;QAC5F,KAAK,CAAC,OAAO,CAAC,CAAA;IACf,CAAC;CACD;AAED,6EAA6E;AAC7E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAClC,IAAI,GAAG,4BAA4B,CAAA;IAErD,YAAY,OAAsB;QACjC,KAAK,CAAC,sEAAsE,EAAE,OAAO,CAAC,CAAA;IACvF,CAAC;CACD;AAED,mFAAmF;AACnF,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACtC,IAAI,GAAG,gCAAgC,CAAA;IAChD,IAAI,GAAG,eAAwB,CAAA;IAExC;QACC,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACxF,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,WAAmB,EACnB,KAAoB,EACpB,MAAoB;IAEpB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAA;IAC5F,IAAI,KAAK;QAAE,OAAO,WAAW,CAAA;IAC7B,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,WAAW,CAAA;IAE3C,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACxF,IAAI,CAAC,SAAS;QAAE,OAAO,WAAW,CAAA;IAClC,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,QAAQ,GAAyB;QACtC,WAAW;QACX,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;KACpB,CAAA;IACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;SACxF,WAAW,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,QAAiB;IAC1C,KAAK,CAAC,QAAQ,CACb;QACC,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QAClC,MAAM,EAAE,eAAe,EAAE;QACzB,kEAAkE;QAClE,sCAAsC;QACtC,GAAG,EAAE,2BAA2B;KAChC,EACD,iBAAiB,EAAE,CACnB,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,QAA8B,EAC9B,SAA+B,EAC/B,MAAwB,EACxB,UAAmB;IAEnB,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC3B,yEAAyE;QACzE,wEAAwE;QACxE,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAA;QAC7C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QAClD,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAA0B,EAAE,CAAA;QACvD,IAAI,MAAsD,CAAA;QAC1D,IAAI,CAAC;YACJ,MAAM,GAAG,2BAA2B,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;YACzD,OAAO,MAAM,CAAC,OAAO,CAAA;QACtB,CAAC;QACD,OAAO,SAAS,CAAA;IACjB,CAAC;IACD,IAAI,MAA8D,CAAA;IAClE,IAAI,CAAC;QACJ,MAAM,GAAG,mCAAmC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,IAAI,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAA;QACzD,OAAO,MAAM,CAAC,OAAO,CAAA;IACtB,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,CAAC;QACJ,gBAAgB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAClC,IAA0B,EAC1B,KAA2B;IAE3B,IACC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACxC,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EACjC,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAA;IACtC,OAAO,CACN,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAChE,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,YAAoB,EACpB,MAAoB,EACpB,SAA4B,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;IAEnD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAA;IAC/C,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC/C,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAChE,IAAI,MAAM,EAAE,OAAO;QAAE,aAAa,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAE1F,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,eAAe,CAChC,KAAK,CAAC,eAAe,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,eAAe;gBAC1B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACvB,CAAC;YACF,MAAM,EAAE,iBAAiB,CAAC,MAAM;SAChC,CAAC,EACF,iBAAiB,CAAC,MAAM,CACxB,CAAA;QACD,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAE3E,CAAA;gBACD,IAAI,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,eAAe,EAAE,CAAC;oBAC3F,MAAM,IAAI,8BAA8B,EAAE,CAAA;gBAC3C,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAKxE,CAAA;QACD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACxF,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;YACxF,SAAS,EACR,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS;YACvF,MAAM,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;SAC5F,CAAA;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,8BAA8B;YAAE,MAAM,KAAK,CAAA;QAChE,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,MAAM,EAAE,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1E,MAAM,MAAM,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IACpD,CAAC;AACF,CAAC"}

package/dist/integrations/providers/preferences.js

@@ -1,287 +0,0 @@
-/**
- * `~/.namzu/preferences.json` — the operator's provider chain.
- *
- * Schema (current = v3):
- *   {
- *     "version": 3,
- *     "providers": [                      // ordered; index 0 is the primary
- *       { "id": "anthropic", "model": "claude-opus-4-7" },
- *       { "id": "openai" }                // model omitted → the registry default
- *     ],
- *     "subagents": { "active": [...] }    // instances reserved for subagent dispatch
- *   }
- *
- * The chain is an ORDER the operator declares, replacing the single provider v2
- * held. It is deliberately a plain readable array in a file the operator owns:
- * the order has to be legible and editable without launching the TUI, which a
- * value only reachable through an interactive picker is not.
- *
- * `providers[0]` serves; the rest are fallen over to, in order, when it cannot.
- * The tail is still validated and reported ahead of any failure (see
- * `readPreferences` and the `providers.chain` doctor check), because a fallback
- * is invisible by construction — nothing exercises it until the primary is
- * already down, which is the worst moment to discover the key was never set.
- *
- * ## Versions
- *
- * v1 stored a peer instance as the default — a different primitive (subagent
- * dispatch, not primary chat). It is still REFUSED rather than migrated, because
- * mapping between the two semantics would surprise more than help.
- *
- * v2 stored a single `provider` + optional `model`. It IS migrated, on read, in
- * memory: one provider is a one-element chain, which is unambiguous, and the
- * distinction from v1 is exactly that. Migration does not rewrite the file — a
- * reader with a write side effect would rewrite `$HOME` on a `--help`. The next
- * `writePreferences` lands v3.
- *
- * Note the consequence: a v3 file read by an older namzu reports `needs-repick`
- * rather than silently losing the tail, which is the safe direction.
- */
-import { randomBytes } from 'node:crypto';
-import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { namzuHomePath } from '../state/home.js';
-import { PROVIDER_REGISTRY, unsupportedProviderMessage } from './registry.js';
-const FILE_MODE = 0o600;
-const DIR_MODE = 0o700;
-export const PREFERENCES_FILE_VERSION = 3;
-/**
- * How a member is named to the operator, by position.
- *
- * One function because three surfaces say it — validation, the doctor listing
- * and the capability refusal — and a chain member called `fallback #1` in one
- * message and `fallback 1` in the next reads as two different things.
- */
-export function chainPositionName(index) {
-    return index === 0 ? 'primary provider' : `fallback #${index}`;
-}
-export class PreferencesError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'PreferencesError';
-    }
-}
-/**
- * The member that actually runs.
- *
- * A helper rather than `prefs.providers[0]` at each call site: the chain is
- * guaranteed non-empty by validation, and every reader repeating an index
- * lookup plus a non-null assertion would be four places to get that wrong.
- */
-export function primaryProvider(prefs) {
-    // Optional-chained rather than indexed: a caller handing over an object of
-    // the old shape is a real case (a stale test fixture did exactly that), and
-    // a `TypeError: cannot read '0' of undefined` names neither the field nor
-    // the fix, while the error below names both.
-    const first = prefs.providers?.[0];
-    if (!first) {
-        // Unreachable through readPreferences/writePreferences, both of which
-        // refuse an empty chain. Reachable only from a hand-built object, and
-        // silently returning a placeholder there would put the caller on a
-        // provider nobody chose.
-        throw new PreferencesError('preferences.providers is empty — no provider to run');
-    }
-    return first;
-}
-export function preferencesPath(home) {
-    return join(namzuHomePath(home), 'preferences.json');
-}
-export function readPreferences(home) {
-    const path = preferencesPath(home);
-    let raw;
-    try {
-        raw = readFileSync(path, 'utf8');
-    }
-    catch (err) {
-        if (err.code === 'ENOENT')
-            return { status: 'missing' };
-        throw new PreferencesError(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (err) {
-        throw new PreferencesError(`${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (typeof parsed !== 'object' || parsed === null) {
-        throw new PreferencesError(`${path} top-level must be an object`);
-    }
-    const v = parsed;
-    if (v.version === 1) {
-        return {
-            status: 'needs-repick',
-            reason: 'preferences file uses an older schema (v1) — namzu now picks an LLM provider client directly. Please re-pick.',
-        };
-    }
-    if (v.version === 2) {
-        const migrated = migrateV2(parsed);
-        if (!migrated) {
-            throw new PreferencesError(`${path} has an unexpected shape for a v2 file`);
-        }
-        const invalid = describeInvalidChain(migrated.providers);
-        if (invalid)
-            return { status: 'needs-repick', reason: `${invalid} — please re-pick.` };
-        return { status: 'ok', prefs: migrated };
-    }
-    if (v.version !== PREFERENCES_FILE_VERSION) {
-        return {
-            status: 'needs-repick',
-            reason: `preferences file at unsupported version ${String(v.version)} — please re-pick.`,
-        };
-    }
-    if (!isPreferences(parsed)) {
-        throw new PreferencesError(`${path} has an unexpected shape`);
-    }
-    // Shape is right; the CONTENT may still name a provider that does not exist
-    // or repeat a member. Reported as `needs-repick` with the offending member
-    // named, not thrown: a bad chain is something the operator can fix by
-    // picking again, and it is the tail this is really for — an unusable
-    // fallback that only surfaces the day the primary goes down is the failure
-    // this check exists to prevent.
-    const invalid = describeInvalidChain(parsed.providers);
-    if (invalid)
-        return { status: 'needs-repick', reason: `${invalid} — please re-pick.` };
-    return { status: 'ok', prefs: parsed };
-}
-export function writePreferences(prefs, home) {
-    if (prefs.version !== PREFERENCES_FILE_VERSION) {
-        throw new PreferencesError(`unsupported preferences version: ${String(prefs.version)} (expected ${PREFERENCES_FILE_VERSION})`);
-    }
-    if (!Array.isArray(prefs.providers) || prefs.providers.length === 0) {
-        throw new PreferencesError('preferences.providers must list at least one provider');
-    }
-    const invalid = describeInvalidChain(prefs.providers);
-    if (invalid)
-        throw new PreferencesError(invalid);
-    const path = preferencesPath(home);
-    mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
-    const body = `${JSON.stringify(prefs, null, 2)}\n`;
-    const tmp = `${path}.tmp.${process.pid}.${randomBytes(4).toString('hex')}`;
-    writeFileSync(tmp, body, { mode: FILE_MODE });
-    chmodSync(tmp, FILE_MODE);
-    renameSync(tmp, path);
-}
-/**
- * A v2 file as a one-element chain, or null if it was not a well-formed v2.
- *
- * `model` is carried only when present, so a v2 file that never pinned a model
- * does not gain one.
- */
-function migrateV2(value) {
-    const v = value;
-    if (typeof v.provider !== 'string' || v.provider.length === 0)
-        return null;
-    if (v.model !== undefined && typeof v.model !== 'string')
-        return null;
-    if (!isSubagents(v.subagents))
-        return null;
-    const member = {
-        id: v.provider,
-        ...(typeof v.model === 'string' ? { model: v.model } : {}),
-    };
-    return {
-        version: PREFERENCES_FILE_VERSION,
-        providers: [member],
-        ...(v.subagents !== undefined
-            ? { subagents: v.subagents }
-            : {}),
-    };
-}
-/**
- * Why this chain is unusable, or null if it is fine.
- *
- * Every member is checked, not only the head. A chain exists to be fallen back
- * to, so a tail member naming a provider that does not exist is precisely as
- * broken as a bad head — it is just broken later, on the worst day.
- */
-function describeInvalidChain(members) {
-    if (members.length === 0) {
-        return 'preferences lists no providers';
-    }
-    const seen = new Set();
-    for (const [index, member] of members.entries()) {
-        const position = chainPositionName(index);
-        if (!(member.id in PROVIDER_REGISTRY)) {
-            return `${position} "${member.id}" is not a provider namzu knows (known: ${Object.keys(PROVIDER_REGISTRY).join(', ')})`;
-        }
-        // Unbuildable PRIMARY only, and the asymmetry with the check above is
-        // deliberate rather than an oversight about the tail.
-        //
-        // An unknown id breaks a chain wherever it sits, so that one is checked
-        // everywhere. An unbuildable one does not: a fallback naming it is
-        // dropped from the chain at launch with a notice, and the session runs
-        // on the primary the operator has. Refusing the whole file for it would
-        // take a working session away over a spare — the opposite of the trade
-        // the notice already makes.
-        //
-        // A primary is the other case entirely, and refusing HERE rather than at
-        // construction is the whole point. Read time returns `needs-repick`,
-        // which puts the operator in the picker with this sentence printed above
-        // it. Construction time returns an empty session, which sets the
-        // `unhealthy` phase — a disabled composer where `/model` cannot be typed
-        // — so the old refusal told an operator to pick another provider on the
-        // one screen that will not let them. A refusal whose advice cannot be
-        // followed is not a refusal; it is a dead end wearing one.
-        if (index === 0 && !PROVIDER_REGISTRY[member.id].constructible) {
-            return unsupportedProviderMessage(member.id);
-        }
-        // Compared as the pair the operator WROTE, not against the resolved
-        // default model. Resolving would make a file that was valid yesterday
-        // invalid the day a registry default changes, which is a config that
-        // breaks on upgrade. Two entries for one provider with different models
-        // stay legitimate: falling back from a large model to a small one on the
-        // same provider is a real chain.
-        const key = JSON.stringify([member.id, member.model ?? null]);
-        if (seen.has(key)) {
-            const shown = member.model ? `${member.id} (${member.model})` : member.id;
-            return `${position} repeats "${shown}", which is already earlier in the chain — a provider cannot be its own fallback`;
-        }
-        seen.add(key);
-    }
-    return null;
-}
-function isSubagents(value) {
-    if (value === undefined)
-        return true;
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const sa = value;
-    if (!Array.isArray(sa.active))
-        return false;
-    for (const item of sa.active) {
-        if (typeof item !== 'string')
-            return false;
-    }
-    return true;
-}
-function isProviderChoice(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const v = value;
-    if (typeof v.id !== 'string' || v.id.length === 0)
-        return false;
-    if (v.model !== undefined && typeof v.model !== 'string')
-        return false;
-    return true;
-}
-function isPreferences(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const v = value;
-    if (v.version !== PREFERENCES_FILE_VERSION)
-        return false;
-    if (!Array.isArray(v.providers))
-        return false;
-    for (const member of v.providers) {
-        if (!isProviderChoice(member))
-            return false;
-    }
-    if (v.allowCapabilityMismatch !== undefined && typeof v.allowCapabilityMismatch !== 'boolean') {
-        return false;
-    }
-    if (!isSubagents(v.subagents))
-        return false;
-    return true;
-}
-//# sourceMappingURL=preferences.js.map

package/dist/integrations/providers/preferences.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"preferences.js","sourceRoot":"","sources":["../../../src/integrations/providers/preferences.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAmB,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAE9F,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAA;AAyClD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAA;AAC/D,CAAC;AAOD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAC/B,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IACjD,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAA;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,yBAAyB;QACzB,MAAM,IAAI,gBAAgB,CAAC,qDAAqD,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC5C,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAa;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAClF,MAAM,IAAI,gBAAgB,CACzB,kBAAkB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAA;IACF,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,gBAAgB,CACzB,GAAG,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAA;IACF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,CAAC,GAAG,MAA+B,CAAA;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACN,MAAM,EAAE,cAAc;YACtB,MAAM,EACL,+GAA+G;SAChH,CAAA;IACF,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAA;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QACxD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,oBAAoB,EAAE,CAAA;QACtF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;IACzC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAC5C,OAAO;YACN,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,2CAA2C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB;SACxF,CAAA;IACF,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAA;IAC9D,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,gCAAgC;IAChC,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACtD,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,oBAAoB,EAAE,CAAA;IACtF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAkB,EAAE,IAAa;IACjE,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QAChD,MAAM,IAAI,gBAAgB,CACzB,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,wBAAwB,GAAG,CAClG,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,gBAAgB,CAAC,uDAAuD,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACrD,IAAI,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAEhD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAClC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;IAClD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1E,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAC7C,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACzB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,KAAc;IAChC,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACrE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,MAAM,GAAmB;QAC9B,EAAE,EAAE,CAAC,CAAC,QAAsB;QAC5B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAA;IACD,OAAO;QACN,OAAO,EAAE,wBAAwB;QACjC,SAAS,EAAE,CAAC,MAAM,CAAC;QACnB,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAmD,EAAE;YACtE,CAAC,CAAC,EAAE,CAAC;KACN,CAAA;AACF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,OAAkC;IAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,gCAAgC,CAAA;IACxC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,iBAAiB,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,QAAQ,KAAK,MAAM,CAAC,EAAE,2CAA2C,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACxH,CAAC;QACD,sEAAsE;QACtE,sDAAsD;QACtD,EAAE;QACF,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,4BAA4B;QAC5B,EAAE;QACF,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;YAChE,OAAO,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAA;QAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAA;YACzE,OAAO,GAAG,QAAQ,aAAa,KAAK,kFAAkF,CAAA;QACvH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,EAAE,GAAG,KAAgC,CAAA;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/D,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACtE,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,CAAC,CAAC,OAAO,KAAK,wBAAwB;QAAE,OAAO,KAAK,CAAA;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7C,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,uBAAuB,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,IAAI,CAAA;AACZ,CAAC"}