@quickchatai/pi-quickreview 0.0.0-stage → 1.2.0

package/dist/src/engine/auth.d.ts

@@ -0,0 +1,214 @@
+import type { CredentialStore } from "@earendil-works/pi-ai";
+/** What a copied OAuth credential carries instead of the real refresh token. */
+export declare const DISABLED_REFRESH = "bench-refresh-disabled";
+/** pi refreshes an OAuth token with less than this left (pi-ai auth/resolve.js
+ * DEFAULT_OAUTH_MINIMUM_VALIDITY_MS), so a run that ends inside it would ask a
+ * refresher it does not have. The engine's preflight keeps clear of it. */
+export declare const PI_REFRESH_MARGIN_MS: number;
+export type AuthErrorCode = "missing" | "expiring" | "refresh-refused" | "rejected";
+/** Base of every auth failure the engine raises: `code` is what a caller
+ * branches on (authwatch's raise, a route's exit status), the message is for a
+ * person. */
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    constructor(code: AuthErrorCode, message: string);
+}
+/** The login was refused before work started: no login (`code` "missing"), or a
+ * token that would expire inside the work window ("expiring"). */
+export declare class AuthExpiring extends AuthError {
+    readonly provider: string | null;
+    readonly expiresAt: number | null;
+    constructor(message: string, detail?: {
+        code?: "missing" | "expiring";
+        provider?: string | null;
+        expiresAt?: number | null;
+    });
+}
+/** Something asked the borrowed login to change. It never may: only the
+ * owner's pi `/login` refreshes. */
+export declare class AuthRefreshRefused extends AuthError {
+    constructor(operation: string, providerId: string);
+}
+/** A provider rejected the token mid-run (the signature authwatch watches for).
+ * `message` is the provider's own text. */
+export declare class AuthRejected extends AuthError {
+    constructor(message: string);
+}
+/** The typed error for a provider's failure text, or undefined when the text is
+ * not an auth failure. One signature, shared with authwatch (PI_AUTH_ERROR_RE). */
+export declare function classifyAuthFailure(message: string): AuthRejected | undefined;
+/** How a borrower waits out a file it cannot parse. */
+export interface ReadRetry {
+    tries?: number;
+    delayMs?: number;
+}
+/**
+ * The owner's `auth.json` as text that parses, taking no lock. Every write by
+ * the refresher is an atomic rename (src/loginrefresh/atomic.ts), so a borrower
+ * reads the old file or the new one, whole. The one file that may not parse is
+ * one a login is rewriting in place (the pi `/login` under the entrypoint's
+ * login mode, which the refresher pauses for): that read is retried, a few
+ * times, and then fails with the parse error.
+ */
+export declare function readOwnerAuth(src: string, retry?: ReadRetry): string;
+/**
+ * The sandbox copy of a pi `auth.json`, as text: every OAuth entry's refresh
+ * token replaced, everything else kept. Returns the earliest OAuth expiry, and
+ * the provider it belongs to, so the caller can refuse work that would outlive it.
+ */
+export declare function authCopyFrom(raw: string, 
+/** Keep only these providers' entries: the copy, and its expiry check,
+ * then cover exactly what the run uses. Omitted: every entry. */
+providers?: readonly string[]): {
+    json: string;
+    expiresAt: number | null;
+    provider: string | null;
+};
+/** A login's providers, each with its credential type and (OAuth) expiry —
+ * never a token. */
+export type LoginSummary = Record<string, {
+    type: string;
+    expires: number | null;
+}>;
+export declare function loginSummary(raw: string): LoginSummary;
+/** The words a refusal is made of — each borrower names its own fix. */
+export interface AuthCopyWords {
+    /** No `auth.json` at `src`. */
+    missing: (src: string) => string;
+    /** The earliest OAuth token (`provider`'s) expires at `expiresAt`, inside `needMs`. */
+    expiring: (o: {
+        provider: string | null;
+        expiresAt: number;
+        needMs: number;
+    }) => string;
+}
+/** The engine host's own refusals. */
+export declare const ENGINE_AUTH_WORDS: AuthCopyWords;
+/** The benchmark's refusals: its fixes are the login volume and the key route. */
+export declare const BENCH_AUTH_WORDS: AuthCopyWords;
+/**
+ * The preflight: throw `AuthExpiring` when the earliest OAuth token expires
+ * inside `needMs` (plus `marginMs`, the stretch at the end of its life in which
+ * pi would try to refresh it). A login with no OAuth entry never expires.
+ */
+export declare function checkAuth(copy: {
+    expiresAt: number | null;
+    provider: string | null;
+}, o: {
+    needMs: number;
+    now?: () => number;
+    marginMs?: number;
+    words?: AuthCopyWords;
+}): void;
+/** The store for the headless key route: no login at all, nothing to refresh,
+ * nothing written (pi would otherwise create an empty `auth.json` in the agent
+ * dir). Keys arrive through `setRuntimeApiKey`, into the runtime's memory. */
+export declare function keyOnlyCredentials(): CredentialStore;
+/** The owner's login, read once from `srcDir/auth.json`, blanked and checked. */
+export interface EngineAuth {
+    /** The credential store for `PiHostOptions.credentials`. */
+    credentials: CredentialStore;
+    /** The earliest OAuth expiry, or null when the login has no OAuth entry. */
+    expiresAt: number | null;
+    provider: string | null;
+}
+/**
+ * Build the engine's credentials from the owner's agent dir `srcDir` (read
+ * only: nothing is written there or anywhere). Throws `AuthExpiring` — before
+ * any session exists — when there is no login, or when its earliest OAuth token
+ * would expire inside the run window `needMs`.
+ */
+export declare function engineCredentials(o: {
+    srcDir: string;
+    needMs: number;
+    now?: () => number;
+    words?: AuthCopyWords;
+    /** The refusal margin on top of `needMs`; default pi's refresh margin. */
+    marginMs?: number;
+}): EngineAuth;
+/**
+ * Write the refresh-disabled copy of `srcDir/auth.json` to `dstDir/auth.json`
+ * (0600, written aside and renamed into place). Throws `AuthExpiring` — and
+ * writes nothing — when there is no login, or when its earliest OAuth token
+ * expires inside `needMs`.
+ *
+ * This is the sandbox copy a pi CHILD reads; it keeps the sandboxes' original
+ * admission rule (no refresh margin). The in-process route's `engineCredentials`
+ * adds pi's five-minute refresh margin.
+ */
+export declare function copyPiAuth(o: {
+    srcDir: string;
+    dstDir: string;
+    needMs: number;
+    now?: () => number;
+    words: AuthCopyWords;
+    /** Copy (and check) only these providers' logins; omitted: all of them. */
+    providers?: readonly string[];
+}): {
+    expiresAt: number | null;
+};
+/** What `setRuntimeApiKey` needs of pi's ModelRuntime, by shape: this module
+ * stays outside the SDK (tests/fences-engine S2). */
+export interface RuntimeKeyTarget {
+    setRuntimeApiKey(providerId: string, apiKey: string): Promise<void>;
+}
+/** The key variable each provider's headless route reads (bench, the Action). */
+export declare const RUNTIME_KEY_ENVS: Readonly<Record<string, string>>;
+/** Give the runtime an API key for `providerId`, in memory only: pi's runtime
+ * overlay never persists it, and no login is read or written. */
+export declare function setRuntimeApiKey(runtime: RuntimeKeyTarget, providerId: string, apiKey: string): Promise<void>;
+/** `setRuntimeApiKey` for every provider whose key variable is set in `env`
+ * (default: `providers`' table). Returns the providers it keyed. */
+export declare function applyEnvApiKeys(runtime: RuntimeKeyTarget, env: NodeJS.ProcessEnv, providers?: readonly string[]): Promise<string[]>;
+/** The scan engine's case runner (src/setup/engine.ts `CaseRunner`), by
+ * shape: this module stays outside src/setup/. */
+export interface CaseRunnerOf<S, O> {
+    run(spec: S, signal: AbortSignal, onCost?: (spentSoFar: number) => void): Promise<O>;
+}
+/** A case the copy refused: it never started, so it spent nothing. */
+export type CaseRefused = {
+    ok: false;
+    reason: string;
+    cost_usd: number;
+};
+/** Set in the scan container: where the companion's agent dir is mounted
+ * read-only. Its presence is what makes the driver copy before each case. */
+export declare const SCAN_AUTH_SRC_ENV = "QCR_SCAN_AUTH_SRC";
+/** The time a scan case may take, which the access token must outlive. */
+export declare const SCAN_CASE_AUTH_BUDGET_MS: number;
+/** The way out of a refused copy: the companion refreshes its own login. */
+export declare const SCAN_AUTH_FIX = "open the companion so its pi refreshes the login (or run `qcr scan login`), then start the scan again";
+export declare function scanAuthMissing(src: string): string;
+export declare function scanAuthExpiring(o: {
+    provider: string | null;
+    expiresAt: number;
+    needMs: number;
+}): string;
+/** Copy the companion's login from `srcDir` into the scan's agent dir
+ * `dstDir`, refresh-disabled. Throws `AuthExpiring` when there is none, or
+ * when its token would expire inside `needMs`. */
+export declare function syncScanAuth(o: {
+    srcDir: string;
+    dstDir: string;
+    needMs: number;
+    now?: () => number;
+}): {
+    expiresAt: number | null;
+};
+/** A case runner over the borrowed login: before each case, the copy is
+ * re-taken from the live source. A refused copy never starts the case — it
+ * fails with the refusal and `onExpired` hears it, so the run can stop. */
+export declare function scanAuthCases<S, O>(inner: CaseRunnerOf<S, O>, o: {
+    srcDir: string;
+    dstDir: string;
+    needMs: number;
+    now?: () => number;
+    onExpired: (reason: string) => void;
+}): CaseRunnerOf<S, O | CaseRefused>;
+/** The driver's case runner: over the borrowed login in the scan container
+ * (its env names the read-only source), the plain runner anywhere else —
+ * `sandbox = "host"` runs on the host pi's own login. `homeDir` is the user's
+ * home as the host resolved it, for an env that names neither the agent dir
+ * nor HOME. */
+export declare function scanCasesForEnv<S, O>(inner: CaseRunnerOf<S, O>, env: NodeJS.ProcessEnv, onExpired: (reason: string) => void, homeDir?: string): CaseRunnerOf<S, O | CaseRefused>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/engine/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/engine/auth.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAIV,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAI/B,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD;;2EAE2E;AAC3E,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAI/C,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;AAEpF;;aAEa;AACb,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;gBACjB,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM;CAKjD;AAED;kEACkE;AAClE,qBAAa,YAAa,SAAQ,SAAS;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEhC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE;QACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB;CAMT;AAED;oCACoC;AACpC,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAMlD;AAED;2CAC2C;AAC3C,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,EAAE,MAAM;CAG5B;AAED;mFACmF;AACnF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE7E;AAID,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAOD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,SAAc,GAAG,MAAM,CAaxE;AA0BD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM;AACX;iEACiE;AACjE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAC5B;IACD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAQA;AAED;oBACoB;AACpB,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC;AAEpF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAYtD;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACjC,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;CACzF;AAED,sCAAsC;AACtC,eAAO,MAAM,iBAAiB,EAAE,aAK/B,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,aAM9B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC3D,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAAE,GAClF,IAAI,CAcN;AAkCD;;8EAE8E;AAC9E,wBAAgB,kBAAkB,IAAI,eAAe,CAEpD;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,WAAW,EAAE,eAAe,CAAC;IAC7B,4EAA4E;IAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,UAAU,CAQb;AAID;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,GAAG;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAc/B;AAID;qDACqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK7D,CAAC;AAEF;iEACiE;AACjE,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;oEACoE;AACpE,wBAAsB,eAAe,CACnC,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,GAAE,SAAS,MAAM,EAAkC,GAC3D,OAAO,CAAC,MAAM,EAAE,CAAC,CAUnB;AAYD;kDACkD;AAClD,MAAM,WAAW,YAAY,CAAC,CAAC,EAAE,CAAC;IAChC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACtF;AACD,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E;6EAC6E;AAC7E,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,QAAc,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,aAAa,0GAC+E,CAAC;AAE1G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE;IAClC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAMT;AAID;;kDAEkD;AAClD,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAE/B;AAED;;2EAE2E;AAC3E,wBAAgB,aAAa,CAAC,CAAC,EAAE,CAAC,EAChC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EACzB,CAAC,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC,GACA,YAAY,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CA6BlC;AAED;;;;eAIe;AACf,wBAAgB,eAAe,CAAC,CAAC,EAAE,CAAC,EAClC,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,EACnC,OAAO,CAAC,EAAE,MAAM,GACf,YAAY,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CASlC"}

package/dist/src/engine/auth.js

@@ -0,0 +1,374 @@
+// The engine's model credentials: one module for every way a headless host gets
+// a pi login it must never refresh.
+//
+// A pi login (its `auth.json`) has one owner: the pi home that ran `/login` and
+// keeps refreshing it. Everything else borrows. An engine host, the benchmark
+// sandbox and the scan sandbox read the owner's login READ-ONLY and run on a
+// copy in which every OAuth entry's refresh token is replaced by a value no
+// OAuth server accepts. A borrower therefore never refreshes, so it can never
+// rotate (and invalidate) the owner's grant, and never writes a file the owner
+// reads. Its price: it cannot outlive the access token, so the login is refused
+// before work starts when the token would expire inside the work window.
+//
+// One exception, the VM's: after the cutover no pi session lives long enough to
+// refresh the bot's login, so ONE locked refresher in the bot container
+// (src/loginrefresh/, spawned and supervised by the daemon by path) is its
+// owner. It holds an exclusive flock on pihome/agent/auth.json.lock for its whole
+// life, refreshes through pi-ai's own OAuth refresh and writes auth.json
+// atomically. Workers, takeover and debug pi are borrowers like any other: they
+// copy the file at spawn, blank, and take no lock. Everywhere else the login-refresh rule is as
+// above.
+//
+// Three ways in, one module:
+//   - `engineCredentials` / `loadAuth`: the in-process route. The copy lives in
+//     memory as a CredentialStore for PiHost (packages/pi-plugin/src/engine/pisdk.ts); no file is
+//     written, and its `modify` is never reached (a refresh is the only caller
+//     on this route, and the copy cannot make one succeed).
+//   - `copyPiAuth`: the process route. The same copy, written 0600 into a
+//     sandbox's own agent dir for a pi child (bench, scan).
+//   - `setRuntimeApiKey` / `applyEnvApiKeys`: the headless key route (bench,
+//     the Action). No login is read at all; the key lives in the runtime only.
+//
+// The scan sandbox's wiring (it mounts the companion's agent dir read-only and
+// re-takes the copy before every case) is here too: it is this module's copy
+// with the scan's words and budget.
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { PI_AUTH_ERROR_RE } from "../authwatch.js";
+import { CASE_STOP_GRACE_MS } from "../casebudget.js";
+/** What a copied OAuth credential carries instead of the real refresh token. */
+export const DISABLED_REFRESH = "bench-refresh-disabled";
+/** pi refreshes an OAuth token with less than this left (pi-ai auth/resolve.js
+ * DEFAULT_OAUTH_MINIMUM_VALIDITY_MS), so a run that ends inside it would ask a
+ * refresher it does not have. The engine's preflight keeps clear of it. */
+export const PI_REFRESH_MARGIN_MS = 5 * 60_000;
+/** Base of every auth failure the engine raises: `code` is what a caller
+ * branches on (authwatch's raise, a route's exit status), the message is for a
+ * person. */
+export class AuthError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = new.target.name;
+        this.code = code;
+    }
+}
+/** The login was refused before work started: no login (`code` "missing"), or a
+ * token that would expire inside the work window ("expiring"). */
+export class AuthExpiring extends AuthError {
+    provider;
+    expiresAt;
+    constructor(message, detail = {}) {
+        super(detail.code ?? "expiring", message);
+        this.provider = detail.provider ?? null;
+        this.expiresAt = detail.expiresAt ?? null;
+    }
+}
+/** Something asked the borrowed login to change. It never may: only the
+ * owner's pi `/login` refreshes. */
+export class AuthRefreshRefused extends AuthError {
+    constructor(operation, providerId) {
+        super("refresh-refused", `refusing to ${operation} the ${providerId} login: this host holds a read-only copy, and only the owner's pi /login refreshes`);
+    }
+}
+/** A provider rejected the token mid-run (the signature authwatch watches for).
+ * `message` is the provider's own text. */
+export class AuthRejected extends AuthError {
+    constructor(message) {
+        super("rejected", message);
+    }
+}
+/** The typed error for a provider's failure text, or undefined when the text is
+ * not an auth failure. One signature, shared with authwatch (PI_AUTH_ERROR_RE). */
+export function classifyAuthFailure(message) {
+    return PI_AUTH_ERROR_RE.test(message) ? new AuthRejected(message) : undefined;
+}
+/** Block this thread for `ms` (a borrower's copy is synchronous). */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * The owner's `auth.json` as text that parses, taking no lock. Every write by
+ * the refresher is an atomic rename (src/loginrefresh/atomic.ts), so a borrower
+ * reads the old file or the new one, whole. The one file that may not parse is
+ * one a login is rewriting in place (the pi `/login` under the entrypoint's
+ * login mode, which the refresher pauses for): that read is retried, a few
+ * times, and then fails with the parse error.
+ */
+export function readOwnerAuth(src, retry = {}) {
+    const tries = retry.tries ?? 5;
+    const delayMs = retry.delayMs ?? 200;
+    for (let attempt = 1;; attempt++) {
+        const raw = readFileSync(src, "utf8");
+        try {
+            JSON.parse(raw);
+            return raw;
+        }
+        catch (err) {
+            if (attempt >= tries)
+                throw err;
+            sleepSync(delayMs);
+        }
+    }
+}
+/** `parsed` with every OAuth entry's refresh token replaced (not deleted — pi's
+ * credential guard expects the field to be a string), everything else kept, and
+ * the earliest OAuth expiry with the provider it belongs to. Mutates `parsed`. */
+function blankRefresh(parsed) {
+    let expiresAt = null;
+    let provider = null;
+    for (const [name, v] of Object.entries(parsed)) {
+        if (typeof v !== "object" || v === null)
+            continue;
+        const cred = v;
+        if (cred["type"] !== "oauth")
+            continue;
+        cred["refresh"] = DISABLED_REFRESH;
+        const exp = cred["expires"];
+        if (typeof exp === "number" && (expiresAt === null || exp < expiresAt)) {
+            expiresAt = exp;
+            provider = name;
+        }
+    }
+    return { expiresAt, provider };
+}
+/**
+ * The sandbox copy of a pi `auth.json`, as text: every OAuth entry's refresh
+ * token replaced, everything else kept. Returns the earliest OAuth expiry, and
+ * the provider it belongs to, so the caller can refuse work that would outlive it.
+ */
+export function authCopyFrom(raw, 
+/** Keep only these providers' entries: the copy, and its expiry check,
+ * then cover exactly what the run uses. Omitted: every entry. */
+providers) {
+    const all = JSON.parse(raw);
+    const parsed = providers === undefined
+        ? all
+        : Object.fromEntries(Object.entries(all).filter(([name]) => providers.includes(name)));
+    const { expiresAt, provider } = blankRefresh(parsed);
+    return { json: JSON.stringify(parsed, null, 2) + "\n", expiresAt, provider };
+}
+export function loginSummary(raw) {
+    const parsed = JSON.parse(raw);
+    const out = {};
+    for (const [name, v] of Object.entries(parsed)) {
+        if (typeof v !== "object" || v === null)
+            continue;
+        const cred = v;
+        out[name] = {
+            type: typeof cred["type"] === "string" ? cred["type"] : "unknown",
+            expires: typeof cred["expires"] === "number" ? cred["expires"] : null,
+        };
+    }
+    return out;
+}
+/** The engine host's own refusals. */
+export const ENGINE_AUTH_WORDS = {
+    missing: (src) => `no pi login at ${src} — run pi's /login as the owner, then start again`,
+    expiring: ({ provider, expiresAt, needMs }) => `the ${provider ?? "pi"} access token expires at ${new Date(expiresAt).toISOString()}, inside this run's ${Math.round(needMs / 60_000)}-minute window. ` +
+        "An engine host never refreshes it (a second refresher would invalidate the owner's grant) — run pi's /login as the owner, then start again.",
+};
+/** The benchmark's refusals: its fixes are the login volume and the key route. */
+export const BENCH_AUTH_WORDS = {
+    missing: (src) => `no pi login at ${src} — log pi in on the auth volume first (/login), or use your own API key: QCR_BENCH_AUTH=api-key (bench/aacr/README.md "Reproduce")`,
+    expiring: ({ expiresAt, needMs }) => `the shared Codex access token expires at ${new Date(expiresAt).toISOString()}, inside this case's ${Math.round(needMs / 60_000)}-minute budget. ` +
+        "The benchmark never refreshes it (that would invalidate the login's own grant). Use pi on that login volume once so it refreshes its own login, then re-run with --resume — or run on your own API key (QCR_BENCH_AUTH=api-key).",
+};
+/**
+ * The preflight: throw `AuthExpiring` when the earliest OAuth token expires
+ * inside `needMs` (plus `marginMs`, the stretch at the end of its life in which
+ * pi would try to refresh it). A login with no OAuth entry never expires.
+ */
+export function checkAuth(copy, o) {
+    if (copy.expiresAt === null)
+        return;
+    const now = (o.now ?? Date.now)();
+    if (copy.expiresAt >= now + o.needMs + (o.marginMs ?? PI_REFRESH_MARGIN_MS))
+        return;
+    const words = (o.words ?? ENGINE_AUTH_WORDS).expiring({
+        provider: copy.provider,
+        expiresAt: copy.expiresAt,
+        needMs: o.needMs,
+    });
+    throw new AuthExpiring(words, {
+        code: "expiring",
+        provider: copy.provider,
+        expiresAt: copy.expiresAt,
+    });
+}
+// ---- the in-process route -------------------------------------------------------
+/** A CredentialStore that serves a frozen copy and refuses every change. pi
+ * writes to a store only to refresh, log in or log out (pi-ai auth/resolve.js,
+ * models.js), and none of those is this host's to do: a call is a bug, so it
+ * throws, loudly and typed, instead of persisting anything. */
+class ReadOnlyCredentials {
+    data;
+    constructor(data) {
+        this.data = new Map(Object.entries(data)
+            .filter(([, v]) => typeof v === "object" && v !== null)
+            .map(([name, v]) => [name, v]));
+    }
+    async read(providerId, options) {
+        options?.signal?.throwIfAborted();
+        const cred = this.data.get(providerId);
+        return cred ? structuredClone(cred) : undefined;
+    }
+    async list(options) {
+        options?.signal?.throwIfAborted();
+        return [...this.data].map(([providerId, c]) => ({ providerId, type: c.type }));
+    }
+    async modify(providerId) {
+        throw new AuthRefreshRefused("modify", providerId);
+    }
+    async delete(providerId) {
+        throw new AuthRefreshRefused("delete", providerId);
+    }
+}
+/** The store for the headless key route: no login at all, nothing to refresh,
+ * nothing written (pi would otherwise create an empty `auth.json` in the agent
+ * dir). Keys arrive through `setRuntimeApiKey`, into the runtime's memory. */
+export function keyOnlyCredentials() {
+    return new ReadOnlyCredentials({});
+}
+/**
+ * Build the engine's credentials from the owner's agent dir `srcDir` (read
+ * only: nothing is written there or anywhere). Throws `AuthExpiring` — before
+ * any session exists — when there is no login, or when its earliest OAuth token
+ * would expire inside the run window `needMs`.
+ */
+export function engineCredentials(o) {
+    const src = join(o.srcDir, "auth.json");
+    const words = o.words ?? ENGINE_AUTH_WORDS;
+    if (!existsSync(src))
+        throw new AuthExpiring(words.missing(src), { code: "missing" });
+    const parsed = JSON.parse(readOwnerAuth(src));
+    const { expiresAt, provider } = blankRefresh(parsed);
+    checkAuth({ expiresAt, provider }, { ...o, words });
+    return { credentials: new ReadOnlyCredentials(parsed), expiresAt, provider };
+}
+// ---- the process route ----------------------------------------------------------
+/**
+ * Write the refresh-disabled copy of `srcDir/auth.json` to `dstDir/auth.json`
+ * (0600, written aside and renamed into place). Throws `AuthExpiring` — and
+ * writes nothing — when there is no login, or when its earliest OAuth token
+ * expires inside `needMs`.
+ *
+ * This is the sandbox copy a pi CHILD reads; it keeps the sandboxes' original
+ * admission rule (no refresh margin). The in-process route's `engineCredentials`
+ * adds pi's five-minute refresh margin.
+ */
+export function copyPiAuth(o) {
+    const src = join(o.srcDir, "auth.json");
+    if (!existsSync(src))
+        throw new AuthExpiring(o.words.missing(src), { code: "missing" });
+    const { json, expiresAt, provider } = authCopyFrom(readOwnerAuth(src), o.providers);
+    checkAuth({ expiresAt, provider }, { needMs: o.needMs, marginMs: 0, words: o.words, ...(o.now ? { now: o.now } : {}) });
+    mkdirSync(o.dstDir, { recursive: true, mode: 0o700 });
+    const tmp = join(o.dstDir, "auth.json.tmp");
+    writeFileSync(tmp, json, { mode: 0o600 });
+    renameSync(tmp, join(o.dstDir, "auth.json"));
+    chmodSync(join(o.dstDir, "auth.json"), 0o600);
+    return { expiresAt };
+}
+/** The key variable each provider's headless route reads (bench, the Action). */
+export const RUNTIME_KEY_ENVS = {
+    openai: "OPENAI_API_KEY",
+    anthropic: "ANTHROPIC_API_KEY",
+    google: "GEMINI_API_KEY",
+    digitalocean: "DIGITALOCEAN_API_KEY",
+};
+/** Give the runtime an API key for `providerId`, in memory only: pi's runtime
+ * overlay never persists it, and no login is read or written. */
+export async function setRuntimeApiKey(runtime, providerId, apiKey) {
+    if (apiKey.trim() === "")
+        throw new Error(`an empty API key for ${providerId}`);
+    await runtime.setRuntimeApiKey(providerId, apiKey);
+}
+/** `setRuntimeApiKey` for every provider whose key variable is set in `env`
+ * (default: `providers`' table). Returns the providers it keyed. */
+export async function applyEnvApiKeys(runtime, env, providers = Object.keys(RUNTIME_KEY_ENVS)) {
+    const keyed = [];
+    for (const providerId of providers) {
+        const name = RUNTIME_KEY_ENVS[providerId];
+        const value = name ? env[name] : undefined;
+        if (!value || value.trim() === "")
+            continue;
+        await setRuntimeApiKey(runtime, providerId, value);
+        keyed.push(providerId);
+    }
+    return keyed;
+}
+/** Set in the scan container: where the companion's agent dir is mounted
+ * read-only. Its presence is what makes the driver copy before each case. */
+export const SCAN_AUTH_SRC_ENV = "QCR_SCAN_AUTH_SRC";
+/** The time a scan case may take, which the access token must outlive. */
+export const SCAN_CASE_AUTH_BUDGET_MS = 30 * 60_000;
+/** The way out of a refused copy: the companion refreshes its own login. */
+export const SCAN_AUTH_FIX = "open the companion so its pi refreshes the login (or run `qcr scan login`), then start the scan again";
+export function scanAuthMissing(src) {
+    return `no pi login in the companion's pi home (${src}) — run \`qcr scan login\` to log the companion's pi in`;
+}
+export function scanAuthExpiring(o) {
+    return (`the companion's ${o.provider ?? "pi"} access token expires at ${new Date(o.expiresAt).toISOString()}, inside a scan case's ${Math.round(o.needMs / 60_000)}-minute budget. ` +
+        "A scan never refreshes it (a second refresher would invalidate the companion's own grant) — " +
+        `${SCAN_AUTH_FIX}.`);
+}
+const SCAN_AUTH_WORDS = { missing: scanAuthMissing, expiring: scanAuthExpiring };
+/** Copy the companion's login from `srcDir` into the scan's agent dir
+ * `dstDir`, refresh-disabled. Throws `AuthExpiring` when there is none, or
+ * when its token would expire inside `needMs`. */
+export function syncScanAuth(o) {
+    return copyPiAuth({ ...o, words: SCAN_AUTH_WORDS });
+}
+/** A case runner over the borrowed login: before each case, the copy is
+ * re-taken from the live source. A refused copy never starts the case — it
+ * fails with the refusal and `onExpired` hears it, so the run can stop. */
+export function scanAuthCases(inner, o) {
+    return {
+        run: async (spec, signal, onCost) => {
+            try {
+                syncScanAuth(o);
+            }
+            catch (err) {
+                const reason = err instanceof Error ? err.message : String(err);
+                if (!(err instanceof AuthExpiring)) {
+                    return { ok: false, reason: `the login copy failed: ${reason}`, cost_usd: 0 };
+                }
+                o.onExpired(reason);
+                return { ok: false, reason, cost_usd: 0 };
+            }
+            const bounded = new AbortController();
+            const stop = () => bounded.abort();
+            signal.addEventListener("abort", stop, { once: true });
+            if (signal.aborted)
+                stop();
+            // Reserve the runner's forced-stop grace inside the login admission budget.
+            const timer = setTimeout(stop, Math.max(0, o.needMs - CASE_STOP_GRACE_MS));
+            timer.unref();
+            try {
+                // Wait for process cleanup and its final cost rather than racing a refusal.
+                return await inner.run(spec, bounded.signal, onCost);
+            }
+            finally {
+                clearTimeout(timer);
+                signal.removeEventListener("abort", stop);
+            }
+        },
+    };
+}
+/** The driver's case runner: over the borrowed login in the scan container
+ * (its env names the read-only source), the plain runner anywhere else —
+ * `sandbox = "host"` runs on the host pi's own login. `homeDir` is the user's
+ * home as the host resolved it, for an env that names neither the agent dir
+ * nor HOME. */
+export function scanCasesForEnv(inner, env, onExpired, homeDir) {
+    const srcDir = env[SCAN_AUTH_SRC_ENV]?.trim();
+    if (!srcDir)
+        return inner;
+    const home = env["HOME"]?.trim() || homeDir;
+    const dstDir = env["PI_CODING_AGENT_DIR"]?.trim() || (home ? join(home, ".pi", "agent") : undefined);
+    if (!dstDir)
+        throw new Error("scan auth: PI_CODING_AGENT_DIR is not set and there is no home to default it");
+    return scanAuthCases(inner, { srcDir, dstDir, needMs: SCAN_CASE_AUTH_BUDGET_MS, onExpired });
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/engine/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/engine/auth.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,oCAAoC;AACpC,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,EAAE;AACF,gFAAgF;AAChF,wEAAwE;AACxE,2EAA2E;AAC3E,kFAAkF;AAClF,yEAAyE;AACzE,gFAAgF;AAChF,gGAAgG;AAChG,SAAS;AACT,EAAE;AACF,6BAA6B;AAC7B,gFAAgF;AAChF,kGAAkG;AAClG,+EAA+E;AAC/E,4DAA4D;AAC5D,0EAA0E;AAC1E,4DAA4D;AAC5D,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,oCAAoC;AACpC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD;;2EAE2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAAM,CAAC;AAM/C;;aAEa;AACb,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAgB;IAC7B,YAAY,IAAmB,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;kEACkE;AAClE,MAAM,OAAO,YAAa,SAAQ,SAAS;IAChC,QAAQ,CAAgB;IACxB,SAAS,CAAgB;IAClC,YACE,OAAe,EACf,SAII,EAAE;QAEN,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,CAAC;CACF;AAED;oCACoC;AACpC,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,SAAiB,EAAE,UAAkB;QAC/C,KAAK,CACH,iBAAiB,EACjB,eAAe,SAAS,QAAQ,UAAU,oFAAoF,CAC/H,CAAC;IACJ,CAAC;CACF;AAED;2CAC2C;AAC3C,MAAM,OAAO,YAAa,SAAQ,SAAS;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;CACF;AAED;mFACmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAUD,qEAAqE;AACrE,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,QAAmB,EAAE;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC;IACrC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,IAAI,KAAK;gBAAE,MAAM,GAAG,CAAC;YAChC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAMD;;kFAEkF;AAClF,SAAS,YAAY,CAAC,MAAgB;IACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,CAA4B,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,OAAO;YAAE,SAAS;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,gBAAgB,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC;YACvE,SAAS,GAAG,GAAG,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW;AACX;iEACiE;AACjE,SAA6B;IAM7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;IACxC,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;QACrB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAMD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IAC1D,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,CAA4B,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACjE,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;SACtE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC9C,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,GAAG,mDAAmD;IAC1F,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5C,OAAO,QAAQ,IAAI,IAAI,4BAA4B,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,uBAAuB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,kBAAkB;QACxJ,6IAA6I;CAChJ,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAkB;IAC7C,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,kBAAkB,GAAG,oIAAoI;IAC3J,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,4CAA4C,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,wBAAwB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,kBAAkB;QAClJ,kOAAkO;CACrO,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAA2D,EAC3D,CAAmF;IAEnF,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO;IACpC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,oBAAoB,CAAC;QAAE,OAAO;IACpF,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,QAAQ,CAAC;QACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC,CAAC;IACH,MAAM,IAAI,YAAY,CAAC,KAAK,EAAE;QAC5B,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AAEpF;;;+DAG+D;AAC/D,MAAM,mBAAmB;IACN,IAAI,CAAkC;IACvD,YAAY,IAAc;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CACjB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;aACjB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;aACtD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAe,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA8B;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAA8B;QACvC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,CAAC;CACF;AAED;;8EAE8E;AAC9E,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAOjC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,iBAAiB,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAa,CAAC;IAC1D,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrD,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,WAAW,EAAE,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,oFAAoF;AAEpF;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,CAQ1B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IACpF,SAAS,CACP,EAAE,SAAS,EAAE,QAAQ,EAAE,EACvB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACpF,CAAC;IACF,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAUD,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,YAAY,EAAE,sBAAsB;CACrC,CAAC;AAEF;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAyB,EACzB,UAAkB,EAClB,MAAc;IAEd,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED;oEACoE;AACpE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAyB,EACzB,GAAsB,EACtB,YAA+B,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAE5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QAC5C,MAAM,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAoBD;6EAC6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GACxB,uGAAuG,CAAC;AAE1G,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,2CAA2C,GAAG,yDAAyD,CAAC;AACjH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAIhC;IACC,OAAO,CACL,mBAAmB,CAAC,CAAC,QAAQ,IAAI,IAAI,4BAA4B,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,kBAAkB;QAC7K,8FAA8F;QAC9F,GAAG,aAAa,GAAG,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAkB,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AAEhG;;kDAEkD;AAClD,MAAM,UAAU,YAAY,CAAC,CAK5B;IACC,OAAO,UAAU,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,KAAyB,EACzB,CAMC;IAED,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAA4B,EAAE;YAC5D,IAAI,CAAC;gBACH,YAAY,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChE,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC,EAAE,CAAC;oBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAChF,CAAC;gBACD,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,EAAE,CAAC;YAC3B,4EAA4E;YAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC;YAC3E,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,4EAA4E;gBAC5E,OAAO,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;eAIe;AACf,MAAM,UAAU,eAAe,CAC7B,KAAyB,EACzB,GAAsB,EACtB,SAAmC,EACnC,OAAgB;IAEhB,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC;IAC5C,MAAM,MAAM,GACV,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/F,CAAC"}