@remnic/core 1.1.11 → 1.1.13

package/dist/chunk-FJ43PRLT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/conversation-index/faiss-adapter.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport path from \"node:path\";\nimport { log } from \"../logger.js\";\nimport type { ConversationChunk } from \"./chunker.js\";\nimport type { ConversationSearchResult } from \"./search.js\";\nimport { launchProcess } from \"../runtime/child-process.js\";\n\nexport interface FaissAdapterConfig {\n  memoryDir: string;\n  scriptPath?: string;\n  pythonBin?: string;\n  modelId: string;\n  indexDir: string;\n  upsertTimeoutMs: number;\n  searchTimeoutMs: number;\n  healthTimeoutMs: number;\n  maxBatchSize: number;\n  maxSearchK: number;\n  spawnFn?: typeof launchProcess;\n}\n\nexport interface FaissHealthResult {\n  ok: boolean;\n  status: \"ok\" | \"degraded\" | \"error\";\n  indexPath: string;\n  message?: string;\n  manifest?: {\n    version: number;\n    modelId: string;\n    normalizedModelId: string;\n    dimension: number;\n    chunkCount: number;\n    updatedAt: string;\n    lastSuccessfulRebuildAt: string;\n  };\n}\n\nexport interface FaissInspectResult extends FaissHealthResult {\n  metadata: {\n    chunkCount: number;\n    hasIndex: boolean;\n    hasMetadata: boolean;\n    hasManifest: boolean;\n  };\n}\n\ntype SidecarCommand = \"upsert\" | \"search\" | \"health\" | \"inspect\" | \"rebuild\";\n\nexport class FaissAdapterError extends Error {\n  constructor(message: string, readonly code: \"timeout\" | \"non_zero_exit\" | \"malformed_output\") {\n    super(message);\n    this.name = \"FaissAdapterError\";\n  }\n}\n\ninterface SidecarResult {\n  ok?: boolean;\n  error?: string;\n  upserted?: number;\n  rebuilt?: number;\n  status?: \"ok\" | \"degraded\" | \"error\";\n  manifest?: {\n    version?: number;\n    modelId?: string;\n    normalizedModelId?: string;\n    dimension?: number;\n    chunkCount?: number;\n    updatedAt?: string;\n    lastSuccessfulRebuildAt?: string;\n  };\n  results?: Array<{\n    path: string;\n    snippet: string;\n    score: number;\n  }>;\n  metadata?: {\n    chunkCount?: number;\n    hasIndex?: boolean;\n    hasMetadata?: boolean;\n    hasManifest?: boolean;\n  };\n}\n\nfunction parseSidecarManifest(result: SidecarResult): FaissHealthResult[\"manifest\"] | undefined {\n  const manifest = result.manifest;\n  if (\n    !manifest ||\n    typeof manifest.version !== \"number\" ||\n    typeof manifest.modelId !== \"string\" ||\n    typeof manifest.normalizedModelId !== \"string\" ||\n    typeof manifest.dimension !== \"number\" ||\n    typeof manifest.chunkCount !== \"number\" ||\n    typeof manifest.updatedAt !== \"string\" ||\n    typeof manifest.lastSuccessfulRebuildAt !== \"string\"\n  ) {\n    return undefined;\n  }\n\n  return {\n    version: manifest.version,\n    modelId: manifest.modelId,\n    normalizedModelId: manifest.normalizedModelId,\n    dimension: manifest.dimension,\n    chunkCount: manifest.chunkCount,\n    updatedAt: manifest.updatedAt,\n    lastSuccessfulRebuildAt: manifest.lastSuccessfulRebuildAt,\n  };\n}\n\nexport function resolveDefaultFaissScriptPath(fromModuleUrl: string = import.meta.url): string {\n  const currentFile = fileURLToPath(fromModuleUrl);\n  const moduleDir = path.dirname(currentFile);\n\n  // Source runtime: src/conversation-index/faiss-adapter.ts\n  if (moduleDir.endsWith(`${path.sep}conversation-index`)) {\n    return path.resolve(moduleDir, \"..\", \"..\", \"scripts\", \"faiss_index.py\");\n  }\n\n  // Bundled runtime: dist/index.js (or neighboring dist chunks)\n  return path.resolve(moduleDir, \"..\", \"scripts\", \"faiss_index.py\");\n}\n\nexport class FaissConversationIndexAdapter {\n  private readonly pythonBin: string;\n  private readonly scriptPath: string;\n  private readonly indexPath: string;\n  private readonly spawnFn: typeof launchProcess;\n\n  constructor(private readonly config: FaissAdapterConfig) {\n    this.pythonBin = config.pythonBin && config.pythonBin.trim().length > 0 ? config.pythonBin.trim() : \"python3\";\n    this.scriptPath = config.scriptPath && config.scriptPath.trim().length > 0\n      ? config.scriptPath.trim()\n      : resolveDefaultFaissScriptPath();\n    this.indexPath = path.isAbsolute(config.indexDir)\n      ? config.indexDir\n      : path.join(config.memoryDir, config.indexDir);\n    this.spawnFn = config.spawnFn ?? launchProcess;\n  }\n\n  async upsertChunks(chunks: ConversationChunk[]): Promise<number> {\n    if (this.config.maxBatchSize <= 0) return 0;\n    let totalUpserted = 0;\n    for (let offset = 0; offset < chunks.length; offset += this.config.maxBatchSize) {\n      const batch = chunks.slice(offset, offset + this.config.maxBatchSize);\n      if (batch.length === 0) continue;\n      const payload = {\n        modelId: this.config.modelId,\n        indexPath: this.indexPath,\n        chunks: batch.map((chunk) => ({\n          id: chunk.id,\n          sessionKey: chunk.sessionKey,\n          text: chunk.text,\n          startTs: chunk.startTs,\n          endTs: chunk.endTs,\n        })),\n      };\n      const result = await this.runCommand(\"upsert\", payload, this.config.upsertTimeoutMs);\n      const upserted = result.upserted;\n      if (typeof upserted !== \"number\" || !Number.isFinite(upserted)) {\n        throw new FaissAdapterError(\"FAISS sidecar produced malformed upsert response\", \"malformed_output\");\n      }\n      totalUpserted += Math.max(0, Math.floor(upserted));\n    }\n    return totalUpserted;\n  }\n\n  async searchChunks(query: string, topK: number): Promise<ConversationSearchResult[]> {\n    const requestedTopK = Number.isFinite(topK) ? Math.floor(topK) : 0;\n    const boundedTopK = this.config.maxSearchK > 0\n      ? Math.max(0, Math.min(requestedTopK, this.config.maxSearchK))\n      : 0;\n    if (boundedTopK <= 0 || query.trim().length === 0) return [];\n    const payload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n      query,\n      topK: boundedTopK,\n    };\n    const result = await this.runCommand(\"search\", payload, this.config.searchTimeoutMs);\n    if (!Array.isArray(result.results)) {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed search response\", \"malformed_output\");\n    }\n    const rows = result.results;\n    return rows\n      .filter((row) =>\n        row &&\n        typeof row.path === \"string\" &&\n        typeof row.snippet === \"string\" &&\n        typeof row.score === \"number\"\n      )\n      .map((row) => ({ path: row.path, snippet: row.snippet, score: row.score }));\n  }\n\n  async health(): Promise<FaissHealthResult> {\n    const payload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n    };\n    const result = await this.runCommand(\"health\", payload, this.config.healthTimeoutMs);\n    if (result.status !== \"ok\" && result.status !== \"degraded\" && result.status !== \"error\") {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed health response\", \"malformed_output\");\n    }\n    return {\n      ok: result.ok === true,\n      status: result.status,\n      indexPath: this.indexPath,\n      message: typeof result.error === \"string\" && result.error.length > 0 ? result.error : undefined,\n      manifest: parseSidecarManifest(result),\n    };\n  }\n\n  async inspect(): Promise<FaissInspectResult> {\n    const payload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n    };\n    const result = await this.runCommand(\"inspect\", payload, this.config.healthTimeoutMs);\n    if (result.status !== \"ok\" && result.status !== \"degraded\" && result.status !== \"error\") {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed inspect response\", \"malformed_output\");\n    }\n    return {\n      ok: result.ok === true,\n      status: result.status,\n      indexPath: this.indexPath,\n      message: typeof result.error === \"string\" && result.error.length > 0 ? result.error : undefined,\n      manifest: parseSidecarManifest(result),\n      metadata: {\n        chunkCount:\n          result.metadata && typeof result.metadata.chunkCount === \"number\"\n            ? result.metadata.chunkCount\n            : 0,\n        hasIndex: result.metadata?.hasIndex === true,\n        hasMetadata: result.metadata?.hasMetadata === true,\n        hasManifest: result.metadata?.hasManifest === true,\n      },\n    };\n  }\n\n  async rebuildChunks(chunks: ConversationChunk[]): Promise<number> {\n    if (this.config.maxBatchSize <= 0) return 0;\n\n    const firstBatch = chunks.slice(0, this.config.maxBatchSize);\n    const rebuildPayload = {\n      modelId: this.config.modelId,\n      indexPath: this.indexPath,\n      chunks: firstBatch.map((chunk) => ({\n        id: chunk.id,\n        sessionKey: chunk.sessionKey,\n        text: chunk.text,\n        startTs: chunk.startTs,\n        endTs: chunk.endTs,\n      })),\n    };\n    const result = await this.runCommand(\"rebuild\", rebuildPayload, this.config.upsertTimeoutMs);\n    const rebuilt = result.rebuilt;\n    if (typeof rebuilt !== \"number\" || !Number.isFinite(rebuilt)) {\n      throw new FaissAdapterError(\"FAISS sidecar produced malformed rebuild response\", \"malformed_output\");\n    }\n\n    const rebuildCount = Math.max(0, Math.floor(rebuilt));\n    const remaining = chunks.slice(firstBatch.length);\n    if (remaining.length === 0) return rebuildCount;\n\n    const upserted = await this.upsertChunks(remaining);\n    return rebuildCount + upserted;\n  }\n\n  private async runCommand(command: SidecarCommand, payload: object, timeoutMs: number): Promise<SidecarResult> {\n    const args = [this.scriptPath, command];\n    const child = this.spawnFn(this.pythonBin, args, {\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n    if (!child.stdin || !child.stdout || !child.stderr) {\n      throw new FaissAdapterError(\n        `FAISS sidecar missing stdio pipes (${command})`,\n        \"non_zero_exit\",\n      );\n    }\n    const stdinPipe = child.stdin;\n    const stdoutPipe = child.stdout;\n    const stderrPipe = child.stderr;\n\n    const stdoutChunks: Buffer[] = [];\n    const stderrChunks: Buffer[] = [];\n    let timedOut = false;\n\n    const timer = timeoutMs > 0\n      ? setTimeout(() => {\n        timedOut = true;\n        child.kill(\"SIGKILL\");\n      }, timeoutMs)\n      : undefined;\n\n    stdoutPipe.on(\"data\", (chunk: Buffer | string) => {\n      stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    });\n    stderrPipe.on(\"data\", (chunk: Buffer | string) => {\n      stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    });\n\n    let code: number | null;\n    try {\n      stdinPipe.write(JSON.stringify(payload));\n      stdinPipe.end();\n\n      code = await new Promise<number | null>((resolve, reject) => {\n        const rejectAsProcessError = (err: unknown) => {\n          const msg = err instanceof Error ? err.message : String(err);\n          reject(new FaissAdapterError(`FAISS sidecar stream/process error (${command}): ${msg}`, \"non_zero_exit\"));\n        };\n        child.once(\"error\", rejectAsProcessError);\n        stdinPipe.once(\"error\", rejectAsProcessError);\n        child.once(\"close\", (exitCode) => resolve(exitCode));\n      });\n    } catch (err) {\n      if (err instanceof FaissAdapterError) throw err;\n      const msg = err instanceof Error ? err.message : String(err);\n      throw new FaissAdapterError(`FAISS sidecar stream/process error (${command}): ${msg}`, \"non_zero_exit\");\n    } finally {\n      if (timer) clearTimeout(timer);\n    }\n\n    const stdout = Buffer.concat(stdoutChunks).toString(\"utf-8\").trim();\n    const stderr = Buffer.concat(stderrChunks).toString(\"utf-8\").trim();\n\n    if (timedOut) {\n      throw new FaissAdapterError(\n        `FAISS sidecar command timed out (${command}, ${timeoutMs}ms)`,\n        \"timeout\",\n      );\n    }\n    if (code !== 0) {\n      throw new FaissAdapterError(\n        `FAISS sidecar exited non-zero (${command}, code=${code ?? \"null\"})${stderr ? `: ${stderr}` : \"\"}`,\n        \"non_zero_exit\",\n      );\n    }\n    if (stdout.length === 0) {\n      throw new FaissAdapterError(\n        `FAISS sidecar produced empty output (${command})`,\n        \"malformed_output\",\n      );\n    }\n\n    let parsed: SidecarResult;\n    try {\n      parsed = JSON.parse(stdout) as SidecarResult;\n    } catch {\n      throw new FaissAdapterError(\n        `FAISS sidecar produced malformed JSON (${command})`,\n        \"malformed_output\",\n      );\n    }\n\n    if (parsed.ok === false) {\n      const message = typeof parsed.error === \"string\" && parsed.error.length > 0\n        ? parsed.error\n        : `FAISS sidecar command failed (${command})`;\n      throw new FaissAdapterError(message, \"non_zero_exit\");\n    }\n    if (parsed.ok !== true) {\n      throw new FaissAdapterError(\n        `FAISS sidecar produced malformed success envelope (${command})`,\n        \"malformed_output\",\n      );\n    }\n\n    return parsed;\n  }\n}\n\nexport async function failOpenFaissHealth(\n  adapter: FaissConversationIndexAdapter | undefined,\n): Promise<FaissHealthResult> {\n  if (!adapter) {\n    return { ok: false, status: \"error\", indexPath: \"\", message: \"adapter-unavailable\" };\n  }\n  try {\n    return await adapter.health();\n  } catch (err) {\n    log.debug(`faiss adapter health failed (fail-open): ${err}`);\n    return { ok: false, status: \"error\", indexPath: \"\", message: \"adapter-error\" };\n  }\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AA+CV,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,SAA0B,MAAwD;AAC5F,UAAM,OAAO;AADuB;AAEpC,SAAK,OAAO;AAAA,EACd;AAAA,EAHsC;AAIxC;AA8BA,SAAS,qBAAqB,QAAkE;AAC9F,QAAM,WAAW,OAAO;AACxB,MACE,CAAC,YACD,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,sBAAsB,YACtC,OAAO,SAAS,cAAc,YAC9B,OAAO,SAAS,eAAe,YAC/B,OAAO,SAAS,cAAc,YAC9B,OAAO,SAAS,4BAA4B,UAC5C;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,SAAS,SAAS;AAAA,IAClB,SAAS,SAAS;AAAA,IAClB,mBAAmB,SAAS;AAAA,IAC5B,WAAW,SAAS;AAAA,IACpB,YAAY,SAAS;AAAA,IACrB,WAAW,SAAS;AAAA,IACpB,yBAAyB,SAAS;AAAA,EACpC;AACF;AAEO,SAAS,8BAA8B,gBAAwB,YAAY,KAAa;AAC7F,QAAM,cAAc,cAAc,aAAa;AAC/C,QAAM,YAAY,KAAK,QAAQ,WAAW;AAG1C,MAAI,UAAU,SAAS,GAAG,KAAK,GAAG,oBAAoB,GAAG;AACvD,WAAO,KAAK,QAAQ,WAAW,MAAM,MAAM,WAAW,gBAAgB;AAAA,EACxE;AAGA,SAAO,KAAK,QAAQ,WAAW,MAAM,WAAW,gBAAgB;AAClE;AAEO,IAAM,gCAAN,MAAoC;AAAA,EAMzC,YAA6B,QAA4B;AAA5B;AAC3B,SAAK,YAAY,OAAO,aAAa,OAAO,UAAU,KAAK,EAAE,SAAS,IAAI,OAAO,UAAU,KAAK,IAAI;AACpG,SAAK,aAAa,OAAO,cAAc,OAAO,WAAW,KAAK,EAAE,SAAS,IACrE,OAAO,WAAW,KAAK,IACvB,8BAA8B;AAClC,SAAK,YAAY,KAAK,WAAW,OAAO,QAAQ,IAC5C,OAAO,WACP,KAAK,KAAK,OAAO,WAAW,OAAO,QAAQ;AAC/C,SAAK,UAAU,OAAO,WAAW;AAAA,EACnC;AAAA,EAT6B;AAAA,EALZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAajB,MAAM,aAAa,QAA8C;AAC/D,QAAI,KAAK,OAAO,gBAAgB,EAAG,QAAO;AAC1C,QAAI,gBAAgB;AACpB,aAAS,SAAS,GAAG,SAAS,OAAO,QAAQ,UAAU,KAAK,OAAO,cAAc;AAC/E,YAAM,QAAQ,OAAO,MAAM,QAAQ,SAAS,KAAK,OAAO,YAAY;AACpE,UAAI,MAAM,WAAW,EAAG;AACxB,YAAM,UAAU;AAAA,QACd,SAAS,KAAK,OAAO;AAAA,QACrB,WAAW,KAAK;AAAA,QAChB,QAAQ,MAAM,IAAI,CAAC,WAAW;AAAA,UAC5B,IAAI,MAAM;AAAA,UACV,YAAY,MAAM;AAAA,UAClB,MAAM,MAAM;AAAA,UACZ,SAAS,MAAM;AAAA,UACf,OAAO,MAAM;AAAA,QACf,EAAE;AAAA,MACJ;AACA,YAAM,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,KAAK,OAAO,eAAe;AACnF,YAAM,WAAW,OAAO;AACxB,UAAI,OAAO,aAAa,YAAY,CAAC,OAAO,SAAS,QAAQ,GAAG;AAC9D,cAAM,IAAI,kBAAkB,oDAAoD,kBAAkB;AAAA,MACpG;AACA,uBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,OAAe,MAAmD;AACnF,UAAM,gBAAgB,OAAO,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI;AACjE,UAAM,cAAc,KAAK,OAAO,aAAa,IACzC,KAAK,IAAI,GAAG,KAAK,IAAI,eAAe,KAAK,OAAO,UAAU,CAAC,IAC3D;AACJ,QAAI,eAAe,KAAK,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO,CAAC;AAC3D,UAAM,UAAU;AAAA,MACd,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,KAAK,OAAO,eAAe;AACnF,QAAI,CAAC,MAAM,QAAQ,OAAO,OAAO,GAAG;AAClC,YAAM,IAAI,kBAAkB,oDAAoD,kBAAkB;AAAA,IACpG;AACA,UAAM,OAAO,OAAO;AACpB,WAAO,KACJ;AAAA,MAAO,CAAC,QACP,OACA,OAAO,IAAI,SAAS,YACpB,OAAO,IAAI,YAAY,YACvB,OAAO,IAAI,UAAU;AAAA,IACvB,EACC,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,OAAO,IAAI,MAAM,EAAE;AAAA,EAC9E;AAAA,EAEA,MAAM,SAAqC;AACzC,UAAM,UAAU;AAAA,MACd,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,IAClB;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,KAAK,OAAO,eAAe;AACnF,QAAI,OAAO,WAAW,QAAQ,OAAO,WAAW,cAAc,OAAO,WAAW,SAAS;AACvF,YAAM,IAAI,kBAAkB,oDAAoD,kBAAkB;AAAA,IACpG;AACA,WAAO;AAAA,MACL,IAAI,OAAO,OAAO;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,MACtF,UAAU,qBAAqB,MAAM;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,UAAuC;AAC3C,UAAM,UAAU;AAAA,MACd,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,IAClB;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,SAAS,KAAK,OAAO,eAAe;AACpF,QAAI,OAAO,WAAW,QAAQ,OAAO,WAAW,cAAc,OAAO,WAAW,SAAS;AACvF,YAAM,IAAI,kBAAkB,qDAAqD,kBAAkB;AAAA,IACrG;AACA,WAAO;AAAA,MACL,IAAI,OAAO,OAAO;AAAA,MAClB,QAAQ,OAAO;AAAA,MACf,WAAW,KAAK;AAAA,MAChB,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,IAAI,OAAO,QAAQ;AAAA,MACtF,UAAU,qBAAqB,MAAM;AAAA,MACrC,UAAU;AAAA,QACR,YACE,OAAO,YAAY,OAAO,OAAO,SAAS,eAAe,WACrD,OAAO,SAAS,aAChB;AAAA,QACN,UAAU,OAAO,UAAU,aAAa;AAAA,QACxC,aAAa,OAAO,UAAU,gBAAgB;AAAA,QAC9C,aAAa,OAAO,UAAU,gBAAgB;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,QAA8C;AAChE,QAAI,KAAK,OAAO,gBAAgB,EAAG,QAAO;AAE1C,UAAM,aAAa,OAAO,MAAM,GAAG,KAAK,OAAO,YAAY;AAC3D,UAAM,iBAAiB;AAAA,MACrB,SAAS,KAAK,OAAO;AAAA,MACrB,WAAW,KAAK;AAAA,MAChB,QAAQ,WAAW,IAAI,CAAC,WAAW;AAAA,QACjC,IAAI,MAAM;AAAA,QACV,YAAY,MAAM;AAAA,QAClB,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,MACf,EAAE;AAAA,IACJ;AACA,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,gBAAgB,KAAK,OAAO,eAAe;AAC3F,UAAM,UAAU,OAAO;AACvB,QAAI,OAAO,YAAY,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG;AAC5D,YAAM,IAAI,kBAAkB,qDAAqD,kBAAkB;AAAA,IACrG;AAEA,UAAM,eAAe,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,CAAC;AACpD,UAAM,YAAY,OAAO,MAAM,WAAW,MAAM;AAChD,QAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,UAAM,WAAW,MAAM,KAAK,aAAa,SAAS;AAClD,WAAO,eAAe;AAAA,EACxB;AAAA,EAEA,MAAc,WAAW,SAAyB,SAAiB,WAA2C;AAC5G,UAAM,OAAO,CAAC,KAAK,YAAY,OAAO;AACtC,UAAM,QAAQ,KAAK,QAAQ,KAAK,WAAW,MAAM;AAAA,MAC/C,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AACD,QAAI,CAAC,MAAM,SAAS,CAAC,MAAM,UAAU,CAAC,MAAM,QAAQ;AAClD,YAAM,IAAI;AAAA,QACR,sCAAsC,OAAO;AAAA,QAC7C;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,MAAM;AACxB,UAAM,aAAa,MAAM;AACzB,UAAM,aAAa,MAAM;AAEzB,UAAM,eAAyB,CAAC;AAChC,UAAM,eAAyB,CAAC;AAChC,QAAI,WAAW;AAEf,UAAM,QAAQ,YAAY,IACtB,WAAW,MAAM;AACjB,iBAAW;AACX,YAAM,KAAK,SAAS;AAAA,IACtB,GAAG,SAAS,IACV;AAEJ,eAAW,GAAG,QAAQ,CAAC,UAA2B;AAChD,mBAAa,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACvE,CAAC;AACD,eAAW,GAAG,QAAQ,CAAC,UAA2B;AAChD,mBAAa,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACvE,CAAC;AAED,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,UAAU,OAAO,CAAC;AACvC,gBAAU,IAAI;AAEd,aAAO,MAAM,IAAI,QAAuB,CAAC,SAAS,WAAW;AAC3D,cAAM,uBAAuB,CAAC,QAAiB;AAC7C,gBAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,iBAAO,IAAI,kBAAkB,uCAAuC,OAAO,MAAM,GAAG,IAAI,eAAe,CAAC;AAAA,QAC1G;AACA,cAAM,KAAK,SAAS,oBAAoB;AACxC,kBAAU,KAAK,SAAS,oBAAoB;AAC5C,cAAM,KAAK,SAAS,CAAC,aAAa,QAAQ,QAAQ,CAAC;AAAA,MACrD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,eAAe,kBAAmB,OAAM;AAC5C,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAM,IAAI,kBAAkB,uCAAuC,OAAO,MAAM,GAAG,IAAI,eAAe;AAAA,IACxG,UAAE;AACA,UAAI,MAAO,cAAa,KAAK;AAAA,IAC/B;AAEA,UAAM,SAAS,OAAO,OAAO,YAAY,EAAE,SAAS,OAAO,EAAE,KAAK;AAClE,UAAM,SAAS,OAAO,OAAO,YAAY,EAAE,SAAS,OAAO,EAAE,KAAK;AAElE,QAAI,UAAU;AACZ,YAAM,IAAI;AAAA,QACR,oCAAoC,OAAO,KAAK,SAAS;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,GAAG;AACd,YAAM,IAAI;AAAA,QACR,kCAAkC,OAAO,UAAU,QAAQ,MAAM,IAAI,SAAS,KAAK,MAAM,KAAK,EAAE;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,wCAAwC,OAAO;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,MAAM;AAAA,IAC5B,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,0CAA0C,OAAO;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,OAAO,OAAO;AACvB,YAAM,UAAU,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,IACtE,OAAO,QACP,iCAAiC,OAAO;AAC5C,YAAM,IAAI,kBAAkB,SAAS,eAAe;AAAA,IACtD;AACA,QAAI,OAAO,OAAO,MAAM;AACtB,YAAM,IAAI;AAAA,QACR,sDAAsD,OAAO;AAAA,QAC7D;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBACpB,SAC4B;AAC5B,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,WAAW,IAAI,SAAS,sBAAsB;AAAA,EACrF;AACA,MAAI;AACF,WAAO,MAAM,QAAQ,OAAO;AAAA,EAC9B,SAAS,KAAK;AACZ,QAAI,MAAM,4CAA4C,GAAG,EAAE;AAC3D,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,WAAW,IAAI,SAAS,gBAAgB;AAAA,EAC/E;AACF;","names":[]}

package/dist/chunk-FKFMOY3N.js

@@ -0,0 +1,32 @@
+import {
+  headerValue
+} from "./chunk-FAJ7FZYM.js";
+
+// src/adapters/hermes.ts
+var HermesAdapter = class {
+  id = "hermes";
+  matches(context) {
+    if (headerValue(context.headers, "x-hermes-session-id")) return true;
+    const clientId = headerValue(context.headers, "x-engram-client-id");
+    if (clientId?.toLowerCase() === "hermes") return true;
+    const clientName = context.clientInfo?.name?.toLowerCase() ?? "";
+    if (clientName.includes("hermes")) return true;
+    return false;
+  }
+  resolveIdentity(context) {
+    const sessionId = headerValue(context.headers, "x-hermes-session-id");
+    const principal = headerValue(context.headers, "x-engram-principal") || "hermes-agent";
+    const namespace = headerValue(context.headers, "x-engram-namespace") || "hermes";
+    return {
+      namespace,
+      principal,
+      sessionKey: sessionId ?? context.sessionKey,
+      adapterId: this.id
+    };
+  }
+};
+
+export {
+  HermesAdapter
+};
+//# sourceMappingURL=chunk-FKFMOY3N.js.map

package/dist/chunk-FKFMOY3N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/hermes.ts"],"sourcesContent":["import { headerValue, type AdapterContext, type EngramAdapter, type ResolvedIdentity } from \"./types.js\";\n\n/**\n * Hermes Agent adapter.\n *\n * Detection: Hermes supports both MCP (via config.yaml mcp_servers)\n * and a dedicated MemoryProvider plugin protocol (Python). The MCP\n * client name is not yet publicly documented, so detection uses:\n *\n * 1. X-Hermes-Session-Id header — confirmed in v0.7.0 API server\n * 2. User-configured headers in Hermes MCP config:\n *      mcp_servers:\n *        engram:\n *          url: \"http://localhost:4318/mcp\"\n *          headers:\n *            X-Engram-Client-Id: \"hermes\"\n *            X-Engram-Namespace: \"my-profile\"\n * 3. MCP clientInfo name containing \"hermes\" (for forward compat)\n *\n * Hermes profiles isolate agent state under ~/.hermes/profiles/<name>/.\n * Each profile can map to a separate Engram namespace via the\n * X-Engram-Namespace header.\n *\n * For deeper integration, Hermes v0.7.0+ supports MemoryProvider\n * plugins (Python protocol with initialize/enrich_turn/sync_turn/\n * shutdown). A Python Engram MemoryProvider plugin would be the\n * optimal integration path — see docs/integration/hermes-setup.md.\n */\nexport class HermesAdapter implements EngramAdapter {\n  readonly id = \"hermes\";\n\n  matches(context: AdapterContext): boolean {\n    // Confirmed header from Hermes v0.7.0 API server\n    if (headerValue(context.headers, \"x-hermes-session-id\")) return true;\n\n    // User-configured client identifier header\n    const clientId = headerValue(context.headers, \"x-engram-client-id\");\n    if (clientId?.toLowerCase() === \"hermes\") return true;\n\n    // MCP clientInfo (for forward compat when Hermes documents its name)\n    const clientName = context.clientInfo?.name?.toLowerCase() ?? \"\";\n    if (clientName.includes(\"hermes\")) return true;\n\n    return false;\n  }\n\n  resolveIdentity(context: AdapterContext): ResolvedIdentity {\n    const sessionId = headerValue(context.headers, \"x-hermes-session-id\");\n\n    const principal = headerValue(context.headers, \"x-engram-principal\")\n      || \"hermes-agent\";\n\n    const namespace = headerValue(context.headers, \"x-engram-namespace\")\n      || \"hermes\";\n\n    return {\n      namespace,\n      principal,\n      sessionKey: sessionId ?? context.sessionKey,\n      adapterId: this.id,\n    };\n  }\n}\n\n"],"mappings":";;;;;AA4BO,IAAM,gBAAN,MAA6C;AAAA,EACzC,KAAK;AAAA,EAEd,QAAQ,SAAkC;AAExC,QAAI,YAAY,QAAQ,SAAS,qBAAqB,EAAG,QAAO;AAGhE,UAAM,WAAW,YAAY,QAAQ,SAAS,oBAAoB;AAClE,QAAI,UAAU,YAAY,MAAM,SAAU,QAAO;AAGjD,UAAM,aAAa,QAAQ,YAAY,MAAM,YAAY,KAAK;AAC9D,QAAI,WAAW,SAAS,QAAQ,EAAG,QAAO;AAE1C,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,SAA2C;AACzD,UAAM,YAAY,YAAY,QAAQ,SAAS,qBAAqB;AAEpE,UAAM,YAAY,YAAY,QAAQ,SAAS,oBAAoB,KAC9D;AAEL,UAAM,YAAY,YAAY,QAAQ,SAAS,oBAAoB,KAC9D;AAEL,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,YAAY,aAAa,QAAQ;AAAA,MACjC,WAAW,KAAK;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-FLTNHQK6.js

@@ -0,0 +1,262 @@
+import {
+  readEnvVar
+} from "./chunk-XIG5PDM7.js";
+import {
+  log
+} from "./chunk-2ODBA7MQ.js";
+
+// src/resolve-provider-secret.ts
+import path from "path";
+import os from "os";
+var _resolveApiKeyForProvider = null;
+var _getRuntimeAuthForModel = null;
+var _resolverLoaded = false;
+var _resolverNextRetryAt = 0;
+var RESOLVER_RETRY_BACKOFF_MS = 6e4;
+var resolvedCache = /* @__PURE__ */ new Map();
+var cacheObjectIds = /* @__PURE__ */ new WeakMap();
+var nextCacheObjectId = 1;
+var NON_LITERAL_AUTH_MARKERS = /* @__PURE__ */ new Set([
+  "secretref-managed",
+  "lm-studio"
+]);
+var ENV_VAR_MARKER_RE = /^[A-Z][A-Z0-9_]*(?:_API_KEY|_ACCESS_TOKEN|_TOKEN|_SECRET|_CREDENTIALS|_CREDENTIALS_JSON)$/;
+async function getGatewayResolver() {
+  if (_resolverLoaded) {
+    return _resolveApiKeyForProvider;
+  }
+  if (_resolverNextRetryAt > 0 && Date.now() < _resolverNextRetryAt) {
+    return null;
+  }
+  try {
+    const candidates = [
+      // Try glob-matching the runtime module name (hash varies per build)
+      ...await findRuntimeModules()
+    ];
+    const { pathToFileURL } = await import("url");
+    for (const candidate of candidates) {
+      try {
+        const importUrl = pathToFileURL(candidate).href;
+        const mod = await import(importUrl);
+        if (typeof mod.resolveApiKeyForProvider === "function") {
+          _resolveApiKeyForProvider = mod.resolveApiKeyForProvider;
+          if (typeof mod.getRuntimeAuthForModel === "function") {
+            _getRuntimeAuthForModel = mod.getRuntimeAuthForModel;
+            log.debug("loaded gateway getRuntimeAuthForModel from runtime module");
+          }
+          _resolverLoaded = true;
+          log.debug("loaded gateway resolveApiKeyForProvider from runtime module");
+          return _resolveApiKeyForProvider;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  _resolverNextRetryAt = Date.now() + RESOLVER_RETRY_BACKOFF_MS;
+  log.debug(`gateway resolveApiKeyForProvider not available \u2014 will retry after ${RESOLVER_RETRY_BACKOFF_MS / 1e3}s`);
+  return null;
+}
+async function findRuntimeModules() {
+  return findGatewayRuntimeModules("runtime-model-auth.runtime-");
+}
+async function findGatewayRuntimeModules(filePrefix) {
+  const { accessSync, constants, readdirSync, realpathSync, statSync } = await import("fs");
+  const { createRequire } = await import("module");
+  const candidates = [];
+  const distDirs = [];
+  const pushDistDirs = (entryPath) => {
+    const resolvedEntryDir = path.dirname(entryPath);
+    const packageRoot = path.basename(resolvedEntryDir) === "dist" ? path.resolve(resolvedEntryDir, "..") : resolvedEntryDir;
+    const candidateDistDirs = [
+      path.join(packageRoot, "dist"),
+      path.join(packageRoot, "..", "dist")
+    ];
+    for (const candidate of candidateDistDirs) {
+      const resolved = path.resolve(candidate);
+      if (!distDirs.includes(resolved)) distDirs.push(resolved);
+    }
+  };
+  try {
+    const req = createRequire(import.meta.url);
+    const openclawMain = req.resolve("openclaw");
+    pushDistDirs(openclawMain);
+  } catch {
+  }
+  try {
+    const mainScript = process.argv[1];
+    if (mainScript) {
+      const realScript = realpathSync(mainScript);
+      if (realScript.includes("openclaw")) {
+        pushDistDirs(realScript);
+      }
+    }
+  } catch {
+  }
+  try {
+    const openclawBin = findExecutableOnPath("openclaw", accessSync, statSync, constants.X_OK);
+    if (openclawBin) {
+      pushDistDirs(realpathSync(openclawBin));
+    }
+  } catch {
+  }
+  for (const dir of distDirs) {
+    try {
+      const files = readdirSync(dir);
+      for (const f of files) {
+        if (f.startsWith(filePrefix) && f.endsWith(".js")) {
+          candidates.push(path.join(dir, f));
+        }
+      }
+    } catch {
+    }
+  }
+  return candidates;
+}
+function findExecutableOnPath(executableName, access, stat, executableMode) {
+  const pathEnv = readEnvVar("PATH");
+  if (!pathEnv) return void 0;
+  const pathExts = process.platform === "win32" ? (readEnvVar("PATHEXT") ?? ".EXE;.CMD;.BAT;.COM").split(";").filter((ext) => ext.length > 0) : [""];
+  const hasExtension = path.extname(executableName).length > 0;
+  for (const dir of pathEnv.split(path.delimiter)) {
+    if (!dir) continue;
+    const candidateNames = process.platform === "win32" && !hasExtension ? pathExts.map((ext) => `${executableName}${ext}`) : [executableName];
+    for (const candidateName of candidateNames) {
+      const candidate = path.join(dir, candidateName);
+      try {
+        access(candidate, executableMode);
+        if (!stat(candidate).isFile()) continue;
+        return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+var __findExecutableOnPathForTest = findExecutableOnPath;
+function isNonLiteralAuthMarker(value) {
+  return NON_LITERAL_AUTH_MARKERS.has(value) || value.endsWith("-oauth") || value.endsWith("-local") || value.startsWith("gcp-") || ENV_VAR_MARKER_RE.test(value);
+}
+function resolveFromNamedEnvVar(marker) {
+  if (!ENV_VAR_MARKER_RE.test(marker)) return void 0;
+  const value = readEnvVar(marker);
+  return value && value.trim().length > 0 ? value.trim() : void 0;
+}
+function cacheIdentity(value) {
+  if (value === null) return "null";
+  if (value === void 0) return "undefined";
+  if (typeof value === "string") return `string:${value}`;
+  if (typeof value === "number") return `number:${String(value)}`;
+  if (typeof value === "boolean") return `boolean:${String(value)}`;
+  if (typeof value === "bigint") return `bigint:${String(value)}`;
+  if (typeof value === "symbol" || typeof value === "function") return typeof value;
+  if (typeof value === "object") {
+    const existingId = cacheObjectIds.get(value);
+    if (existingId !== void 0) return `object:${existingId}`;
+    const newId = nextCacheObjectId++;
+    cacheObjectIds.set(value, newId);
+    return `object:${newId}`;
+  }
+  return String(value);
+}
+function providerSecretCacheKey(providerId, resolvedAgentDir, apiKeyValue, gatewayConfig) {
+  return [
+    `provider:${providerId}`,
+    `agentDir:${resolvedAgentDir}`,
+    `apiKey:${cacheIdentity(apiKeyValue)}`,
+    `cfg:${cacheIdentity(gatewayConfig)}`
+  ].join(":");
+}
+async function resolveProviderApiKey(providerId, apiKeyValue, gatewayConfig, agentDir) {
+  const resolvedAgentDir = path.resolve(
+    agentDir ?? path.join(os.homedir(), ".openclaw", "agents", "main", "agent")
+  );
+  let resolved;
+  if (typeof apiKeyValue === "string" && apiKeyValue.trim().length > 0) {
+    const trimmedApiKeyValue = apiKeyValue.trim();
+    if (isNonLiteralAuthMarker(trimmedApiKeyValue)) {
+      const markerEnvValue = resolveFromNamedEnvVar(trimmedApiKeyValue);
+      if (markerEnvValue) {
+        return markerEnvValue;
+      }
+    } else {
+      return trimmedApiKeyValue;
+    }
+  }
+  const cacheKey = providerSecretCacheKey(providerId, resolvedAgentDir, apiKeyValue, gatewayConfig);
+  if (resolvedCache.has(cacheKey)) {
+    return resolvedCache.get(cacheKey);
+  }
+  const resolver = await getGatewayResolver();
+  if (resolver) {
+    try {
+      const auth = await resolver({ provider: providerId, cfg: gatewayConfig, agentDir: resolvedAgentDir });
+      if (auth?.apiKey) {
+        resolved = auth.apiKey;
+        log.debug(`resolved API key for provider "${providerId}" via gateway auth (source: ${auth.source ?? "unknown"}, mode: ${auth.mode ?? "unknown"})`);
+        resolvedCache.set(cacheKey, resolved);
+        return resolved;
+      }
+    } catch (err) {
+      log.debug(
+        `gateway auth resolution failed for provider "${providerId}": ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
+  resolved = resolveFromEnv(providerId);
+  if (resolved) {
+    log.debug(`resolved API key for provider "${providerId}" from environment variable`);
+  } else {
+    log.debug(`could not resolve API key for provider "${providerId}" \u2014 skipping`);
+  }
+  if (resolved) {
+    resolvedCache.set(cacheKey, resolved);
+  }
+  return resolved;
+}
+function resolveFromEnv(providerId) {
+  const normalized = providerId.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+  const candidates = [
+    `${normalized}_API_KEY`,
+    `${normalized}_TOKEN`
+  ];
+  for (const envVar of candidates) {
+    const value = readEnvVar(envVar);
+    if (value && value.trim().length > 0) {
+      return value.trim();
+    }
+  }
+  return void 0;
+}
+async function getGatewayRuntimeAuthForModel() {
+  await getGatewayResolver();
+  return _getRuntimeAuthForModel;
+}
+function clearSecretCache() {
+  resolvedCache.clear();
+  _resolveApiKeyForProvider = null;
+  _getRuntimeAuthForModel = null;
+  _resolverLoaded = false;
+  _resolverNextRetryAt = 0;
+}
+function __setGatewayResolverForTest(resolver) {
+  _resolveApiKeyForProvider = resolver;
+  _resolverLoaded = resolver !== null;
+  _resolverNextRetryAt = 0;
+}
+function __setGatewayRuntimeAuthForModelForTest(resolver) {
+  _getRuntimeAuthForModel = resolver;
+  _resolverLoaded = resolver !== null || _resolveApiKeyForProvider !== null;
+  _resolverNextRetryAt = 0;
+}
+
+export {
+  findGatewayRuntimeModules,
+  __findExecutableOnPathForTest,
+  resolveProviderApiKey,
+  getGatewayRuntimeAuthForModel,
+  clearSecretCache,
+  __setGatewayResolverForTest,
+  __setGatewayRuntimeAuthForModelForTest
+};
+//# sourceMappingURL=chunk-FLTNHQK6.js.map

package/dist/chunk-FLTNHQK6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resolve-provider-secret.ts"],"sourcesContent":["import { log } from \"./logger.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport path from \"node:path\";\nimport os from \"node:os\";\n\n/**\n * Resolve a provider API key using OpenClaw's own auth resolution system.\n *\n * This module delegates to the gateway's `resolveApiKeyForProvider()` function,\n * which handles all secret reference formats (SecretRef objects, auth profiles,\n * \"secretref-managed\" markers, environment variables, etc.) using the same\n * codepath the gateway uses for its own agent sessions.\n *\n * For plain-text API keys, a fast path returns them directly without\n * involving the gateway auth system.\n *\n * Results are cached per provider for the gateway process lifetime.\n */\n\ntype ResolveApiKeyFn = (params: {\n  provider: string;\n  cfg?: unknown;\n  agentDir?: string;\n}) => Promise<{ apiKey?: string; source?: string; mode?: string } | null>;\n\n/**\n * Resolve request-ready auth for a model, including provider-owned transforms\n * (e.g., OAuth token exchange, base URL override for openai-codex).\n */\nexport type GetRuntimeAuthForModelFn = (params: {\n  model: { provider: string; id: string; api?: string; baseUrl?: string };\n  cfg?: unknown;\n  workspaceDir?: string;\n}) => Promise<{\n  apiKey?: string;\n  baseUrl?: string;\n  source?: string;\n  mode?: string;\n  profileId?: string;\n} | null>;\n\nlet _resolveApiKeyForProvider: ResolveApiKeyFn | null = null;\nlet _getRuntimeAuthForModel: GetRuntimeAuthForModelFn | null = null;\nlet _resolverLoaded = false;\nlet _resolverNextRetryAt = 0;\nconst RESOLVER_RETRY_BACKOFF_MS = 60_000; // 1 minute between retries after first failure\nconst resolvedCache = new Map<string, string | undefined>();\nconst cacheObjectIds = new WeakMap<object, number>();\nlet nextCacheObjectId = 1;\nconst NON_LITERAL_AUTH_MARKERS = new Set([\n  \"secretref-managed\",\n  \"lm-studio\",\n]);\nconst ENV_VAR_MARKER_RE =\n  /^[A-Z][A-Z0-9_]*(?:_API_KEY|_ACCESS_TOKEN|_TOKEN|_SECRET|_CREDENTIALS|_CREDENTIALS_JSON)$/;\n\n/**\n * Lazily load the gateway's resolveApiKeyForProvider function.\n * Returns null if not available (e.g., running outside the gateway process).\n */\nasync function getGatewayResolver(): Promise<ResolveApiKeyFn | null> {\n  if (_resolverLoaded) {\n    return _resolveApiKeyForProvider;\n  }\n  // Backoff: don't re-scan filesystem on every call when module wasn't found.\n  // After a failure, wait RESOLVER_RETRY_BACKOFF_MS before trying again.\n  if (_resolverNextRetryAt > 0 && Date.now() < _resolverNextRetryAt) {\n    return null;\n  }\n\n  try {\n    // The gateway bundles this in a runtime chunk — import it dynamically.\n    // This import path is stable across gateway versions since it's a named runtime export.\n    const candidates = [\n      // Try glob-matching the runtime module name (hash varies per build)\n      ...await findRuntimeModules(),\n    ];\n\n    const { pathToFileURL } = await import(\"node:url\");\n    for (const candidate of candidates) {\n      try {\n        // Convert native path to file:// URL for cross-platform ESM import compatibility\n        const importUrl = pathToFileURL(candidate).href;\n        const mod = await import(importUrl);\n        if (typeof mod.resolveApiKeyForProvider === \"function\") {\n          _resolveApiKeyForProvider = mod.resolveApiKeyForProvider;\n          if (typeof mod.getRuntimeAuthForModel === \"function\") {\n            _getRuntimeAuthForModel = mod.getRuntimeAuthForModel;\n            log.debug(\"loaded gateway getRuntimeAuthForModel from runtime module\");\n          }\n          _resolverLoaded = true;\n          log.debug(\"loaded gateway resolveApiKeyForProvider from runtime module\");\n          return _resolveApiKeyForProvider;\n        }\n      } catch {\n        // Try next candidate\n      }\n    }\n  } catch {\n    // Silent\n  }\n\n  // Backoff before retrying — avoid repeated fs scanning.\n  // Retries after RESOLVER_RETRY_BACKOFF_MS so the resolver can\n  // recover if the gateway restarts or the module becomes available.\n  _resolverNextRetryAt = Date.now() + RESOLVER_RETRY_BACKOFF_MS;\n  log.debug(`gateway resolveApiKeyForProvider not available — will retry after ${RESOLVER_RETRY_BACKOFF_MS / 1000}s`);\n  return null;\n}\n\n/**\n * Find the gateway's model-auth runtime module by scanning the dist directory.\n * Uses require.resolve to find the openclaw package regardless of install method.\n */\nasync function findRuntimeModules(): Promise<string[]> {\n  return findGatewayRuntimeModules(\"runtime-model-auth.runtime-\");\n}\n\n/**\n * Discover gateway runtime module files matching the given filename prefix.\n *\n * Reused by adjacent SecretRef resolution code (`resolve-auth-token.ts`,\n * issue #757). Walks the same dist-dir candidates as the model-auth path\n * so callers don't reimplement install-method discovery.\n */\nexport async function findGatewayRuntimeModules(filePrefix: string): Promise<string[]> {\n  const { accessSync, constants, readdirSync, realpathSync, statSync } = await import(\"node:fs\");\n  const { createRequire } = await import(\"node:module\");\n  const candidates: string[] = [];\n\n  const distDirs: string[] = [];\n  const pushDistDirs = (entryPath: string): void => {\n    const resolvedEntryDir = path.dirname(entryPath);\n    const packageRoot = path.basename(resolvedEntryDir) === \"dist\"\n      ? path.resolve(resolvedEntryDir, \"..\")\n      : resolvedEntryDir;\n    const candidateDistDirs = [\n      path.join(packageRoot, \"dist\"),\n      path.join(packageRoot, \"..\", \"dist\"),\n    ];\n    for (const candidate of candidateDistDirs) {\n      const resolved = path.resolve(candidate);\n      if (!distDirs.includes(resolved)) distDirs.push(resolved);\n    }\n  };\n\n  try {\n    const req = createRequire(import.meta.url);\n    const openclawMain = req.resolve(\"openclaw\");\n    pushDistDirs(openclawMain);\n  } catch {\n    // openclaw not resolvable from plugin context — try alternate paths\n  }\n\n  try {\n    const mainScript = process.argv[1];\n    if (mainScript) {\n      const realScript = realpathSync(mainScript);\n      if (realScript.includes(\"openclaw\")) {\n        pushDistDirs(realScript);\n      }\n    }\n  } catch {\n    // Silent\n  }\n\n  try {\n    const openclawBin = findExecutableOnPath(\"openclaw\", accessSync, statSync, constants.X_OK);\n    if (openclawBin) {\n      pushDistDirs(realpathSync(openclawBin));\n    }\n  } catch {\n    // Silent\n  }\n\n  for (const dir of distDirs) {\n    try {\n      const files = readdirSync(dir);\n      for (const f of files) {\n        if (f.startsWith(filePrefix) && f.endsWith(\".js\")) {\n          candidates.push(path.join(dir, f));\n        }\n      }\n    } catch {\n      // Directory doesn't exist — skip\n    }\n  }\n\n  return candidates;\n}\n\nfunction findExecutableOnPath(\n  executableName: string,\n  access: (path: string, mode?: number) => void,\n  stat: (path: string) => { isFile(): boolean },\n  executableMode: number,\n): string | undefined {\n  const pathEnv = readEnvVar(\"PATH\");\n  if (!pathEnv) return undefined;\n\n  const pathExts = process.platform === \"win32\"\n    ? (readEnvVar(\"PATHEXT\") ?? \".EXE;.CMD;.BAT;.COM\")\n        .split(\";\")\n        .filter((ext) => ext.length > 0)\n    : [\"\"];\n  const hasExtension = path.extname(executableName).length > 0;\n\n  for (const dir of pathEnv.split(path.delimiter)) {\n    if (!dir) continue;\n    const candidateNames = process.platform === \"win32\" && !hasExtension\n      ? pathExts.map((ext) => `${executableName}${ext}`)\n      : [executableName];\n\n    for (const candidateName of candidateNames) {\n      const candidate = path.join(dir, candidateName);\n      try {\n        access(candidate, executableMode);\n        if (!stat(candidate).isFile()) continue;\n        return candidate;\n      } catch {\n        // Try the next PATH entry.\n      }\n    }\n  }\n\n  return undefined;\n}\n\nexport const __findExecutableOnPathForTest = findExecutableOnPath;\n\nfunction isNonLiteralAuthMarker(value: string): boolean {\n  return (\n    NON_LITERAL_AUTH_MARKERS.has(value) ||\n    value.endsWith(\"-oauth\") ||\n    value.endsWith(\"-local\") ||\n    value.startsWith(\"gcp-\") ||\n    ENV_VAR_MARKER_RE.test(value)\n  );\n}\n\nfunction resolveFromNamedEnvVar(marker: string): string | undefined {\n  if (!ENV_VAR_MARKER_RE.test(marker)) return undefined;\n  const value = readEnvVar(marker);\n  return value && value.trim().length > 0 ? value.trim() : undefined;\n}\n\nfunction cacheIdentity(value: unknown): string {\n  if (value === null) return \"null\";\n  if (value === undefined) return \"undefined\";\n  if (typeof value === \"string\") return `string:${value}`;\n  if (typeof value === \"number\") return `number:${String(value)}`;\n  if (typeof value === \"boolean\") return `boolean:${String(value)}`;\n  if (typeof value === \"bigint\") return `bigint:${String(value)}`;\n  if (typeof value === \"symbol\" || typeof value === \"function\") return typeof value;\n  if (typeof value === \"object\") {\n    const existingId = cacheObjectIds.get(value);\n    if (existingId !== undefined) return `object:${existingId}`;\n    const newId = nextCacheObjectId++;\n    cacheObjectIds.set(value, newId);\n    return `object:${newId}`;\n  }\n  return String(value);\n}\n\nfunction providerSecretCacheKey(\n  providerId: string,\n  resolvedAgentDir: string,\n  apiKeyValue: unknown,\n  gatewayConfig: unknown,\n): string {\n  return [\n    `provider:${providerId}`,\n    `agentDir:${resolvedAgentDir}`,\n    `apiKey:${cacheIdentity(apiKeyValue)}`,\n    `cfg:${cacheIdentity(gatewayConfig)}`,\n  ].join(\":\");\n}\n\n/**\n * Resolve a provider API key from various OpenClaw formats.\n *\n * Resolution order:\n * 1. Plain-text string → returned immediately\n * 2. Gateway's resolveApiKeyForProvider → handles all secret ref formats\n * 3. Environment variable fallback (PROVIDER_NAME_API_KEY)\n * 4. undefined → provider is skipped in the fallback chain\n */\nexport async function resolveProviderApiKey(\n  providerId: string,\n  apiKeyValue: unknown,\n  gatewayConfig?: unknown,\n  agentDir?: string,\n): Promise<string | undefined> {\n  const resolvedAgentDir = path.resolve(\n    agentDir ?? path.join(os.homedir(), \".openclaw\", \"agents\", \"main\", \"agent\"),\n  );\n\n  let resolved: string | undefined;\n\n  // Fast path: plain-text string that looks like an actual API key\n  if (typeof apiKeyValue === \"string\" && apiKeyValue.trim().length > 0) {\n    const trimmedApiKeyValue = apiKeyValue.trim();\n    // Skip known non-API-key markers used by the gateway for auth modes,\n    // plus env-var-shaped markers such as OPENAI_API_KEY.\n    if (isNonLiteralAuthMarker(trimmedApiKeyValue)) {\n      const markerEnvValue = resolveFromNamedEnvVar(trimmedApiKeyValue);\n      if (markerEnvValue) {\n        return markerEnvValue;\n      }\n      // Fall through to gateway resolver / env var fallback\n    } else {\n      return trimmedApiKeyValue;\n    }\n  }\n\n  const cacheKey = providerSecretCacheKey(providerId, resolvedAgentDir, apiKeyValue, gatewayConfig);\n  if (resolvedCache.has(cacheKey)) {\n    return resolvedCache.get(cacheKey);\n  }\n\n  // The API key is either a SecretRef object, \"secretref-managed\", or empty.\n  // Try the gateway's own auth resolution system first.\n  const resolver = await getGatewayResolver();\n  if (resolver) {\n    try {\n      const auth = await resolver({ provider: providerId, cfg: gatewayConfig, agentDir: resolvedAgentDir });\n      if (auth?.apiKey) {\n        resolved = auth.apiKey;\n        log.debug(`resolved API key for provider \"${providerId}\" via gateway auth (source: ${auth.source ?? \"unknown\"}, mode: ${auth.mode ?? \"unknown\"})`);\n        resolvedCache.set(cacheKey, resolved);\n        return resolved;\n      }\n    } catch (err) {\n      log.debug(\n        `gateway auth resolution failed for provider \"${providerId}\": ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  // Environment variable fallback\n  resolved = resolveFromEnv(providerId);\n  if (resolved) {\n    log.debug(`resolved API key for provider \"${providerId}\" from environment variable`);\n  } else {\n    log.debug(`could not resolve API key for provider \"${providerId}\" — skipping`);\n  }\n\n  // Only cache successful resolutions — failures are retried on next call\n  // so providers can recover after transient issues (e.g., 1Password agent restart)\n  if (resolved) {\n    resolvedCache.set(cacheKey, resolved);\n  }\n  return resolved;\n}\n\n/**\n * Try to resolve an API key from environment variables.\n */\nfunction resolveFromEnv(providerId: string): string | undefined {\n  const normalized = providerId.toUpperCase().replace(/[^A-Z0-9]/g, \"_\");\n  const candidates = [\n    `${normalized}_API_KEY`,\n    `${normalized}_TOKEN`,\n  ];\n  for (const envVar of candidates) {\n    const value = readEnvVar(envVar);\n    if (value && value.trim().length > 0) {\n      return value.trim();\n    }\n  }\n  return undefined;\n}\n\n/**\n * Get the gateway's getRuntimeAuthForModel function, if available.\n * This resolves request-ready auth including provider-owned transforms\n * (OAuth token exchange, base URL override for codex/copilot/etc.).\n * Must be called after at least one resolveProviderApiKey() call to\n * trigger the lazy module load.\n */\nexport async function getGatewayRuntimeAuthForModel(): Promise<GetRuntimeAuthForModelFn | null> {\n  // Ensure the runtime module has been loaded\n  await getGatewayResolver();\n  return _getRuntimeAuthForModel;\n}\n\n/**\n * Clear the resolution cache (useful for testing or key rotation).\n */\nexport function clearSecretCache(): void {\n  resolvedCache.clear();\n  _resolveApiKeyForProvider = null;\n  _getRuntimeAuthForModel = null;\n  _resolverLoaded = false;\n  _resolverNextRetryAt = 0;\n}\n\nexport function __setGatewayResolverForTest(resolver: ResolveApiKeyFn | null): void {\n  _resolveApiKeyForProvider = resolver;\n  _resolverLoaded = resolver !== null;\n  _resolverNextRetryAt = 0;\n}\n\nexport function __setGatewayRuntimeAuthForModelForTest(\n  resolver: GetRuntimeAuthForModelFn | null,\n): void {\n  _getRuntimeAuthForModel = resolver;\n  _resolverLoaded = resolver !== null || _resolveApiKeyForProvider !== null;\n  _resolverNextRetryAt = 0;\n}\n"],"mappings":";;;;;;;;AAEA,OAAO,UAAU;AACjB,OAAO,QAAQ;AAsCf,IAAI,4BAAoD;AACxD,IAAI,0BAA2D;AAC/D,IAAI,kBAAkB;AACtB,IAAI,uBAAuB;AAC3B,IAAM,4BAA4B;AAClC,IAAM,gBAAgB,oBAAI,IAAgC;AAC1D,IAAM,iBAAiB,oBAAI,QAAwB;AACnD,IAAI,oBAAoB;AACxB,IAAM,2BAA2B,oBAAI,IAAI;AAAA,EACvC;AAAA,EACA;AACF,CAAC;AACD,IAAM,oBACJ;AAMF,eAAe,qBAAsD;AACnE,MAAI,iBAAiB;AACnB,WAAO;AAAA,EACT;AAGA,MAAI,uBAAuB,KAAK,KAAK,IAAI,IAAI,sBAAsB;AACjE,WAAO;AAAA,EACT;AAEA,MAAI;AAGF,UAAM,aAAa;AAAA;AAAA,MAEjB,GAAG,MAAM,mBAAmB;AAAA,IAC9B;AAEA,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,KAAU;AACjD,eAAW,aAAa,YAAY;AAClC,UAAI;AAEF,cAAM,YAAY,cAAc,SAAS,EAAE;AAC3C,cAAM,MAAM,MAAM,OAAO;AACzB,YAAI,OAAO,IAAI,6BAA6B,YAAY;AACtD,sCAA4B,IAAI;AAChC,cAAI,OAAO,IAAI,2BAA2B,YAAY;AACpD,sCAA0B,IAAI;AAC9B,gBAAI,MAAM,2DAA2D;AAAA,UACvE;AACA,4BAAkB;AAClB,cAAI,MAAM,6DAA6D;AACvE,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAKA,yBAAuB,KAAK,IAAI,IAAI;AACpC,MAAI,MAAM,0EAAqE,4BAA4B,GAAI,GAAG;AAClH,SAAO;AACT;AAMA,eAAe,qBAAwC;AACrD,SAAO,0BAA0B,6BAA6B;AAChE;AASA,eAAsB,0BAA0B,YAAuC;AACrF,QAAM,EAAE,YAAY,WAAW,aAAa,cAAc,SAAS,IAAI,MAAM,OAAO,IAAS;AAC7F,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,QAAa;AACpD,QAAM,aAAuB,CAAC;AAE9B,QAAM,WAAqB,CAAC;AAC5B,QAAM,eAAe,CAAC,cAA4B;AAChD,UAAM,mBAAmB,KAAK,QAAQ,SAAS;AAC/C,UAAM,cAAc,KAAK,SAAS,gBAAgB,MAAM,SACpD,KAAK,QAAQ,kBAAkB,IAAI,IACnC;AACJ,UAAM,oBAAoB;AAAA,MACxB,KAAK,KAAK,aAAa,MAAM;AAAA,MAC7B,KAAK,KAAK,aAAa,MAAM,MAAM;AAAA,IACrC;AACA,eAAW,aAAa,mBAAmB;AACzC,YAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,UAAI,CAAC,SAAS,SAAS,QAAQ,EAAG,UAAS,KAAK,QAAQ;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,UAAM,eAAe,IAAI,QAAQ,UAAU;AAC3C,iBAAa,YAAY;AAAA,EAC3B,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,aAAa,QAAQ,KAAK,CAAC;AACjC,QAAI,YAAY;AACd,YAAM,aAAa,aAAa,UAAU;AAC1C,UAAI,WAAW,SAAS,UAAU,GAAG;AACnC,qBAAa,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,cAAc,qBAAqB,YAAY,YAAY,UAAU,UAAU,IAAI;AACzF,QAAI,aAAa;AACf,mBAAa,aAAa,WAAW,CAAC;AAAA,IACxC;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,aAAW,OAAO,UAAU;AAC1B,QAAI;AACF,YAAM,QAAQ,YAAY,GAAG;AAC7B,iBAAW,KAAK,OAAO;AACrB,YAAI,EAAE,WAAW,UAAU,KAAK,EAAE,SAAS,KAAK,GAAG;AACjD,qBAAW,KAAK,KAAK,KAAK,KAAK,CAAC,CAAC;AAAA,QACnC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,qBACP,gBACA,QACA,MACA,gBACoB;AACpB,QAAM,UAAU,WAAW,MAAM;AACjC,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,WAAW,QAAQ,aAAa,WACjC,WAAW,SAAS,KAAK,uBACvB,MAAM,GAAG,EACT,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,IACjC,CAAC,EAAE;AACP,QAAM,eAAe,KAAK,QAAQ,cAAc,EAAE,SAAS;AAE3D,aAAW,OAAO,QAAQ,MAAM,KAAK,SAAS,GAAG;AAC/C,QAAI,CAAC,IAAK;AACV,UAAM,iBAAiB,QAAQ,aAAa,WAAW,CAAC,eACpD,SAAS,IAAI,CAAC,QAAQ,GAAG,cAAc,GAAG,GAAG,EAAE,IAC/C,CAAC,cAAc;AAEnB,eAAW,iBAAiB,gBAAgB;AAC1C,YAAM,YAAY,KAAK,KAAK,KAAK,aAAa;AAC9C,UAAI;AACF,eAAO,WAAW,cAAc;AAChC,YAAI,CAAC,KAAK,SAAS,EAAE,OAAO,EAAG;AAC/B,eAAO;AAAA,MACT,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,IAAM,gCAAgC;AAE7C,SAAS,uBAAuB,OAAwB;AACtD,SACE,yBAAyB,IAAI,KAAK,KAClC,MAAM,SAAS,QAAQ,KACvB,MAAM,SAAS,QAAQ,KACvB,MAAM,WAAW,MAAM,KACvB,kBAAkB,KAAK,KAAK;AAEhC;AAEA,SAAS,uBAAuB,QAAoC;AAClE,MAAI,CAAC,kBAAkB,KAAK,MAAM,EAAG,QAAO;AAC5C,QAAM,QAAQ,WAAW,MAAM;AAC/B,SAAO,SAAS,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC3D;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,KAAK;AACrD,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,OAAO,KAAK,CAAC;AAC7D,MAAI,OAAO,UAAU,UAAW,QAAO,WAAW,OAAO,KAAK,CAAC;AAC/D,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,OAAO,KAAK,CAAC;AAC7D,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAY,QAAO,OAAO;AAC5E,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,aAAa,eAAe,IAAI,KAAK;AAC3C,QAAI,eAAe,OAAW,QAAO,UAAU,UAAU;AACzD,UAAM,QAAQ;AACd,mBAAe,IAAI,OAAO,KAAK;AAC/B,WAAO,UAAU,KAAK;AAAA,EACxB;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,uBACP,YACA,kBACA,aACA,eACQ;AACR,SAAO;AAAA,IACL,YAAY,UAAU;AAAA,IACtB,YAAY,gBAAgB;AAAA,IAC5B,UAAU,cAAc,WAAW,CAAC;AAAA,IACpC,OAAO,cAAc,aAAa,CAAC;AAAA,EACrC,EAAE,KAAK,GAAG;AACZ;AAWA,eAAsB,sBACpB,YACA,aACA,eACA,UAC6B;AAC7B,QAAM,mBAAmB,KAAK;AAAA,IAC5B,YAAY,KAAK,KAAK,GAAG,QAAQ,GAAG,aAAa,UAAU,QAAQ,OAAO;AAAA,EAC5E;AAEA,MAAI;AAGJ,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,GAAG;AACpE,UAAM,qBAAqB,YAAY,KAAK;AAG5C,QAAI,uBAAuB,kBAAkB,GAAG;AAC9C,YAAM,iBAAiB,uBAAuB,kBAAkB;AAChE,UAAI,gBAAgB;AAClB,eAAO;AAAA,MACT;AAAA,IAEF,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,WAAW,uBAAuB,YAAY,kBAAkB,aAAa,aAAa;AAChG,MAAI,cAAc,IAAI,QAAQ,GAAG;AAC/B,WAAO,cAAc,IAAI,QAAQ;AAAA,EACnC;AAIA,QAAM,WAAW,MAAM,mBAAmB;AAC1C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,EAAE,UAAU,YAAY,KAAK,eAAe,UAAU,iBAAiB,CAAC;AACpG,UAAI,MAAM,QAAQ;AAChB,mBAAW,KAAK;AAChB,YAAI,MAAM,kCAAkC,UAAU,+BAA+B,KAAK,UAAU,SAAS,WAAW,KAAK,QAAQ,SAAS,GAAG;AACjJ,sBAAc,IAAI,UAAU,QAAQ;AACpC,eAAO;AAAA,MACT;AAAA,IACF,SAAS,KAAK;AACZ,UAAI;AAAA,QACF,gDAAgD,UAAU,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAClH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,eAAe,UAAU;AACpC,MAAI,UAAU;AACZ,QAAI,MAAM,kCAAkC,UAAU,6BAA6B;AAAA,EACrF,OAAO;AACL,QAAI,MAAM,2CAA2C,UAAU,mBAAc;AAAA,EAC/E;AAIA,MAAI,UAAU;AACZ,kBAAc,IAAI,UAAU,QAAQ;AAAA,EACtC;AACA,SAAO;AACT;AAKA,SAAS,eAAe,YAAwC;AAC9D,QAAM,aAAa,WAAW,YAAY,EAAE,QAAQ,cAAc,GAAG;AACrE,QAAM,aAAa;AAAA,IACjB,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,EACf;AACA,aAAW,UAAU,YAAY;AAC/B,UAAM,QAAQ,WAAW,MAAM;AAC/B,QAAI,SAAS,MAAM,KAAK,EAAE,SAAS,GAAG;AACpC,aAAO,MAAM,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AASA,eAAsB,gCAA0E;AAE9F,QAAM,mBAAmB;AACzB,SAAO;AACT;AAKO,SAAS,mBAAyB;AACvC,gBAAc,MAAM;AACpB,8BAA4B;AAC5B,4BAA0B;AAC1B,oBAAkB;AAClB,yBAAuB;AACzB;AAEO,SAAS,4BAA4B,UAAwC;AAClF,8BAA4B;AAC5B,oBAAkB,aAAa;AAC/B,yBAAuB;AACzB;AAEO,SAAS,uCACd,UACM;AACN,4BAA0B;AAC1B,oBAAkB,aAAa,QAAQ,8BAA8B;AACrE,yBAAuB;AACzB;","names":[]}