@remnic/core 9.69.44 → 9.69.46

package/dist/{chunk-UHSOPTNB.js → chunk-EP6BA7VV.js}

@@ -116,6 +116,7 @@ var CodexSubscriptionTimeoutError = class extends Error {
   }
 };
 var loginStatusCache = /* @__PURE__ */ new Map();
+var inFlightLoginByRunner = /* @__PURE__ */ new WeakMap();
 var childrenByRunner = /* @__PURE__ */ new WeakMap();
 var runnerByOwner = /* @__PURE__ */ new WeakMap();
 var shutdownByRunner = /* @__PURE__ */ new WeakMap();
@@ -138,7 +139,8 @@ function createCodexSubscriptionRunner(deps = {}) {
     return runCodexSubscriptionRequest(
       { ...request, options: { ...request.options, signal } },
       runnerDeps,
-      envSource
+      envSource,
+      runner
     );
   };
   childrenByRunner.set(runner, children);
@@ -191,7 +193,7 @@ function beginCodexSubscriptionShutdown(runner, forceKillAfterMs = 1e3) {
     terminateActiveCodexSubscriptionChildren("SIGKILL", runner);
   };
 }
-async function runCodexSubscriptionRequest(request, deps, envSource) {
+async function runCodexSubscriptionRequest(request, deps, envSource, runner) {
   const { config } = request;
   assertNoApiKeyConfig(config);
   const executable = resolveExecutable(config, envSource);
@@ -204,7 +206,7 @@ async function runCodexSubscriptionRequest(request, deps, envSource) {
     throw abortErrorOf(request.options.signal);
   }
   await assertSubscriptionLogin(executable, env, deps, {
-    loginStatusTimeoutMs: Math.min(LOGIN_STATUS_TIMEOUT_MS, timeoutMs),
+    runner,
     callerTimeoutMs: timeoutMs,
     deadlineStartedAt,
     signal: request.options.signal
@@ -301,15 +303,32 @@ function isAllowedEnvKey(key) {
 }
 async function assertSubscriptionLogin(executable, env, deps, ctx) {
   const now = deps.now ?? Date.now;
-  const cacheKey = `${executable}\0${resolveCodexAuthHome(env) ?? ""}`;
+  const cacheKey = loginCacheKey(executable, env);
+  const inflight = inFlightLoginsFor(ctx.runner).get(cacheKey);
+  if (inflight && now() - inflight.at < LOGIN_STATUS_CACHE_TTL_MS) {
+    await waitForLoginEntry(inflight, cacheKey, ctx, now);
+    return;
+  }
   const cached = loginStatusCache.get(cacheKey);
   if (cached && now() - cached.at < LOGIN_STATUS_CACHE_TTL_MS) {
     if (!cached.settled || await authStoreFingerprint(env) === cached.fingerprint) {
       await waitForLoginEntry(cached, cacheKey, ctx, now);
       return;
     }
+    if (loginStatusCache.get(cacheKey) === cached) {
+      loginStatusCache.delete(cacheKey);
+    }
+  }
+  const raced = inFlightLoginsFor(ctx.runner).get(cacheKey);
+  if (raced && now() - raced.at < LOGIN_STATUS_CACHE_TTL_MS) {
+    await waitForLoginEntry(raced, cacheKey, ctx, now);
+    return;
+  }
+  const published = loginStatusCache.get(cacheKey);
+  if (published && now() - published.at < LOGIN_STATUS_CACHE_TTL_MS) {
+    await waitForLoginEntry(published, cacheKey, ctx, now);
+    return;
   }
-  loginStatusCache.delete(cacheKey);
   if (ctx.signal?.aborted) {
     throw abortErrorOf(ctx.signal);
   }
@@ -321,28 +340,28 @@ async function assertSubscriptionLogin(executable, env, deps, ctx) {
     controller: new AbortController(),
     promise: Promise.resolve(void 0)
   };
-  entry.promise = runLoginStatusCheck(executable, env, deps, ctx, entry);
+  entry.promise = runLoginStatusCheck(executable, env, deps, entry);
   entry.promise.then(
     () => {
       entry.settled = true;
+      loginStatusCache.set(cacheKey, entry);
+      dropInFlightLogin(ctx.runner, cacheKey, entry);
     },
     () => {
       entry.settled = true;
-      if (loginStatusCache.get(cacheKey) === entry) {
-        loginStatusCache.delete(cacheKey);
-      }
+      dropInFlightLogin(ctx.runner, cacheKey, entry);
     }
   );
-  loginStatusCache.set(cacheKey, entry);
+  inFlightLoginsFor(ctx.runner).set(cacheKey, entry);
   await waitForLoginEntry(entry, cacheKey, ctx, now);
 }
-async function runLoginStatusCheck(executable, env, deps, ctx, entry) {
+async function runLoginStatusCheck(executable, env, deps, entry) {
   const runLoginStatus = deps.runLoginStatus;
-  const result = await runLoginStatus(executable, env, ctx.loginStatusTimeoutMs, entry.controller.signal);
+  const result = await runLoginStatus(executable, env, LOGIN_STATUS_TIMEOUT_MS, entry.controller.signal);
   const output = `${result.stdout}
 ${result.stderr}`.trim();
   if (TIMEOUT_PATTERN.test(output)) {
-    throw new CodexSubscriptionTimeoutError(ctx.loginStatusTimeoutMs);
+    throw new CodexSubscriptionTimeoutError(LOGIN_STATUS_TIMEOUT_MS);
   }
   if (result.status === 0 && LOGIN_OK_PATTERN.test(output)) {
     entry.fingerprint = await authStoreFingerprint(env);
@@ -393,6 +412,7 @@ async function waitForLoginEntry(entry, cacheKey, ctx, now) {
     entry.waiters--;
     if (entry.waiters <= 0 && !entry.settled) {
       entry.controller.abort();
+      dropInFlightLogin(ctx.runner, cacheKey, entry);
       if (loginStatusCache.get(cacheKey) === entry) {
         loginStatusCache.delete(cacheKey);
       }
@@ -416,6 +436,21 @@ function resolveCodexAuthHome(env) {
   const profile = env.HOME ?? env.USERPROFILE;
   return profile ? path.join(profile, ".codex") : void 0;
 }
+function loginCacheKey(executable, env) {
+  return `${executable}\0${resolveCodexAuthHome(env) ?? ""}`;
+}
+function inFlightLoginsFor(runner) {
+  let map = inFlightLoginByRunner.get(runner);
+  if (!map) {
+    map = /* @__PURE__ */ new Map();
+    inFlightLoginByRunner.set(runner, map);
+  }
+  return map;
+}
+function dropInFlightLogin(runner, cacheKey, entry) {
+  const map = inFlightLoginByRunner.get(runner);
+  if (map?.get(cacheKey) === entry) map.delete(cacheKey);
+}
 function buildExecArgs(modelId, config, workspacePath, outputPath) {
   const reasoningEffort = readReasoningEffort(config) ?? DEFAULT_REASONING_EFFORT;
   return [
@@ -511,7 +546,7 @@ ${result.stdout}`;
     return new CodexSubscriptionTimeoutError(timeoutMs);
   }
   if (AUTH_FAILURE_PATTERN.test(combined)) {
-    loginStatusCache.delete(`${executable}\0${env.CODEX_HOME ?? env.HOME ?? ""}`);
+    loginStatusCache.delete(loginCacheKey(executable, env));
     return new CodexSubscriptionAuthError(
       "expired_or_revoked",
       "codex-subscription: the Codex CLI rejected the request as unauthenticated (session expired or revoked). Run `codex login` again to re-authenticate, then retry."
@@ -981,4 +1016,4 @@ export {
   readGatewayWorkspaceDir,
   defaultOpenClawWorkspaceDir
 };
-//# sourceMappingURL=chunk-UHSOPTNB.js.map
+//# sourceMappingURL=chunk-EP6BA7VV.js.map

package/dist/chunk-EP6BA7VV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fallback-llm-codex-subscription.ts","../src/providers/codex-subscription.ts"],"sourcesContent":["/**\n * Helpers extracted from FallbackLlmClient so fallback-llm.ts stays under\n * the 1200-line cap: Codex-subscription lifecycle (issue #2833) plus\n * generic chain helpers used by the same client.\n */\n\nimport path from \"node:path\";\nimport { raceAbort } from \"./abort-error.js\";\nimport { callCodexCliFallback, isCodexCliFallbackRunnerRegistered } from \"./cli-fallback.js\";\nimport type { CodexCliFallbackRunner } from \"./cli-fallback.js\";\nimport {\n  CODEX_SUBSCRIPTION_PROVIDER_ID,\n  CodexSubscriptionAuthError,\n  CodexSubscriptionConfigError,\n  CodexSubscriptionTimeoutError,\n  assertNoApiKeyConfig,\n  ensureCodexSubscriptionRunnerRegistered,\n  getCodexSubscriptionRunnerForOwner,\n  getCodexSubscriptionShutdownSignal,\n  isDefaultRegisteredCodexSubscriptionRunner,\n} from \"./providers/codex-subscription.js\";\nimport type { GetRuntimeAuthForModelFn, ResolveApiKeyFn } from \"./resolve-provider-secret.js\";\nimport { resolveHomeDir } from \"./runtime/env.js\";\nimport type { GatewayConfig, ModelProviderConfig } from \"./types.js\";\nimport { expandTildePath } from \"./utils/path.js\";\n\ntype CodexSubscriptionAttemptResult = {\n  content: string;\n  usage?: {\n    inputTokens?: number;\n    outputTokens?: number;\n    totalTokens?: number;\n  };\n};\n\n/**\n * Terminal codex-subscription failures (timeout, auth, config contract).\n * These carry documented caller guidance (`TimeoutError` name, `codex login`\n * steps), so they must survive the chain instead of collapsing into a\n * generic empty/http_error result (issue #2833).\n */\nexport function isTerminalCodexSubscriptionError(error: unknown): boolean {\n  return (\n    error instanceof CodexSubscriptionTimeoutError ||\n    error instanceof CodexSubscriptionAuthError ||\n    error instanceof CodexSubscriptionConfigError\n  );\n}\n\n/**\n * Single bounded headroom shared by both sides of the Codex deadline\n * (issue #2890): the provider gets it as SIGTERM lead time\n * (`timeoutMs - headroom`) and the outer race as settle grace, so the hard\n * outer bound stays `timeoutMs + headroom` (<= 25 ms past the deadline).\n */\nexport function codexDeadlineHeadroomMs(timeoutMs: number): number {\n  return Math.min(25, Math.max(1, Math.floor(timeoutMs / 10)));\n}\n\n/**\n * Settle a fallback-LLM chain at the caller deadline. Abort the in-flight\n * work, then wait a bounded settle grace for the chain to surface a typed\n * provider timeout (default: one event-loop turn). A chain that settles\n * within the grace wins with its own result or error; one that never\n * settles still cannot exceed `timeoutMs + settleGraceMs`. The abandoned\n * promise is observed so a late rejection cannot become unhandled.\n */\nexport async function raceFallbackLlmDeadline<T>(\n  work: Promise<T>,\n  timeoutMs: number,\n  abortOnTimeout: () => void,\n  settleGraceMs = 0,\n): Promise<{ timedOut: true } | { timedOut: false; value: T }> {\n  const deadline = new AbortController();\n  const timer = setTimeout(() => deadline.abort(), timeoutMs);\n  deadline.signal.addEventListener(\"abort\", abortOnTimeout, { once: true });\n  try {\n    const value = await raceAbort(\n      work,\n      deadline.signal,\n      `fallback LLM timed out after ${timeoutMs}ms`,\n    );\n    return { timedOut: false, value };\n  } catch (error) {\n    if (!deadline.signal.aborted) throw error;\n    let graceTimer: NodeJS.Timeout | undefined;\n    const afterAbort = await Promise.race([\n      work.then(\n        (value) => ({ state: \"value\" as const, value }),\n        (lateError) => ({ state: \"error\" as const, error: lateError }),\n      ),\n      new Promise<{ state: \"pending\" }>((resolve) => {\n        if (settleGraceMs > 0) {\n          graceTimer = setTimeout(() => resolve({ state: \"pending\" }), settleGraceMs);\n        } else {\n          setImmediate(() => resolve({ state: \"pending\" }));\n        }\n      }),\n    ]);\n    clearTimeout(graceTimer);\n    if (afterAbort.state === \"value\") return { timedOut: false, value: afterAbort.value };\n    if (afterAbort.state === \"error\") throw afterAbort.error;\n    void work.then(\n      () => undefined,\n      () => undefined,\n    );\n    return { timedOut: true };\n  } finally {\n    clearTimeout(timer);\n    deadline.signal.removeEventListener(\"abort\", abortOnTimeout);\n  }\n}\n\n/**\n * Attempt the Codex CLI / subscription provider. Returns `undefined` when the\n * model is not `api: \"codex-cli\"` so the generic FallbackLlmClient path runs.\n *\n * Subscription ids reject a configured apiKey before generic secret resolution\n * — otherwise an unresolvable ref throws a generic error and the provider's\n * `codex login` guidance never surfaces (issue #2833). Other `codex-cli`\n * providers still resolve a configured key. Runtime auth is skipped: the CLI\n * login is the credential.\n */\nexport async function tryCodexSubscriptionProvider(\n  model: {\n    providerId: string;\n    modelId: string;\n    providerConfig: ModelProviderConfig;\n  },\n  messages: Array<{ role: \"system\" | \"user\" | \"assistant\"; content: string }>,\n  options: { timeoutMs?: number; signal?: AbortSignal },\n  resolveFallbackApiKey: () => Promise<string | undefined>,\n  runner?: CodexCliFallbackRunner,\n): Promise<CodexSubscriptionAttemptResult | undefined> {\n  if (model.providerConfig.api !== \"codex-cli\") return undefined;\n\n  if (model.providerId === CODEX_SUBSCRIPTION_PROVIDER_ID) {\n    assertNoApiKeyConfig(model.providerConfig);\n  }\n\n  const resolvedApiKey =\n    model.providerConfig.apiKey === undefined ? undefined : await resolveFallbackApiKey();\n  const rawKey = model.providerConfig.apiKey;\n  const needsResolution =\n    rawKey === \"secretref-managed\" || (typeof rawKey === \"object\" && rawKey !== null);\n  if (needsResolution && !resolvedApiKey) {\n    throw new Error(`API key for provider \"${model.providerId}\" could not be resolved from secret ref`);\n  }\n\n  const effectiveConfig: ModelProviderConfig = {\n    ...model.providerConfig,\n    ...(resolvedApiKey ? { apiKey: resolvedApiKey } : {}),\n  };\n\n  // Let the provider surface its typed timeout before the generic outer\n  // deadline: the shared bounded headroom is SIGTERM lead time here and\n  // settle grace in raceFallbackLlmDeadline (issue #2890).\n  const callOptions = {\n    timeoutMs: options.timeoutMs === undefined\n      ? undefined\n      : Math.max(1, options.timeoutMs - codexDeadlineHeadroomMs(options.timeoutMs)),\n    signal: options.signal,\n  };\n  // A host/benchmark runner on the process seam still wins. The core\n  // default runner does not: prefer the owning runtime so shutdown\n  // terminates the request that runtime started.\n  if (isCodexCliFallbackRunnerRegistered() && !(runner && isDefaultRegisteredCodexSubscriptionRunner())) {\n    return await callCodexCliFallback(effectiveConfig, model.modelId, messages, callOptions);\n  }\n  if (runner) {\n    return await callCodexCliFallback(effectiveConfig, model.modelId, messages, callOptions, runner);\n  }\n  ensureCodexSubscriptionRunnerRegistered();\n  return await callCodexCliFallback(effectiveConfig, model.modelId, messages, callOptions);\n}\n\nexport function abortReason(signal: AbortSignal | undefined): Error {\n  const reason = signal?.reason;\n  return reason instanceof Error ? reason : new Error(\"task LLM request aborted\");\n}\n\nexport function withCodexRuntimeShutdown<T extends { signal?: AbortSignal }>(\n  options: T,\n  runner: CodexCliFallbackRunner | undefined,\n): T {\n  if (!runner) return options;\n  const shutdown = getCodexSubscriptionShutdownSignal(runner);\n  if (!shutdown) return options;\n  return {\n    ...options,\n    signal: options.signal ? AbortSignal.any([options.signal, shutdown]) : shutdown,\n  };\n}\n\nexport function isUnsupportedJsonSchemaError(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  // Require an HTTP status plus explicit schema/format context. A bare\n  // \"unsupported\" (e.g. \"'temperature' is unsupported with this model\") must\n  // NOT trigger the schema-stripping retry, or we pay a duplicate request\n  // for unrelated provider errors.\n  if (!/\\b(?:400|404|422)\\b/.test(message)) {\n    return false;\n  }\n  if (/(?:response[_ ]?format|json[_ ]?schema|structured[_ ]?output)/i.test(message)) {\n    return true;\n  }\n  // \"unsupported\" only counts when adjacent to schema/format terminology.\n  return /\\bunsupported\\b[\\s\\S]{0,40}\\b(?:schema|format)\\b/i.test(message);\n}\n\nexport function extractResponsesOutputText(data: {\n  output_text?: string;\n  output?: Array<{\n    type?: string;\n    text?: string;\n    content?: Array<{\n      type?: string;\n      text?: string;\n    }>;\n  }>;\n}): string | null {\n  if (typeof data.output_text === \"string\" && data.output_text.trim().length > 0) {\n    return data.output_text;\n  }\n\n  const chunks: string[] = [];\n  for (const item of data.output ?? []) {\n    if (typeof item.text === \"string\" && item.text.trim().length > 0) {\n      chunks.push(item.text);\n    }\n    for (const part of item.content ?? []) {\n      if (\n        (part.type === \"output_text\" || part.type === \"text\") &&\n        typeof part.text === \"string\" &&\n        part.text.trim().length > 0\n      ) {\n        chunks.push(part.text);\n      }\n    }\n  }\n\n  const joined = chunks.join(\"\\n\").trim();\n  return joined.length > 0 ? joined : null;\n}\n\nexport type StructuredParseFailureReason =\n  | \"no_models\"\n  | \"empty\"\n  | \"http_error\"\n  | \"schema_rejection\"\n  | \"timeout\";\n\nexport interface StructuredParseFailure {\n  result: null;\n  failureReason: StructuredParseFailureReason;\n  /** Model string of the last attempt, when one was selected. Not `modelUsed`. */\n  attemptedModel?: string;\n  /** HTTP status when known. Never a response body. */\n  httpStatus?: number;\n  /** Coarse class: http_4xx / http_5xx / timeout / network / empty / schema_rejection / no_models. */\n  errorClass?: string;\n}\n\nexport type StructuredParseResult<T> =\n  | { result: T; modelUsed: string }\n  | StructuredParseFailure;\n\nexport interface FallbackLlmRuntimeContext {\n  agentDir?: string;\n  getRuntimeAuthForModel?: GetRuntimeAuthForModelFn | null;\n  resolveApiKeyForProvider?: ResolveApiKeyFn | null;\n  workspaceDir?: string;\n  /** Per-runtime Codex child owner. Shutdown must terminate only this runner. */\n  codexSubscriptionRunner?: CodexCliFallbackRunner;\n}\n\ntype GatewayBackedRuntimeConfig = {\n  providerApiKeyResolver?: ResolveApiKeyFn | null;\n  runtimeAuthForModelResolver?: GetRuntimeAuthForModelFn | null;\n  workspaceDir?: string;\n};\n\nexport function fallbackLlmRuntimeContextFromConfig(\n  config: Pick<\n    GatewayBackedRuntimeConfig,\n    \"providerApiKeyResolver\" | \"runtimeAuthForModelResolver\" | \"workspaceDir\"\n  >,\n  overrides: FallbackLlmRuntimeContext = {},\n): FallbackLlmRuntimeContext {\n  return {\n    workspaceDir: config.workspaceDir,\n    resolveApiKeyForProvider: config.providerApiKeyResolver,\n    getRuntimeAuthForModel: config.runtimeAuthForModelResolver,\n    codexSubscriptionRunner: getCodexSubscriptionRunnerForOwner(config),\n    ...overrides,\n  };\n}\n\nconst HTTP_STATUS_IN_MESSAGE = /\\b([1-5]\\d{2})\\b/;\n\nexport function isTimeoutError(err: unknown): boolean {\n  const msg = err instanceof Error ? err.message : String(err);\n  return /timed out after \\d+ms/i.test(msg) || /timed out before request started/i.test(msg);\n}\n\nfunction isEmptyProviderResponse(err: unknown): boolean {\n  const msg = err instanceof Error ? err.message : String(err);\n  return /^Empty response from /i.test(msg);\n}\n\nfunction finiteHttpStatus(value: unknown): number | undefined {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || !Number.isInteger(value)) return undefined;\n  if (value < 100 || value > 599) return undefined;\n  return value;\n}\n\nfunction httpStatusFromProviderError(err: unknown): number | undefined {\n  if (err && typeof err === \"object\") {\n    if (\"status\" in err) {\n      const status = finiteHttpStatus(err.status);\n      if (status !== undefined) return status;\n    }\n    if (\"statusCode\" in err) {\n      const status = finiteHttpStatus(err.statusCode);\n      if (status !== undefined) return status;\n    }\n  }\n  const msg = err instanceof Error ? err.message : String(err);\n  const match = HTTP_STATUS_IN_MESSAGE.exec(msg);\n  if (!match) return undefined;\n  return finiteHttpStatus(Number(match[1]));\n}\n\nfunction errorClassForHttpStatus(status: number): string {\n  if (status >= 500) return \"http_5xx\";\n  if (status >= 400) return \"http_4xx\";\n  return `http_${status}`;\n}\n\nexport function classifyThrownProviderError(err: unknown): Omit<StructuredParseFailure, \"result\"> {\n  if (isTimeoutError(err)) {\n    return { failureReason: \"timeout\", errorClass: \"timeout\" };\n  }\n  if (isEmptyProviderResponse(err)) {\n    return { failureReason: \"empty\", errorClass: \"empty\" };\n  }\n  const httpStatus = httpStatusFromProviderError(err);\n  if (httpStatus !== undefined) {\n    return {\n      failureReason: \"http_error\",\n      httpStatus,\n      errorClass: errorClassForHttpStatus(httpStatus),\n    };\n  }\n  return { failureReason: \"http_error\", errorClass: \"network\" };\n}\n\nexport function normalizeRuntimePath(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? expandTildePath(trimmed) : undefined;\n}\n\nexport function readGatewayWorkspaceDir(gatewayConfig: GatewayConfig | undefined): string | undefined {\n  if (!gatewayConfig || typeof gatewayConfig !== \"object\") return undefined;\n  const raw = gatewayConfig as Record<string, unknown>;\n  return (\n    normalizeRuntimePath(raw.workspaceDir) ??\n    normalizeRuntimePath(raw.workspacePath) ??\n    normalizeRuntimePath(raw.workspace)\n  );\n}\n\nexport function defaultOpenClawWorkspaceDir(): string {\n  return path.join(resolveHomeDir(), \".openclaw\", \"workspace\");\n}\n","/**\n * Codex subscription extraction provider (issue #2784).\n *\n * Routes extraction/consolidation LLM calls through the `codex` CLI so the\n * operator's Codex subscription (ChatGPT OAuth login) authenticates the\n * request — no OpenAI API key and no codex-openai-proxy. Credentials stay in\n * the CLI's own auth store; this module never reads, accepts, or logs tokens.\n *\n * Transport contract mirrors `packages/bench/src/providers/codex-cli.ts`\n * (`codex exec --json --output-last-message`, env allowlist, login-status\n * precheck) but lives in core so the standalone daemon and host plugins get\n * a working `api: \"codex-cli\"` transport without importing the optional\n * bench package. Registered through the existing\n * `setCodexCliFallbackRunnerForProcess` seam, and only when no host or\n * benchmark runner has claimed it first.\n */\n\nimport { mkdir, mkdtemp, readFile, rm, stat } from \"node:fs/promises\";\nimport os from \"node:os\";\nimport path from \"node:path\";\n\nimport type {\n  CodexCliFallbackConfig,\n  CodexCliFallbackMessage,\n  CodexCliFallbackRequest,\n  CodexCliFallbackResult,\n  CodexCliFallbackRunner,\n} from \"../cli-fallback.js\";\nimport { getCodexCliFallbackRunnerForProcess, isCodexCliFallbackRunnerRegistered, normalizeCodexCliTimeoutMs, setCodexCliFallbackRunnerForProcess } from \"../cli-fallback.js\";\nimport { log } from \"../logger.js\";\nimport { launchProcess } from \"../runtime/child-process.js\";\nimport type { CodexCliReasoningEffort, ModelProviderConfig } from \"../types.js\";\nimport { expandTildePath } from \"../utils/path.js\";\n\nexport const CODEX_SUBSCRIPTION_PROVIDER_ID = \"codex-subscription\";\n\n/** Env var overriding the codex executable (mirrors the bench provider). */\nconst CODEX_EXECUTABLE_ENV = \"REMNIC_CODEX_EXECUTABLE\";\n\nconst DEFAULT_REASONING_EFFORT: CodexCliReasoningEffort = \"medium\";\nconst DEFAULT_TIMEOUT_MS = 120_000;\nconst LOGIN_STATUS_TIMEOUT_MS = 10_000;\nconst LOGIN_STATUS_CACHE_TTL_MS = 10 * 60_000;\nconst STDIO_LIMIT = 64_000;\nconst OUTPUT_SUMMARY_LIMIT = 500;\n/**\n * Env keys whose value is a filesystem path. Relative values resolve against\n * the original process cwd before either child launches, because the exec\n * child runs with cwd = the ephemeral workspace (same rule as executables).\n */\nconst PATH_BEARING_ENV_KEYS: Readonly<Record<string, true>> = Object.freeze({ CODEX_HOME: true, HOME: true, USERPROFILE: true });\n\n/**\n * Environment keys forwarded to the codex child. Everything else — including\n * ambient `OPENAI_API_KEY` / `OPENAI_BASE_URL` — is stripped so the CLI cannot\n * silently fall back to metered API-key auth instead of the subscription\n * login. Mirrors the bench provider's allowlist.\n */\nconst CODEX_RUNTIME_ENV_ALLOWLIST: Readonly<Record<string, true>> = Object.freeze({\n  ALL_PROXY: true,\n  APPDATA: true,\n  CODEX_HOME: true,\n  COLORTERM: true,\n  COMSPEC: true,\n  FORCE_COLOR: true,\n  HOME: true,\n  HOMEDRIVE: true,\n  HOMEPATH: true,\n  LANG: true,\n  LOCALAPPDATA: true,\n  LOGNAME: true,\n  NO_COLOR: true,\n  NODE_EXTRA_CA_CERTS: true,\n  NO_PROXY: true,\n  NUMBER_OF_PROCESSORS: true,\n  OS: true,\n  PATH: true,\n  PATHEXT: true,\n  PROGRAMDATA: true,\n  PROCESSOR_ARCHITECTURE: true,\n  HTTP_PROXY: true,\n  HTTPS_PROXY: true,\n  SHELL: true,\n  SSL_CERT_DIR: true,\n  SSL_CERT_FILE: true,\n  SYSTEMDRIVE: true,\n  SYSTEMROOT: true,\n  TEMP: true,\n  TERM: true,\n  TMP: true,\n  TMPDIR: true,\n  USER: true,\n  USERNAME: true,\n  USERPROFILE: true,\n  WINDIR: true,\n  XDG_CACHE_HOME: true,\n  XDG_CONFIG_HOME: true,\n  XDG_DATA_HOME: true,\n  XDG_RUNTIME_DIR: true,\n});\n\nconst LOGIN_OK_PATTERN = /logged in using chatgpt/i;\nconst LOGIN_API_KEY_PATTERN = /api key/i;\n/** CLI output shapes that mean the subscription session was rejected. */\nconst AUTH_FAILURE_PATTERN =\n  /\\b401\\b|\\b403\\b|unauthorized|forbidden|not logged in|no active|re-?authenticat|token expired|session expired|please log ?in/i;\nconst TIMEOUT_PATTERN = /timed out after \\d+ms/i;\n/** Secret shapes a codex CLI could echo into errors; replaced before surfacing. */\nconst SECRET_ECHO_PATTERNS: readonly RegExp[] = [\n  /sk-[A-Za-z0-9_-]{8,}/g,\n  /Bearer\\s+[A-Za-z0-9._-]{8,}/g,\n  /eyJ[A-Za-z0-9._-]{10,}/g,\n];\n\n/**\n * Built-in provider entry so `\"codex-subscription/<model>\"` chains resolve\n * with no models.json and no apiKey — the transport owns authentication.\n */\nexport function codexSubscriptionBuiltinProviderConfig(): ModelProviderConfig {\n  return {\n    baseUrl: \"codex-cli://subscription\",\n    api: \"codex-cli\",\n    models: [],\n  };\n}\n\nexport type CodexSubscriptionAuthReason = \"unauthenticated\" | \"expired_or_revoked\";\n\n/** Login/authorization failure with actionable re-auth guidance. */\nexport class CodexSubscriptionAuthError extends Error {\n  readonly reason: CodexSubscriptionAuthReason;\n\n  constructor(reason: CodexSubscriptionAuthReason, message: string) {\n    super(message);\n    this.name = \"CodexSubscriptionAuthError\";\n    this.reason = reason;\n  }\n}\n\n/** Provider config violated the no-raw-credentials contract. */\nexport class CodexSubscriptionConfigError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"CodexSubscriptionConfigError\";\n  }\n}\n\n/** Request exceeded its deadline. Abort-driven cancellations rethrow the\n * caller's own abort reason instead, preserving the AbortError contract. */\nexport class CodexSubscriptionTimeoutError extends Error {\n  constructor(timeoutMs: number) {\n    super(`codex-subscription request timed out after ${timeoutMs}ms`);\n    this.name = \"TimeoutError\";\n  }\n}\n\nexport interface CodexSubscriptionExecRequest {\n  executable: string;\n  args: string[];\n  input: string;\n  env: NodeJS.ProcessEnv;\n  outputPath: string;\n  workspacePath: string;\n  timeoutMs?: number;\n  signal?: AbortSignal;\n}\n\nexport interface CodexSubscriptionExecResult {\n  status: number | null;\n  signal?: NodeJS.Signals | null;\n  stdout: string;\n  stderr: string;\n  outputText: string;\n}\n\nexport interface CodexSubscriptionRunnerDeps {\n  /** Runs `codex exec`. Default: isolated subprocess via launchProcess. */\n  runCodexExec?: (request: CodexSubscriptionExecRequest) => Promise<CodexSubscriptionExecResult>;\n  /** Runs `codex login status`. Default: isolated subprocess. Receives the\n   * shared login-status ceiling (not any one caller's deadline) and the\n   * shared-check abort signal (fires when the last waiter leaves). */\n  runLoginStatus?: (\n    executable: string,\n    env: NodeJS.ProcessEnv,\n    timeoutMs: number,\n    signal?: AbortSignal\n  ) => Promise<{ status: number | null; stdout: string; stderr: string }>;\n  /** Environment the isolated child env is filtered from. Tests inject fakes. */\n  env?: NodeJS.ProcessEnv;\n  tmpdir?: () => string;\n  now?: () => number;\n}\n\ninterface CommandOutput {\n  status: number | null;\n  signal?: NodeJS.Signals | null;\n  stdout: string;\n  stderr: string;\n}\n\ninterface LoginStatusCacheEntry {\n  at: number;\n  promise: Promise<void>;\n  /** Auth-store fingerprint at check time; a mismatch invalidates the entry. */\n  fingerprint: string | null;\n  /** Live waiters. The in-flight check aborts when the last waiter leaves. */\n  waiters: number;\n  settled: boolean;\n  controller: AbortController;\n}\n\nconst loginStatusCache = new Map<string, LoginStatusCacheEntry>();\nconst inFlightLoginByRunner = new WeakMap<CodexCliFallbackRunner, Map<string, LoginStatusCacheEntry>>();\nconst childrenByRunner = new WeakMap<CodexCliFallbackRunner, Set<number>>();\nconst runnerByOwner = new WeakMap<object, CodexCliFallbackRunner>();\nconst shutdownByRunner = new WeakMap<CodexCliFallbackRunner, AbortController>();\nlet defaultRegisteredRunner: CodexCliFallbackRunner | undefined;\nlet coreRunnerRegistered = false;\n\nexport function createCodexSubscriptionRunner(deps: CodexSubscriptionRunnerDeps = {}): CodexCliFallbackRunner {\n  const envSource = deps.env ?? process.env;\n  const children = new Set<number>();\n  const shutdown = new AbortController();\n  const runnerDeps: CodexSubscriptionRunnerDeps = {\n    ...deps,\n    runCodexExec: deps.runCodexExec ?? ((request) => runCodexExecSubprocess(request, children)),\n    runLoginStatus:\n      deps.runLoginStatus ??\n      ((executable, env, timeoutMs, signal) =>\n        runLoginStatusSubprocess(executable, env, timeoutMs, signal, children)),\n  };\n  const runner: CodexCliFallbackRunner = (request) => {\n    const signal = request.options.signal\n      ? AbortSignal.any([request.options.signal, shutdown.signal])\n      : shutdown.signal;\n    if (signal.aborted) {\n      return Promise.reject(abortErrorOf(signal));\n    }\n    return runCodexSubscriptionRequest(\n      { ...request, options: { ...request.options, signal } },\n      runnerDeps,\n      envSource,\n      runner,\n    );\n  };\n  childrenByRunner.set(runner, children);\n  shutdownByRunner.set(runner, shutdown);\n  return runner;\n}\n\n/** One runner per owning runtime/config object so teardown cannot cross instances. */\nexport function getCodexSubscriptionRunnerForOwner(owner: object): CodexCliFallbackRunner {\n  let runner = runnerByOwner.get(owner);\n  const shutdown = runner ? shutdownByRunner.get(runner) : undefined;\n  if (!runner || shutdown?.signal.aborted) {\n    runner = createCodexSubscriptionRunner();\n    runnerByOwner.set(owner, runner);\n  }\n  return runner;\n}\n\n/** Shutdown signal for the owning runner, if this function is a core runner. */\nexport function getCodexSubscriptionShutdownSignal(\n  runner: CodexCliFallbackRunner,\n): AbortSignal | undefined {\n  return shutdownByRunner.get(runner)?.signal;\n}\n\n/**\n * Registers the core subprocess transport on the codex-cli seam, but only\n * when no runner is registered yet — a host or benchmark runner that claimed\n * the seam first always wins. If the seam was cleared afterwards\n * (setCodexCliFallbackRunnerForProcess(undefined)), the core runner is\n * re-registered so the next call still routes. Idempotent.\n */\nexport function ensureCodexSubscriptionRunnerRegistered(deps: CodexSubscriptionRunnerDeps = {}): boolean {\n  if (isCodexCliFallbackRunnerRegistered()) return false;\n  defaultRegisteredRunner = createCodexSubscriptionRunner(deps);\n  setCodexCliFallbackRunnerForProcess(defaultRegisteredRunner);\n  coreRunnerRegistered = true;\n  return true;\n}\n\n/** True when the process seam still holds the core default runner. */\nexport function isDefaultRegisteredCodexSubscriptionRunner(): boolean {\n  return defaultRegisteredRunner !== undefined\n    && getCodexCliFallbackRunnerForProcess() === defaultRegisteredRunner;\n}\n/** Host shutdown hook: terminate this runtime's detached Codex children. Does not exit. */\nexport function terminateActiveCodexSubscriptionChildren(\n  signal: NodeJS.Signals = \"SIGTERM\",\n  runner?: CodexCliFallbackRunner,\n): void {\n  const target = runner ?? defaultRegisteredRunner;\n  if (!target) return;\n  const shutdown = shutdownByRunner.get(target);\n  if (shutdown && !shutdown.signal.aborted) {\n    shutdown.abort(new DOMException(\"The operation was aborted.\", \"AbortError\"));\n  }\n  const pids = childrenByRunner.get(target);\n  if (!pids) return;\n  for (const pid of pids) {\n    terminateCodexChildPid(pid, signal);\n  }\n}\n\n/** SIGTERM now, SIGKILL after a bound, even if the caller later awaits drain. */\nexport function beginCodexSubscriptionShutdown(\n  runner?: CodexCliFallbackRunner,\n  forceKillAfterMs = 1_000,\n): () => void {\n  terminateActiveCodexSubscriptionChildren(\"SIGTERM\", runner);\n  const timer = setTimeout(() => {\n    terminateActiveCodexSubscriptionChildren(\"SIGKILL\", runner);\n  }, forceKillAfterMs);\n  timer.unref();\n  return () => {\n    clearTimeout(timer);\n    terminateActiveCodexSubscriptionChildren(\"SIGKILL\", runner);\n  };\n}\nasync function runCodexSubscriptionRequest(\n  request: CodexCliFallbackRequest,\n  deps: CodexSubscriptionRunnerDeps,\n  envSource: NodeJS.ProcessEnv,\n  runner: CodexCliFallbackRunner,\n): Promise<CodexCliFallbackResult> {\n  const { config } = request;\n  assertNoApiKeyConfig(config);\n  const executable = resolveExecutable(config, envSource);\n  const env = buildIsolatedEnv(envSource);\n\n  const providerTimeoutMs = config.retryOptions?.timeoutMs !== undefined\n    ? normalizeCodexCliTimeoutMs(config.retryOptions.timeoutMs)\n    : undefined;\n  const timeoutMs = request.options.timeoutMs ?? providerTimeoutMs ?? DEFAULT_TIMEOUT_MS;\n  // The effective deadline starts BEFORE the login-status precheck: login\n  // consumes the same call/provider timeout budget, it is not additive.\n  const now = deps.now ?? Date.now;\n  const deadlineStartedAt = now();\n  if (request.options.signal?.aborted) {\n    throw abortErrorOf(request.options.signal);\n  }\n  await assertSubscriptionLogin(executable, env, deps, {\n    runner,\n    callerTimeoutMs: timeoutMs,\n    deadlineStartedAt,\n    signal: request.options.signal,\n  });\n\n  if (request.options.signal?.aborted) {\n    throw abortErrorOf(request.options.signal);\n  }\n\n  const remainingTimeoutMs = timeoutMs - (now() - deadlineStartedAt);\n  if (remainingTimeoutMs <= 0) {\n    throw new CodexSubscriptionTimeoutError(timeoutMs);\n  }\n  let tempDir: string | undefined;\n  try {\n    tempDir = await mkdtemp(path.join(deps.tmpdir?.() ?? os.tmpdir(), \"remnic-codex-sub-\"));\n    const workspacePath = path.join(tempDir, \"workspace\");\n    const outputPath = path.join(tempDir, \"last-message.txt\");\n    await mkdir(workspacePath, { recursive: true });\n\n    const runCodexExec = deps.runCodexExec!;\n    const result = await runCodexExec({\n      executable,\n      args: buildExecArgs(request.modelId, config, workspacePath, outputPath),\n      input: buildPrompt(request.messages),\n      env,\n      outputPath,\n      workspacePath,\n      timeoutMs: remainingTimeoutMs,\n      signal: request.options.signal,\n    });\n\n    if (result.status !== 0) {\n      const failure = execFailureError(result, remainingTimeoutMs, executable, env);\n      if (failure instanceof CodexSubscriptionTimeoutError) {\n        throw failure;\n      }\n      if (request.options.signal?.aborted) {\n        throw abortErrorOf(request.options.signal);\n      }\n      throw failure;\n    }\n    if (request.options.signal?.aborted) {\n      throw abortErrorOf(request.options.signal);\n    }\n\n    const content = result.outputText.trim();\n    if (content.length === 0) {\n      throw new Error(\n        `codex-subscription: codex exec returned no final message (${summarizeOutput(result.stderr, result.stdout)})`\n      );\n    }\n    return { content, ...usageFrom(result) };\n  } finally {\n    if (tempDir) {\n      await rm(tempDir, { force: true, recursive: true }).catch(() => {});\n    }\n  }\n}\n\n/**\n * This provider authenticates exclusively through the codex CLI login, so a\n * configured apiKey is a configuration mistake — reject it without echoing\n * the value.\n */\nexport function assertNoApiKeyConfig(config: CodexCliFallbackConfig): void {\n  if (config.apiKey !== undefined && config.apiKey !== \"\") {\n    throw new CodexSubscriptionConfigError(\n      `${CODEX_SUBSCRIPTION_PROVIDER_ID} does not accept apiKey configuration: it authenticates through the Codex CLI login. Remove the apiKey field and run \\`codex login\\` with a ChatGPT account instead.`\n    );\n  }\n}\n\nfunction resolveExecutable(config: CodexCliFallbackConfig, env: NodeJS.ProcessEnv): string {\n  const configured = config.codexCliExecutable ?? config.executable ?? env[CODEX_EXECUTABLE_ENV] ?? \"codex\";\n  const expanded = expandTildePath(String(configured).trim());\n  if (expanded.trim().length === 0) {\n    throw new CodexSubscriptionConfigError(`${CODEX_EXECUTABLE_ENV} / executable must not be empty`);\n  }\n  // The exec child runs with cwd = the temp workspace, and spawn resolves a\n  // relative executable against the CHILD cwd. Resolve relative paths against\n  // the original process cwd now so `./codex` stays valid; bare names keep\n  // PATH lookup.\n  if (expanded.includes(\"/\") || expanded.includes(\"\\\\\")) {\n    return path.resolve(expanded);\n  }\n  return expanded;\n}\n\nfunction buildIsolatedEnv(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = {};\n  for (const [key, value] of Object.entries(source)) {\n    if (value !== undefined && isAllowedEnvKey(key)) {\n      env[key] = PATH_BEARING_ENV_KEYS[key.toUpperCase()] === true\n        ? normalizePathEnvValue(value)\n        : value;\n    }\n  }\n  return env;\n}\n\n/**\n * The exec child runs with cwd = the ephemeral workspace while the login\n * child runs with cwd = this process, so a relative HOME/CODEX_HOME would\n * resolve differently per child. Anchor both to the original process cwd.\n */\nfunction normalizePathEnvValue(value: string): string {\n  const trimmed = value.trim();\n  if (trimmed.length === 0) {\n    return value;\n  }\n  const expanded = expandTildePath(trimmed);\n  return path.isAbsolute(expanded) ? expanded : path.resolve(expanded);\n}\nfunction isAllowedEnvKey(key: string): boolean {\n  const normalized = key.toUpperCase();\n  return CODEX_RUNTIME_ENV_ALLOWLIST[normalized] === true || normalized.startsWith(\"LC_\");\n}\n\ninterface LoginCheckContext {\n  runner: CodexCliFallbackRunner;\n  /** The caller's overall effective deadline (login + exec). */\n  callerTimeoutMs: number;\n  deadlineStartedAt: number;\n  signal?: AbortSignal;\n}\n\n/**\n * Verifies the operator's Codex subscription login via `codex login status`.\n * Success is cached briefly; failures are never cached so a re-login takes\n * effect on the next request. A cached success is also invalidated when the\n * auth store changes on disk (e.g. another process switches the same Codex\n * home from a ChatGPT login to an API key), so the cache can never mask a\n * later non-subscription login mode.\n */\nasync function assertSubscriptionLogin(\n  executable: string,\n  env: NodeJS.ProcessEnv,\n  deps: CodexSubscriptionRunnerDeps,\n  ctx: LoginCheckContext\n): Promise<void> {\n  const now = deps.now ?? Date.now;\n  const cacheKey = loginCacheKey(executable, env);\n  const inflight = inFlightLoginsFor(ctx.runner).get(cacheKey);\n  if (inflight && now() - inflight.at < LOGIN_STATUS_CACHE_TTL_MS) {\n    await waitForLoginEntry(inflight, cacheKey, ctx, now);\n    return;\n  }\n  const cached = loginStatusCache.get(cacheKey);\n  if (cached && now() - cached.at < LOGIN_STATUS_CACHE_TTL_MS) {\n    if (!cached.settled || (await authStoreFingerprint(env)) === cached.fingerprint) {\n      await waitForLoginEntry(cached, cacheKey, ctx, now);\n      return;\n    }\n    if (loginStatusCache.get(cacheKey) === cached) {\n      loginStatusCache.delete(cacheKey);\n    }\n  }\n  const raced = inFlightLoginsFor(ctx.runner).get(cacheKey);\n  if (raced && now() - raced.at < LOGIN_STATUS_CACHE_TTL_MS) {\n    await waitForLoginEntry(raced, cacheKey, ctx, now);\n    return;\n  }\n  const published = loginStatusCache.get(cacheKey);\n  if (published && now() - published.at < LOGIN_STATUS_CACHE_TTL_MS) {\n    await waitForLoginEntry(published, cacheKey, ctx, now);\n    return;\n  }\n  if (ctx.signal?.aborted) {\n    throw abortErrorOf(ctx.signal);\n  }\n  const entry: LoginStatusCacheEntry = {\n    at: now(),\n    fingerprint: null,\n    waiters: 0,\n    settled: false,\n    controller: new AbortController(),\n    promise: Promise.resolve(undefined),\n  };\n  entry.promise = runLoginStatusCheck(executable, env, deps, entry);\n  entry.promise.then(\n    () => {\n      entry.settled = true;\n      loginStatusCache.set(cacheKey, entry);\n      dropInFlightLogin(ctx.runner, cacheKey, entry);\n    },\n    () => {\n      entry.settled = true;\n      dropInFlightLogin(ctx.runner, cacheKey, entry);\n    }\n  );\n  inFlightLoginsFor(ctx.runner).set(cacheKey, entry);\n  await waitForLoginEntry(entry, cacheKey, ctx, now);\n}\n\nasync function runLoginStatusCheck(\n  executable: string,\n  env: NodeJS.ProcessEnv,\n  deps: CodexSubscriptionRunnerDeps,\n  entry: LoginStatusCacheEntry\n): Promise<void> {\n  const runLoginStatus = deps.runLoginStatus!;\n  const result = await runLoginStatus(executable, env, LOGIN_STATUS_TIMEOUT_MS, entry.controller.signal);\n  const output = `${result.stdout}\\n${result.stderr}`.trim();\n  if (TIMEOUT_PATTERN.test(output)) {\n    // A login-status subprocess timeout is a deadline expiry, not an auth\n    // failure — never report it as \"unauthenticated\".\n    throw new CodexSubscriptionTimeoutError(LOGIN_STATUS_TIMEOUT_MS);\n  }\n  if (result.status === 0 && LOGIN_OK_PATTERN.test(output)) {\n    entry.fingerprint = await authStoreFingerprint(env);\n    return;\n  }\n  const apiKeyNote = LOGIN_API_KEY_PATTERN.test(output)\n    ? \" The CLI currently reports an API-key login; subscription extraction needs a ChatGPT login.\"\n    : \"\";\n  throw new CodexSubscriptionAuthError(\n    \"unauthenticated\",\n    `codex-subscription: no ChatGPT-backed Codex login found. Run \\`codex login\\` and choose the ChatGPT account option, then retry.${apiKeyNote}`\n  );\n}\n\n/**\n * Waits on a shared login check with this caller's own budget. A deadline or\n * caller abort rejects immediately — without cancelling the shared check\n * while other callers still wait on it. When the LAST waiter leaves an\n * in-flight check, the subprocess is aborted and the entry dropped so a later\n * caller starts a fresh check.\n */\nasync function waitForLoginEntry(\n  entry: LoginStatusCacheEntry,\n  cacheKey: string,\n  ctx: LoginCheckContext,\n  now: () => number\n): Promise<void> {\n  const remainingMs = ctx.callerTimeoutMs - (now() - ctx.deadlineStartedAt);\n  if (remainingMs <= 0) {\n    throw new CodexSubscriptionTimeoutError(ctx.callerTimeoutMs);\n  }\n  const signal = ctx.signal;\n  let rejectOnAbort!: (reason?: unknown) => void;\n  const abortWait = new Promise<never>((_resolve, reject) => {\n    rejectOnAbort = reject;\n  });\n  // Identity matters: the same reference is removed in the finally below.\n  const onAbort = (): void => {\n    if (signal === undefined) return;\n    rejectOnAbort(abortErrorOf(signal));\n  };\n  signal?.addEventListener(\"abort\", onAbort, { once: true });\n  entry.waiters++;\n  // The deadline timer intentionally holds the event loop: this caller's\n  // await is backed by nothing else while the shared check is in flight.\n  let deadlineTimer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    await Promise.race([\n      entry.promise,\n      abortWait,\n      new Promise<never>((_resolve, reject) => {\n        deadlineTimer = setTimeout(\n          () => reject(new CodexSubscriptionTimeoutError(ctx.callerTimeoutMs)),\n          remainingMs\n        );\n      }),\n    ]);\n  } catch (err) {\n    if (signal?.aborted) {\n      throw abortErrorOf(signal);\n    }\n    throw err;\n  } finally {\n    clearTimeout(deadlineTimer);\n    signal?.removeEventListener(\"abort\", onAbort);\n    entry.waiters--;\n    if (entry.waiters <= 0 && !entry.settled) {\n      entry.controller.abort();\n      dropInFlightLogin(ctx.runner, cacheKey, entry);\n      if (loginStatusCache.get(cacheKey) === entry) {\n        loginStatusCache.delete(cacheKey);\n      }\n    }\n  }\n}\n\n/**\n * `mtimeMs:size` of the Codex auth store, read as metadata only — the\n * provider never reads the store's contents. A change between the cached\n * check and now invalidates the cached login mode.\n */\nasync function authStoreFingerprint(env: NodeJS.ProcessEnv): Promise<string | null> {\n  const home = resolveCodexAuthHome(env);\n  if (!home) {\n    return null;\n  }\n  try {\n    const stats = await stat(path.join(home, \"auth.json\"));\n    return `${stats.mtimeMs}:${stats.size}`;\n  } catch {\n    return null;\n  }\n}\n\nfunction resolveCodexAuthHome(env: NodeJS.ProcessEnv): string | undefined {\n  if (env.CODEX_HOME) return env.CODEX_HOME;\n  const profile = env.HOME ?? env.USERPROFILE;\n  return profile ? path.join(profile, \".codex\") : undefined;\n}\n\nfunction loginCacheKey(executable: string, env: NodeJS.ProcessEnv): string {\n  return `${executable}\\0${resolveCodexAuthHome(env) ?? \"\"}`;\n}\n\nfunction inFlightLoginsFor(runner: CodexCliFallbackRunner): Map<string, LoginStatusCacheEntry> {\n  let map = inFlightLoginByRunner.get(runner);\n  if (!map) {\n    map = new Map();\n    inFlightLoginByRunner.set(runner, map);\n  }\n  return map;\n}\n\nfunction dropInFlightLogin(\n  runner: CodexCliFallbackRunner,\n  cacheKey: string,\n  entry: LoginStatusCacheEntry,\n): void {\n  const map = inFlightLoginByRunner.get(runner);\n  if (map?.get(cacheKey) === entry) map.delete(cacheKey);\n}\n\n/**\n * Args mirror the bench provider: fully sandboxed, ephemeral, no tools/hooks/\n * plugins/memories — extraction must behave as a plain completion endpoint.\n */\nfunction buildExecArgs(\n  modelId: string,\n  config: CodexCliFallbackConfig,\n  workspacePath: string,\n  outputPath: string\n): string[] {\n  const reasoningEffort = readReasoningEffort(config) ?? DEFAULT_REASONING_EFFORT;\n  return [\n    \"exec\",\n    \"--strict-config\",\n    \"--model\",\n    modelId,\n    \"--config\",\n    `model_reasoning_effort=${JSON.stringify(reasoningEffort)}`,\n    \"--config\",\n    'approval_policy=\"never\"',\n    \"--config\",\n    'web_search=\"disabled\"',\n    \"--disable\",\n    \"hooks\",\n    \"--disable\",\n    \"shell_tool\",\n    \"--disable\",\n    \"unified_exec\",\n    \"--disable\",\n    \"apps\",\n    \"--disable\",\n    \"plugins\",\n    \"--disable\",\n    \"remote_plugin\",\n    \"--disable\",\n    \"multi_agent\",\n    \"--disable\",\n    \"browser_use\",\n    \"--disable\",\n    \"browser_use_external\",\n    \"--disable\",\n    \"computer_use\",\n    \"--disable\",\n    \"image_generation\",\n    \"--disable\",\n    \"in_app_browser\",\n    \"--disable\",\n    \"goals\",\n    \"--disable\",\n    \"memories\",\n    \"--disable\",\n    \"chronicle\",\n    \"--disable\",\n    \"tool_suggest\",\n    \"--disable\",\n    \"workspace_dependencies\",\n    \"--disable\",\n    \"shell_snapshot\",\n    \"--ephemeral\",\n    \"--ignore-user-config\",\n    \"--ignore-rules\",\n    \"--sandbox\",\n    \"read-only\",\n    \"--cd\",\n    workspacePath,\n    \"--skip-git-repo-check\",\n    \"--json\",\n    \"--output-last-message\",\n    outputPath,\n    \"-\",\n  ];\n}\n\nfunction readReasoningEffort(config: CodexCliFallbackConfig): CodexCliReasoningEffort | undefined {\n  for (const value of [config.codexCliReasoningEffort, config.reasoningEffort]) {\n    if (typeof value === \"string\") {\n      const normalized = value.trim().toLowerCase();\n      if (normalized === \"low\" || normalized === \"medium\" || normalized === \"high\" || normalized === \"xhigh\") {\n        return normalized;\n      }\n      throw new CodexSubscriptionConfigError(\n        \"codex-subscription reasoningEffort must be one of low, medium, high, xhigh (got unrecognized value)\"\n      );\n    }\n  }\n  return undefined;\n}\n\n/**\n * One JSON object per message: role boundaries are structural (JSON string\n * escaping), so literal `[system]`/role-marker text inside message content\n * can never forge another role's turn. Content stays model-visible verbatim.\n */\nfunction buildPrompt(messages: readonly CodexCliFallbackMessage[]): string {\n  const transcript = messages\n    .map((message) => JSON.stringify({ role: message.role, content: message.content }))\n    .join(\"\\n\");\n  return [\n    \"You are acting as an LLM completion endpoint for a memory-extraction pipeline, not as a coding agent.\",\n    \"Answer the request in the transcript below. Do not inspect files, run commands, browse, or use tools.\",\n    \"Return only the final answer text. If the request asks for JSON, return raw JSON only.\",\n    \"\",\n    'TRANSCRIPT (JSON Lines: one {\"role\":\"...\",\"content\":\"...\"} object per message; newlines inside content are escaped):',\n    transcript,\n  ].join(\"\\n\");\n}\n\nfunction execFailureError(\n  result: CodexSubscriptionExecResult,\n  timeoutMs: number,\n  executable: string,\n  env: NodeJS.ProcessEnv\n): Error {\n  const combined = `${result.stderr}\\n${result.stdout}`;\n  // The authoritative timeout marker wins over auth-pattern text: a timed-out\n  // exec may have already printed model/diagnostic output containing 401/403\n  // before the deadline fired (issue #2833).\n  if (TIMEOUT_PATTERN.test(combined)) {\n    return new CodexSubscriptionTimeoutError(timeoutMs);\n  }\n  if (AUTH_FAILURE_PATTERN.test(combined)) {\n    // Re-check login on the next request; the cached status is now stale.\n    loginStatusCache.delete(loginCacheKey(executable, env));\n    return new CodexSubscriptionAuthError(\n      \"expired_or_revoked\",\n      \"codex-subscription: the Codex CLI rejected the request as unauthenticated \" +\n        \"(session expired or revoked). Run `codex login` again to re-authenticate, then retry.\"\n    );\n  }\n\n  const exitLabel = result.signal ? `signal ${result.signal}` : `exit ${result.status ?? \"unknown\"}`;\n  return new Error(\n    `codex-subscription: codex exec failed (${exitLabel}): ${summarizeOutput(result.stderr, result.stdout)}`\n  );\n}\n\n/** Secret-redacted, then bounded tail of child output — the only child text\n * that ever reaches a thrown error. Redaction runs BEFORE bounding so a\n * secret straddling the cutoff cannot survive as an unmatchable fragment. */\nfunction summarizeOutput(stderr: string, stdout: string): string {\n  const summary = [stderr.trim(), stdout.trim()].filter((part) => part.length > 0).join(\"\\n\");\n  if (summary.length === 0) {\n    return \"no process output\";\n  }\n  return redactSecretEchoes(summary).slice(-OUTPUT_SUMMARY_LIMIT);\n}\n\nexport function redactSecretEchoes(value: string): string {\n  let redacted = value;\n  for (const pattern of SECRET_ECHO_PATTERNS) {\n    redacted = redacted.replace(pattern, \"[redacted]\");\n  }\n  return redacted;\n}\ntype CodexSubscriptionUsage = Pick<CodexCliFallbackResult, \"usage\">;\n\nfunction usageFrom(result: CodexSubscriptionExecResult): CodexSubscriptionUsage {\n  const usage = parseCodexJsonlUsage(`${result.stdout}\\n${result.stderr}`);\n  if (!usage) {\n    return {};\n  }\n  return {\n    usage: {\n      inputTokens: usage.inputTokens,\n      outputTokens: usage.outputTokens,\n      totalTokens: usage.inputTokens + usage.outputTokens,\n    },\n  };\n}\n\nexport function parseCodexJsonlUsage(output: string): { inputTokens: number; outputTokens: number } | undefined {\n  let usage: { inputTokens: number; outputTokens: number } | undefined;\n  for (const line of output.split(/\\r?\\n/)) {\n    const trimmed = line.trim();\n    if (!trimmed.startsWith(\"{\")) continue;\n    try {\n      const event = JSON.parse(trimmed) as {\n        type?: unknown;\n        usage?: Record<string, unknown>;\n      };\n      if (event.type !== \"turn.completed\" || !event.usage) continue;\n      const inputTokens = readCounter(event.usage.input_tokens);\n      const outputTokens = readCounter(event.usage.output_tokens);\n      if (inputTokens !== undefined && outputTokens !== undefined) {\n        usage = { inputTokens, outputTokens };\n      }\n    } catch {\n      // codex exec prints non-JSON status text alongside JSONL; ignore it\n    }\n  }\n  return usage;\n}\n\nfunction readCounter(value: unknown): number | undefined {\n  if (typeof value !== \"number\" || !Number.isFinite(value) || value < 0) {\n    return undefined;\n  }\n  return value;\n}\n\nfunction abortErrorOf(signal: AbortSignal): Error {\n  if (signal.reason instanceof CodexSubscriptionTimeoutError) return signal.reason;\n  const reason =\n    signal.reason instanceof Error\n      ? signal.reason\n      : signal.reason !== undefined\n        ? new Error(String(signal.reason))\n        : new DOMException(\"The operation was aborted.\", \"AbortError\");\n  const match = /fallback LLM timed out after (\\d+)ms/i.exec(reason.message);\n  if (match) {\n    return new CodexSubscriptionTimeoutError(Number(match[1]));\n  }\n  return reason;\n}\n\n/** Bounds streamed child output to STDIO_LIMIT, keeping the TAIL — codex\n * prints its final error or turn.completed result last. Secrets are redacted\n * BEFORE bounding so one straddling the cutoff cannot leak a fragment. */\nfunction appendBounded(existing: string, next: string): string {\n  const redacted = redactSecretEchoes(existing + next);\n  return redacted.length > STDIO_LIMIT ? redacted.slice(-STDIO_LIMIT) : redacted;\n}\n\nasync function runLoginStatusSubprocess(\n  executable: string,\n  env: NodeJS.ProcessEnv,\n  timeoutMs: number,\n  signal: AbortSignal | undefined,\n  children: Set<number>,\n): Promise<{ status: number | null; stdout: string; stderr: string }> {\n  return await runSubprocess(executable, [\"login\", \"status\"], {\n    env,\n    stdin: undefined,\n    timeoutMs,\n    timeoutLabel: \"login status\",\n    signal,\n    children,\n  });\n}\n\nasync function runCodexExecSubprocess(\n  request: CodexSubscriptionExecRequest,\n  children: Set<number>,\n): Promise<CodexSubscriptionExecResult> {\n  const result = await runSubprocess(request.executable, request.args, {\n    env: request.env,\n    stdin: request.input,\n    timeoutMs: request.timeoutMs,\n    timeoutLabel: \"exec\",\n    signal: request.signal,\n    cwd: request.workspacePath,\n    children,\n  });\n  if (result.status === 124) return { ...result, outputText: \"\" };\n  let outputText = \"\";\n  try {\n    outputText = (await readFile(request.outputPath, \"utf8\")).trim();\n  } catch {\n    // Missing output file surfaces as the no-final-message error path.\n  }\n  return { ...result, outputText };\n}\n\ninterface SubprocessOptions {\n  env: NodeJS.ProcessEnv;\n  stdin?: string;\n  timeoutMs?: number;\n  timeoutLabel: string;\n  signal?: AbortSignal;\n  cwd?: string;\n  children: Set<number>;\n}\n\nasync function runSubprocess(executable: string, args: string[], options: SubprocessOptions): Promise<CommandOutput> {\n  return await new Promise<CommandOutput>((resolve, reject) => {\n    if (options.signal?.aborted) {\n      reject(abortErrorOf(options.signal));\n      return;\n    }\n    const child = launchProcess(executable, args, {\n      ...(options.cwd ? { cwd: options.cwd } : {}),\n      env: options.env,\n      stdio: [options.stdin === undefined ? \"ignore\" : \"pipe\", \"pipe\", \"pipe\"],\n      detached: process.platform !== \"win32\",\n      windowsHide: true,\n    });\n    registerActiveCodexChild(child.pid, options.children);\n    let stdout = \"\";\n    let stderr = \"\";\n    let timedOut = false;\n    let settled = false;\n    let killTimeout: ReturnType<typeof setTimeout> | undefined;\n    const clearKillTimeout = (): void => {\n      if (killTimeout) {\n        clearTimeout(killTimeout);\n        killTimeout = undefined;\n      }\n    };\n    const terminate = (signal: NodeJS.Signals): void => {\n      if (child.pid && process.platform !== \"win32\") {\n        try {\n          process.kill(-child.pid, signal);\n          return;\n        } catch {\n          // fall through to killing the direct child\n        }\n      }\n      child.kill(signal);\n    };\n    const scheduleForcedKill = (): void => {\n      clearKillTimeout();\n      killTimeout = setTimeout(() => terminate(\"SIGKILL\"), 1_000);\n      killTimeout.unref();\n    };\n    const finish = (fn: () => void): void => {\n      if (settled) return;\n      settled = true;\n      clearTimeout(timeout);\n      options.signal?.removeEventListener(\"abort\", onAbort);\n      fn();\n    };\n    const settleTimeout = (): void => {\n      timedOut = true;\n      stderr = appendBounded(\n        stderr,\n        `\\ncodex-subscription: ${options.timeoutLabel} timed out after ${options.timeoutMs}ms.`\n      );\n      finish(() => {\n        resolve({\n          status: 124,\n          signal: \"SIGTERM\",\n          stdout,\n          stderr,\n        });\n      });\n    };\n    const onAbort = (): void => {\n      const reasonText =\n        options.signal?.reason instanceof Error\n          ? options.signal.reason.message\n          : String(options.signal?.reason ?? \"\");\n      terminate(\"SIGTERM\");\n      scheduleForcedKill();\n      if (/fallback LLM timed out after \\d+ms/i.test(reasonText)) {\n        settleTimeout();\n        return;\n      }\n      finish(() => reject(abortErrorOf(options.signal!)));\n    };\n    options.signal?.addEventListener(\"abort\", onAbort, { once: true });\n    const timeout = options.timeoutMs\n      ? setTimeout(() => {\n          terminate(\"SIGTERM\");\n          scheduleForcedKill();\n          settleTimeout();\n        }, options.timeoutMs)\n      : undefined;\n    timeout?.unref();\n    child.stdout?.setEncoding(\"utf8\");\n    child.stderr?.setEncoding(\"utf8\");\n    child.stdout?.on(\"data\", (chunk: string) => {\n      stdout = appendBounded(stdout, chunk);\n    });\n    child.stderr?.on(\"data\", (chunk: string) => {\n      stderr = appendBounded(stderr, chunk);\n    });\n    child.stdin?.on(\"error\", (error: NodeJS.ErrnoException) => {\n      stderr = appendBounded(stderr, `\\ncodex-subscription: stdin error: ${error.code ?? error.message}`);\n    });\n    child.on(\"error\", (error) => {\n      unregisterActiveCodexChild(child.pid, options.children);\n      finish(() => {\n        reject(\n          child.pid\n            ? new Error(`codex-subscription: codex CLI failed after start: ${safeMessage(error)}`, { cause: error })\n            : new CodexSubscriptionAuthError(\n                \"unauthenticated\",\n                `codex-subscription: codex CLI not found at \\`${executable}\\` — install the Codex CLI and run \\`codex login\\` with a ChatGPT account, then retry.`\n              )\n        );\n      });\n    });\n    child.on(\"close\", (status, signal) => {\n      clearKillTimeout();\n      unregisterActiveCodexChild(child.pid, options.children);\n      finish(() => {\n        resolve({\n          status: timedOut ? (status === null || status === 0 ? 124 : status) : status,\n          signal: timedOut ? (signal ?? \"SIGTERM\") : signal,\n          stdout,\n          stderr,\n        });\n      });\n    });\n    if (options.stdin !== undefined) {\n      try {\n        child.stdin?.end(options.stdin);\n      } catch (error) {\n        log.debug(`codex-subscription: failed writing prompt to stdin: ${safeMessage(error)}`);\n      }\n    }\n  });\n}\n\nfunction safeMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nexport const __codexSubscriptionTestHooks = {\n  activeCodexChildCount: (runner?: CodexCliFallbackRunner): number => {\n    const target = runner ?? defaultRegisteredRunner;\n    return target ? (childrenByRunner.get(target)?.size ?? 0) : 0;\n  },\n  appendBounded,\n  resetLoginStatusCache: (): void => {\n    loginStatusCache.clear();\n  },\n  isCoreRunnerRegistered: (): boolean => coreRunnerRegistered,\n  resetCoreRunnerRegistered: (): void => {\n    coreRunnerRegistered = false;\n    defaultRegisteredRunner = undefined;\n  },\n};\n\nfunction registerActiveCodexChild(pid: number | undefined, children: Set<number>): void {\n  if (pid === undefined) return;\n  children.add(pid);\n}\n\nfunction unregisterActiveCodexChild(pid: number | undefined, children: Set<number>): void {\n  if (pid === undefined) return;\n  children.delete(pid);\n}\n\nfunction terminateCodexChildPid(pid: number, signal: NodeJS.Signals): void {\n  if (process.platform !== \"win32\") {\n    try {\n      process.kill(-pid, signal);\n      return;\n    } catch {\n      // Fall back to killing the direct child below.\n    }\n  }\n\n  try {\n    process.kill(pid, signal);\n  } catch {\n    // The child may already have exited.\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMA,OAAOA,WAAU;;;ACWjB,SAAS,OAAO,SAAS,UAAU,IAAI,YAAY;AACnD,OAAO,QAAQ;AACf,OAAO,UAAU;AAeV,IAAM,iCAAiC;AAG9C,IAAM,uBAAuB;AAE7B,IAAM,2BAAoD;AAC1D,IAAM,qBAAqB;AAC3B,IAAM,0BAA0B;AAChC,IAAM,4BAA4B,KAAK;AACvC,IAAM,cAAc;AACpB,IAAM,uBAAuB;AAM7B,IAAM,wBAAwD,OAAO,OAAO,EAAE,YAAY,MAAM,MAAM,MAAM,aAAa,KAAK,CAAC;AAQ/H,IAAM,8BAA8D,OAAO,OAAO;AAAA,EAChF,WAAW;AAAA,EACX,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM;AAAA,EACN,WAAW;AAAA,EACX,UAAU;AAAA,EACV,MAAM;AAAA,EACN,cAAc;AAAA,EACd,SAAS;AAAA,EACT,UAAU;AAAA,EACV,qBAAqB;AAAA,EACrB,UAAU;AAAA,EACV,sBAAsB;AAAA,EACtB,IAAI;AAAA,EACJ,MAAM;AAAA,EACN,SAAS;AAAA,EACT,aAAa;AAAA,EACb,wBAAwB;AAAA,EACxB,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,OAAO;AAAA,EACP,cAAc;AAAA,EACd,eAAe;AAAA,EACf,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,MAAM;AAAA,EACN,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,iBAAiB;AACnB,CAAC;AAED,IAAM,mBAAmB;AACzB,IAAM,wBAAwB;AAE9B,IAAM,uBACJ;AACF,IAAM,kBAAkB;AAExB,IAAM,uBAA0C;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAMO,SAAS,yCAA8D;AAC5E,SAAO;AAAA,IACL,SAAS;AAAA,IACT,KAAK;AAAA,IACL,QAAQ,CAAC;AAAA,EACX;AACF;AAKO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C;AAAA,EAET,YAAY,QAAqC,SAAiB;AAChE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAGO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EACtD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EACvD,YAAY,WAAmB;AAC7B,UAAM,8CAA8C,SAAS,IAAI;AACjE,SAAK,OAAO;AAAA,EACd;AACF;AAyDA,IAAM,mBAAmB,oBAAI,IAAmC;AAChE,IAAM,wBAAwB,oBAAI,QAAoE;AACtG,IAAM,mBAAmB,oBAAI,QAA6C;AAC1E,IAAM,gBAAgB,oBAAI,QAAwC;AAClE,IAAM,mBAAmB,oBAAI,QAAiD;AAC9E,IAAI;AACJ,IAAI,uBAAuB;AAEpB,SAAS,8BAA8B,OAAoC,CAAC,GAA2B;AAC5G,QAAM,YAAY,KAAK,OAAO,QAAQ;AACtC,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,WAAW,IAAI,gBAAgB;AACrC,QAAM,aAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,cAAc,KAAK,iBAAiB,CAAC,YAAY,uBAAuB,SAAS,QAAQ;AAAA,IACzF,gBACE,KAAK,mBACJ,CAAC,YAAY,KAAK,WAAW,WAC5B,yBAAyB,YAAY,KAAK,WAAW,QAAQ,QAAQ;AAAA,EAC3E;AACA,QAAM,SAAiC,CAAC,YAAY;AAClD,UAAM,SAAS,QAAQ,QAAQ,SAC3B,YAAY,IAAI,CAAC,QAAQ,QAAQ,QAAQ,SAAS,MAAM,CAAC,IACzD,SAAS;AACb,QAAI,OAAO,SAAS;AAClB,aAAO,QAAQ,OAAO,aAAa,MAAM,CAAC;AAAA,IAC5C;AACA,WAAO;AAAA,MACL,EAAE,GAAG,SAAS,SAAS,EAAE,GAAG,QAAQ,SAAS,OAAO,EAAE;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,mBAAiB,IAAI,QAAQ,QAAQ;AACrC,mBAAiB,IAAI,QAAQ,QAAQ;AACrC,SAAO;AACT;AAGO,SAAS,mCAAmC,OAAuC;AACxF,MAAI,SAAS,cAAc,IAAI,KAAK;AACpC,QAAM,WAAW,SAAS,iBAAiB,IAAI,MAAM,IAAI;AACzD,MAAI,CAAC,UAAU,UAAU,OAAO,SAAS;AACvC,aAAS,8BAA8B;AACvC,kBAAc,IAAI,OAAO,MAAM;AAAA,EACjC;AACA,SAAO;AACT;AAGO,SAAS,mCACd,QACyB;AACzB,SAAO,iBAAiB,IAAI,MAAM,GAAG;AACvC;AASO,SAAS,wCAAwC,OAAoC,CAAC,GAAY;AACvG,MAAI,mCAAmC,EAAG,QAAO;AACjD,4BAA0B,8BAA8B,IAAI;AAC5D,sCAAoC,uBAAuB;AAC3D,yBAAuB;AACvB,SAAO;AACT;AAGO,SAAS,6CAAsD;AACpE,SAAO,4BAA4B,UAC9B,oCAAoC,MAAM;AACjD;AAEO,SAAS,yCACd,SAAyB,WACzB,QACM;AACN,QAAM,SAAS,UAAU;AACzB,MAAI,CAAC,OAAQ;AACb,QAAM,WAAW,iBAAiB,IAAI,MAAM;AAC5C,MAAI,YAAY,CAAC,SAAS,OAAO,SAAS;AACxC,aAAS,MAAM,IAAI,aAAa,8BAA8B,YAAY,CAAC;AAAA,EAC7E;AACA,QAAM,OAAO,iBAAiB,IAAI,MAAM;AACxC,MAAI,CAAC,KAAM;AACX,aAAW,OAAO,MAAM;AACtB,2BAAuB,KAAK,MAAM;AAAA,EACpC;AACF;AAGO,SAAS,+BACd,QACA,mBAAmB,KACP;AACZ,2CAAyC,WAAW,MAAM;AAC1D,QAAM,QAAQ,WAAW,MAAM;AAC7B,6CAAyC,WAAW,MAAM;AAAA,EAC5D,GAAG,gBAAgB;AACnB,QAAM,MAAM;AACZ,SAAO,MAAM;AACX,iBAAa,KAAK;AAClB,6CAAyC,WAAW,MAAM;AAAA,EAC5D;AACF;AACA,eAAe,4BACb,SACA,MACA,WACA,QACiC;AACjC,QAAM,EAAE,OAAO,IAAI;AACnB,uBAAqB,MAAM;AAC3B,QAAM,aAAa,kBAAkB,QAAQ,SAAS;AACtD,QAAM,MAAM,iBAAiB,SAAS;AAEtC,QAAM,oBAAoB,OAAO,cAAc,cAAc,SACzD,2BAA2B,OAAO,aAAa,SAAS,IACxD;AACJ,QAAM,YAAY,QAAQ,QAAQ,aAAa,qBAAqB;AAGpE,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,oBAAoB,IAAI;AAC9B,MAAI,QAAQ,QAAQ,QAAQ,SAAS;AACnC,UAAM,aAAa,QAAQ,QAAQ,MAAM;AAAA,EAC3C;AACA,QAAM,wBAAwB,YAAY,KAAK,MAAM;AAAA,IACnD;AAAA,IACA,iBAAiB;AAAA,IACjB;AAAA,IACA,QAAQ,QAAQ,QAAQ;AAAA,EAC1B,CAAC;AAED,MAAI,QAAQ,QAAQ,QAAQ,SAAS;AACnC,UAAM,aAAa,QAAQ,QAAQ,MAAM;AAAA,EAC3C;AAEA,QAAM,qBAAqB,aAAa,IAAI,IAAI;AAChD,MAAI,sBAAsB,GAAG;AAC3B,UAAM,IAAI,8BAA8B,SAAS;AAAA,EACnD;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,KAAK,KAAK,KAAK,SAAS,KAAK,GAAG,OAAO,GAAG,mBAAmB,CAAC;AACtF,UAAM,gBAAgB,KAAK,KAAK,SAAS,WAAW;AACpD,UAAM,aAAa,KAAK,KAAK,SAAS,kBAAkB;AACxD,UAAM,MAAM,eAAe,EAAE,WAAW,KAAK,CAAC;AAE9C,UAAM,eAAe,KAAK;AAC1B,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC;AAAA,MACA,MAAM,cAAc,QAAQ,SAAS,QAAQ,eAAe,UAAU;AAAA,MACtE,OAAO,YAAY,QAAQ,QAAQ;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,QAAQ,QAAQ,QAAQ;AAAA,IAC1B,CAAC;AAED,QAAI,OAAO,WAAW,GAAG;AACvB,YAAM,UAAU,iBAAiB,QAAQ,oBAAoB,YAAY,GAAG;AAC5E,UAAI,mBAAmB,+BAA+B;AACpD,cAAM;AAAA,MACR;AACA,UAAI,QAAQ,QAAQ,QAAQ,SAAS;AACnC,cAAM,aAAa,QAAQ,QAAQ,MAAM;AAAA,MAC3C;AACA,YAAM;AAAA,IACR;AACA,QAAI,QAAQ,QAAQ,QAAQ,SAAS;AACnC,YAAM,aAAa,QAAQ,QAAQ,MAAM;AAAA,IAC3C;AAEA,UAAM,UAAU,OAAO,WAAW,KAAK;AACvC,QAAI,QAAQ,WAAW,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,6DAA6D,gBAAgB,OAAO,QAAQ,OAAO,MAAM,CAAC;AAAA,MAC5G;AAAA,IACF;AACA,WAAO,EAAE,SAAS,GAAG,UAAU,MAAM,EAAE;AAAA,EACzC,UAAE;AACA,QAAI,SAAS;AACX,YAAM,GAAG,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACpE;AAAA,EACF;AACF;AAOO,SAAS,qBAAqB,QAAsC;AACzE,MAAI,OAAO,WAAW,UAAa,OAAO,WAAW,IAAI;AACvD,UAAM,IAAI;AAAA,MACR,GAAG,8BAA8B;AAAA,IACnC;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,QAAgC,KAAgC;AACzF,QAAM,aAAa,OAAO,sBAAsB,OAAO,cAAc,IAAI,oBAAoB,KAAK;AAClG,QAAM,WAAW,gBAAgB,OAAO,UAAU,EAAE,KAAK,CAAC;AAC1D,MAAI,SAAS,KAAK,EAAE,WAAW,GAAG;AAChC,UAAM,IAAI,6BAA6B,GAAG,oBAAoB,iCAAiC;AAAA,EACjG;AAKA,MAAI,SAAS,SAAS,GAAG,KAAK,SAAS,SAAS,IAAI,GAAG;AACrD,WAAO,KAAK,QAAQ,QAAQ;AAAA,EAC9B;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,QAA8C;AACtE,QAAM,MAAyB,CAAC;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,UAAU,UAAa,gBAAgB,GAAG,GAAG;AAC/C,UAAI,GAAG,IAAI,sBAAsB,IAAI,YAAY,CAAC,MAAM,OACpD,sBAAsB,KAAK,IAC3B;AAAA,IACN;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,sBAAsB,OAAuB;AACpD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,gBAAgB,OAAO;AACxC,SAAO,KAAK,WAAW,QAAQ,IAAI,WAAW,KAAK,QAAQ,QAAQ;AACrE;AACA,SAAS,gBAAgB,KAAsB;AAC7C,QAAM,aAAa,IAAI,YAAY;AACnC,SAAO,4BAA4B,UAAU,MAAM,QAAQ,WAAW,WAAW,KAAK;AACxF;AAkBA,eAAe,wBACb,YACA,KACA,MACA,KACe;AACf,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,WAAW,cAAc,YAAY,GAAG;AAC9C,QAAM,WAAW,kBAAkB,IAAI,MAAM,EAAE,IAAI,QAAQ;AAC3D,MAAI,YAAY,IAAI,IAAI,SAAS,KAAK,2BAA2B;AAC/D,UAAM,kBAAkB,UAAU,UAAU,KAAK,GAAG;AACpD;AAAA,EACF;AACA,QAAM,SAAS,iBAAiB,IAAI,QAAQ;AAC5C,MAAI,UAAU,IAAI,IAAI,OAAO,KAAK,2BAA2B;AAC3D,QAAI,CAAC,OAAO,WAAY,MAAM,qBAAqB,GAAG,MAAO,OAAO,aAAa;AAC/E,YAAM,kBAAkB,QAAQ,UAAU,KAAK,GAAG;AAClD;AAAA,IACF;AACA,QAAI,iBAAiB,IAAI,QAAQ,MAAM,QAAQ;AAC7C,uBAAiB,OAAO,QAAQ;AAAA,IAClC;AAAA,EACF;AACA,QAAM,QAAQ,kBAAkB,IAAI,MAAM,EAAE,IAAI,QAAQ;AACxD,MAAI,SAAS,IAAI,IAAI,MAAM,KAAK,2BAA2B;AACzD,UAAM,kBAAkB,OAAO,UAAU,KAAK,GAAG;AACjD;AAAA,EACF;AACA,QAAM,YAAY,iBAAiB,IAAI,QAAQ;AAC/C,MAAI,aAAa,IAAI,IAAI,UAAU,KAAK,2BAA2B;AACjE,UAAM,kBAAkB,WAAW,UAAU,KAAK,GAAG;AACrD;AAAA,EACF;AACA,MAAI,IAAI,QAAQ,SAAS;AACvB,UAAM,aAAa,IAAI,MAAM;AAAA,EAC/B;AACA,QAAM,QAA+B;AAAA,IACnC,IAAI,IAAI;AAAA,IACR,aAAa;AAAA,IACb,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY,IAAI,gBAAgB;AAAA,IAChC,SAAS,QAAQ,QAAQ,MAAS;AAAA,EACpC;AACA,QAAM,UAAU,oBAAoB,YAAY,KAAK,MAAM,KAAK;AAChE,QAAM,QAAQ;AAAA,IACZ,MAAM;AACJ,YAAM,UAAU;AAChB,uBAAiB,IAAI,UAAU,KAAK;AACpC,wBAAkB,IAAI,QAAQ,UAAU,KAAK;AAAA,IAC/C;AAAA,IACA,MAAM;AACJ,YAAM,UAAU;AAChB,wBAAkB,IAAI,QAAQ,UAAU,KAAK;AAAA,IAC/C;AAAA,EACF;AACA,oBAAkB,IAAI,MAAM,EAAE,IAAI,UAAU,KAAK;AACjD,QAAM,kBAAkB,OAAO,UAAU,KAAK,GAAG;AACnD;AAEA,eAAe,oBACb,YACA,KACA,MACA,OACe;AACf,QAAM,iBAAiB,KAAK;AAC5B,QAAM,SAAS,MAAM,eAAe,YAAY,KAAK,yBAAyB,MAAM,WAAW,MAAM;AACrG,QAAM,SAAS,GAAG,OAAO,MAAM;AAAA,EAAK,OAAO,MAAM,GAAG,KAAK;AACzD,MAAI,gBAAgB,KAAK,MAAM,GAAG;AAGhC,UAAM,IAAI,8BAA8B,uBAAuB;AAAA,EACjE;AACA,MAAI,OAAO,WAAW,KAAK,iBAAiB,KAAK,MAAM,GAAG;AACxD,UAAM,cAAc,MAAM,qBAAqB,GAAG;AAClD;AAAA,EACF;AACA,QAAM,aAAa,sBAAsB,KAAK,MAAM,IAChD,gGACA;AACJ,QAAM,IAAI;AAAA,IACR;AAAA,IACA,kIAAkI,UAAU;AAAA,EAC9I;AACF;AASA,eAAe,kBACb,OACA,UACA,KACA,KACe;AACf,QAAM,cAAc,IAAI,mBAAmB,IAAI,IAAI,IAAI;AACvD,MAAI,eAAe,GAAG;AACpB,UAAM,IAAI,8BAA8B,IAAI,eAAe;AAAA,EAC7D;AACA,QAAM,SAAS,IAAI;AACnB,MAAI;AACJ,QAAM,YAAY,IAAI,QAAe,CAAC,UAAU,WAAW;AACzD,oBAAgB;AAAA,EAClB,CAAC;AAED,QAAM,UAAU,MAAY;AAC1B,QAAI,WAAW,OAAW;AAC1B,kBAAc,aAAa,MAAM,CAAC;AAAA,EACpC;AACA,UAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACzD,QAAM;AAGN,MAAI;AACJ,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,MAAM;AAAA,MACN;AAAA,MACA,IAAI,QAAe,CAAC,UAAU,WAAW;AACvC,wBAAgB;AAAA,UACd,MAAM,OAAO,IAAI,8BAA8B,IAAI,eAAe,CAAC;AAAA,UACnE;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,QAAQ,SAAS;AACnB,YAAM,aAAa,MAAM;AAAA,IAC3B;AACA,UAAM;AAAA,EACR,UAAE;AACA,iBAAa,aAAa;AAC1B,YAAQ,oBAAoB,SAAS,OAAO;AAC5C,UAAM;AACN,QAAI,MAAM,WAAW,KAAK,CAAC,MAAM,SAAS;AACxC,YAAM,WAAW,MAAM;AACvB,wBAAkB,IAAI,QAAQ,UAAU,KAAK;AAC7C,UAAI,iBAAiB,IAAI,QAAQ,MAAM,OAAO;AAC5C,yBAAiB,OAAO,QAAQ;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AACF;AAOA,eAAe,qBAAqB,KAAgD;AAClF,QAAM,OAAO,qBAAqB,GAAG;AACrC,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,QAAQ,MAAM,KAAK,KAAK,KAAK,MAAM,WAAW,CAAC;AACrD,WAAO,GAAG,MAAM,OAAO,IAAI,MAAM,IAAI;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,KAA4C;AACxE,MAAI,IAAI,WAAY,QAAO,IAAI;AAC/B,QAAM,UAAU,IAAI,QAAQ,IAAI;AAChC,SAAO,UAAU,KAAK,KAAK,SAAS,QAAQ,IAAI;AAClD;AAEA,SAAS,cAAc,YAAoB,KAAgC;AACzE,SAAO,GAAG,UAAU,KAAK,qBAAqB,GAAG,KAAK,EAAE;AAC1D;AAEA,SAAS,kBAAkB,QAAoE;AAC7F,MAAI,MAAM,sBAAsB,IAAI,MAAM;AAC1C,MAAI,CAAC,KAAK;AACR,UAAM,oBAAI,IAAI;AACd,0BAAsB,IAAI,QAAQ,GAAG;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,kBACP,QACA,UACA,OACM;AACN,QAAM,MAAM,sBAAsB,IAAI,MAAM;AAC5C,MAAI,KAAK,IAAI,QAAQ,MAAM,MAAO,KAAI,OAAO,QAAQ;AACvD;AAMA,SAAS,cACP,SACA,QACA,eACA,YACU;AACV,QAAM,kBAAkB,oBAAoB,MAAM,KAAK;AACvD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0BAA0B,KAAK,UAAU,eAAe,CAAC;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAAqE;AAChG,aAAW,SAAS,CAAC,OAAO,yBAAyB,OAAO,eAAe,GAAG;AAC5E,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,UAAI,eAAe,SAAS,eAAe,YAAY,eAAe,UAAU,eAAe,SAAS;AACtG,eAAO;AAAA,MACT;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,YAAY,UAAsD;AACzE,QAAM,aAAa,SAChB,IAAI,CAAC,YAAY,KAAK,UAAU,EAAE,MAAM,QAAQ,MAAM,SAAS,QAAQ,QAAQ,CAAC,CAAC,EACjF,KAAK,IAAI;AACZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,SAAS,iBACP,QACA,WACA,YACA,KACO;AACP,QAAM,WAAW,GAAG,OAAO,MAAM;AAAA,EAAK,OAAO,MAAM;AAInD,MAAI,gBAAgB,KAAK,QAAQ,GAAG;AAClC,WAAO,IAAI,8BAA8B,SAAS;AAAA,EACpD;AACA,MAAI,qBAAqB,KAAK,QAAQ,GAAG;AAEvC,qBAAiB,OAAO,cAAc,YAAY,GAAG,CAAC;AACtD,WAAO,IAAI;AAAA,MACT;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,SAAS,UAAU,OAAO,MAAM,KAAK,QAAQ,OAAO,UAAU,SAAS;AAChG,SAAO,IAAI;AAAA,IACT,0CAA0C,SAAS,MAAM,gBAAgB,OAAO,QAAQ,OAAO,MAAM,CAAC;AAAA,EACxG;AACF;AAKA,SAAS,gBAAgB,QAAgB,QAAwB;AAC/D,QAAM,UAAU,CAAC,OAAO,KAAK,GAAG,OAAO,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,KAAK,IAAI;AAC1F,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,SAAO,mBAAmB,OAAO,EAAE,MAAM,CAAC,oBAAoB;AAChE;AAEO,SAAS,mBAAmB,OAAuB;AACxD,MAAI,WAAW;AACf,aAAW,WAAW,sBAAsB;AAC1C,eAAW,SAAS,QAAQ,SAAS,YAAY;AAAA,EACnD;AACA,SAAO;AACT;AAGA,SAAS,UAAU,QAA6D;AAC9E,QAAM,QAAQ,qBAAqB,GAAG,OAAO,MAAM;AAAA,EAAK,OAAO,MAAM,EAAE;AACvE,MAAI,CAAC,OAAO;AACV,WAAO,CAAC;AAAA,EACV;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,aAAa,MAAM;AAAA,MACnB,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM,cAAc,MAAM;AAAA,IACzC;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,QAA2E;AAC9G,MAAI;AACJ,aAAW,QAAQ,OAAO,MAAM,OAAO,GAAG;AACxC,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,CAAC,QAAQ,WAAW,GAAG,EAAG;AAC9B,QAAI;AACF,YAAM,QAAQ,KAAK,MAAM,OAAO;AAIhC,UAAI,MAAM,SAAS,oBAAoB,CAAC,MAAM,MAAO;AACrD,YAAM,cAAc,YAAY,MAAM,MAAM,YAAY;AACxD,YAAM,eAAe,YAAY,MAAM,MAAM,aAAa;AAC1D,UAAI,gBAAgB,UAAa,iBAAiB,QAAW;AAC3D,gBAAQ,EAAE,aAAa,aAAa;AAAA,MACtC;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAoC;AACvD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,QAAQ,GAAG;AACrE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,aAAa,QAA4B;AAChD,MAAI,OAAO,kBAAkB,8BAA+B,QAAO,OAAO;AAC1E,QAAM,SACJ,OAAO,kBAAkB,QACrB,OAAO,SACP,OAAO,WAAW,SAChB,IAAI,MAAM,OAAO,OAAO,MAAM,CAAC,IAC/B,IAAI,aAAa,8BAA8B,YAAY;AACnE,QAAM,QAAQ,wCAAwC,KAAK,OAAO,OAAO;AACzE,MAAI,OAAO;AACT,WAAO,IAAI,8BAA8B,OAAO,MAAM,CAAC,CAAC,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;AAKA,SAAS,cAAc,UAAkB,MAAsB;AAC7D,QAAM,WAAW,mBAAmB,WAAW,IAAI;AACnD,SAAO,SAAS,SAAS,cAAc,SAAS,MAAM,CAAC,WAAW,IAAI;AACxE;AAEA,eAAe,yBACb,YACA,KACA,WACA,QACA,UACoE;AACpE,SAAO,MAAM,cAAc,YAAY,CAAC,SAAS,QAAQ,GAAG;AAAA,IAC1D;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAe,uBACb,SACA,UACsC;AACtC,QAAM,SAAS,MAAM,cAAc,QAAQ,YAAY,QAAQ,MAAM;AAAA,IACnE,KAAK,QAAQ;AAAA,IACb,OAAO,QAAQ;AAAA,IACf,WAAW,QAAQ;AAAA,IACnB,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB,KAAK,QAAQ;AAAA,IACb;AAAA,EACF,CAAC;AACD,MAAI,OAAO,WAAW,IAAK,QAAO,EAAE,GAAG,QAAQ,YAAY,GAAG;AAC9D,MAAI,aAAa;AACjB,MAAI;AACF,kBAAc,MAAM,SAAS,QAAQ,YAAY,MAAM,GAAG,KAAK;AAAA,EACjE,QAAQ;AAAA,EAER;AACA,SAAO,EAAE,GAAG,QAAQ,WAAW;AACjC;AAYA,eAAe,cAAc,YAAoB,MAAgB,SAAoD;AACnH,SAAO,MAAM,IAAI,QAAuB,CAAC,SAAS,WAAW;AAC3D,QAAI,QAAQ,QAAQ,SAAS;AAC3B,aAAO,aAAa,QAAQ,MAAM,CAAC;AACnC;AAAA,IACF;AACA,UAAM,QAAQ,cAAc,YAAY,MAAM;AAAA,MAC5C,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,MAC1C,KAAK,QAAQ;AAAA,MACb,OAAO,CAAC,QAAQ,UAAU,SAAY,WAAW,QAAQ,QAAQ,MAAM;AAAA,MACvE,UAAU,QAAQ,aAAa;AAAA,MAC/B,aAAa;AAAA,IACf,CAAC;AACD,6BAAyB,MAAM,KAAK,QAAQ,QAAQ;AACpD,QAAI,SAAS;AACb,QAAI,SAAS;AACb,QAAI,WAAW;AACf,QAAI,UAAU;AACd,QAAI;AACJ,UAAM,mBAAmB,MAAY;AACnC,UAAI,aAAa;AACf,qBAAa,WAAW;AACxB,sBAAc;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,CAAC,WAAiC;AAClD,UAAI,MAAM,OAAO,QAAQ,aAAa,SAAS;AAC7C,YAAI;AACF,kBAAQ,KAAK,CAAC,MAAM,KAAK,MAAM;AAC/B;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,KAAK,MAAM;AAAA,IACnB;AACA,UAAM,qBAAqB,MAAY;AACrC,uBAAiB;AACjB,oBAAc,WAAW,MAAM,UAAU,SAAS,GAAG,GAAK;AAC1D,kBAAY,MAAM;AAAA,IACpB;AACA,UAAM,SAAS,CAAC,OAAyB;AACvC,UAAI,QAAS;AACb,gBAAU;AACV,mBAAa,OAAO;AACpB,cAAQ,QAAQ,oBAAoB,SAAS,OAAO;AACpD,SAAG;AAAA,IACL;AACA,UAAM,gBAAgB,MAAY;AAChC,iBAAW;AACX,eAAS;AAAA,QACP;AAAA,QACA;AAAA,sBAAyB,QAAQ,YAAY,oBAAoB,QAAQ,SAAS;AAAA,MACpF;AACA,aAAO,MAAM;AACX,gBAAQ;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAY;AAC1B,YAAM,aACJ,QAAQ,QAAQ,kBAAkB,QAC9B,QAAQ,OAAO,OAAO,UACtB,OAAO,QAAQ,QAAQ,UAAU,EAAE;AACzC,gBAAU,SAAS;AACnB,yBAAmB;AACnB,UAAI,sCAAsC,KAAK,UAAU,GAAG;AAC1D,sBAAc;AACd;AAAA,MACF;AACA,aAAO,MAAM,OAAO,aAAa,QAAQ,MAAO,CAAC,CAAC;AAAA,IACpD;AACA,YAAQ,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACjE,UAAM,UAAU,QAAQ,YACpB,WAAW,MAAM;AACf,gBAAU,SAAS;AACnB,yBAAmB;AACnB,oBAAc;AAAA,IAChB,GAAG,QAAQ,SAAS,IACpB;AACJ,aAAS,MAAM;AACf,UAAM,QAAQ,YAAY,MAAM;AAChC,UAAM,QAAQ,YAAY,MAAM;AAChC,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB;AAC1C,eAAS,cAAc,QAAQ,KAAK;AAAA,IACtC,CAAC;AACD,UAAM,QAAQ,GAAG,QAAQ,CAAC,UAAkB;AAC1C,eAAS,cAAc,QAAQ,KAAK;AAAA,IACtC,CAAC;AACD,UAAM,OAAO,GAAG,SAAS,CAAC,UAAiC;AACzD,eAAS,cAAc,QAAQ;AAAA,mCAAsC,MAAM,QAAQ,MAAM,OAAO,EAAE;AAAA,IACpG,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,UAAU;AAC3B,iCAA2B,MAAM,KAAK,QAAQ,QAAQ;AACtD,aAAO,MAAM;AACX;AAAA,UACE,MAAM,MACF,IAAI,MAAM,qDAAqD,YAAY,KAAK,CAAC,IAAI,EAAE,OAAO,MAAM,CAAC,IACrG,IAAI;AAAA,YACF;AAAA,YACA,gDAAgD,UAAU;AAAA,UAC5D;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,UAAM,GAAG,SAAS,CAAC,QAAQ,WAAW;AACpC,uBAAiB;AACjB,iCAA2B,MAAM,KAAK,QAAQ,QAAQ;AACtD,aAAO,MAAM;AACX,gBAAQ;AAAA,UACN,QAAQ,WAAY,WAAW,QAAQ,WAAW,IAAI,MAAM,SAAU;AAAA,UACtE,QAAQ,WAAY,UAAU,YAAa;AAAA,UAC3C;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AACD,QAAI,QAAQ,UAAU,QAAW;AAC/B,UAAI;AACF,cAAM,OAAO,IAAI,QAAQ,KAAK;AAAA,MAChC,SAAS,OAAO;AACd,YAAI,MAAM,uDAAuD,YAAY,KAAK,CAAC,EAAE;AAAA,MACvF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,YAAY,OAAwB;AAC3C,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAkBA,SAAS,yBAAyB,KAAyB,UAA6B;AACtF,MAAI,QAAQ,OAAW;AACvB,WAAS,IAAI,GAAG;AAClB;AAEA,SAAS,2BAA2B,KAAyB,UAA6B;AACxF,MAAI,QAAQ,OAAW;AACvB,WAAS,OAAO,GAAG;AACrB;AAEA,SAAS,uBAAuB,KAAa,QAA8B;AACzE,MAAI,QAAQ,aAAa,SAAS;AAChC,QAAI;AACF,cAAQ,KAAK,CAAC,KAAK,MAAM;AACzB;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI;AACF,YAAQ,KAAK,KAAK,MAAM;AAAA,EAC1B,QAAQ;AAAA,EAER;AACF;;;AD3jCO,SAAS,iCAAiC,OAAyB;AACxE,SACE,iBAAiB,iCACjB,iBAAiB,8BACjB,iBAAiB;AAErB;AAQO,SAAS,wBAAwB,WAA2B;AACjE,SAAO,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,EAAE,CAAC,CAAC;AAC7D;AAUA,eAAsB,wBACpB,MACA,WACA,gBACA,gBAAgB,GAC6C;AAC7D,QAAM,WAAW,IAAI,gBAAgB;AACrC,QAAM,QAAQ,WAAW,MAAM,SAAS,MAAM,GAAG,SAAS;AAC1D,WAAS,OAAO,iBAAiB,SAAS,gBAAgB,EAAE,MAAM,KAAK,CAAC;AACxE,MAAI;AACF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA,SAAS;AAAA,MACT,gCAAgC,SAAS;AAAA,IAC3C;AACA,WAAO,EAAE,UAAU,OAAO,MAAM;AAAA,EAClC,SAAS,OAAO;AACd,QAAI,CAAC,SAAS,OAAO,QAAS,OAAM;AACpC,QAAI;AACJ,UAAM,aAAa,MAAM,QAAQ,KAAK;AAAA,MACpC,KAAK;AAAA,QACH,CAAC,WAAW,EAAE,OAAO,SAAkB,MAAM;AAAA,QAC7C,CAAC,eAAe,EAAE,OAAO,SAAkB,OAAO,UAAU;AAAA,MAC9D;AAAA,MACA,IAAI,QAA8B,CAAC,YAAY;AAC7C,YAAI,gBAAgB,GAAG;AACrB,uBAAa,WAAW,MAAM,QAAQ,EAAE,OAAO,UAAU,CAAC,GAAG,aAAa;AAAA,QAC5E,OAAO;AACL,uBAAa,MAAM,QAAQ,EAAE,OAAO,UAAU,CAAC,CAAC;AAAA,QAClD;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AACD,iBAAa,UAAU;AACvB,QAAI,WAAW,UAAU,QAAS,QAAO,EAAE,UAAU,OAAO,OAAO,WAAW,MAAM;AACpF,QAAI,WAAW,UAAU,QAAS,OAAM,WAAW;AACnD,SAAK,KAAK;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,WAAO,EAAE,UAAU,KAAK;AAAA,EAC1B,UAAE;AACA,iBAAa,KAAK;AAClB,aAAS,OAAO,oBAAoB,SAAS,cAAc;AAAA,EAC7D;AACF;AAYA,eAAsB,6BACpB,OAKA,UACA,SACA,uBACA,QACqD;AACrD,MAAI,MAAM,eAAe,QAAQ,YAAa,QAAO;AAErD,MAAI,MAAM,eAAe,gCAAgC;AACvD,yBAAqB,MAAM,cAAc;AAAA,EAC3C;AAEA,QAAM,iBACJ,MAAM,eAAe,WAAW,SAAY,SAAY,MAAM,sBAAsB;AACtF,QAAM,SAAS,MAAM,eAAe;AACpC,QAAM,kBACJ,WAAW,uBAAwB,OAAO,WAAW,YAAY,WAAW;AAC9E,MAAI,mBAAmB,CAAC,gBAAgB;AACtC,UAAM,IAAI,MAAM,yBAAyB,MAAM,UAAU,yCAAyC;AAAA,EACpG;AAEA,QAAM,kBAAuC;AAAA,IAC3C,GAAG,MAAM;AAAA,IACT,GAAI,iBAAiB,EAAE,QAAQ,eAAe,IAAI,CAAC;AAAA,EACrD;AAKA,QAAM,cAAc;AAAA,IAClB,WAAW,QAAQ,cAAc,SAC7B,SACA,KAAK,IAAI,GAAG,QAAQ,YAAY,wBAAwB,QAAQ,SAAS,CAAC;AAAA,IAC9E,QAAQ,QAAQ;AAAA,EAClB;AAIA,MAAI,mCAAmC,KAAK,EAAE,UAAU,2CAA2C,IAAI;AACrG,WAAO,MAAM,qBAAqB,iBAAiB,MAAM,SAAS,UAAU,WAAW;AAAA,EACzF;AACA,MAAI,QAAQ;AACV,WAAO,MAAM,qBAAqB,iBAAiB,MAAM,SAAS,UAAU,aAAa,MAAM;AAAA,EACjG;AACA,0CAAwC;AACxC,SAAO,MAAM,qBAAqB,iBAAiB,MAAM,SAAS,UAAU,WAAW;AACzF;AAEO,SAAS,YAAY,QAAwC;AAClE,QAAM,SAAS,QAAQ;AACvB,SAAO,kBAAkB,QAAQ,SAAS,IAAI,MAAM,0BAA0B;AAChF;AAEO,SAAS,yBACd,SACA,QACG;AACH,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,WAAW,mCAAmC,MAAM;AAC1D,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,QAAQ,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,QAAQ,CAAC,IAAI;AAAA,EACzE;AACF;AAEO,SAAS,6BAA6B,OAAyB;AACpE,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAKrE,MAAI,CAAC,sBAAsB,KAAK,OAAO,GAAG;AACxC,WAAO;AAAA,EACT;AACA,MAAI,iEAAiE,KAAK,OAAO,GAAG;AAClF,WAAO;AAAA,EACT;AAEA,SAAO,oDAAoD,KAAK,OAAO;AACzE;AAEO,SAAS,2BAA2B,MAUzB;AAChB,MAAI,OAAO,KAAK,gBAAgB,YAAY,KAAK,YAAY,KAAK,EAAE,SAAS,GAAG;AAC9E,WAAO,KAAK;AAAA,EACd;AAEA,QAAM,SAAmB,CAAC;AAC1B,aAAW,QAAQ,KAAK,UAAU,CAAC,GAAG;AACpC,QAAI,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,GAAG;AAChE,aAAO,KAAK,KAAK,IAAI;AAAA,IACvB;AACA,eAAW,QAAQ,KAAK,WAAW,CAAC,GAAG;AACrC,WACG,KAAK,SAAS,iBAAiB,KAAK,SAAS,WAC9C,OAAO,KAAK,SAAS,YACrB,KAAK,KAAK,KAAK,EAAE,SAAS,GAC1B;AACA,eAAO,KAAK,KAAK,IAAI;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,KAAK,IAAI,EAAE,KAAK;AACtC,SAAO,OAAO,SAAS,IAAI,SAAS;AACtC;AAuCO,SAAS,oCACd,QAIA,YAAuC,CAAC,GACb;AAC3B,SAAO;AAAA,IACL,cAAc,OAAO;AAAA,IACrB,0BAA0B,OAAO;AAAA,IACjC,wBAAwB,OAAO;AAAA,IAC/B,yBAAyB,mCAAmC,MAAM;AAAA,IAClE,GAAG;AAAA,EACL;AACF;AAEA,IAAM,yBAAyB;AAExB,SAAS,eAAe,KAAuB;AACpD,QAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,SAAO,yBAAyB,KAAK,GAAG,KAAK,oCAAoC,KAAK,GAAG;AAC3F;AAEA,SAAS,wBAAwB,KAAuB;AACtD,QAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,SAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEA,SAAS,iBAAiB,OAAoC;AAC5D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,UAAU,KAAK,EAAG,QAAO;AAC7F,MAAI,QAAQ,OAAO,QAAQ,IAAK,QAAO;AACvC,SAAO;AACT;AAEA,SAAS,4BAA4B,KAAkC;AACrE,MAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,QAAI,YAAY,KAAK;AACnB,YAAM,SAAS,iBAAiB,IAAI,MAAM;AAC1C,UAAI,WAAW,OAAW,QAAO;AAAA,IACnC;AACA,QAAI,gBAAgB,KAAK;AACvB,YAAM,SAAS,iBAAiB,IAAI,UAAU;AAC9C,UAAI,WAAW,OAAW,QAAO;AAAA,IACnC;AAAA,EACF;AACA,QAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,QAAM,QAAQ,uBAAuB,KAAK,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,iBAAiB,OAAO,MAAM,CAAC,CAAC,CAAC;AAC1C;AAEA,SAAS,wBAAwB,QAAwB;AACvD,MAAI,UAAU,IAAK,QAAO;AAC1B,MAAI,UAAU,IAAK,QAAO;AAC1B,SAAO,QAAQ,MAAM;AACvB;AAEO,SAAS,4BAA4B,KAAsD;AAChG,MAAI,eAAe,GAAG,GAAG;AACvB,WAAO,EAAE,eAAe,WAAW,YAAY,UAAU;AAAA,EAC3D;AACA,MAAI,wBAAwB,GAAG,GAAG;AAChC,WAAO,EAAE,eAAe,SAAS,YAAY,QAAQ;AAAA,EACvD;AACA,QAAM,aAAa,4BAA4B,GAAG;AAClD,MAAI,eAAe,QAAW;AAC5B,WAAO;AAAA,MACL,eAAe;AAAA,MACf;AAAA,MACA,YAAY,wBAAwB,UAAU;AAAA,IAChD;AAAA,EACF;AACA,SAAO,EAAE,eAAe,cAAc,YAAY,UAAU;AAC9D;AAEO,SAAS,qBAAqB,OAAoC;AACvE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,gBAAgB,OAAO,IAAI;AACzD;AAEO,SAAS,wBAAwB,eAA8D;AACpG,MAAI,CAAC,iBAAiB,OAAO,kBAAkB,SAAU,QAAO;AAChE,QAAM,MAAM;AACZ,SACE,qBAAqB,IAAI,YAAY,KACrC,qBAAqB,IAAI,aAAa,KACtC,qBAAqB,IAAI,SAAS;AAEtC;AAEO,SAAS,8BAAsC;AACpD,SAAOC,MAAK,KAAK,eAAe,GAAG,aAAa,WAAW;AAC7D;","names":["path","path"]}

package/dist/{chunk-BPXJINHW.js → chunk-EUP4AXIW.js}

@@ -1,7 +1,7 @@
 import {
   raceRecallAbort,
   throwIfRecallAborted
-} from "./chunk-F6PTJLEM.js";
+} from "./chunk-K4KE5MYE.js";
 import {
   classifyOrigin
 } from "./chunk-6Q3ZTEF6.js";
@@ -1081,4 +1081,4 @@ export {
   ExtractionDeadlineError,
   ExtractionRunCoordinator
 };
-//# sourceMappingURL=chunk-BPXJINHW.js.map
+//# sourceMappingURL=chunk-EUP4AXIW.js.map

package/dist/{chunk-2WMXZYMS.js → chunk-F5V7KRQS.js}

@@ -1,7 +1,7 @@
 import {
   canonicalCategoryForAlias,
   categoryAliasCoercion
-} from "./chunk-JUOJGZPV.js";
+} from "./chunk-AYP2FZFA.js";
 
 // src/access-observe-write-category.ts
 function splitCanonicalWriteRequest(request) {
@@ -22,4 +22,4 @@ function splitCanonicalWriteRequest(request) {
 export {
   splitCanonicalWriteRequest
 };
-//# sourceMappingURL=chunk-2WMXZYMS.js.map
+//# sourceMappingURL=chunk-F5V7KRQS.js.map

package/dist/{chunk-4AX5OYKC.js → chunk-FDDCZDBI.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BOADKFN4.js";
 import {
   gatewayTaskChainOptions
-} from "./chunk-TRTLWUDD.js";
+} from "./chunk-ZTHGFTMW.js";
 import {
   normalizeProcedureSteps
 } from "./chunk-QDW3E4RD.js";
@@ -491,4 +491,4 @@ export {
   createVerdictCache,
   createDeferCountMap
 };
-//# sourceMappingURL=chunk-4AX5OYKC.js.map
+//# sourceMappingURL=chunk-FDDCZDBI.js.map

package/dist/{chunk-XLPZN3A5.js → chunk-FMEP2RB5.js}

@@ -1,7 +1,7 @@
 import {
   SupportPassportCreateGrantRequestSchema,
   defineOperation
-} from "./chunk-3K64PLY3.js";
+} from "./chunk-HXDXR2FH.js";
 import {
   SupportPassportCardCategorySchema,
   SupportPassportMemoryIdSchema,
@@ -220,4 +220,4 @@ var supportPassportGrantAskOperation = defineOperation({
     result: await ctx.service.supportPassportAskGrant(grantId, secret, question, ctx.abortSignal)
   })
 });
-//# sourceMappingURL=chunk-XLPZN3A5.js.map
+//# sourceMappingURL=chunk-FMEP2RB5.js.map

package/dist/{chunk-D7UUB33A.js → chunk-FSH6KRKO.js}

@@ -1,6 +1,6 @@
 import {
   parseEntityFile
-} from "./chunk-GMU7MAHS.js";
+} from "./chunk-QUFJ3NJE.js";
 import {
   inferMemoryStatus
 } from "./chunk-7RJUVTVF.js";
@@ -253,4 +253,4 @@ export {
   WHO_KNOWS_MCP_TOOLS,
   handleWhoKnowsHttpQuery
 };
-//# sourceMappingURL=chunk-D7UUB33A.js.map
+//# sourceMappingURL=chunk-FSH6KRKO.js.map

package/dist/{chunk-3254BYQV.js → chunk-GGY7WKMB.js}

@@ -318,4 +318,4 @@ export {
   readProjectedHarmonicGraph,
   searchHarmonicRetrieval
 };
-//# sourceMappingURL=chunk-3254BYQV.js.map
+//# sourceMappingURL=chunk-GGY7WKMB.js.map

package/dist/{chunk-ROXDOKLM.js → chunk-GYYLZOSO.js}

@@ -40,16 +40,16 @@ import {
 } from "./chunk-2AV75BJW.js";
 import {
   getOperation
-} from "./chunk-3K64PLY3.js";
+} from "./chunk-HXDXR2FH.js";
 import {
   WHO_KNOWS_MCP_TOOLS
-} from "./chunk-D7UUB33A.js";
+} from "./chunk-FSH6KRKO.js";
 import {
   PROMOTION_CANDIDATES_MCP_TOOLS
 } from "./chunk-VYCOJKSX.js";
 import {
   validateRequest
-} from "./chunk-JUOJGZPV.js";
+} from "./chunk-AYP2FZFA.js";
 import {
   SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH
 } from "./chunk-PWPIERBM.js";
@@ -3987,4 +3987,4 @@ export {
   MCP_MIGRATED_OPERATIONS,
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-ROXDOKLM.js.map
+//# sourceMappingURL=chunk-GYYLZOSO.js.map

package/dist/{chunk-3K64PLY3.js → chunk-HXDXR2FH.js}

@@ -38,7 +38,7 @@ import {
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-D7UUB33A.js";
+} from "./chunk-FSH6KRKO.js";
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
@@ -59,13 +59,13 @@ import {
 } from "./chunk-ROBHL3GL.js";
 import {
   summarizeHourlyStatus
-} from "./chunk-J2MGTGKC.js";
+} from "./chunk-5ZXGH2ZL.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-P5FPO2BR.js";
 import {
   isSearchExcludedPath
-} from "./chunk-46FVFU7S.js";
+} from "./chunk-EC5SVM6H.js";
 import {
   renderNavigationResult
 } from "./chunk-KIW3OOZE.js";
@@ -73,6 +73,9 @@ import {
   DEFAULT_TRAVERSE_LIMIT,
   selectTraverseNeighbors
 } from "./chunk-YE4JBZO5.js";
+import {
+  parseNavigateLinkType
+} from "./chunk-7O5EW7KX.js";
 import {
   assertIdInNavigationWindow
 } from "./chunk-5KVT6G5U.js";
@@ -82,9 +85,6 @@ import {
 import {
   planDisclosureStep
 } from "./chunk-AS2NOPDM.js";
-import {
-  parseNavigateLinkType
-} from "./chunk-7O5EW7KX.js";
 import {
   decideDisclosureEscalation
 } from "./chunk-H7XKCNR6.js";
@@ -97,7 +97,7 @@ import {
 } from "./chunk-VW5TGNJN.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-2HDLDBJW.js";
+} from "./chunk-DDBLZJRV.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-CVILPI77.js";
@@ -118,7 +118,7 @@ import {
 } from "./chunk-HWLIMQE2.js";
 import {
   readProjectedHarmonicGraph
-} from "./chunk-3254BYQV.js";
+} from "./chunk-GGY7WKMB.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
@@ -141,7 +141,7 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-LQVXSRAJ.js";
+} from "./chunk-B4EGAHHS.js";
 import {
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
@@ -152,7 +152,7 @@ import {
 } from "./chunk-7ZNJN5WZ.js";
 import {
   callDeepRecallPolicyLlm
-} from "./chunk-YR5QT4SR.js";
+} from "./chunk-NAFPHFDM.js";
 import {
   renderDeepRecallResult
 } from "./chunk-RF2SMMPP.js";
@@ -169,18 +169,18 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-5AJZ7EUW.js";
+} from "./chunk-S7KDHFF2.js";
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-KDLOKVX7.js";
+} from "./chunk-SW42MMAH.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
 } from "./chunk-UFGFMWAD.js";
 import {
   ExtractionDeadlineError
-} from "./chunk-BPXJINHW.js";
+} from "./chunk-EUP4AXIW.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
@@ -190,17 +190,17 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-OGAKUA7I.js";
+} from "./chunk-YUQPUK6H.js";
 import {
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-GMU7MAHS.js";
+} from "./chunk-QUFJ3NJE.js";
 import {
   namespaceCollectionName
-} from "./chunk-T3F2HWIG.js";
+} from "./chunk-TZ44E732.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
@@ -228,7 +228,7 @@ import {
 } from "./chunk-5WITETWU.js";
 import {
   FallbackLlmClient
-} from "./chunk-TRTLWUDD.js";
+} from "./chunk-ZTHGFTMW.js";
 import {
   CORRECTION_TEXT_MAX,
   CorrectionContractError,
@@ -281,7 +281,7 @@ import {
 } from "./chunk-SYOIVK7K.js";
 import {
   splitCanonicalWriteRequest
-} from "./chunk-2WMXZYMS.js";
+} from "./chunk-F5V7KRQS.js";
 import {
   applyBriefingLocationContext,
   daySummaryAutoOptions
@@ -303,16 +303,16 @@ import {
 } from "./chunk-VYCOJKSX.js";
 import {
   reapplyCategoryCoercion
-} from "./chunk-JUOJGZPV.js";
+} from "./chunk-AYP2FZFA.js";
 import {
   exportCapsule
-} from "./chunk-KQAFEZQX.js";
+} from "./chunk-IPLYGWQF.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-6EGIQEKC.js";
+} from "./chunk-4HTQ76O4.js";
 import {
   offlineSyncStorageForSnapshot
 } from "./chunk-RFIJH2OE.js";
@@ -485,7 +485,7 @@ import {
 } from "./chunk-B6O2YLUR.js";
 import {
   AccessAuditAdapter
-} from "./chunk-7K5Q6COX.js";
+} from "./chunk-TVVEYCNW.js";
 import {
   decodeCitationNamespace
 } from "./chunk-YRLHEEQT.js";
@@ -18238,4 +18238,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-3K64PLY3.js.map
+//# sourceMappingURL=chunk-HXDXR2FH.js.map

package/dist/{chunk-XOCGC3FJ.js → chunk-HYWPUYLO.js}

@@ -2,7 +2,7 @@ import {
   WHO_KNOWS_DEFAULT_LIMIT,
   WHO_KNOWS_MAX_LIMIT,
   validateWhoKnowsInput
-} from "./chunk-D7UUB33A.js";
+} from "./chunk-FSH6KRKO.js";
 
 // src/who-knows-cli.ts
 function extractWhoKnowsRawArgs(rest) {
@@ -74,4 +74,4 @@ export {
   renderWhoKnowsText,
   renderWhoKnows
 };
-//# sourceMappingURL=chunk-XOCGC3FJ.js.map
+//# sourceMappingURL=chunk-HYWPUYLO.js.map