@skaile/workspaces 5.6.1 → 5.8.0

package/dist/{chunk-KUFNKVBM.js.map → chunk-SH5D7U7N.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/drivers/_subprocess-cli.ts"],"names":[],"mappings":";;;;;;AAuCO,IAAe,mBAAA,GAAf,cAA2C,WAAA,CAAY;AAAA;AAAA,EAezC,IAAA,GAA6B,OAAA;AAAA,EAEtC,MAAA;AAAA,EAEF,IAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,eAAyB,EAAC;AAAA,EAC1B,YAAA,GAAe,EAAA;AAAA,EACf,OAAA,GAAU,KAAA;AAAA;AAAA,EAGV,QAAA,GAAW,EAAA;AAAA,EACX,eAAA,GAAkB,KAAA;AAAA,EAClB,qBAAqC,EAAC;AAAA,EACtC,SAAA,GAAY,KAAA;AAAA,EACZ,QAAA,GAAW,KAAA;AAAA,EACX,WAAA,GAAmC,IAAA;AAAA,EACnC,UAAA,GAA4C,IAAA;AAAA,EAE1C,UAAA;AAAA,EACA,WAAA,GAAiC,IAAA;AAAA,EAE3C,YAAY,MAAA,EAAqB;AAC/B,IAAA,KAAA,EAAM;AACN,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AAAA,EAEA,IAAa,gBAAA,GAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA,EAES,QAAA,GAA+B;AACtC,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAES,aAAA,GAAmC;AAC1C,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA,EAES,YAAY,KAAA,EAA0E;AAC7F,IAAA,IAAI,MAAM,KAAA,KAAU,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,QAAQ,KAAA,CAAM,KAAA;AACzD,IAAA,IAAI,MAAM,QAAA,KAAa,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,WAAW,KAAA,CAAM,QAAA;AAC/D,IAAA,IAAI,MAAM,MAAA,KAAW,MAAA,EAAW,IAAA,CAAK,MAAA,CAAO,SAAS,KAAA,CAAM,MAAA;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,IAAA,KAAS,IAAA,IAAQ,CAAC,KAAK,IAAA,CAAK,MAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,IAAA,CAAK,MAAM,MAAM,IAAI,MAAM,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,yBAAA,CAA2B,CAAA;AAC7E,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,MAAM,KAAK,KAAA,EAAM;AAEpC,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAChB,IAAA,IAAA,CAAK,eAAe,EAAC;AACrB,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAEnB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAC3C,IAAA,MAAM,cAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,WAAA,CAAa,CAAA;AAC9D,IAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,CAAA,EAAG,KAAK,SAAS,CAAA,eAAA,CAAiB,IACzD,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAA,CAAK,SAAS,iBAAiB,CAAA,CAAa,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,GACvF,EAAC;AACL,IAAA,MAAM,GAAA,GAAM,eAAe,IAAA,CAAK,UAAA;AAChC,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,OAAA,EAAS,GAAG,KAAK,SAAA,CAAU,QAAA,EAAU,IAAA,CAAK,UAAU,CAAC,CAAA;AACtE,IAAA,MAAM,GAAA,GAAM,KAAK,QAAA,EAAS;AAE1B,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,MAAA,IAAA,CAAK,WAAA,GAAc,OAAA;AACnB,MAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,cAAA,EAAgB;AAAA,QAC5B,GAAA;AAAA,QACA,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,UAAU;AAAA,OAChC,CAAA;AAGD,MAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,kBAAkB,CAAA;AAC7D,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,OAAO,IAAA,EAAM;AAAA,QAC9C,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,GAAA;AAAA,QACA,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,MAAA,MAAM,WAAA,GAAc,IAAA;AAEpB,MAAA,WAAA,CAAY,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AACtC,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,oBAAA,CAAqB,GAA4B,CAAA;AACrE,QAAA,IAAA,CAAK,IAAI,KAAA,CAAM,aAAA,EAAe,GAAA,EAAK,EAAE,QAAQ,CAAA;AAC7C,QAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,QAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,QAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,CAAC,CAAA;AAAA,MACxE,CAAC,CAAA;AAED,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,IAAI,IAAA,CAAK,SAAS,OAAA,EAAS;AACzB,UAAA,MAAM,KAAK,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACjD,UAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,UAAC,EAAA,CAA+B,GAAG,MAAA,EAAQ,CAAC,SAAiB,IAAA,CAAK,YAAA,CAAa,IAAI,CAAC,CAAA;AAAA,QACtF,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,MAAA,CAAO,YAAY,MAAM,CAAA;AAC9B,UAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACxC,YAAA,IAAA,CAAK,YAAA,IAAgB,KAAA;AAAA,UACvB,CAAC,CAAA;AAAA,QACH;AAAA,MACF;AAEA,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,MAAM,WAAW,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACvD,QAAC,QAAA,CAAqC,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,KAAiB;AACjE,UAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,QAAA,EAAU,EAAE,MAAM,CAAA;AACjC,UAAA,IAAA,CAAK,YAAA,CAAa,KAAK,IAAI,CAAA;AAC3B,UAAA,IAAI,KAAK,YAAA,CAAa,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,QAC7D,CAAC,CAAA;AAAA,MACH;AAEA,MAAA,WAAA,CAAY,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,EAAqB,MAAA,KAAkC;AAC7E,QAAA,IAAA,CAAK,IAAI,IAAA,CAAK,YAAA,EAAc,EAAE,IAAA,EAAM,QAAQ,CAAA;AAC5C,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC1B,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AAAA,EAC3B;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AACzB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA,EAEA,MAAM,YAAA,GAA8B;AAClC,IAAA,IAAA,CAAK,IAAA,EAAK;AACV,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAWU,WAAW,KAAA,EAAsB;AAAA,EAAC;AAAA;AAAA,EAGlC,eAAe,IAAA,EAAoB;AAAA,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUpC,YAAA,CAAa,MAAqB,MAAA,EAAkD;AAC5F,IAAA,IAAI,SAAS,CAAA,IAAM,IAAA,KAAS,IAAA,IAAQ,MAAA,KAAW,MAAO,OAAO,IAAA;AAC7D,IAAA,MAAM,OAAO,IAAA,CAAK,YAAA,CAAa,MAAM,GAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACnD,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,kBAAA,EAAqB,IAAA,IAAQ,MAAM,CAAA,EAAG,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,MACzF,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,IAAA,IAAQ,CAAA,IAAA,EAAO,IAAA,CAAK,WAAW,CAAA,mDAAA;AAAA,KACvC;AAAA,EACF;AAAA;AAAA;AAAA,EAKU,cAAc,OAAA,EAAyB;AAC/C,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA,GAAe,CAAA,EAAG,IAAA,CAAK,OAAO,YAAY;;AAAA;;AAAA,EAAc,OAAO,CAAA,CAAA,GAAK,OAAA;AAAA,EACzF;AAAA,EAEU,mBAAmB,QAAA,EAAwB;AACnD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,eAAA;AAAA,QACN,OAAA,EAAS,YAAY,EAAE;AAAA,OACH,CAAA;AAAA,IACxB;AACA,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,UAAA,CAAW,IAAA,CAAK,QAAQ,CAAA,GAC3C,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,GACnC,QAAA;AACJ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,gBAAA;AAAA,QACN,OAAA,EAAS,YAAY,QAAQ,CAAA;AAAA,QAC7B,UAAA,EAAY;AAAA,OACQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEU,iBAAiB,QAAA,EAAyB;AAClD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC3B,IAAA,MAAM,IAAA,GAAO,YAAY,IAAA,CAAK,QAAA;AAC9B,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,aAAA;AAAA,MACN,OAAA,EAAS,YAAY,IAAI;AAAA,KACL,CAAA;AACtB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAAA,EAClB;AAAA,EAEU,YAAA,CAAa,MAAc,KAAA,EAAsB;AACzD,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,WAAA;AAAA,MACN,IAAA;AAAA,MACA,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,MACb;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAA,EAAc,IAAA,EAAe,OAAA,GAAU,KAAA,EAAa;AAC3E,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAS,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,CAAA;AACzF,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,oBAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACU,CAAA;AAAA,EACxB;AAAA,EAEQ,gBAAA,GAAyB;AAC/B,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,MAAA,KAAW,CAAA,EAAG;AAC1C,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,UAAA;AAAA,MACN,WAAA,EAAa,CAAC,GAAG,IAAA,CAAK,kBAAkB;AAAA,KACpB,CAAA;AACtB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAAA,EAC7B;AAAA,EAEU,WAAW,IAAA,EAKZ;AACP,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,MAAA;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS,KAAK,OAAA,IAAW,SAAA;AAAA,MACzB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,KAAK,OAAA,IAAW,CAAA;AAAA,MACzB,GAAI,KAAK,MAAA,GAAS,EAAE,QAAQ,IAAA,CAAK,MAAA,KAAW;AAAC,KACzB,CAAA;AAAA,EACxB;AAAA,EAEU,SAAA,CAAU,MAAA,EAAoB,KAAA,GAAQ,KAAA,EAAa;AAC3D,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,OAAA;AAAA,MACN,OAAO,MAAA,CAAO,OAAA;AAAA,MACd,MAAA;AAAA,MACA;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAa,IAAA,EAAqB;AACzD,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,KAAO,IAAA,CAAK,UAAA,EAAY;AACnC,IAAA,IAAA,CAAK,UAAA,GAAa,EAAA;AAClB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,cAAA;AAAA,MACN,eAAA,EAAiB,EAAA;AAAA,MACjB,GAAI,IAAA,GAAO,EAAE,WAAA,EAAa,IAAA,KAAS;AAAC,KAChB,CAAA;AAAA,EACxB;AAAA;AAAA,EAGU,gBAAgB,OAAA,EAA6B;AACrD,IAAA,MAAM,OAAA,GAAU,4BAA4B,OAAO,CAAA;AACnD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO;AAAA,QACL,OAAA;AAAA,QACA,QAAA,EAAU,SAAA;AAAA,QACV,SAAA,EAAW,IAAA;AAAA,QACX,IAAA,EAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,WAAW,CAAA,sCAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GACJ,QAAQ,QAAA,KAAa,MAAA,GACjB,4CAA4C,IAAA,CAAK,WAAW,MAC5D,OAAA,CAAQ,QAAA,KAAa,eACnB,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,wDAAA,CAAA,GACnB,OAAA,CAAQ,aAAa,OAAA,GACnB,wGAAA,GACA,CAAA,0CAAA,EAA6C,IAAA,CAAK,WAAW,CAAA,CAAA,CAAA;AACvE,IAAA,OAAO,EAAE,SAAS,QAAA,EAAU,OAAA,CAAQ,UAAU,SAAA,EAAW,OAAA,CAAQ,WAAW,IAAA,EAAK;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBU,OAAA,CAAQ,SAAA,GAAsB,EAAC,EAA2B;AAClE,IAAA,MAAM,MAA8B,EAAC;AACrC,IAAA,MAAM,QAAA,GAAW,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,UAAA,EAAY,mBAAA,EAAqB,GAAG,SAAS,CAAA;AACvF,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACzB,MAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA;AAAA,IAClC;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtD,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC/B,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,UAAU,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC9E,QAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,MACb;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,UAAA,EAAY;AAC1B,MAAA,GAAA,CAAI,eAAA,GAAkB,CAAA,QAAA,EAAW,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,qCAAA,CAAA;AAAA,IACzD;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,GAAA,EAAK,MAAA,CAAO,OAAO,GAAA,EAAK,IAAA,CAAK,OAAO,GAAG,CAAA;AACvD,IAAA,OAAO,sBAAsB,GAAG,CAAA;AAAA,EAClC;AAAA;AAAA,EAIQ,aAAa,IAAA,EAAoB;AACvC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,MAAM,CAAA;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAW,IAAI,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kBAAA,EAAoB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA,EAEQ,MAAA,CAAO,MAAqB,MAAA,EAAqC;AACvE,IAAA,IAAA,CAAK,OAAA,EAAQ;AAEb,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,aAAA,EAAc;AACnB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAK,IAAA,KAAS,UAAA,KAAe,IAAA,KAAS,CAAA,IAAK,SAAS,IAAA,CAAA,EAAO;AAC7D,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,cAAA,CAAe,KAAK,YAAY,CAAA;AAAA,MACvC,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,sBAAA,EAAwB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,MAC9D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAC9C,IAAA,IAAI,OAAA,IAAW,CAAC,IAAA,CAAK,SAAA,EAAW;AAC9B,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,UAAU,OAAO,CAAA;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAC,CAAA;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW,IAAA,CAAK,WAAW,EAAE,OAAA,EAAS,kBAAkB,CAAA;AAAA,SAC7D;AACH,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,IACxB;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,IAAA,IAAA,CAAK,aAAA,EAAc;AAAA,EACrB;AAAA,EAEQ,aAAA,GAAsB;AAC5B,IAAA,MAAM,UAAU,IAAA,CAAK,WAAA;AACrB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,OAAA,IAAU;AAAA,EACZ;AAAA,EAEQ,aAAa,GAAA,EAAkB;AACrC,IAAA,MAAM,SAAS,IAAA,CAAK,UAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,MAAA,GAAS,GAAG,CAAA;AAAA,EACd;AAAA,EAEQ,OAAA,GAAgB;AACtB,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AACV,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEQ,qBAAqB,GAAA,EAAwC;AACnE,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA,kBAAA,CAAA;AAAA,QAC3B,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,KAAK,WAAA;AAAY,OACzB;AAAA,IACF;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,0BAAA,EAA6B,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,QACrD,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,CAAA,+BAAA,EAAkC,IAAA,CAAK,UAAU,CAAA,QAAA;AAAA,OACzD;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,CAAA,6CAAA,EAAgD,IAAA,CAAK,WAAW,CAAA,YAAA;AAAA,KACxE;AAAA,EACF;AACF;AAOA,SAAS,YAAY,IAAA,EAA4B;AAC/C,EAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAE;AAChE;AAGO,SAAS,YAAY,IAAA,EAAmB;AAC7C,EAAA,IAAI,OAAO,IAAA,EAAM,IAAA,KAAS,QAAA,SAAiB,IAAA,CAAK,IAAA;AAChD,EAAA,IAAI,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,SAAiB,IAAA,CAAK,KAAA;AACjD,EAAA,IAAI,OAAO,IAAA,EAAM,OAAA,KAAY,QAAA,SAAiB,IAAA,CAAK,OAAA;AACnD,EAAA,IAAI,OAAO,IAAA,EAAM,QAAA,KAAa,QAAA,SAAiB,IAAA,CAAK,QAAA;AACpD,EAAA,MAAM,MAAM,IAAA,EAAM,OAAA;AAClB,EAAA,IAAI,OAAO,GAAA,EAAK,OAAA,KAAY,QAAA,SAAiB,GAAA,CAAI,OAAA;AACjD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAI,OAAA,CACR,MAAA;AAAA,MACC,CAAC,CAAA,KAAA,CAAY,CAAA,EAAG,IAAA,KAAS,MAAA,IAAU,GAAG,IAAA,KAAS,MAAA,KAAc,OAAO,CAAA,EAAG,IAAA,KAAS;AAAA,KAClF,CACC,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAK,KAAA,CACT,MAAA,CAAO,CAAC,CAAA,KAAW,OAAO,CAAA,EAAG,IAAA,KAAS,QAAQ,CAAA,CAC9C,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AAEA,EAAA,IAAI,OAAO,IAAA,EAAM,IAAA,EAAM,SAAS,QAAA,EAAU,OAAO,KAAK,IAAA,CAAK,IAAA;AAC3D,EAAA,OAAO,EAAA;AACT;AAGO,SAAS,cAAc,IAAA,EAA8B;AAC1D,EAAA,MAAM,CAAA,GAAI,MAAM,KAAA,IAAS,IAAA,EAAM,OAAO,KAAA,IAAS,IAAA,EAAM,KAAA,IAAS,IAAA,EAAM,MAAA,IAAU,IAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,UAAU,OAAO,IAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,EAAE,YAAA,IAAgB,CAAA,CAAE,eAAe,CAAA,CAAE,aAAA,IAAiB,CAAA,CAAE,gBAAA,IAAoB,CAAA,CAAE,KAAA;AAC5F,EAAA,MAAM,MAAA,GACJ,EAAE,aAAA,IAAiB,CAAA,CAAE,gBAAgB,CAAA,CAAE,iBAAA,IAAqB,CAAA,CAAE,oBAAA,IAAwB,CAAA,CAAE,MAAA;AAC1F,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,mBAAA,IAAuB,CAAA,CAAE,mBAAmB,CAAA,CAAE,uBAAA;AAClE,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,IAAA;AACxD,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,MAAA,CAAO,WAAA,GAAc,KAAA;AACpD,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,MAAA,CAAO,YAAA,GAAe,MAAA;AACtD,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,MAAA,CAAO,eAAA,GAAkB,SAAA;AAC5D,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,YAAY,IAAA,EAA+B;AACzD,EAAA,MAAM,CAAA,GACJ,IAAA,EAAM,IAAA,IAAQ,IAAA,EAAM,OAAA,IAAW,IAAA,EAAM,cAAA,IAAkB,IAAA,EAAM,KAAA,EAAO,IAAA,IAAQ,IAAA,EAAM,KAAA,EAAO,IAAA;AAC3F,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC","file":"chunk-KUFNKVBM.js","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport type { EventEmitter } from \"node:events\";\nimport { createInterface, type Interface } from \"node:readline\";\nimport type { Logger, TokenUsage } from \"@skaile/workspaces/types\";\nimport { resolveAgentExec, wrapAgentCommand } from \"../agent-exec.js\";\nimport { classifyGenericErrorMessage } from \"../error-classifier.js\";\nimport { stripRunnerPrivateEnv } from \"../runner-private-env.js\";\nimport {\n  type AgentConfig,\n  AgentDriver,\n  type AgentError,\n  type AgentEvent,\n  type AgentMessage,\n} from \"../types.js\";\n\n/**\n * Shared base for one-shot **subprocess CLI** agent harnesses (Gemini, Qwen,\n * OpenCode, Goose, Continue).\n *\n * These harnesses are neither persistent JSON-RPC subprocesses (`omp`) nor\n * in-process SDKs (`claude-sdk`, `codex`). In headless mode each is invoked\n * **once per turn** — `prompt()` spawns the CLI fresh, a `readline` loop maps\n * newline-delimited JSON on stdout to the unified {@link AgentEvent} stream, and\n * **process exit marks the end of the turn**. Multi-turn continuity comes from\n * capturing a harness session id (emitted as `session_info`) and replaying it\n * via a resume flag on the next spawn.\n *\n * Subclasses implement {@link buildArgs}, {@link buildEnv}, and either\n * {@link handleJson} (streaming JSONL, the default) or {@link handleBuffered}\n * (`mode = \"buffered\"`, for CLIs that print a single JSON blob at the end).\n *\n * **Terminal-sequence invariant.** Subclasses MUST NOT emit `agent_end`. The\n * base emits exactly one `result` (synthesizing a success result when the\n * stream produced none) followed by a single `agent_end` on clean exit, or an\n * `error` + `agent_end` on crash. This keeps the turn-completion contract\n * (`prompt()` resolves after `agent_end`) identical across every CLI driver.\n *\n * @docLink packages/bridge/drivers#subprocess-cli\n */\nexport abstract class SubprocessCliDriver extends AgentDriver {\n  /** Per-driver logger, constructed once by the subclass. */\n  protected abstract readonly log: Logger;\n  /** Default binary name spawned in production (e.g. `\"gemini\"`). */\n  protected abstract readonly defaultBin: string;\n  /** Human product name used in error messages / hints (e.g. `\"Gemini CLI\"`). */\n  protected abstract readonly productName: string;\n  /**\n   * Test-seam env prefix. `<PREFIX>_BRIDGE_BIN` overrides the spawn binary and\n   * `<PREFIX>_BRIDGE_PREARGS` (space-delimited) supplies leading argv — used by\n   * the fake-CLI harness to redirect spawn without monkey-patching\n   * `child_process`. Both are ignored in production.\n   */\n  protected abstract readonly envPrefix: string;\n  /** `\"jsonl\"` streams events line-by-line; `\"buffered\"` parses all stdout once on exit. */\n  protected readonly mode: \"jsonl\" | \"buffered\" = \"jsonl\";\n\n  protected config: AgentConfig;\n\n  private proc: ChildProcess | null = null;\n  private rl: Interface | null = null;\n  private stderrBuffer: string[] = [];\n  private stdoutBuffer = \"\";\n  private started = false;\n\n  // ── Per-turn state ──────────────────────────────────────────────────────\n  private prevText = \"\";\n  private activeAssistant = false;\n  private pendingToolResults: AgentMessage[] = [];\n  private sawResult = false;\n  private aborting = false;\n  private turnResolve: (() => void) | null = null;\n  private turnReject: ((err: Error) => void) | null = null;\n\n  protected _sessionId?: string;\n  protected _lastTokens: TokenUsage | null = null;\n\n  constructor(config: AgentConfig) {\n    super();\n    this.config = config;\n  }\n\n  override get runtimeSessionId(): string | undefined {\n    return this._sessionId;\n  }\n\n  override getModel(): string | undefined {\n    return this.config.model;\n  }\n\n  override getTokenUsage(): TokenUsage | null {\n    return this._lastTokens;\n  }\n\n  override reconfigure(patch: Partial<Pick<AgentConfig, \"model\" | \"thinking\" | \"effort\">>): void {\n    if (patch.model !== undefined) this.config.model = patch.model;\n    if (patch.thinking !== undefined) this.config.thinking = patch.thinking;\n    if (patch.effort !== undefined) this.config.effort = patch.effort;\n  }\n\n  /**\n   * No-op for one-shot CLIs — there is no long-lived process to spawn until the\n   * first prompt. Kept so the runner's `start()` → `prompt()` ordering works\n   * uniformly; binary-presence failures surface as a `config` error on the\n   * first spawn (see {@link classifyProcessError}).\n   */\n  async start(): Promise<void> {\n    this.started = true;\n  }\n\n  get isRunning(): boolean {\n    return this.proc !== null && !this.proc.killed;\n  }\n\n  /**\n   * Sends a user message to the CLI and resolves after the turn completes\n   * (`agent_end`). Spawns a fresh child per call; rejects if the child exits\n   * non-zero before emitting a result, so the caller never hangs.\n   */\n  async prompt(message: string): Promise<void> {\n    if (this.proc) throw new Error(`${this.productName} turn already in progress`);\n    if (!this.started) await this.start();\n\n    this.prevText = \"\";\n    this.activeAssistant = false;\n    this.pendingToolResults = [];\n    this.sawResult = false;\n    this.aborting = false;\n    this.stderrBuffer = [];\n    this.stdoutBuffer = \"\";\n    this._lastTokens = null;\n\n    const composed = this.composePrompt(message);\n    const overrideBin = process.env[`${this.envPrefix}_BRIDGE_BIN`];\n    const preArgs = process.env[`${this.envPrefix}_BRIDGE_PREARGS`]\n      ? (process.env[`${this.envPrefix}_BRIDGE_PREARGS`] as string).split(/\\s+/).filter(Boolean)\n      : [];\n    const bin = overrideBin || this.defaultBin;\n    const args = [...preArgs, ...this.buildArgs(composed, this._sessionId)];\n    const env = this.buildEnv();\n\n    return new Promise<void>((resolve, reject) => {\n      this.turnResolve = resolve;\n      this.turnReject = reject;\n      this.log.info(\"spawning CLI\", {\n        bin,\n        cwd: this.config.cwd,\n        resume: Boolean(this._sessionId),\n      });\n\n      // With the uid split on, the CLI runs as the agent uid through the launch shim.\n      const target = wrapAgentCommand(bin, args, resolveAgentExec());\n      const proc = spawn(target.command, target.args, {\n        cwd: this.config.cwd,\n        env,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      }) as ChildProcess;\n      this.proc = proc;\n      const procEmitter = proc as unknown as EventEmitter;\n\n      procEmitter.on(\"error\", (err: Error) => {\n        const detail = this.classifyProcessError(err as NodeJS.ErrnoException);\n        this.log.error(\"spawn error\", err, { detail });\n        this.pushError(detail);\n        this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n        this.settleReject(Object.assign(new Error(detail.message), { detail }));\n      });\n\n      if (proc.stdout) {\n        if (this.mode === \"jsonl\") {\n          const rl = createInterface({ input: proc.stdout });\n          this.rl = rl;\n          (rl as unknown as EventEmitter).on(\"line\", (line: string) => this.onStdoutLine(line));\n        } else {\n          proc.stdout.setEncoding(\"utf8\");\n          proc.stdout.on(\"data\", (chunk: string) => {\n            this.stdoutBuffer += chunk;\n          });\n        }\n      }\n\n      if (proc.stderr) {\n        const stderrRl = createInterface({ input: proc.stderr });\n        (stderrRl as unknown as EventEmitter).on(\"line\", (line: string) => {\n          this.log.debug(\"stderr\", { line });\n          this.stderrBuffer.push(line);\n          if (this.stderrBuffer.length > 20) this.stderrBuffer.shift();\n        });\n      }\n\n      procEmitter.on(\"exit\", (code: number | null, signal: NodeJS.Signals | null) => {\n        this.log.info(\"CLI exited\", { code, signal });\n        this.onExit(code, signal);\n      });\n    });\n  }\n\n  /** Out-of-band abort: terminates the current child. Driver stays usable for the next prompt. */\n  async abort(): Promise<void> {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n  }\n\n  kill(): void {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n    this.cleanup();\n  }\n\n  async resetSession(): Promise<void> {\n    this.kill();\n    this._sessionId = undefined;\n    this._lastTokens = null;\n  }\n\n  // ── Subclass hooks ────────────────────────────────────────────────────────\n\n  /** Build the CLI argv (binary excluded) for one turn. `resumeId` is the captured session id, if any. */\n  protected abstract buildArgs(message: string, resumeId: string | undefined): string[];\n\n  /** Build the child-process env (explicit allowlist — see {@link baseEnv}). */\n  protected abstract buildEnv(): Record<string, string>;\n\n  /** Map one parsed stdout JSON object to events via the `push*` helpers. Streaming (`jsonl`) mode only. */\n  protected handleJson(_json: unknown): void {}\n\n  /** Parse the full stdout blob once on clean exit. `buffered` mode only. */\n  protected handleBuffered(_raw: string): void {}\n\n  /** Install-failure hint surfaced when the binary is missing. */\n  protected abstract installHint(): string;\n\n  /**\n   * Classify a non-zero exit into an {@link AgentError}, or `null` to treat the\n   * exit as success (e.g. a turn-limit code where a result was already\n   * emitted). Default: code `0` / clean signal → success; otherwise `process`.\n   */\n  protected classifyExit(code: number | null, signal: NodeJS.Signals | null): AgentError | null {\n    if (code === 0 || (code === null && signal === null)) return null;\n    const tail = this.stderrBuffer.slice(-10).join(\"\\n\");\n    return {\n      message: `${this.productName} exited with code ${code ?? \"null\"}${tail ? `: ${tail}` : \"\"}`,\n      category: \"process\",\n      retryable: true,\n      hint: tail || `The ${this.productName} process exited unexpectedly. Try the prompt again.`,\n    };\n  }\n\n  // ── Protected emit helpers (used by handleJson / handleBuffered) ────────────\n\n  /** Prepend `systemPrompt` to the user message — uniform across CLIs lacking a reliable system flag. */\n  protected composePrompt(message: string): string {\n    return this.config.systemPrompt ? `${this.config.systemPrompt}\\n\\n---\\n\\n${message}` : message;\n  }\n\n  protected pushAssistantDelta(fullText: string): void {\n    if (!this.activeAssistant) {\n      this.activeAssistant = true;\n      this.prevText = \"\";\n      this.emit(\"agent-event\", {\n        type: \"message_start\",\n        message: asstMessage(\"\"),\n      } satisfies AgentEvent);\n    }\n    const delta = fullText.startsWith(this.prevText)\n      ? fullText.slice(this.prevText.length)\n      : fullText;\n    this.prevText = fullText;\n    if (delta) {\n      this.emit(\"agent-event\", {\n        type: \"message_update\",\n        message: asstMessage(fullText),\n        _textDelta: delta,\n      } satisfies AgentEvent);\n    }\n  }\n\n  protected pushAssistantEnd(fullText?: string): void {\n    if (!this.activeAssistant) return;\n    const text = fullText ?? this.prevText;\n    this.emit(\"agent-event\", {\n      type: \"message_end\",\n      message: asstMessage(text),\n    } satisfies AgentEvent);\n    this.activeAssistant = false;\n    this.prevText = \"\";\n  }\n\n  protected pushToolCall(name: string, input: unknown): void {\n    this.emit(\"agent-event\", {\n      type: \"tool_call\",\n      name,\n      tool: { name },\n      input,\n    } satisfies AgentEvent);\n  }\n\n  protected pushToolResult(name: string, data: unknown, isError = false): void {\n    this.pendingToolResults.push({ role: \"tool\", toolName: name, content: \"\", data, isError });\n    this.emit(\"agent-event\", {\n      type: \"tool_execution_end\",\n      toolName: name,\n    } satisfies AgentEvent);\n  }\n\n  private flushToolResults(): void {\n    if (this.pendingToolResults.length === 0) return;\n    this.emit(\"agent-event\", {\n      type: \"turn_end\",\n      toolResults: [...this.pendingToolResults],\n    } satisfies AgentEvent);\n    this.pendingToolResults = [];\n  }\n\n  protected pushResult(opts: {\n    tokens?: TokenUsage | null;\n    costUsd?: number;\n    summary?: string;\n    subtype?: string;\n  }): void {\n    this.pushAssistantEnd();\n    this.flushToolResults();\n    if (opts.tokens) this._lastTokens = opts.tokens;\n    this.sawResult = true;\n    this.emit(\"agent-event\", {\n      type: \"result\",\n      subtype: opts.subtype ?? \"success\",\n      summary: opts.summary,\n      costUsd: opts.costUsd ?? 0,\n      ...(opts.tokens ? { tokens: opts.tokens } : {}),\n    } satisfies AgentEvent);\n  }\n\n  protected pushError(detail: AgentError, fatal = false): void {\n    this.emit(\"agent-event\", {\n      type: \"error\",\n      error: detail.message,\n      detail,\n      fatal,\n    } satisfies AgentEvent);\n  }\n\n  protected captureSession(id?: string, file?: string): void {\n    if (!id || id === this._sessionId) return;\n    this._sessionId = id;\n    this.emit(\"agent-event\", {\n      type: \"session_info\",\n      driverSessionId: id,\n      ...(file ? { sessionFile: file } : {}),\n    } satisfies AgentEvent);\n  }\n\n  /** Shared keyword classification + per-driver hint copy (mirrors omp/codex). */\n  protected classifyMessage(message: string): AgentError {\n    const generic = classifyGenericErrorMessage(message);\n    if (!generic) {\n      return {\n        message,\n        category: \"unknown\",\n        retryable: true,\n        hint: `An unexpected ${this.productName} error occurred. Try the prompt again.`,\n      };\n    }\n    const hint =\n      generic.category === \"auth\"\n        ? `Check the API key / login configured for ${this.productName}.`\n        : generic.category === \"rate_limit\"\n          ? `${this.productName} hit a provider rate limit. Wait a moment and try again.`\n          : generic.category === \"model\"\n            ? \"The selected model is unavailable or the context is too long. Change the model or start a new session.\"\n            : `A network error occurred while talking to ${this.productName}.`;\n    return { message, category: generic.category, retryable: generic.retryable, hint };\n  }\n\n  // ── Env allowlist ──────────────────────────────────────────────────────────\n\n  /**\n   * Explicit env whitelist forwarded to the child. Omits anything provisioned\n   * by `provision_secrets` so user credentials stay out of the subprocess\n   * environment. Always passes through the driver's test-seam vars and\n   * `FAKE_CLI_*`.\n   *\n   * `config.env` is merged **over** the whitelist, not in place of it. It used\n   * to replace it wholesale, which meant any caller that set a single variable\n   * silently dropped `PATH` and `HOME` and the spawn failed with ENOENT —\n   * unusable as the delivery channel for registry-derived endpoint variables\n   * (plan §2.3, \"Delivery rule\"). Widening keeps both: the caller's variables\n   * win per key, the process still has a `PATH`.\n   */\n  protected baseEnv(extraKeys: string[] = []): Record<string, string> {\n    const out: Record<string, string> = {};\n    const explicit = [\"PATH\", \"HOME\", \"USER\", \"HOSTNAME\", \"SKAILE_SESSION_ID\", ...extraKeys];\n    for (const key of explicit) {\n      const v = process.env[key];\n      if (v !== undefined) out[key] = v;\n    }\n    for (const [key, value] of Object.entries(process.env)) {\n      if (typeof value !== \"string\") continue;\n      if (key.startsWith(`${this.envPrefix}_BRIDGE_`) || key.startsWith(\"FAKE_CLI_\")) {\n        out[key] = value;\n      }\n    }\n    if (this.config.sshKeyPath) {\n      out.GIT_SSH_COMMAND = `ssh -i \"${this.config.sshKeyPath}\" -o StrictHostKeyChecking=accept-new`;\n    }\n    if (this.config.env) Object.assign(out, this.config.env);\n    return stripRunnerPrivateEnv(out);\n  }\n\n  // ── Internals ────────────────────────────────────────────────────────────\n\n  private onStdoutLine(line: string): void {\n    if (!line.trim()) return;\n    let json: unknown;\n    try {\n      json = JSON.parse(line);\n    } catch {\n      this.log.debug(\"non-JSON stdout line\", { line });\n      return;\n    }\n    try {\n      this.handleJson(json);\n    } catch (err) {\n      this.log.warn(\"handleJson threw\", { error: String(err) });\n    }\n  }\n\n  private onExit(code: number | null, signal: NodeJS.Signals | null): void {\n    this.cleanup();\n\n    if (this.aborting) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleResolve();\n      return;\n    }\n\n    if (this.mode === \"buffered\" && (code === 0 || code === null)) {\n      try {\n        this.handleBuffered(this.stdoutBuffer);\n      } catch (err) {\n        this.log.warn(\"handleBuffered threw\", { error: String(err) });\n      }\n    }\n\n    const exitErr = this.classifyExit(code, signal);\n    if (exitErr && !this.sawResult) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.pushError(exitErr);\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleReject(Object.assign(new Error(exitErr.message), { detail: exitErr }));\n      return;\n    }\n\n    // Clean exit (or non-zero exit after a result already streamed): close any\n    // open assistant message, synthesize a success result if none arrived, end.\n    if (!this.sawResult) this.pushResult({ summary: \"Task completed\" });\n    else {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n    }\n    this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n    this.settleResolve();\n  }\n\n  private settleResolve(): void {\n    const resolve = this.turnResolve;\n    this.turnResolve = null;\n    this.turnReject = null;\n    resolve?.();\n  }\n\n  private settleReject(err: Error): void {\n    const reject = this.turnReject;\n    this.turnResolve = null;\n    this.turnReject = null;\n    reject?.(err);\n  }\n\n  private cleanup(): void {\n    this.rl?.close();\n    this.rl = null;\n    this.proc = null;\n  }\n\n  private classifyProcessError(err: NodeJS.ErrnoException): AgentError {\n    if (err.code === \"ENOENT\") {\n      return {\n        message: `${this.defaultBin} command not found`,\n        category: \"config\",\n        retryable: false,\n        hint: this.installHint(),\n      };\n    }\n    if (err.code === \"EACCES\") {\n      return {\n        message: `Permission denied running ${this.defaultBin}`,\n        category: \"config\",\n        retryable: false,\n        hint: `Check file permissions for the ${this.defaultBin} binary.`,\n      };\n    }\n    return {\n      message: err.message,\n      category: \"process\",\n      retryable: true,\n      hint: `An unexpected process error occurred running ${this.productName}. Try again.`,\n    };\n  }\n}\n\n// ───────────────────────────────────────────────────────────────────────────\n// Tolerant JSON extractors — shared because the upstream stream-json schemas\n// are not fully pinned; read the common field-name variants defensively.\n// ───────────────────────────────────────────────────────────────────────────\n\nfunction asstMessage(text: string): AgentMessage {\n  return { role: \"assistant\", content: [{ type: \"text\", text }] };\n}\n\n/** Pull assistant text out of a CLI event, trying the common field names. */\nexport function extractText(json: any): string {\n  if (typeof json?.text === \"string\") return json.text;\n  if (typeof json?.delta === \"string\") return json.delta;\n  if (typeof json?.content === \"string\") return json.content;\n  if (typeof json?.response === \"string\") return json.response;\n  const msg = json?.message;\n  if (typeof msg?.content === \"string\") return msg.content;\n  if (Array.isArray(msg?.content)) {\n    return msg.content\n      .filter(\n        (b: any) => (b?.type === \"text\" || b?.type === undefined) && typeof b?.text === \"string\",\n      )\n      .map((b: any) => b.text)\n      .join(\"\");\n  }\n  if (Array.isArray(json?.parts)) {\n    return json.parts\n      .filter((p: any) => typeof p?.text === \"string\")\n      .map((p: any) => p.text)\n      .join(\"\");\n  }\n  // OpenCode (`run --format json`) nests the payload under `part`.\n  if (typeof json?.part?.text === \"string\") return json.part.text;\n  return \"\";\n}\n\n/** Map a CLI usage/stats object onto {@link TokenUsage}, trying common field names. */\nexport function extractTokens(json: any): TokenUsage | null {\n  const u = json?.usage ?? json?.stats?.usage ?? json?.stats ?? json?.tokens ?? json;\n  if (!u || typeof u !== \"object\") return null;\n  const input = u.input_tokens ?? u.inputTokens ?? u.prompt_tokens ?? u.promptTokenCount ?? u.input;\n  const output =\n    u.output_tokens ?? u.outputTokens ?? u.completion_tokens ?? u.candidatesTokenCount ?? u.output;\n  const cacheRead = u.cached_input_tokens ?? u.cacheReadTokens ?? u.cachedContentTokenCount;\n  if (input === undefined && output === undefined) return null;\n  const tokens: TokenUsage = {};\n  if (typeof input === \"number\") tokens.inputTokens = input;\n  if (typeof output === \"number\") tokens.outputTokens = output;\n  if (typeof cacheRead === \"number\") tokens.cacheReadTokens = cacheRead;\n  return tokens;\n}\n\n/** Pull a per-turn USD cost from a CLI result object, or `undefined`. */\nexport function extractCost(json: any): number | undefined {\n  const c =\n    json?.cost ?? json?.costUsd ?? json?.total_cost_usd ?? json?.stats?.cost ?? json?.usage?.cost;\n  return typeof c === \"number\" ? c : undefined;\n}\n"]}
+{"version":3,"sources":["../bridge/src/drivers/_subprocess-cli.ts"],"names":[],"mappings":";;;;;;AA2CO,IAAe,mBAAA,GAAf,cAA2C,WAAA,CAAY;AAAA;AAAA,EAezC,IAAA,GAA6B,OAAA;AAAA,EAEtC,MAAA;AAAA,EACO,QAAA;AAAA,EAET,IAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,eAAyB,EAAC;AAAA,EAC1B,YAAA,GAAe,EAAA;AAAA,EACf,OAAA,GAAU,KAAA;AAAA;AAAA,EAGV,QAAA,GAAW,EAAA;AAAA,EACX,eAAA,GAAkB,KAAA;AAAA,EAClB,qBAAqC,EAAC;AAAA,EACtC,SAAA,GAAY,KAAA;AAAA,EACZ,QAAA,GAAW,KAAA;AAAA,EACX,WAAA,GAAmC,IAAA;AAAA,EACnC,UAAA,GAA4C,IAAA;AAAA,EAE1C,UAAA;AAAA,EACA,WAAA,GAAiC,IAAA;AAAA,EAE3C,YAAY,MAAA,EAAqB;AAC/B,IAAA,KAAA,EAAM;AACN,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,iBAAA,CAAkB;AAAA,MACpC,MAAA,EAAQ,MAAM,IAAA,CAAK,MAAA;AAAA,MACnB,SAAA,EAAW,CAAC,OAAA,KAAY,IAAA,CAAK,eAAe,OAAO;AAAA,KACpD,CAAA;AAAA,EACH;AAAA,EAEA,IAAa,gBAAA,GAAuC;AAClD,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA,EAES,QAAA,GAA+B;AACtC,IAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,EACrB;AAAA,EAES,aAAA,GAAmC;AAC1C,IAAA,OAAO,IAAA,CAAK,WAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMS,YAAY,KAAA,EAAsD;AACzE,IAAA,OAAO,IAAA,CAAK,QAAA,CAAS,WAAA,CAAY,KAAK,CAAA;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMU,eAAe,OAAA,EAAmC;AACrD,EACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAAA,EACjB;AAAA,EAEA,IAAI,SAAA,GAAqB;AACvB,IAAA,OAAO,IAAA,CAAK,IAAA,KAAS,IAAA,IAAQ,CAAC,KAAK,IAAA,CAAK,MAAA;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,OAAA,EAAgC;AAC3C,IAAA,IAAI,IAAA,CAAK,MAAM,MAAM,IAAI,MAAM,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,yBAAA,CAA2B,CAAA;AAC7E,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,MAAM,KAAK,KAAA,EAAM;AAEpC,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAC3B,IAAA,IAAA,CAAK,SAAA,GAAY,KAAA;AACjB,IAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAChB,IAAA,IAAA,CAAK,eAAe,EAAC;AACrB,IAAA,IAAA,CAAK,YAAA,GAAe,EAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAEnB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,aAAA,CAAc,OAAO,CAAA;AAC3C,IAAA,MAAM,cAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,SAAS,CAAA,WAAA,CAAa,CAAA;AAC9D,IAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,CAAA,EAAG,KAAK,SAAS,CAAA,eAAA,CAAiB,IACzD,OAAA,CAAQ,GAAA,CAAI,GAAG,IAAA,CAAK,SAAS,iBAAiB,CAAA,CAAa,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,GACvF,EAAC;AACL,IAAA,MAAM,GAAA,GAAM,eAAe,IAAA,CAAK,UAAA;AAChC,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,OAAA,EAAS,GAAG,KAAK,SAAA,CAAU,QAAA,EAAU,IAAA,CAAK,UAAU,CAAC,CAAA;AACtE,IAAA,MAAM,GAAA,GAAM,KAAK,QAAA,EAAS;AAE1B,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,EAAS,MAAA,KAAW;AAC5C,MAAA,IAAA,CAAK,WAAA,GAAc,OAAA;AACnB,MAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,cAAA,EAAgB;AAAA,QAC5B,GAAA;AAAA,QACA,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,MAAA,EAAQ,OAAA,CAAQ,IAAA,CAAK,UAAU;AAAA,OAChC,CAAA;AAGD,MAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,GAAA,EAAK,IAAA,EAAM,kBAAkB,CAAA;AAC7D,MAAA,MAAM,IAAA,GAAO,KAAA,CAAM,MAAA,CAAO,OAAA,EAAS,OAAO,IAAA,EAAM;AAAA,QAC9C,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,QACjB,GAAA;AAAA,QACA,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,OACjC,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,MAAA,MAAM,WAAA,GAAc,IAAA;AAEpB,MAAA,WAAA,CAAY,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AACtC,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,oBAAA,CAAqB,GAA4B,CAAA;AACrE,QAAA,IAAA,CAAK,IAAI,KAAA,CAAM,aAAA,EAAe,GAAA,EAAK,EAAE,QAAQ,CAAA;AAC7C,QAAA,IAAA,CAAK,UAAU,MAAM,CAAA;AACrB,QAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,QAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,CAAC,CAAA;AAAA,MACxE,CAAC,CAAA;AAED,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,IAAI,IAAA,CAAK,SAAS,OAAA,EAAS;AACzB,UAAA,MAAM,KAAK,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACjD,UAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,UAAC,EAAA,CAA+B,GAAG,MAAA,EAAQ,CAAC,SAAiB,IAAA,CAAK,YAAA,CAAa,IAAI,CAAC,CAAA;AAAA,QACtF,CAAA,MAAO;AACL,UAAA,IAAA,CAAK,MAAA,CAAO,YAAY,MAAM,CAAA;AAC9B,UAAA,IAAA,CAAK,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACxC,YAAA,IAAA,CAAK,YAAA,IAAgB,KAAA;AAAA,UACvB,CAAC,CAAA;AAAA,QACH;AAAA,MACF;AAEA,MAAA,IAAI,KAAK,MAAA,EAAQ;AACf,QAAA,MAAM,WAAW,eAAA,CAAgB,EAAE,KAAA,EAAO,IAAA,CAAK,QAAQ,CAAA;AACvD,QAAC,QAAA,CAAqC,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,KAAiB;AACjE,UAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,QAAA,EAAU,EAAE,MAAM,CAAA;AACjC,UAAA,IAAA,CAAK,YAAA,CAAa,KAAK,IAAI,CAAA;AAC3B,UAAA,IAAI,KAAK,YAAA,CAAa,MAAA,GAAS,EAAA,EAAI,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,QAC7D,CAAC,CAAA;AAAA,MACH;AAEA,MAAA,WAAA,CAAY,EAAA,CAAG,MAAA,EAAQ,CAAC,IAAA,EAAqB,MAAA,KAAkC;AAC7E,QAAA,IAAA,CAAK,IAAI,IAAA,CAAK,YAAA,EAAc,EAAE,IAAA,EAAM,QAAQ,CAAA;AAC5C,QAAA,IAAA,CAAK,MAAA,CAAO,MAAM,MAAM,CAAA;AAAA,MAC1B,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,KAAA,GAAuB;AAC3B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AAAA,EAC3B;AAAA,EAEA,IAAA,GAAa;AACX,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAA,CAAK,IAAA,EAAM,KAAK,SAAS,CAAA;AACzB,IAAA,IAAA,CAAK,OAAA,EAAQ;AAAA,EACf;AAAA,EAEA,MAAM,YAAA,GAA8B;AAClC,IAAA,IAAA,CAAK,IAAA,EAAK;AACV,IAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAWU,WAAW,KAAA,EAAsB;AAAA,EAAC;AAAA;AAAA,EAGlC,eAAe,IAAA,EAAoB;AAAA,EAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUpC,YAAA,CAAa,MAAqB,MAAA,EAAkD;AAC5F,IAAA,IAAI,SAAS,CAAA,IAAM,IAAA,KAAS,IAAA,IAAQ,MAAA,KAAW,MAAO,OAAO,IAAA;AAC7D,IAAA,MAAM,OAAO,IAAA,CAAK,YAAA,CAAa,MAAM,GAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AACnD,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,kBAAA,EAAqB,IAAA,IAAQ,MAAM,CAAA,EAAG,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,MACzF,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,IAAA,IAAQ,CAAA,IAAA,EAAO,IAAA,CAAK,WAAW,CAAA,mDAAA;AAAA,KACvC;AAAA,EACF;AAAA;AAAA;AAAA,EAKU,cAAc,OAAA,EAAyB;AAC/C,IAAA,OAAO,KAAK,MAAA,CAAO,YAAA,GAAe,CAAA,EAAG,IAAA,CAAK,OAAO,YAAY;;AAAA;;AAAA,EAAc,OAAO,CAAA,CAAA,GAAK,OAAA;AAAA,EACzF;AAAA,EAEU,mBAAmB,QAAA,EAAwB;AACnD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AACzB,MAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,MAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAChB,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,eAAA;AAAA,QACN,OAAA,EAAS,YAAY,EAAE;AAAA,OACH,CAAA;AAAA,IACxB;AACA,IAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,UAAA,CAAW,IAAA,CAAK,QAAQ,CAAA,GAC3C,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAM,CAAA,GACnC,QAAA;AACJ,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,QACvB,IAAA,EAAM,gBAAA;AAAA,QACN,OAAA,EAAS,YAAY,QAAQ,CAAA;AAAA,QAC7B,UAAA,EAAY;AAAA,OACQ,CAAA;AAAA,IACxB;AAAA,EACF;AAAA,EAEU,iBAAiB,QAAA,EAAyB;AAClD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC3B,IAAA,MAAM,IAAA,GAAO,YAAY,IAAA,CAAK,QAAA;AAC9B,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,aAAA;AAAA,MACN,OAAA,EAAS,YAAY,IAAI;AAAA,KACL,CAAA;AACtB,IAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AACvB,IAAA,IAAA,CAAK,QAAA,GAAW,EAAA;AAAA,EAClB;AAAA,EAEU,YAAA,CAAa,MAAc,KAAA,EAAsB;AACzD,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,WAAA;AAAA,MACN,IAAA;AAAA,MACA,IAAA,EAAM,EAAE,IAAA,EAAK;AAAA,MACb;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAA,EAAc,IAAA,EAAe,OAAA,GAAU,KAAA,EAAa;AAC3E,IAAA,IAAA,CAAK,kBAAA,CAAmB,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAS,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,CAAA;AACzF,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,oBAAA;AAAA,MACN,QAAA,EAAU;AAAA,KACU,CAAA;AAAA,EACxB;AAAA,EAEQ,gBAAA,GAAyB;AAC/B,IAAA,IAAI,IAAA,CAAK,kBAAA,CAAmB,MAAA,KAAW,CAAA,EAAG;AAC1C,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,UAAA;AAAA,MACN,WAAA,EAAa,CAAC,GAAG,IAAA,CAAK,kBAAkB;AAAA,KACpB,CAAA;AACtB,IAAA,IAAA,CAAK,qBAAqB,EAAC;AAAA,EAC7B;AAAA,EAEU,WAAW,IAAA,EAKZ;AACP,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,MAAA;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA;AACjB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS,KAAK,OAAA,IAAW,SAAA;AAAA,MACzB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,KAAK,OAAA,IAAW,CAAA;AAAA,MACzB,GAAI,KAAK,MAAA,GAAS,EAAE,QAAQ,IAAA,CAAK,MAAA,KAAW;AAAC,KACzB,CAAA;AAAA,EACxB;AAAA,EAEU,SAAA,CAAU,MAAA,EAAoB,KAAA,GAAQ,KAAA,EAAa;AAC3D,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,OAAA;AAAA,MACN,OAAO,MAAA,CAAO,OAAA;AAAA,MACd,MAAA;AAAA,MACA;AAAA,KACoB,CAAA;AAAA,EACxB;AAAA,EAEU,cAAA,CAAe,IAAa,IAAA,EAAqB;AACzD,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,KAAO,IAAA,CAAK,UAAA,EAAY;AACnC,IAAA,IAAA,CAAK,UAAA,GAAa,EAAA;AAClB,IAAA,IAAA,CAAK,KAAK,aAAA,EAAe;AAAA,MACvB,IAAA,EAAM,cAAA;AAAA,MACN,eAAA,EAAiB,EAAA;AAAA,MACjB,GAAI,IAAA,GAAO,EAAE,WAAA,EAAa,IAAA,KAAS;AAAC,KAChB,CAAA;AAAA,EACxB;AAAA;AAAA,EAGU,gBAAgB,OAAA,EAA6B;AACrD,IAAA,MAAM,OAAA,GAAU,4BAA4B,OAAO,CAAA;AACnD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO;AAAA,QACL,OAAA;AAAA,QACA,QAAA,EAAU,SAAA;AAAA,QACV,SAAA,EAAW,IAAA;AAAA,QACX,IAAA,EAAM,CAAA,cAAA,EAAiB,IAAA,CAAK,WAAW,CAAA,sCAAA;AAAA,OACzC;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GACJ,QAAQ,QAAA,KAAa,MAAA,GACjB,4CAA4C,IAAA,CAAK,WAAW,MAC5D,OAAA,CAAQ,QAAA,KAAa,eACnB,CAAA,EAAG,IAAA,CAAK,WAAW,CAAA,wDAAA,CAAA,GACnB,OAAA,CAAQ,aAAa,OAAA,GACnB,wGAAA,GACA,CAAA,0CAAA,EAA6C,IAAA,CAAK,WAAW,CAAA,CAAA,CAAA;AACvE,IAAA,OAAO,EAAE,SAAS,QAAA,EAAU,OAAA,CAAQ,UAAU,SAAA,EAAW,OAAA,CAAQ,WAAW,IAAA,EAAK;AAAA,EACnF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBU,OAAA,CAAQ,SAAA,GAAsB,EAAC,EAA2B;AAClE,IAAA,MAAM,MAA8B,EAAC;AACrC,IAAA,MAAM,QAAA,GAAW,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,UAAA,EAAY,mBAAA,EAAqB,GAAG,SAAS,CAAA;AACvF,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,MAAM,CAAA,GAAI,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AACzB,MAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,CAAA;AAAA,IAClC;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,EAAG;AACtD,MAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC/B,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,CAAA,EAAG,IAAA,CAAK,SAAS,UAAU,CAAA,IAAK,GAAA,CAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC9E,QAAA,GAAA,CAAI,GAAG,CAAA,GAAI,KAAA;AAAA,MACb;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,UAAA,EAAY;AAC1B,MAAA,GAAA,CAAI,eAAA,GAAkB,CAAA,QAAA,EAAW,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA,qCAAA,CAAA;AAAA,IACzD;AACA,IAAA,IAAI,IAAA,CAAK,OAAO,GAAA,EAAK,MAAA,CAAO,OAAO,GAAA,EAAK,IAAA,CAAK,OAAO,GAAG,CAAA;AACvD,IAAA,OAAO,sBAAsB,GAAG,CAAA;AAAA,EAClC;AAAA;AAAA,EAIQ,aAAa,IAAA,EAAoB;AACvC,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,sBAAA,EAAwB,EAAE,MAAM,CAAA;AAC/C,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,WAAW,IAAI,CAAA;AAAA,IACtB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,GAAA,CAAI,KAAK,kBAAA,EAAoB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA,EAEQ,MAAA,CAAO,MAAqB,MAAA,EAAqC;AACvE,IAAA,IAAA,CAAK,OAAA,EAAQ;AAEb,IAAA,IAAI,KAAK,QAAA,EAAU;AACjB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,aAAA,EAAc;AACnB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,KAAK,IAAA,KAAS,UAAA,KAAe,IAAA,KAAS,CAAA,IAAK,SAAS,IAAA,CAAA,EAAO;AAC7D,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,cAAA,CAAe,KAAK,YAAY,CAAA;AAAA,MACvC,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,GAAA,CAAI,KAAK,sBAAA,EAAwB,EAAE,OAAO,MAAA,CAAO,GAAG,GAAG,CAAA;AAAA,MAC9D;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAC9C,IAAA,IAAI,OAAA,IAAW,CAAC,IAAA,CAAK,SAAA,EAAW;AAC9B,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,UAAU,OAAO,CAAA;AACtB,MAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,MAAA,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAI,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAC,CAAA;AAChF,MAAA;AAAA,IACF;AAIA,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW,IAAA,CAAK,WAAW,EAAE,OAAA,EAAS,kBAAkB,CAAA;AAAA,SAC7D;AACH,MAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,MAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,IACxB;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAe,EAAE,IAAA,EAAM,aAAkC,CAAA;AACnE,IAAA,IAAA,CAAK,aAAA,EAAc;AAAA,EACrB;AAAA,EAEQ,aAAA,GAAsB;AAC5B,IAAA,MAAM,UAAU,IAAA,CAAK,WAAA;AACrB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,OAAA,IAAU;AAAA,EACZ;AAAA,EAEQ,aAAa,GAAA,EAAkB;AACrC,IAAA,MAAM,SAAS,IAAA,CAAK,UAAA;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,MAAA,GAAS,GAAG,CAAA;AAAA,EACd;AAAA,EAEQ,OAAA,GAAgB;AACtB,IAAA,IAAA,CAAK,IAAI,KAAA,EAAM;AACf,IAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AACV,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AAAA,EAEQ,qBAAqB,GAAA,EAAwC;AACnE,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA,kBAAA,CAAA;AAAA,QAC3B,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,KAAK,WAAA;AAAY,OACzB;AAAA,IACF;AACA,IAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAA,0BAAA,EAA6B,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,QACrD,QAAA,EAAU,QAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,IAAA,EAAM,CAAA,+BAAA,EAAkC,IAAA,CAAK,UAAU,CAAA,QAAA;AAAA,OACzD;AAAA,IACF;AACA,IAAA,OAAO;AAAA,MACL,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,QAAA,EAAU,SAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,IAAA,EAAM,CAAA,6CAAA,EAAgD,IAAA,CAAK,WAAW,CAAA,YAAA;AAAA,KACxE;AAAA,EACF;AACF;AAOA,SAAS,YAAY,IAAA,EAA4B;AAC/C,EAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA,EAAE;AAChE;AAGO,SAAS,YAAY,IAAA,EAAmB;AAC7C,EAAA,IAAI,OAAO,IAAA,EAAM,IAAA,KAAS,QAAA,SAAiB,IAAA,CAAK,IAAA;AAChD,EAAA,IAAI,OAAO,IAAA,EAAM,KAAA,KAAU,QAAA,SAAiB,IAAA,CAAK,KAAA;AACjD,EAAA,IAAI,OAAO,IAAA,EAAM,OAAA,KAAY,QAAA,SAAiB,IAAA,CAAK,OAAA;AACnD,EAAA,IAAI,OAAO,IAAA,EAAM,QAAA,KAAa,QAAA,SAAiB,IAAA,CAAK,QAAA;AACpD,EAAA,MAAM,MAAM,IAAA,EAAM,OAAA;AAClB,EAAA,IAAI,OAAO,GAAA,EAAK,OAAA,KAAY,QAAA,SAAiB,GAAA,CAAI,OAAA;AACjD,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAI,OAAA,CACR,MAAA;AAAA,MACC,CAAC,CAAA,KAAA,CAAY,CAAA,EAAG,IAAA,KAAS,MAAA,IAAU,GAAG,IAAA,KAAS,MAAA,KAAc,OAAO,CAAA,EAAG,IAAA,KAAS;AAAA,KAClF,CACC,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAA,EAAG;AAC9B,IAAA,OAAO,KAAK,KAAA,CACT,MAAA,CAAO,CAAC,CAAA,KAAW,OAAO,CAAA,EAAG,IAAA,KAAS,QAAQ,CAAA,CAC9C,IAAI,CAAC,CAAA,KAAW,EAAE,IAAI,CAAA,CACtB,KAAK,EAAE,CAAA;AAAA,EACZ;AAEA,EAAA,IAAI,OAAO,IAAA,EAAM,IAAA,EAAM,SAAS,QAAA,EAAU,OAAO,KAAK,IAAA,CAAK,IAAA;AAC3D,EAAA,OAAO,EAAA;AACT;AAGO,SAAS,cAAc,IAAA,EAA8B;AAC1D,EAAA,MAAM,CAAA,GAAI,MAAM,KAAA,IAAS,IAAA,EAAM,OAAO,KAAA,IAAS,IAAA,EAAM,KAAA,IAAS,IAAA,EAAM,MAAA,IAAU,IAAA;AAC9E,EAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,UAAU,OAAO,IAAA;AACxC,EAAA,MAAM,KAAA,GAAQ,EAAE,YAAA,IAAgB,CAAA,CAAE,eAAe,CAAA,CAAE,aAAA,IAAiB,CAAA,CAAE,gBAAA,IAAoB,CAAA,CAAE,KAAA;AAC5F,EAAA,MAAM,MAAA,GACJ,EAAE,aAAA,IAAiB,CAAA,CAAE,gBAAgB,CAAA,CAAE,iBAAA,IAAqB,CAAA,CAAE,oBAAA,IAAwB,CAAA,CAAE,MAAA;AAC1F,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,mBAAA,IAAuB,CAAA,CAAE,mBAAmB,CAAA,CAAE,uBAAA;AAClE,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW,OAAO,IAAA;AACxD,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,MAAA,CAAO,WAAA,GAAc,KAAA;AACpD,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,MAAA,CAAO,YAAA,GAAe,MAAA;AACtD,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,EAAU,MAAA,CAAO,eAAA,GAAkB,SAAA;AAC5D,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,YAAY,IAAA,EAA+B;AACzD,EAAA,MAAM,CAAA,GACJ,IAAA,EAAM,IAAA,IAAQ,IAAA,EAAM,OAAA,IAAW,IAAA,EAAM,cAAA,IAAkB,IAAA,EAAM,KAAA,EAAO,IAAA,IAAQ,IAAA,EAAM,KAAA,EAAO,IAAA;AAC3F,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC","file":"chunk-SH5D7U7N.js","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport type { EventEmitter } from \"node:events\";\nimport { createInterface, type Interface } from \"node:readline\";\nimport type { Logger, TokenUsage } from \"@skaile/workspaces/types\";\nimport { resolveAgentExec, wrapAgentCommand } from \"../agent-exec.js\";\nimport { classifyGenericErrorMessage } from \"../error-classifier.js\";\nimport { ReconfigureLedger } from \"../reconfigure-ledger.js\";\nimport { stripRunnerPrivateEnv } from \"../runner-private-env.js\";\nimport {\n  type AgentConfig,\n  AgentDriver,\n  type AgentError,\n  type AgentEvent,\n  type AgentMessage,\n  type ReconfigureApplied,\n  type ReconfigureOutcome,\n  type ReconfigurePatch,\n} from \"../types.js\";\n\n/**\n * Shared base for one-shot **subprocess CLI** agent harnesses (Gemini, Qwen,\n * OpenCode, Goose, Continue).\n *\n * These harnesses are neither persistent JSON-RPC subprocesses (`omp`) nor\n * in-process SDKs (`claude-sdk`, `codex`). In headless mode each is invoked\n * **once per turn** — `prompt()` spawns the CLI fresh, a `readline` loop maps\n * newline-delimited JSON on stdout to the unified {@link AgentEvent} stream, and\n * **process exit marks the end of the turn**. Multi-turn continuity comes from\n * capturing a harness session id (emitted as `session_info`) and replaying it\n * via a resume flag on the next spawn.\n *\n * Subclasses implement {@link buildArgs}, {@link buildEnv}, and either\n * {@link handleJson} (streaming JSONL, the default) or {@link handleBuffered}\n * (`mode = \"buffered\"`, for CLIs that print a single JSON blob at the end).\n *\n * **Terminal-sequence invariant.** Subclasses MUST NOT emit `agent_end`. The\n * base emits exactly one `result` (synthesizing a success result when the\n * stream produced none) followed by a single `agent_end` on clean exit, or an\n * `error` + `agent_end` on crash. This keeps the turn-completion contract\n * (`prompt()` resolves after `agent_end`) identical across every CLI driver.\n *\n * @docLink packages/bridge/drivers#subprocess-cli\n */\nexport abstract class SubprocessCliDriver extends AgentDriver {\n  /** Per-driver logger, constructed once by the subclass. */\n  protected abstract readonly log: Logger;\n  /** Default binary name spawned in production (e.g. `\"gemini\"`). */\n  protected abstract readonly defaultBin: string;\n  /** Human product name used in error messages / hints (e.g. `\"Gemini CLI\"`). */\n  protected abstract readonly productName: string;\n  /**\n   * Test-seam env prefix. `<PREFIX>_BRIDGE_BIN` overrides the spawn binary and\n   * `<PREFIX>_BRIDGE_PREARGS` (space-delimited) supplies leading argv — used by\n   * the fake-CLI harness to redirect spawn without monkey-patching\n   * `child_process`. Both are ignored in production.\n   */\n  protected abstract readonly envPrefix: string;\n  /** `\"jsonl\"` streams events line-by-line; `\"buffered\"` parses all stdout once on exit. */\n  protected readonly mode: \"jsonl\" | \"buffered\" = \"jsonl\";\n\n  protected config: AgentConfig;\n  private readonly reconfig: ReconfigureLedger;\n\n  private proc: ChildProcess | null = null;\n  private rl: Interface | null = null;\n  private stderrBuffer: string[] = [];\n  private stdoutBuffer = \"\";\n  private started = false;\n\n  // ── Per-turn state ──────────────────────────────────────────────────────\n  private prevText = \"\";\n  private activeAssistant = false;\n  private pendingToolResults: AgentMessage[] = [];\n  private sawResult = false;\n  private aborting = false;\n  private turnResolve: (() => void) | null = null;\n  private turnReject: ((err: Error) => void) | null = null;\n\n  protected _sessionId?: string;\n  protected _lastTokens: TokenUsage | null = null;\n\n  constructor(config: AgentConfig) {\n    super();\n    this.config = config;\n    this.reconfig = new ReconfigureLedger({\n      config: () => this.config,\n      onDesired: (applied) => this.onReconfigured(applied),\n    });\n  }\n\n  override get runtimeSessionId(): string | undefined {\n    return this._sessionId;\n  }\n\n  override getModel(): string | undefined {\n    return this.config.model;\n  }\n\n  override getTokenUsage(): TokenUsage | null {\n    return this._lastTokens;\n  }\n\n  /**\n   * A one-shot CLI has no resident process: a patch is stored and the next\n   * spawn reads it. The ledger scopes the model and writes the config.\n   */\n  override reconfigure(patch: ReconfigurePatch): Promise<ReconfigureOutcome> {\n    return this.reconfig.reconfigure(patch);\n  }\n\n  /**\n   * A patch was stored in {@link config}. Subclasses that cache something derived\n   * from the model (rendered provider files, bindings) invalidate it here.\n   */\n  protected onReconfigured(applied: ReconfigureApplied): void {\n    void applied;\n  }\n\n  /**\n   * No-op for one-shot CLIs — there is no long-lived process to spawn until the\n   * first prompt. Kept so the runner's `start()` → `prompt()` ordering works\n   * uniformly; binary-presence failures surface as a `config` error on the\n   * first spawn (see {@link classifyProcessError}).\n   */\n  async start(): Promise<void> {\n    this.started = true;\n  }\n\n  get isRunning(): boolean {\n    return this.proc !== null && !this.proc.killed;\n  }\n\n  /**\n   * Sends a user message to the CLI and resolves after the turn completes\n   * (`agent_end`). Spawns a fresh child per call; rejects if the child exits\n   * non-zero before emitting a result, so the caller never hangs.\n   */\n  async prompt(message: string): Promise<void> {\n    if (this.proc) throw new Error(`${this.productName} turn already in progress`);\n    if (!this.started) await this.start();\n\n    this.prevText = \"\";\n    this.activeAssistant = false;\n    this.pendingToolResults = [];\n    this.sawResult = false;\n    this.aborting = false;\n    this.stderrBuffer = [];\n    this.stdoutBuffer = \"\";\n    this._lastTokens = null;\n\n    const composed = this.composePrompt(message);\n    const overrideBin = process.env[`${this.envPrefix}_BRIDGE_BIN`];\n    const preArgs = process.env[`${this.envPrefix}_BRIDGE_PREARGS`]\n      ? (process.env[`${this.envPrefix}_BRIDGE_PREARGS`] as string).split(/\\s+/).filter(Boolean)\n      : [];\n    const bin = overrideBin || this.defaultBin;\n    const args = [...preArgs, ...this.buildArgs(composed, this._sessionId)];\n    const env = this.buildEnv();\n\n    return new Promise<void>((resolve, reject) => {\n      this.turnResolve = resolve;\n      this.turnReject = reject;\n      this.log.info(\"spawning CLI\", {\n        bin,\n        cwd: this.config.cwd,\n        resume: Boolean(this._sessionId),\n      });\n\n      // With the uid split on, the CLI runs as the agent uid through the launch shim.\n      const target = wrapAgentCommand(bin, args, resolveAgentExec());\n      const proc = spawn(target.command, target.args, {\n        cwd: this.config.cwd,\n        env,\n        stdio: [\"ignore\", \"pipe\", \"pipe\"],\n      }) as ChildProcess;\n      this.proc = proc;\n      const procEmitter = proc as unknown as EventEmitter;\n\n      procEmitter.on(\"error\", (err: Error) => {\n        const detail = this.classifyProcessError(err as NodeJS.ErrnoException);\n        this.log.error(\"spawn error\", err, { detail });\n        this.pushError(detail);\n        this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n        this.settleReject(Object.assign(new Error(detail.message), { detail }));\n      });\n\n      if (proc.stdout) {\n        if (this.mode === \"jsonl\") {\n          const rl = createInterface({ input: proc.stdout });\n          this.rl = rl;\n          (rl as unknown as EventEmitter).on(\"line\", (line: string) => this.onStdoutLine(line));\n        } else {\n          proc.stdout.setEncoding(\"utf8\");\n          proc.stdout.on(\"data\", (chunk: string) => {\n            this.stdoutBuffer += chunk;\n          });\n        }\n      }\n\n      if (proc.stderr) {\n        const stderrRl = createInterface({ input: proc.stderr });\n        (stderrRl as unknown as EventEmitter).on(\"line\", (line: string) => {\n          this.log.debug(\"stderr\", { line });\n          this.stderrBuffer.push(line);\n          if (this.stderrBuffer.length > 20) this.stderrBuffer.shift();\n        });\n      }\n\n      procEmitter.on(\"exit\", (code: number | null, signal: NodeJS.Signals | null) => {\n        this.log.info(\"CLI exited\", { code, signal });\n        this.onExit(code, signal);\n      });\n    });\n  }\n\n  /** Out-of-band abort: terminates the current child. Driver stays usable for the next prompt. */\n  async abort(): Promise<void> {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n  }\n\n  kill(): void {\n    this.aborting = true;\n    this.proc?.kill(\"SIGTERM\");\n    this.cleanup();\n  }\n\n  async resetSession(): Promise<void> {\n    this.kill();\n    this._sessionId = undefined;\n    this._lastTokens = null;\n  }\n\n  // ── Subclass hooks ────────────────────────────────────────────────────────\n\n  /** Build the CLI argv (binary excluded) for one turn. `resumeId` is the captured session id, if any. */\n  protected abstract buildArgs(message: string, resumeId: string | undefined): string[];\n\n  /** Build the child-process env (explicit allowlist — see {@link baseEnv}). */\n  protected abstract buildEnv(): Record<string, string>;\n\n  /** Map one parsed stdout JSON object to events via the `push*` helpers. Streaming (`jsonl`) mode only. */\n  protected handleJson(_json: unknown): void {}\n\n  /** Parse the full stdout blob once on clean exit. `buffered` mode only. */\n  protected handleBuffered(_raw: string): void {}\n\n  /** Install-failure hint surfaced when the binary is missing. */\n  protected abstract installHint(): string;\n\n  /**\n   * Classify a non-zero exit into an {@link AgentError}, or `null` to treat the\n   * exit as success (e.g. a turn-limit code where a result was already\n   * emitted). Default: code `0` / clean signal → success; otherwise `process`.\n   */\n  protected classifyExit(code: number | null, signal: NodeJS.Signals | null): AgentError | null {\n    if (code === 0 || (code === null && signal === null)) return null;\n    const tail = this.stderrBuffer.slice(-10).join(\"\\n\");\n    return {\n      message: `${this.productName} exited with code ${code ?? \"null\"}${tail ? `: ${tail}` : \"\"}`,\n      category: \"process\",\n      retryable: true,\n      hint: tail || `The ${this.productName} process exited unexpectedly. Try the prompt again.`,\n    };\n  }\n\n  // ── Protected emit helpers (used by handleJson / handleBuffered) ────────────\n\n  /** Prepend `systemPrompt` to the user message — uniform across CLIs lacking a reliable system flag. */\n  protected composePrompt(message: string): string {\n    return this.config.systemPrompt ? `${this.config.systemPrompt}\\n\\n---\\n\\n${message}` : message;\n  }\n\n  protected pushAssistantDelta(fullText: string): void {\n    if (!this.activeAssistant) {\n      this.activeAssistant = true;\n      this.prevText = \"\";\n      this.emit(\"agent-event\", {\n        type: \"message_start\",\n        message: asstMessage(\"\"),\n      } satisfies AgentEvent);\n    }\n    const delta = fullText.startsWith(this.prevText)\n      ? fullText.slice(this.prevText.length)\n      : fullText;\n    this.prevText = fullText;\n    if (delta) {\n      this.emit(\"agent-event\", {\n        type: \"message_update\",\n        message: asstMessage(fullText),\n        _textDelta: delta,\n      } satisfies AgentEvent);\n    }\n  }\n\n  protected pushAssistantEnd(fullText?: string): void {\n    if (!this.activeAssistant) return;\n    const text = fullText ?? this.prevText;\n    this.emit(\"agent-event\", {\n      type: \"message_end\",\n      message: asstMessage(text),\n    } satisfies AgentEvent);\n    this.activeAssistant = false;\n    this.prevText = \"\";\n  }\n\n  protected pushToolCall(name: string, input: unknown): void {\n    this.emit(\"agent-event\", {\n      type: \"tool_call\",\n      name,\n      tool: { name },\n      input,\n    } satisfies AgentEvent);\n  }\n\n  protected pushToolResult(name: string, data: unknown, isError = false): void {\n    this.pendingToolResults.push({ role: \"tool\", toolName: name, content: \"\", data, isError });\n    this.emit(\"agent-event\", {\n      type: \"tool_execution_end\",\n      toolName: name,\n    } satisfies AgentEvent);\n  }\n\n  private flushToolResults(): void {\n    if (this.pendingToolResults.length === 0) return;\n    this.emit(\"agent-event\", {\n      type: \"turn_end\",\n      toolResults: [...this.pendingToolResults],\n    } satisfies AgentEvent);\n    this.pendingToolResults = [];\n  }\n\n  protected pushResult(opts: {\n    tokens?: TokenUsage | null;\n    costUsd?: number;\n    summary?: string;\n    subtype?: string;\n  }): void {\n    this.pushAssistantEnd();\n    this.flushToolResults();\n    if (opts.tokens) this._lastTokens = opts.tokens;\n    this.sawResult = true;\n    this.emit(\"agent-event\", {\n      type: \"result\",\n      subtype: opts.subtype ?? \"success\",\n      summary: opts.summary,\n      costUsd: opts.costUsd ?? 0,\n      ...(opts.tokens ? { tokens: opts.tokens } : {}),\n    } satisfies AgentEvent);\n  }\n\n  protected pushError(detail: AgentError, fatal = false): void {\n    this.emit(\"agent-event\", {\n      type: \"error\",\n      error: detail.message,\n      detail,\n      fatal,\n    } satisfies AgentEvent);\n  }\n\n  protected captureSession(id?: string, file?: string): void {\n    if (!id || id === this._sessionId) return;\n    this._sessionId = id;\n    this.emit(\"agent-event\", {\n      type: \"session_info\",\n      driverSessionId: id,\n      ...(file ? { sessionFile: file } : {}),\n    } satisfies AgentEvent);\n  }\n\n  /** Shared keyword classification + per-driver hint copy (mirrors omp/codex). */\n  protected classifyMessage(message: string): AgentError {\n    const generic = classifyGenericErrorMessage(message);\n    if (!generic) {\n      return {\n        message,\n        category: \"unknown\",\n        retryable: true,\n        hint: `An unexpected ${this.productName} error occurred. Try the prompt again.`,\n      };\n    }\n    const hint =\n      generic.category === \"auth\"\n        ? `Check the API key / login configured for ${this.productName}.`\n        : generic.category === \"rate_limit\"\n          ? `${this.productName} hit a provider rate limit. Wait a moment and try again.`\n          : generic.category === \"model\"\n            ? \"The selected model is unavailable or the context is too long. Change the model or start a new session.\"\n            : `A network error occurred while talking to ${this.productName}.`;\n    return { message, category: generic.category, retryable: generic.retryable, hint };\n  }\n\n  // ── Env allowlist ──────────────────────────────────────────────────────────\n\n  /**\n   * Explicit env whitelist forwarded to the child. Omits anything provisioned\n   * by `provision_secrets` so user credentials stay out of the subprocess\n   * environment. Always passes through the driver's test-seam vars and\n   * `FAKE_CLI_*`.\n   *\n   * `config.env` is merged **over** the whitelist, not in place of it. It used\n   * to replace it wholesale, which meant any caller that set a single variable\n   * silently dropped `PATH` and `HOME` and the spawn failed with ENOENT —\n   * unusable as the delivery channel for registry-derived endpoint variables\n   * (plan §2.3, \"Delivery rule\"). Widening keeps both: the caller's variables\n   * win per key, the process still has a `PATH`.\n   */\n  protected baseEnv(extraKeys: string[] = []): Record<string, string> {\n    const out: Record<string, string> = {};\n    const explicit = [\"PATH\", \"HOME\", \"USER\", \"HOSTNAME\", \"SKAILE_SESSION_ID\", ...extraKeys];\n    for (const key of explicit) {\n      const v = process.env[key];\n      if (v !== undefined) out[key] = v;\n    }\n    for (const [key, value] of Object.entries(process.env)) {\n      if (typeof value !== \"string\") continue;\n      if (key.startsWith(`${this.envPrefix}_BRIDGE_`) || key.startsWith(\"FAKE_CLI_\")) {\n        out[key] = value;\n      }\n    }\n    if (this.config.sshKeyPath) {\n      out.GIT_SSH_COMMAND = `ssh -i \"${this.config.sshKeyPath}\" -o StrictHostKeyChecking=accept-new`;\n    }\n    if (this.config.env) Object.assign(out, this.config.env);\n    return stripRunnerPrivateEnv(out);\n  }\n\n  // ── Internals ────────────────────────────────────────────────────────────\n\n  private onStdoutLine(line: string): void {\n    if (!line.trim()) return;\n    let json: unknown;\n    try {\n      json = JSON.parse(line);\n    } catch {\n      this.log.debug(\"non-JSON stdout line\", { line });\n      return;\n    }\n    try {\n      this.handleJson(json);\n    } catch (err) {\n      this.log.warn(\"handleJson threw\", { error: String(err) });\n    }\n  }\n\n  private onExit(code: number | null, signal: NodeJS.Signals | null): void {\n    this.cleanup();\n\n    if (this.aborting) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleResolve();\n      return;\n    }\n\n    if (this.mode === \"buffered\" && (code === 0 || code === null)) {\n      try {\n        this.handleBuffered(this.stdoutBuffer);\n      } catch (err) {\n        this.log.warn(\"handleBuffered threw\", { error: String(err) });\n      }\n    }\n\n    const exitErr = this.classifyExit(code, signal);\n    if (exitErr && !this.sawResult) {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n      this.pushError(exitErr);\n      this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n      this.settleReject(Object.assign(new Error(exitErr.message), { detail: exitErr }));\n      return;\n    }\n\n    // Clean exit (or non-zero exit after a result already streamed): close any\n    // open assistant message, synthesize a success result if none arrived, end.\n    if (!this.sawResult) this.pushResult({ summary: \"Task completed\" });\n    else {\n      this.pushAssistantEnd();\n      this.flushToolResults();\n    }\n    this.emit(\"agent-event\", { type: \"agent_end\" } satisfies AgentEvent);\n    this.settleResolve();\n  }\n\n  private settleResolve(): void {\n    const resolve = this.turnResolve;\n    this.turnResolve = null;\n    this.turnReject = null;\n    resolve?.();\n  }\n\n  private settleReject(err: Error): void {\n    const reject = this.turnReject;\n    this.turnResolve = null;\n    this.turnReject = null;\n    reject?.(err);\n  }\n\n  private cleanup(): void {\n    this.rl?.close();\n    this.rl = null;\n    this.proc = null;\n  }\n\n  private classifyProcessError(err: NodeJS.ErrnoException): AgentError {\n    if (err.code === \"ENOENT\") {\n      return {\n        message: `${this.defaultBin} command not found`,\n        category: \"config\",\n        retryable: false,\n        hint: this.installHint(),\n      };\n    }\n    if (err.code === \"EACCES\") {\n      return {\n        message: `Permission denied running ${this.defaultBin}`,\n        category: \"config\",\n        retryable: false,\n        hint: `Check file permissions for the ${this.defaultBin} binary.`,\n      };\n    }\n    return {\n      message: err.message,\n      category: \"process\",\n      retryable: true,\n      hint: `An unexpected process error occurred running ${this.productName}. Try again.`,\n    };\n  }\n}\n\n// ───────────────────────────────────────────────────────────────────────────\n// Tolerant JSON extractors — shared because the upstream stream-json schemas\n// are not fully pinned; read the common field-name variants defensively.\n// ───────────────────────────────────────────────────────────────────────────\n\nfunction asstMessage(text: string): AgentMessage {\n  return { role: \"assistant\", content: [{ type: \"text\", text }] };\n}\n\n/** Pull assistant text out of a CLI event, trying the common field names. */\nexport function extractText(json: any): string {\n  if (typeof json?.text === \"string\") return json.text;\n  if (typeof json?.delta === \"string\") return json.delta;\n  if (typeof json?.content === \"string\") return json.content;\n  if (typeof json?.response === \"string\") return json.response;\n  const msg = json?.message;\n  if (typeof msg?.content === \"string\") return msg.content;\n  if (Array.isArray(msg?.content)) {\n    return msg.content\n      .filter(\n        (b: any) => (b?.type === \"text\" || b?.type === undefined) && typeof b?.text === \"string\",\n      )\n      .map((b: any) => b.text)\n      .join(\"\");\n  }\n  if (Array.isArray(json?.parts)) {\n    return json.parts\n      .filter((p: any) => typeof p?.text === \"string\")\n      .map((p: any) => p.text)\n      .join(\"\");\n  }\n  // OpenCode (`run --format json`) nests the payload under `part`.\n  if (typeof json?.part?.text === \"string\") return json.part.text;\n  return \"\";\n}\n\n/** Map a CLI usage/stats object onto {@link TokenUsage}, trying common field names. */\nexport function extractTokens(json: any): TokenUsage | null {\n  const u = json?.usage ?? json?.stats?.usage ?? json?.stats ?? json?.tokens ?? json;\n  if (!u || typeof u !== \"object\") return null;\n  const input = u.input_tokens ?? u.inputTokens ?? u.prompt_tokens ?? u.promptTokenCount ?? u.input;\n  const output =\n    u.output_tokens ?? u.outputTokens ?? u.completion_tokens ?? u.candidatesTokenCount ?? u.output;\n  const cacheRead = u.cached_input_tokens ?? u.cacheReadTokens ?? u.cachedContentTokenCount;\n  if (input === undefined && output === undefined) return null;\n  const tokens: TokenUsage = {};\n  if (typeof input === \"number\") tokens.inputTokens = input;\n  if (typeof output === \"number\") tokens.outputTokens = output;\n  if (typeof cacheRead === \"number\") tokens.cacheReadTokens = cacheRead;\n  return tokens;\n}\n\n/** Pull a per-turn USD cost from a CLI result object, or `undefined`. */\nexport function extractCost(json: any): number | undefined {\n  const c =\n    json?.cost ?? json?.costUsd ?? json?.total_cost_usd ?? json?.stats?.cost ?? json?.usage?.cost;\n  return typeof c === \"number\" ? c : undefined;\n}\n"]}

package/dist/{chunk-SX4UIDKT.js → chunk-UAROCOXF.js}

@@ -1,5 +1,5 @@
 import { readAllSessions } from './chunk-R6O6YWU7.js';
-import { findAiAssetsRoot } from './chunk-45VFGT7A.js';
+import { findAiAssetsRoot } from './chunk-4PTSR4UU.js';
 import { okJson, err } from './chunk-X5YPJV4N.js';
 
 // workspace-plugin/src/tools/flows.ts
@@ -68,5 +68,5 @@ async function flowFindFlowForSession(projectDir, runId) {
 }
 
 export { flowFindFlowForSession, flowGetSession, flowList, flowListSessions, flowShow };
-//# sourceMappingURL=chunk-SX4UIDKT.js.map
-//# sourceMappingURL=chunk-SX4UIDKT.js.map
+//# sourceMappingURL=chunk-UAROCOXF.js.map
+//# sourceMappingURL=chunk-UAROCOXF.js.map

package/dist/{chunk-SX4UIDKT.js.map → chunk-UAROCOXF.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../workspace-plugin/src/tools/flows.ts"],"names":[],"mappings":";;;;;AAmBA,eAAsB,SAAS,UAAA,EAAyC;AACtE,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,UAAU,CAAA;AACpD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,MAAA,CAAO,EAAE,CAAA;AACjC,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAC7B,4CACF,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,aAAa,UAAU,CAAA;AACrC,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAY;AAAA,MACrC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,IAAA,EAAM,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,EAAA;AAAA,MAClB,SAAA,EAAW,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU;AAAA,KAChC,CAAE,CAAA;AACF,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,QAAA,CAAS,YAAoB,MAAA,EAAqC;AACtF,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,UAAU,CAAA;AACpD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,GAAA,CAAI,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AACvD,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAC7B,4CACF,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,aAAa,UAAU,CAAA;AACrC,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAW,CAAA,CAAE,OAAO,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,GAAA,CAAI,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AACjD,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAYA,eAAsB,iBAAiB,UAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,UAAU,CAAA;AACjD,IAAA,OAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,cAAA,CAAe,YAAoB,KAAA,EAAoC;AAC3F,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,UAAU,CAAA;AACjD,IAAA,MAAM,UAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,KAAK,CAAA;AACtD,IAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AACtD,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAaA,eAAsB,sBAAA,CACpB,YACA,KAAA,EACqB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,UAAU,CAAA;AACjD,IAAA,MAAM,UAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,KAAK,CAAA;AACtD,IAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAEtD,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,UAAU,CAAA;AACpD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,GAAA,CAAI,CAAA,4BAAA,EAA+B,KAAK,CAAA,oBAAA,CAAsB,CAAA;AAEtF,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAC7B,4CACF,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,aAAa,UAAU,CAAA;AACrC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,CAAC,MAAW,CAAA,CAAE,EAAA,KAAO,QAAQ,MAAM,CAAA;AAC3D,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,IAAI,CAAA,gBAAA,EAAmB,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AACzD,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF","file":"chunk-SX4UIDKT.js","sourcesContent":["// src/tools/flows.ts\n\nimport type { ToolResult } from \"../types.js\";\nimport { err, okJson } from \"../types.js\";\nimport { findAiAssetsRoot } from \"../utils/ai-assets.js\";\nimport { readAllSessions } from \"./sessions.js\";\n\n// ── Flow tools ────────────────────────────────────────────────────────────────\n\n/**\n * List all flow definitions available in the project's `ai-assets` directory.\n *\n * Returns a JSON array of summary objects `{ id, name, nodeCount }`.\n * Returns an empty array when no `ai-assets` root is found.\n *\n * @param projectDir - Absolute path to the skaile project root.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowList(projectDir: string): Promise<ToolResult> {\n  try {\n    const assetsRoot = await findAiAssetsRoot(projectDir);\n    if (!assetsRoot) return okJson([]);\n    const { loadAllFlows } = await import(\n      \"@skaile/workspaces/factory-assets/connectors/flow/engine\"\n    );\n    const flows = loadAllFlows(assetsRoot);\n    const summary = flows.map((f: any) => ({\n      id: f.id,\n      name: f.name ?? f.id,\n      nodeCount: f.nodes?.length ?? 0,\n    }));\n    return okJson(summary);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Show the full flow definition (nodes, edges, metadata) for a specific flow.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param flowId     - Flow ID as returned by {@link flowList}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowShow(projectDir: string, flowId: string): Promise<ToolResult> {\n  try {\n    const assetsRoot = await findAiAssetsRoot(projectDir);\n    if (!assetsRoot) return err(`Flow not found: ${flowId}`);\n    const { loadAllFlows } = await import(\n      \"@skaile/workspaces/factory-assets/connectors/flow/engine\"\n    );\n    const flows = loadAllFlows(assetsRoot);\n    const flow = flows.find((f: any) => f.id === flowId);\n    if (!flow) return err(`Flow not found: ${flowId}`);\n    return okJson(flow);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * List all past and active flow run sessions for the workspace.\n *\n * Delegates to {@link readAllSessions} (reads `.skaile/sessions/*.json`),\n * sorted newest-first by `updatedAt`.\n *\n * @param projectDir - Absolute path to the skaile project root.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowListSessions(projectDir: string): Promise<ToolResult> {\n  try {\n    const sessions = await readAllSessions(projectDir);\n    return okJson(sessions);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Get driver metadata for a specific flow run session.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param runId      - Run ID from {@link flowListSessions}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowGetSession(projectDir: string, runId: string): Promise<ToolResult> {\n  try {\n    const sessions = await readAllSessions(projectDir);\n    const session = sessions.find((s) => s.runId === runId);\n    if (!session) return err(`Session not found: ${runId}`);\n    return okJson(session);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Resolve and return the flow definition that was used in a past session.\n *\n * Looks up the session by `runId`, reads its `flowId`, then returns the full\n * flow definition from `ai-assets`.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param runId      - Run ID from {@link flowListSessions}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowFindFlowForSession(\n  projectDir: string,\n  runId: string,\n): Promise<ToolResult> {\n  try {\n    const sessions = await readAllSessions(projectDir);\n    const session = sessions.find((s) => s.runId === runId);\n    if (!session) return err(`Session not found: ${runId}`);\n\n    const assetsRoot = await findAiAssetsRoot(projectDir);\n    if (!assetsRoot) return err(`Flow not found for session: ${runId} (no ai-assets root)`);\n\n    const { loadAllFlows } = await import(\n      \"@skaile/workspaces/factory-assets/connectors/flow/engine\"\n    );\n    const flows = loadAllFlows(assetsRoot);\n    const flow = flows.find((f: any) => f.id === session.flowId);\n    if (!flow) return err(`Flow not found: ${session.flowId}`);\n    return okJson(flow);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n"]}
+{"version":3,"sources":["../workspace-plugin/src/tools/flows.ts"],"names":[],"mappings":";;;;;AAmBA,eAAsB,SAAS,UAAA,EAAyC;AACtE,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,UAAU,CAAA;AACpD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,MAAA,CAAO,EAAE,CAAA;AACjC,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAC7B,4CACF,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,aAAa,UAAU,CAAA;AACrC,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAY;AAAA,MACrC,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,IAAA,EAAM,CAAA,CAAE,IAAA,IAAQ,CAAA,CAAE,EAAA;AAAA,MAClB,SAAA,EAAW,CAAA,CAAE,KAAA,EAAO,MAAA,IAAU;AAAA,KAChC,CAAE,CAAA;AACF,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,QAAA,CAAS,YAAoB,MAAA,EAAqC;AACtF,EAAA,IAAI;AACF,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,UAAU,CAAA;AACpD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,GAAA,CAAI,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AACvD,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAC7B,4CACF,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,aAAa,UAAU,CAAA;AACrC,IAAA,MAAM,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAW,CAAA,CAAE,OAAO,MAAM,CAAA;AACnD,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,GAAA,CAAI,CAAA,gBAAA,EAAmB,MAAM,CAAA,CAAE,CAAA;AACjD,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAYA,eAAsB,iBAAiB,UAAA,EAAyC;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,UAAU,CAAA;AACjD,IAAA,OAAO,OAAO,QAAQ,CAAA;AAAA,EACxB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAUA,eAAsB,cAAA,CAAe,YAAoB,KAAA,EAAoC;AAC3F,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,UAAU,CAAA;AACjD,IAAA,MAAM,UAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,KAAK,CAAA;AACtD,IAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AACtD,IAAA,OAAO,OAAO,OAAO,CAAA;AAAA,EACvB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF;AAaA,eAAsB,sBAAA,CACpB,YACA,KAAA,EACqB;AACrB,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,eAAA,CAAgB,UAAU,CAAA;AACjD,IAAA,MAAM,UAAU,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAU,KAAK,CAAA;AACtD,IAAA,IAAI,CAAC,OAAA,EAAS,OAAO,GAAA,CAAI,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAEtD,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,UAAU,CAAA;AACpD,IAAA,IAAI,CAAC,UAAA,EAAY,OAAO,GAAA,CAAI,CAAA,4BAAA,EAA+B,KAAK,CAAA,oBAAA,CAAsB,CAAA;AAEtF,IAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAC7B,4CACF,CAAA;AACA,IAAA,MAAM,KAAA,GAAQ,aAAa,UAAU,CAAA;AACrC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,CAAC,MAAW,CAAA,CAAE,EAAA,KAAO,QAAQ,MAAM,CAAA;AAC3D,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,IAAI,CAAA,gBAAA,EAAmB,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AACzD,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB,SAAS,CAAA,EAAY;AACnB,IAAA,OAAO,IAAI,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACvD;AACF","file":"chunk-UAROCOXF.js","sourcesContent":["// src/tools/flows.ts\n\nimport type { ToolResult } from \"../types.js\";\nimport { err, okJson } from \"../types.js\";\nimport { findAiAssetsRoot } from \"../utils/ai-assets.js\";\nimport { readAllSessions } from \"./sessions.js\";\n\n// ── Flow tools ────────────────────────────────────────────────────────────────\n\n/**\n * List all flow definitions available in the project's `ai-assets` directory.\n *\n * Returns a JSON array of summary objects `{ id, name, nodeCount }`.\n * Returns an empty array when no `ai-assets` root is found.\n *\n * @param projectDir - Absolute path to the skaile project root.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowList(projectDir: string): Promise<ToolResult> {\n  try {\n    const assetsRoot = await findAiAssetsRoot(projectDir);\n    if (!assetsRoot) return okJson([]);\n    const { loadAllFlows } = await import(\n      \"@skaile/workspaces/factory-assets/connectors/flow/engine\"\n    );\n    const flows = loadAllFlows(assetsRoot);\n    const summary = flows.map((f: any) => ({\n      id: f.id,\n      name: f.name ?? f.id,\n      nodeCount: f.nodes?.length ?? 0,\n    }));\n    return okJson(summary);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Show the full flow definition (nodes, edges, metadata) for a specific flow.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param flowId     - Flow ID as returned by {@link flowList}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowShow(projectDir: string, flowId: string): Promise<ToolResult> {\n  try {\n    const assetsRoot = await findAiAssetsRoot(projectDir);\n    if (!assetsRoot) return err(`Flow not found: ${flowId}`);\n    const { loadAllFlows } = await import(\n      \"@skaile/workspaces/factory-assets/connectors/flow/engine\"\n    );\n    const flows = loadAllFlows(assetsRoot);\n    const flow = flows.find((f: any) => f.id === flowId);\n    if (!flow) return err(`Flow not found: ${flowId}`);\n    return okJson(flow);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * List all past and active flow run sessions for the workspace.\n *\n * Delegates to {@link readAllSessions} (reads `.skaile/sessions/*.json`),\n * sorted newest-first by `updatedAt`.\n *\n * @param projectDir - Absolute path to the skaile project root.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowListSessions(projectDir: string): Promise<ToolResult> {\n  try {\n    const sessions = await readAllSessions(projectDir);\n    return okJson(sessions);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Get driver metadata for a specific flow run session.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param runId      - Run ID from {@link flowListSessions}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowGetSession(projectDir: string, runId: string): Promise<ToolResult> {\n  try {\n    const sessions = await readAllSessions(projectDir);\n    const session = sessions.find((s) => s.runId === runId);\n    if (!session) return err(`Session not found: ${runId}`);\n    return okJson(session);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n\n/**\n * Resolve and return the flow definition that was used in a past session.\n *\n * Looks up the session by `runId`, reads its `flowId`, then returns the full\n * flow definition from `ai-assets`.\n *\n * @param projectDir - Absolute path to the skaile project root.\n * @param runId      - Run ID from {@link flowListSessions}.\n *\n * @docLink packages/workspace-plugin/concepts#tool-delivery\n */\nexport async function flowFindFlowForSession(\n  projectDir: string,\n  runId: string,\n): Promise<ToolResult> {\n  try {\n    const sessions = await readAllSessions(projectDir);\n    const session = sessions.find((s) => s.runId === runId);\n    if (!session) return err(`Session not found: ${runId}`);\n\n    const assetsRoot = await findAiAssetsRoot(projectDir);\n    if (!assetsRoot) return err(`Flow not found for session: ${runId} (no ai-assets root)`);\n\n    const { loadAllFlows } = await import(\n      \"@skaile/workspaces/factory-assets/connectors/flow/engine\"\n    );\n    const flows = loadAllFlows(assetsRoot);\n    const flow = flows.find((f: any) => f.id === session.flowId);\n    if (!flow) return err(`Flow not found: ${session.flowId}`);\n    return okJson(flow);\n  } catch (e: unknown) {\n    return err(e instanceof Error ? e.message : String(e));\n  }\n}\n"]}

package/dist/{chunk-JMKB7IB4.js → chunk-UMVKJM4Q.js}

@@ -228,7 +228,7 @@ function resolveLogStoreConfig(input) {
     retention: yaml.retention
   };
 }
-function createLogStoreFromConfig(cfg) {
+function createLogStoreFromConfig(cfg, opts = {}) {
   const sinks = [];
   if (cfg.mode === "off") {
     sinks.push(new NoOpSink());
@@ -243,7 +243,7 @@ function createLogStoreFromConfig(cfg) {
     const dbPath = path.join(dir, "logs.db");
     sinks.push(new SqliteSink({ path: dbPath }));
   }
-  sinks.push(new StdoutSink());
+  if (opts.stdout !== false) sinks.push(new StdoutSink());
   return new LogStore({
     sessionId: cfg.sessionId,
     level: cfg.level,
@@ -355,5 +355,5 @@ var WsLogSink = class {
 };
 
 export { DEFAULT_LOGS_RETENTION, OnLogBridgeSink, SqliteSink, WsLogSink, createLogStoreFromConfig, enforceLogsRetention, openSqlite, resolveLogStoreConfig, resolveLogsRetention };
-//# sourceMappingURL=chunk-JMKB7IB4.js.map
-//# sourceMappingURL=chunk-JMKB7IB4.js.map
+//# sourceMappingURL=chunk-UMVKJM4Q.js.map
+//# sourceMappingURL=chunk-UMVKJM4Q.js.map

package/dist/chunk-UMVKJM4Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../core/src/logging/sinks/sqlite-runtime.ts","../core/src/logging/sinks/sqlite-sink.ts","../core/src/logging/config.ts","../core/src/logging/retention.ts","../core/src/logging/sinks/on-log-bridge-sink.ts","../core/src/logging/sinks/ws-log-sink.ts"],"names":["path"],"mappings":";;;;;;AAeA,IAAM,WAAA,GAAc,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAGjD,IAAM,KAAA,GAAQ,OAAQ,UAAA,CAAiC,GAAA,KAAQ,WAAA;AAyC/D,SAAS,cAAc,IAAA,EAAuC;AAC5D,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,CAAC,MAAA,KAAW;AACf,MAAA,MAAM,GAAA,GAAO,WAAW,MAAA,GAAY,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,IAAI,MAAM,CAAA;AAGhE,MAAA,OAAO,EAAE,OAAA,EAAS,MAAA,CAAO,GAAA,EAAK,OAAA,IAAW,CAAC,CAAA,EAAE;AAAA,IAC9C,CAAA;AAAA,IACA,GAAA,EAAK,CAAC,MAAA,KAAY,MAAA,KAAW,MAAA,GAAY,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAAA,IACrE,GAAA,EAAK,CAAC,MAAA,KAAY,MAAA,KAAW,MAAA,GAAY,KAAK,GAAA,EAAI,GAAI,IAAA,CAAK,GAAA,CAAI,MAAM;AAAA,GACvE;AACF;AAEA,SAAS,aAAA,CAAcA,OAAc,IAAA,EAA2C;AAC9E,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,WAAA,CAAY,YAAY,CAAA;AAQ7C,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAASA,KAAAA,EAAM,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,GAAI,IAAI,SAASA,KAAI,CAAA;AACrF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,CAAC,GAAA,KAAQ;AACb,MAAA,EAAA,CAAG,KAAK,GAAG,CAAA;AAAA,IACb,CAAA;AAAA,IACA,SAAS,CAAC,GAAA,KAAQ,cAAc,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,IAC/C,WAAA,EAAa,CAAC,EAAA,KAAO,EAAA,CAAG,YAAY,EAAE,CAAA;AAAA,IACtC,OAAO,MAAM;AACX,MAAA,EAAA,CAAG,KAAA,EAAM;AAAA,IACX;AAAA,GACF;AACF;AAEA,SAAS,cAAA,CAAeA,OAAc,IAAA,EAA2C;AAC/E,EAAA,MAAM,EAAE,YAAA,EAAa,GAAI,WAAA,CAAY,aAAa,CAAA;AAGlD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,QAAA,GAAW,IAAI,YAAA,CAAaA,KAAAA,EAAM,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA,GAAI,IAAI,aAAaA,KAAI,CAAA;AAC7F,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,CAAC,GAAA,KAAQ;AACb,MAAA,EAAA,CAAG,KAAK,GAAG,CAAA;AAAA,IACb,CAAA;AAAA,IACA,SAAS,CAAC,GAAA,KAAQ,cAAc,EAAA,CAAG,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,IAC/C,WAAA,EACE,CAAC,EAAA,KACD,CAAA,GAAI,IAAA,KAAS;AACX,MAAA,EAAA,CAAG,KAAK,OAAO,CAAA;AACf,MAAA,IAAI;AACF,QAAA,EAAA,CAAG,GAAG,IAAI,CAAA;AACV,QAAA,EAAA,CAAG,KAAK,QAAQ,CAAA;AAAA,MAClB,SAAS,GAAA,EAAK;AACZ,QAAA,EAAA,CAAG,KAAK,UAAU,CAAA;AAClB,QAAA,MAAM,GAAA;AAAA,MACR;AAAA,IACF,CAAA;AAAA,IACF,OAAO,MAAM;AACX,MAAA,EAAA,CAAG,KAAA,EAAM;AAAA,IACX;AAAA,GACF;AACF;AAMO,SAAS,UAAA,CAAWA,KAAAA,EAAc,IAAA,GAA0B,EAAC,EAAqB;AACvF,EAAA,OAAO,QAAQ,aAAA,CAAcA,KAAAA,EAAM,IAAI,CAAA,GAAI,cAAA,CAAeA,OAAM,IAAI,CAAA;AACtE;;;ACvHA,IAAM,MAAA,GAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA+BR,IAAM,aAAN,MAAoC;AAAA,EACjC,EAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA,GAAS,KAAA;AAAA,EAEjB,YAAY,IAAA,EAAyB;AACnC,IAAA,IAAA,CAAK,EAAA,GAAK,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,SAAS,UAAA,EAAY;AAC5B,MAAA,IAAA,CAAK,EAAA,CAAG,KAAK,2BAA2B,CAAA;AAAA,IAC1C;AACA,IAAA,IAAA,CAAK,EAAA,CAAG,KAAK,MAAM,CAAA;AACnB,IAAA,IAAI,IAAA,CAAK,SAAS,UAAA,EAAY;AAE5B,MAAA,iBAAA,CAAkB,KAAK,IAAI,CAAA;AAAA,IAC7B;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,KAAK,EAAA,CAAG,OAAA;AAAA,MACxB,CAAA;AAAA,mHAAA;AAAA,KAEF;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,EAAA,CAAG,WAAA,CAAY,CAAC,OAAA,KAAwB;AAC7D,MAAA,KAAA,MAAW,CAAA,IAAK,SAAS,IAAA,CAAK,UAAA,CAAW,IAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,IAC5D,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,KAAA,EAAuB;AAC3B,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,WAAW,OAAA,EAA2B;AACpC,IAAA,IAAI,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACzC,IAAA,IAAA,CAAK,WAAW,OAAO,CAAA;AAAA,EACzB;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAI,KAAK,MAAA,EAAQ;AACjB,IAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,IAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,EAChB;AAAA,EAEA,MAAM,CAAA,EAA6B;AACjC,IAAA,IAAI,KAAK,MAAA,EAAQ,OAAO,EAAE,OAAA,EAAS,EAAC,EAAE;AACtC,IAAA,MAAM,KAAA,GAAkB,CAAC,yBAAyB,CAAA;AAClD,IAAA,MAAM,MAAA,GAAkC,EAAE,UAAA,EAAY,CAAA,CAAE,SAAA,EAAU;AAElE,IAAA,IAAI,CAAA,CAAE,QAAQ,IAAA,EAAM;AAClB,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,MAAA,CAAO,KAAA,GAAQ,EAAE,MAAA,CAAO,IAAA;AAAA,IAC1B;AACA,IAAA,IAAI,CAAA,CAAE,QAAQ,OAAA,EAAS;AACrB,MAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAC/B,MAAA,MAAA,CAAO,QAAA,GAAW,EAAE,MAAA,CAAO,OAAA;AAAA,IAC7B;AACA,IAAA,IAAI,CAAA,CAAE,QAAQ,QAAA,EAAU;AACtB,MAAA,KAAA,CAAM,KAAK,sBAAsB,CAAA;AACjC,MAAA,MAAA,CAAO,SAAA,GAAY,EAAE,MAAA,CAAO,QAAA;AAAA,IAC9B;AACA,IAAA,IAAI,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,MAAA,CAAO,SAAS,CAAA,EAAG;AACnC,MAAA,MAAM,YAAA,GAAe,CAAA,CAAE,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA;AACnE,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,UAAA,EAAa,YAAY,CAAA,CAAA,CAAG,CAAA;AACvC,MAAA,CAAA,CAAE,MAAA,CAAO,OAAA,CAAQ,CAAC,GAAA,EAAK,CAAA,KAAM;AAC3B,QAAA,MAAA,CAAO,CAAA,MAAA,EAAS,CAAC,CAAA,CAAE,CAAA,GAAI,GAAA;AAAA,MACzB,CAAC,CAAA;AAAA,IACH;AACA,IAAA,IAAI,EAAE,KAAA,EAAO;AACX,MAAA,KAAA,CAAM,KAAK,qBAAqB,CAAA;AAChC,MAAA,MAAA,CAAO,SAAS,CAAA,CAAE,KAAA;AAAA,IACpB;AACA,IAAA,IAAI,EAAE,KAAA,EAAO;AACX,MAAA,KAAA,CAAM,KAAK,oBAAoB,CAAA;AAC/B,MAAA,MAAA,CAAO,SAAS,CAAA,CAAE,KAAA;AAAA,IACpB;AACA,IAAA,IAAI,EAAE,MAAA,EAAQ;AAGZ,MAAA,MAAM,OAAA,GAAU,CAAA,CAAE,MAAA,CAAO,OAAA,CAAQ,WAAW,MAAM,CAAA;AAClD,MAAA,KAAA,CAAM,KAAK,kCAAkC,CAAA;AAC7C,MAAA,MAAA,CAAO,OAAA,GAAU,IAAI,OAAO,CAAA,CAAA,CAAA;AAAA,IAC9B;AACA,IAAA,IAAI,EAAE,MAAA,EAAQ;AACZ,MAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,MAAA,MAAA,CAAO,UAAU,CAAA,CAAE,MAAA;AAAA,IACrB;AAEA,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,KAAA,IAAS,KAAK,GAAI,CAAA;AAC3C,IAAA,MAAA,CAAO,SAAS,KAAA,GAAQ,CAAA;AAExB,IAAA,MAAM,GAAA,GAAM,CAAA;AAAA;AAAA,YAAA,EAEF,KAAA,CAAM,IAAA,CAAK,OAAO,CAAC;AAAA;AAAA,kBAAA,CAAA;AAI7B,IAAA,MAAM,OAAO,IAAA,CAAK,EAAA,CAAG,QAAQ,GAAG,CAAA,CAAE,IAAiB,MAAM,CAAA;AAEzD,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,GAAS,KAAA;AAC9B,IAAA,MAAM,SAAS,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,GAAI,IAAA;AAChD,IAAA,MAAM,OAAA,GAAsB,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MAC7C,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,WAAW,CAAA,CAAE,SAAA;AAAA,MACb,WAAW,CAAA,CAAE,UAAA;AAAA,MACb,MAAA,EAAQ;AAAA,QACN,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,QAAA,EAAU,EAAE,QAAA,IAAY;AAAA,OAC1B;AAAA,MACA,OAAO,CAAA,CAAE,KAAA;AAAA,MACT,SAAS,CAAA,CAAE,OAAA;AAAA,MACX,MAAM,CAAA,CAAE,SAAA,GAAY,KAAK,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,GAAI,MAAA;AAAA,MAC9C,OAAO,CAAA,CAAE,UAAA,GAAa,KAAK,KAAA,CAAM,CAAA,CAAE,UAAU,CAAA,GAAI;AAAA,KACnD,CAAE,CAAA;AAEF,IAAA,OAAO;AAAA,MACL,OAAA;AAAA,MACA,YAAY,OAAA,GAAU,OAAA,CAAQ,QAAQ,MAAA,GAAS,CAAC,EAAE,EAAA,GAAK;AAAA,KACzD;AAAA,EACF;AAAA;AAAA;AAAA,EAIQ,MAAM,CAAA,EAAsC;AAClD,IAAA,OAAO;AAAA,MACL,KAAK,CAAA,CAAE,EAAA;AAAA,MACP,YAAY,CAAA,CAAE,SAAA;AAAA,MACd,aAAa,CAAA,CAAE,SAAA;AAAA,MACf,KAAA,EAAO,EAAE,MAAA,CAAO,IAAA;AAAA,MAChB,QAAA,EAAU,EAAE,MAAA,CAAO,OAAA;AAAA,MACnB,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,QAAA,IAAY,IAAA;AAAA,MAChC,QAAQ,CAAA,CAAE,KAAA;AAAA,MACV,UAAU,CAAA,CAAE,OAAA;AAAA,MACZ,YAAY,CAAA,CAAE,IAAA,GAAO,KAAK,SAAA,CAAU,CAAA,CAAE,IAAI,CAAA,GAAI,IAAA;AAAA,MAC9C,aAAa,CAAA,CAAE,KAAA,GAAQ,KAAK,SAAA,CAAU,CAAA,CAAE,KAAK,CAAA,GAAI;AAAA,KACnD;AAAA,EACF;AACF;AAMA,SAAS,kBAAkB,MAAA,EAAsB;AAC/C,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAA,EAAQ,CAAA,EAAG,MAAM,CAAA,IAAA,CAAM,CAAA,EAAG;AAC1D,IAAA,IAAI;AACF,MAAA,SAAA,CAAU,GAAG,GAAK,CAAA;AAAA,IACpB,CAAA,CAAA,MAAQ;AAAA,IAGR;AAAA,EACF;AACF;;;ACtLA,IAAM,WAAA,GAA8B,CAAC,YAAA,EAAc,WAAA,EAAa,KAAK,CAAA;AACrE,IAAM,YAAA,GAA2B,CAAC,OAAA,EAAS,MAAA,EAAQ,QAAQ,OAAO,CAAA;AAY3D,SAAS,sBAAsB,KAAA,EAAmD;AACvF,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,SAAA,IAAa,EAAC;AACjC,EAAA,MAAM,OAAA,GAAU,QAAQ,GAAA,CAAI,eAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,QAAQ,GAAA,CAAI,gBAAA;AAE7B,EAAA,MAAM,IAAA,GAAO,OAAA,IAAW,IAAA,CAAK,IAAA,IAAQ,YAAA;AACrC,EAAA,IAAI,CAAC,WAAA,CAAY,QAAA,CAAS,IAAI,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAE,CAAA;AAAA,EACjD;AACA,EAAA,MAAM,KAAA,GAAQ,QAAA,IAAY,IAAA,CAAK,KAAA,IAAS,MAAA;AACxC,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,KAAK,CAAA,CAAE,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO;AAAA,IACL,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,IAAA;AAAA,IACA,KAAA;AAAA,IACA,WAAW,IAAA,CAAK;AAAA,GAClB;AACF;AAWO,SAAS,wBAAA,CACd,GAAA,EACA,IAAA,GAA8B,EAAC,EACrB;AACV,EAAA,MAAM,QAAQ,EAAC;AACf,EAAA,IAAI,GAAA,CAAI,SAAS,KAAA,EAAO;AACtB,IAAA,KAAA,CAAM,IAAA,CAAK,IAAI,QAAA,EAAU,CAAA;AAAA,EAC3B,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,WAAA,EAAa;AACnC,IAAA,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,EAAE,IAAA,EAAM,UAAA,EAAY,CAAC,CAAA;AAAA,EACjD,CAAA,MAAO;AACL,IAAA,IAAI,CAAC,IAAI,aAAA,EAAe;AACtB,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IAClE;AACA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,eAAe,SAAS,CAAA;AAClD,IAAA,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAClC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AACvC,IAAA,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAC,CAAA;AAAA,EAC7C;AAEA,EAAA,IAAI,KAAK,MAAA,KAAW,KAAA,QAAa,IAAA,CAAK,IAAI,YAAY,CAAA;AACtD,EAAA,OAAO,IAAI,QAAA,CAAS;AAAA,IAClB,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,OAAO,GAAA,CAAI,KAAA;AAAA,IACX;AAAA,GACD,CAAA;AACH;ACpDO,IAAM,sBAAA,GAAgE,OAAO,MAAA,CAAO;AAAA,EACzF,UAAA,EAAY,GAAA;AAAA,EACZ,UAAA,EAAY;AACd,CAAC;AAED,IAAM,MAAA,GAAS,KAAA;AAGf,IAAM,UAAA,GAAa,GAAA;AAOnB,IAAM,eAAA,GAAkB,GAAA;AAGxB,IAAM,eAAA,GAAkB,GAAA;AAIxB,IAAM,YAAA,GAAe,CAAA;AAAA;AAAA,CAAA,CAAA;AAIrB,IAAM,cAAA,GAAiB,CAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAAA;AAYhB,SAAS,qBACd,UAAA,EAC6B;AAC7B,EAAA,OAAO;AAAA,IACL,YAAY,gBAAA,CAAiB,UAAA,EAAY,UAAU,CAAA,GAC/C,UAAA,CAAW,aACX,sBAAA,CAAuB,UAAA;AAAA,IAC3B,YAAY,gBAAA,CAAiB,UAAA,EAAY,UAAU,CAAA,GAC/C,UAAA,CAAW,aACX,sBAAA,CAAuB;AAAA,GAC7B;AACF;AAEA,SAAS,gBAAA,GAAkC;AACzC,EAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY,YAAA,CAAa,OAAO,CAAC,CAAA;AAC7D;AAOA,eAAe,cAAA,CACb,MACA,MAAA,EACiB;AACjB,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,KAAA,IAAS,IAAA,GAAO,CAAA,EAAG,IAAA,GAAO,eAAA,EAAiB,IAAA,EAAA,EAAQ;AACjD,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,IAAA,CAAK,IAAI,MAAM,CAAA;AACnC,IAAA,OAAA,IAAW,OAAA;AACX,IAAA,IAAI,UAAU,UAAA,EAAY;AAC1B,IAAA,MAAM,gBAAA,EAAiB;AAAA,EACzB;AACA,EAAA,OAAO,OAAA;AACT;AAWA,eAAsB,oBAAA,CACpB,QACA,SAAA,EACqC;AACrC,EAAA,MAAM,MAAA,GAAqC,EAAE,YAAA,EAAc,CAAA,EAAG,gBAAgB,CAAA,EAAE;AAChF,EAAA,IAAI,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,IAAI,UAAU,UAAA,IAAc,IAAA,IAAQ,SAAA,CAAU,UAAA,IAAc,MAAM,OAAO,MAAA;AAEzE,EAAA,MAAM,EAAA,GAAK,WAAW,MAAM,CAAA;AAC5B,EAAA,IAAI;AACF,IAAA,EAAA,CAAG,IAAA,CAAK,CAAA,sBAAA,EAAyB,eAAe,CAAA,CAAE,CAAA;AAClD,IAAA,IAAI,SAAA,CAAU,cAAc,IAAA,EAAM;AAChC,MAAA,MAAM,MAAA,GAAS,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,KAAQ,SAAA,CAAU,UAAA,GAAa,MAAM,CAAA,CAAE,WAAA,EAAY;AAChF,MAAA,MAAA,CAAO,eAAe,MAAM,cAAA,CAAe,EAAA,CAAG,OAAA,CAAQ,YAAY,CAAA,EAAG;AAAA,QACnE,OAAA,EAAS,MAAA;AAAA,QACT,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AACA,IAAA,IAAI,SAAA,CAAU,cAAc,IAAA,EAAM;AAChC,MAAA,MAAA,CAAO,iBAAiB,MAAM,cAAA,CAAe,EAAA,CAAG,OAAA,CAAQ,cAAc,CAAA,EAAG;AAAA,QACvE,OAAO,SAAA,CAAU,UAAA;AAAA,QACjB,MAAA,EAAQ;AAAA,OACT,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,SAAE;AACA,IAAA,EAAA,CAAG,KAAA,EAAM;AAAA,EACX;AACF;;;AChIO,IAAM,kBAAN,MAAyC;AAAA,EAC9C,YAA6B,KAAA,EAA+B;AAA/B,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAgC;AAAA,EAAhC,KAAA;AAAA,EAE7B,MAAM,KAAA,EAAuB;AAC3B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,MAAA,CAAO,QAAA,GACrB,CAAA,EAAG,MAAM,MAAA,CAAO,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,MAAA,CAAO,QAAQ,CAAA,CAAA,GACrE,CAAA,EAAG,KAAA,CAAM,OAAO,IAAI,CAAA,CAAA,EAAI,KAAA,CAAM,MAAA,CAAO,OAAO,CAAA,CAAA;AAChD,IAAA,IAAI,IAAA,GAAO,IAAI,KAAA,CAAM,KAAK,MAAM,GAAG,CAAA,EAAA,EAAK,MAAM,OAAO,CAAA,CAAA;AACrD,IAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,IAAI,CAAA,CAAE,SAAS,CAAA,EAAG;AACpD,MAAA,IAAA,IAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA,CAAA;AAAA,IACxC;AACA,IAAA,IAAI,KAAA,CAAM,OAAO,OAAA,EAAS;AACxB,MAAA,IAAA,IAAQ,CAAA,QAAA,EAAM,KAAA,CAAM,KAAA,CAAM,OAAO,CAAA,CAAA;AAAA,IACnC;AACA,IAAA,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACjB;AAAA,EAEA,WAAW,OAAA,EAA2B;AACpC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AAAA,EAEd;AACF;;;ACfO,IAAM,YAAN,MAAmC;AAAA,EACvB,IAAA;AAAA,EAEjB,YAAY,IAAA,EAAwB;AAClC,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AAAA,EACnB;AAAA,EAEA,MAAM,KAAA,EAAuB;AAC3B,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAM,WAAA,EAAa,OAAO,CAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,WAAW,OAAA,EAA2B;AACpC,IAAA,KAAA,MAAW,CAAA,IAAK,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AAAA,EAEd;AACF","file":"chunk-UMVKJM4Q.js","sourcesContent":["/**\n * Runtime-portable embedded SQLite for the logging sink.\n *\n * The log store needs a synchronous, embedded SQLite driver. Bun ships\n * `bun:sqlite`; Node 22.5+ ships `node:sqlite`. This shim selects the right\n * one at runtime so the CLI and runtime run unmodified under either — no Bun\n * dependency baked into the published build.\n *\n * Both drivers accept `$`-prefixed named-parameter keys directly, so callers\n * use one binding convention. The only API gap is transactions: `bun:sqlite`\n * has `db.transaction()`, `node:sqlite` does not — {@link openSqlite}\n * synthesizes it with manual `BEGIN`/`COMMIT`/`ROLLBACK`.\n */\nimport { createRequire } from \"node:module\";\n\nconst nodeRequire = createRequire(import.meta.url);\n\n/** True when executing under the Bun runtime. */\nconst isBun = typeof (globalThis as { Bun?: unknown }).Bun !== \"undefined\";\n\n/** A prepared statement bound with `$`-prefixed named parameters. */\nexport interface PortableStatement {\n  /** Returns the number of rows the statement changed. */\n  run(params?: Record<string, unknown>): PortableRunResult;\n  all<T = unknown>(params?: Record<string, unknown>): T[];\n  get<T = unknown>(params?: Record<string, unknown>): T | undefined;\n}\n\n/** Outcome of {@link PortableStatement.run}, normalised across drivers. */\nexport interface PortableRunResult {\n  changes: number;\n}\n\n/** A synchronous embedded SQLite handle, uniform across Bun and Node. */\nexport interface PortableDatabase {\n  exec(sql: string): void;\n  prepare(sql: string): PortableStatement;\n  /** Wrap `fn` so the statements it runs commit as one transaction. */\n  transaction<A extends unknown[]>(fn: (...args: A) => void): (...args: A) => void;\n  close(): void;\n}\n\nexport interface OpenSqliteOptions {\n  /** Open read-only. The database file must already exist. */\n  readonly?: boolean;\n}\n\n/** Minimal structural shape shared by `bun:sqlite` and `node:sqlite` handles. */\ninterface RawStatement {\n  run(params?: unknown): unknown;\n  all(params?: unknown): unknown[];\n  get(params?: unknown): unknown;\n}\ninterface RawDatabase {\n  exec(sql: string): unknown;\n  prepare(sql: string): RawStatement;\n  close(): void;\n}\n\nfunction wrapStatement(stmt: RawStatement): PortableStatement {\n  return {\n    run: (params) => {\n      const raw = (params === undefined ? stmt.run() : stmt.run(params)) as\n        | { changes?: number | bigint }\n        | undefined;\n      return { changes: Number(raw?.changes ?? 0) };\n    },\n    all: (params) => (params === undefined ? stmt.all() : stmt.all(params)) as never,\n    get: (params) => (params === undefined ? stmt.get() : stmt.get(params)) as never,\n  };\n}\n\nfunction openBunSqlite(path: string, opts: OpenSqliteOptions): PortableDatabase {\n  const { Database } = nodeRequire(\"bun:sqlite\") as {\n    Database: new (\n      p: string,\n      o?: { readonly?: boolean },\n    ) => RawDatabase & {\n      transaction<A extends unknown[]>(fn: (...args: A) => void): (...args: A) => void;\n    };\n  };\n  const db = opts.readonly ? new Database(path, { readonly: true }) : new Database(path);\n  return {\n    exec: (sql) => {\n      db.exec(sql);\n    },\n    prepare: (sql) => wrapStatement(db.prepare(sql)),\n    transaction: (fn) => db.transaction(fn),\n    close: () => {\n      db.close();\n    },\n  };\n}\n\nfunction openNodeSqlite(path: string, opts: OpenSqliteOptions): PortableDatabase {\n  const { DatabaseSync } = nodeRequire(\"node:sqlite\") as {\n    DatabaseSync: new (p: string, o?: { readOnly?: boolean }) => RawDatabase;\n  };\n  const db = opts.readonly ? new DatabaseSync(path, { readOnly: true }) : new DatabaseSync(path);\n  return {\n    exec: (sql) => {\n      db.exec(sql);\n    },\n    prepare: (sql) => wrapStatement(db.prepare(sql)),\n    transaction:\n      (fn) =>\n      (...args) => {\n        db.exec(\"BEGIN\");\n        try {\n          fn(...args);\n          db.exec(\"COMMIT\");\n        } catch (err) {\n          db.exec(\"ROLLBACK\");\n          throw err;\n        }\n      },\n    close: () => {\n      db.close();\n    },\n  };\n}\n\n/**\n * Open an embedded SQLite database using the runtime's native driver —\n * `bun:sqlite` under Bun, `node:sqlite` under Node 22.5+.\n */\nexport function openSqlite(path: string, opts: OpenSqliteOptions = {}): PortableDatabase {\n  return isBun ? openBunSqlite(path, opts) : openNodeSqlite(path, opts);\n}\n","import { chmodSync } from \"node:fs\";\nimport type { LogEntry, LogQuery, LogQueryResult } from \"@skaile/workspaces/types\";\nimport { openSqlite, type PortableDatabase, type PortableStatement } from \"./sqlite-runtime.js\";\nimport type { LogSink } from \"./types.js\";\n\nexport interface SqliteSinkOptions {\n  path: string; // ':memory:' or filesystem path\n}\n\nconst SCHEMA = `\nCREATE TABLE IF NOT EXISTS log_entries (\n  id            TEXT PRIMARY KEY,\n  timestamp     TEXT NOT NULL,\n  session_id    TEXT NOT NULL,\n  kind          TEXT NOT NULL,\n  subkind       TEXT NOT NULL,\n  instance      TEXT,\n  level         TEXT NOT NULL,\n  message       TEXT NOT NULL,\n  data_json     TEXT,\n  error_json    TEXT\n);\nCREATE INDEX IF NOT EXISTS idx_logs_timestamp ON log_entries(timestamp);\nCREATE INDEX IF NOT EXISTS idx_logs_kind_level ON log_entries(kind, level);\nCREATE INDEX IF NOT EXISTS idx_logs_source ON log_entries(kind, subkind, instance);\n`;\n\ninterface LogEntryRow {\n  id: string;\n  timestamp: string;\n  session_id: string;\n  kind: string;\n  subkind: string;\n  instance: string | null;\n  level: string;\n  message: string;\n  data_json: string | null;\n  error_json: string | null;\n}\n\nexport class SqliteSink implements LogSink {\n  private db: PortableDatabase;\n  private insertStmt: PortableStatement;\n  private insertMany: (entries: LogEntry[]) => void;\n  private closed = false;\n\n  constructor(opts: SqliteSinkOptions) {\n    this.db = openSqlite(opts.path);\n    if (opts.path !== \":memory:\") {\n      this.db.exec(\"PRAGMA journal_mode = WAL\");\n    }\n    this.db.exec(SCHEMA);\n    if (opts.path !== \":memory:\") {\n      // Group-writable so a co-grouped host process can open read-write for retention.\n      makeGroupWritable(opts.path);\n    }\n    this.insertStmt = this.db.prepare(\n      `INSERT INTO log_entries (id, timestamp, session_id, kind, subkind, instance, level, message, data_json, error_json)\n       VALUES ($id, $timestamp, $session_id, $kind, $subkind, $instance, $level, $message, $data_json, $error_json)`,\n    );\n    this.insertMany = this.db.transaction((entries: LogEntry[]) => {\n      for (const e of entries) this.insertStmt.run(this.toRow(e));\n    });\n  }\n\n  write(entry: LogEntry): void {\n    if (this.closed) return;\n    this.insertStmt.run(this.toRow(entry));\n  }\n\n  writeBatch(entries: LogEntry[]): void {\n    if (this.closed || entries.length === 0) return;\n    this.insertMany(entries);\n  }\n\n  close(): void {\n    if (this.closed) return;\n    this.closed = true;\n    this.db.close();\n  }\n\n  query(q: LogQuery): LogQueryResult {\n    if (this.closed) return { entries: [] };\n    const where: string[] = [\"session_id = $sessionId\"];\n    const params: Record<string, unknown> = { $sessionId: q.sessionId };\n\n    if (q.source?.kind) {\n      where.push(\"kind = $kind\");\n      params.$kind = q.source.kind;\n    }\n    if (q.source?.subkind) {\n      where.push(\"subkind = $subkind\");\n      params.$subkind = q.source.subkind;\n    }\n    if (q.source?.instance) {\n      where.push(\"instance = $instance\");\n      params.$instance = q.source.instance;\n    }\n    if (q.levels && q.levels.length > 0) {\n      const placeholders = q.levels.map((_, i) => `$level${i}`).join(\", \");\n      where.push(`level IN (${placeholders})`);\n      q.levels.forEach((lvl, i) => {\n        params[`$level${i}`] = lvl;\n      });\n    }\n    if (q.since) {\n      where.push(\"timestamp >= $since\");\n      params.$since = q.since;\n    }\n    if (q.until) {\n      where.push(\"timestamp < $until\");\n      params.$until = q.until;\n    }\n    if (q.search) {\n      // Escape SQL LIKE wildcards so a search for \"100%\" matches the literal string,\n      // not \"100<anything>\". \\\\ is also escaped because it's the escape character itself.\n      const escaped = q.search.replace(/[\\\\%_]/g, \"\\\\$&\");\n      where.push(\"message LIKE $search ESCAPE '\\\\'\");\n      params.$search = `%${escaped}%`;\n    }\n    if (q.cursor) {\n      where.push(\"id < $cursor\");\n      params.$cursor = q.cursor;\n    }\n\n    const limit = Math.min(q.limit ?? 500, 5000);\n    params.$limit = limit + 1;\n\n    const sql = `SELECT id, timestamp, session_id, kind, subkind, instance, level, message, data_json, error_json\n      FROM log_entries\n      WHERE ${where.join(\" AND \")}\n      ORDER BY id DESC\n      LIMIT $limit`;\n\n    const rows = this.db.prepare(sql).all<LogEntryRow>(params);\n\n    const hasMore = rows.length > limit;\n    const sliced = hasMore ? rows.slice(0, limit) : rows;\n    const entries: LogEntry[] = sliced.map((r) => ({\n      id: r.id,\n      timestamp: r.timestamp,\n      sessionId: r.session_id,\n      source: {\n        kind: r.kind as LogEntry[\"source\"][\"kind\"],\n        subkind: r.subkind,\n        instance: r.instance ?? undefined,\n      },\n      level: r.level as LogEntry[\"level\"],\n      message: r.message,\n      data: r.data_json ? JSON.parse(r.data_json) : undefined,\n      error: r.error_json ? JSON.parse(r.error_json) : undefined,\n    }));\n\n    return {\n      entries,\n      nextCursor: hasMore ? entries[entries.length - 1].id : undefined,\n    };\n  }\n\n  // Both bun:sqlite and node:sqlite bind `$name` SQL placeholders from\n  // matching `$`-prefixed object keys.\n  private toRow(e: LogEntry): Record<string, unknown> {\n    return {\n      $id: e.id,\n      $timestamp: e.timestamp,\n      $session_id: e.sessionId,\n      $kind: e.source.kind,\n      $subkind: e.source.subkind,\n      $instance: e.source.instance ?? null,\n      $level: e.level,\n      $message: e.message,\n      $data_json: e.data ? JSON.stringify(e.data) : null,\n      $error_json: e.error ? JSON.stringify(e.error) : null,\n    };\n  }\n}\n\n/**\n * Best-effort `chmod 0664` on the db file and its WAL/SHM siblings. Swallows all\n * errors (missing sibling, EPERM when not the owner) so logging never throws.\n */\nfunction makeGroupWritable(dbPath: string): void {\n  for (const p of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {\n    try {\n      chmodSync(p, 0o664);\n    } catch {\n      // Sibling may not exist yet, or this process may not own the file.\n      // Either way, retention degrades cleanly — never break logging.\n    }\n  }\n}\n","import { mkdirSync } from \"node:fs\";\nimport path from \"node:path\";\nimport type { LogLevel, LogStoreConfig, LogStoreMode } from \"@skaile/workspaces/types\";\nimport { LogStore } from \"./log-store.js\";\nimport { NoOpSink } from \"./sinks/no-op-sink.js\";\nimport { SqliteSink } from \"./sinks/sqlite-sink.js\";\nimport { StdoutSink } from \"./sinks/stdout-sink.js\";\n\nconst VALID_MODES: LogStoreMode[] = [\"persistent\", \"ephemeral\", \"off\"];\nconst VALID_LEVELS: LogLevel[] = [\"debug\", \"info\", \"warn\", \"error\"];\n\nexport interface ResolveLogStoreConfigInput {\n  sessionId: string;\n  workspacePath?: string;\n  yamlBlock?: Partial<{\n    mode: LogStoreMode;\n    level: LogLevel;\n    retention: { maxEntries?: number; maxAgeDays?: number };\n  }>;\n}\n\nexport function resolveLogStoreConfig(input: ResolveLogStoreConfigInput): LogStoreConfig {\n  const yaml = input.yamlBlock ?? {};\n  const envMode = process.env.SKAILE_LOG_MODE as LogStoreMode | undefined;\n  const envLevel = process.env.SKAILE_LOG_LEVEL as LogLevel | undefined;\n\n  const mode = envMode ?? yaml.mode ?? \"persistent\";\n  if (!VALID_MODES.includes(mode)) {\n    throw new Error(`Invalid logging.mode: ${mode}`);\n  }\n  const level = envLevel ?? yaml.level ?? \"info\";\n  if (!VALID_LEVELS.includes(level)) {\n    throw new Error(`Invalid logging.level: ${level}`);\n  }\n\n  return {\n    sessionId: input.sessionId,\n    workspacePath: input.workspacePath,\n    mode,\n    level,\n    retention: yaml.retention,\n  };\n}\n\nexport interface CreateLogStoreOptions {\n  /**\n   * Mirror every entry to stdout as well (default `true`, for container logs).\n   * A CLI host that already renders the entries itself passes `false` so a\n   * record is not printed twice.\n   */\n  stdout?: boolean;\n}\n\nexport function createLogStoreFromConfig(\n  cfg: LogStoreConfig,\n  opts: CreateLogStoreOptions = {},\n): LogStore {\n  const sinks = [];\n  if (cfg.mode === \"off\") {\n    sinks.push(new NoOpSink());\n  } else if (cfg.mode === \"ephemeral\") {\n    sinks.push(new SqliteSink({ path: \":memory:\" }));\n  } else {\n    if (!cfg.workspacePath) {\n      throw new Error(\"logging.mode=persistent requires workspacePath\");\n    }\n    const dir = path.join(cfg.workspacePath, \".skaile\");\n    mkdirSync(dir, { recursive: true });\n    const dbPath = path.join(dir, \"logs.db\");\n    sinks.push(new SqliteSink({ path: dbPath }));\n  }\n  // Include stdout for live container logs (dev-friendly) unless the host opts out.\n  if (opts.stdout !== false) sinks.push(new StdoutSink());\n  return new LogStore({\n    sessionId: cfg.sessionId,\n    level: cfg.level,\n    sinks,\n  });\n}\n","/**\n * Retention for the per-session structured-log SQLite store (`logs.db`).\n *\n * Mirrors the platform's `enforceLogsRetention`\n * (`platform/backend/libs/session/src/logs-retention.utils.ts`): the same\n * age-then-count semantics, batch size, pass ceiling and busy timeout. The\n * platform trims the host copy of the file once per wake; in broker mode that\n * copy is not the file the runner writes, so the runner trims its own file at\n * boot. In docker mode both trim the same file with the same rules, which is\n * harmless: a second pass finds nothing left to delete.\n */\nimport { existsSync } from \"node:fs\";\nimport type { LogStoreRetention } from \"@skaile/workspaces/types\";\nimport { isRetentionValue } from \"./retention-value.js\";\nimport { openSqlite, type PortableStatement } from \"./sinks/sqlite-runtime.js\";\n\n/** Rows removed by one {@link enforceLogsRetention} run. */\nexport interface EnforceLogsRetentionResult {\n  deletedByAge: number;\n  deletedByCount: number;\n}\n\n/**\n * The platform's cloud-mode retention defaults (docker and broker). Used when\n * `skaile.yaml` has no `logging.retention` value for a field.\n */\nexport const DEFAULT_LOGS_RETENTION: Readonly<Required<LogStoreRetention>> = Object.freeze({\n  maxEntries: 100_000,\n  maxAgeDays: 7,\n});\n\nconst DAY_MS = 86_400_000;\n\n/** Rows deleted per statement. Caps both the write lock and the loop stall. */\nconst BATCH_SIZE = 500;\n\n/**\n * Pass ceiling per statement. Concurrent inserts keep refilling the count-trim\n * delete-set, so \"loop until a short batch\" is not a guaranteed bound;\n * leftovers are trimmed on the next boot.\n */\nconst MAX_TRIM_PASSES = 200;\n\n/** Wait on a lock held by another connection instead of failing with SQLITE_BUSY. */\nconst BUSY_TIMEOUT_MS = 2_000;\n\n// `LIMIT` directly on `DELETE` needs SQLITE_ENABLE_UPDATE_DELETE_LIMIT; the\n// `id IN (SELECT ... LIMIT)` form works under both bun:sqlite and node:sqlite.\nconst AGE_TRIM_SQL = `DELETE FROM log_entries WHERE id IN (\n  SELECT id FROM log_entries WHERE timestamp < $cutoff ORDER BY id LIMIT $batch\n)`;\n\nconst COUNT_TRIM_SQL = `DELETE FROM log_entries WHERE id IN (\n  SELECT id FROM log_entries\n  WHERE id NOT IN (SELECT id FROM log_entries ORDER BY id DESC LIMIT $keep)\n  ORDER BY id LIMIT $batch\n)`;\n\n/**\n * Overlay the configured retention on {@link DEFAULT_LOGS_RETENTION}, field by\n * field. A value that is not a non-negative finite number counts as unset.\n * `0` is a valid value: `maxEntries: 0` or `maxAgeDays: 0` deletes every row,\n * as it does on the platform.\n */\nexport function resolveLogsRetention(\n  configured: LogStoreRetention | undefined,\n): Required<LogStoreRetention> {\n  return {\n    maxEntries: isRetentionValue(configured?.maxEntries)\n      ? configured.maxEntries\n      : DEFAULT_LOGS_RETENTION.maxEntries,\n    maxAgeDays: isRetentionValue(configured?.maxAgeDays)\n      ? configured.maxAgeDays\n      : DEFAULT_LOGS_RETENTION.maxAgeDays,\n  };\n}\n\nfunction yieldToEventLoop(): Promise<void> {\n  return new Promise<void>((resolve) => setImmediate(resolve));\n}\n\n/**\n * Run one bounded delete until it stops filling a batch. Each statement is its\n * own implicit transaction, so no lock is held across the yield and the\n * in-process sink can write between batches.\n */\nasync function runBoundedTrim(\n  stmt: PortableStatement,\n  params: Record<string, unknown>,\n): Promise<number> {\n  let deleted = 0;\n  for (let pass = 0; pass < MAX_TRIM_PASSES; pass++) {\n    const { changes } = stmt.run(params);\n    deleted += changes;\n    if (changes < BATCH_SIZE) break;\n    await yieldToEventLoop();\n  }\n  return deleted;\n}\n\n/**\n * Delete rows older than `maxAgeDays`, then keep at most the `maxEntries`\n * newest rows (by ULID id). Uses its own connection with a busy timeout, in\n * bounded batches that yield to the event loop between passes.\n *\n * Returns zero counts when the file does not exist or the policy is empty.\n * Other failures (lock timeout, not a log store) reject; the caller decides\n * how loud to be.\n */\nexport async function enforceLogsRetention(\n  dbPath: string,\n  retention: LogStoreRetention,\n): Promise<EnforceLogsRetentionResult> {\n  const result: EnforceLogsRetentionResult = { deletedByAge: 0, deletedByCount: 0 };\n  if (!existsSync(dbPath)) return result;\n  if (retention.maxAgeDays == null && retention.maxEntries == null) return result;\n\n  const db = openSqlite(dbPath);\n  try {\n    db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);\n    if (retention.maxAgeDays != null) {\n      const cutoff = new Date(Date.now() - retention.maxAgeDays * DAY_MS).toISOString();\n      result.deletedByAge = await runBoundedTrim(db.prepare(AGE_TRIM_SQL), {\n        $cutoff: cutoff,\n        $batch: BATCH_SIZE,\n      });\n    }\n    if (retention.maxEntries != null) {\n      result.deletedByCount = await runBoundedTrim(db.prepare(COUNT_TRIM_SQL), {\n        $keep: retention.maxEntries,\n        $batch: BATCH_SIZE,\n      });\n    }\n    return result;\n  } finally {\n    db.close();\n  }\n}\n","import type { LogEntry, LogSink } from \"@skaile/workspaces/types\";\n\n/**\n * OnLogBridgeSink — forwards every entry as a single formatted text line to\n * a legacy `onLog(line)` callback. Used as a back-compat bridge for callers\n * that historically received plain text lines from the runner.\n *\n * Format: `[level] [kind:subkind[:instance]] message [data-json] [— error.message]`\n */\nexport class OnLogBridgeSink implements LogSink {\n  constructor(private readonly onLog: (line: string) => void) {}\n\n  write(entry: LogEntry): void {\n    const tag = entry.source.instance\n      ? `${entry.source.kind}:${entry.source.subkind}:${entry.source.instance}`\n      : `${entry.source.kind}:${entry.source.subkind}`;\n    let line = `[${entry.level}] [${tag}] ${entry.message}`;\n    if (entry.data && Object.keys(entry.data).length > 0) {\n      line += ` ${JSON.stringify(entry.data)}`;\n    }\n    if (entry.error?.message) {\n      line += ` — ${entry.error.message}`;\n    }\n    this.onLog(line);\n  }\n\n  writeBatch(entries: LogEntry[]): void {\n    for (const e of entries) this.write(e);\n  }\n\n  close(): void {\n    /* no-op */\n  }\n}\n","import type { LogEntry, LogEntryEvent } from \"@skaile/workspaces/types\";\nimport type { LogSink } from \"./types.js\";\n\nexport interface WsLogSinkOptions {\n  /**\n   * Transport send callback. Typically wired to `transport.send` on the\n   * runner's `WebSocketServerTransport`. The transport already drops sends\n   * when no client is connected — this sink does not buffer.\n   */\n  send: (event: LogEntryEvent) => void;\n}\n\n/**\n * Forwards every LogEntry recorded by LogStore as a `log_entry` AgentEvent\n * over the configured transport. Used by the runner to make container-side\n * structured logs visible to the platform gateway in real time. Historical\n * reads still go through SQLite — this sink is for live tail only.\n */\nexport class WsLogSink implements LogSink {\n  private readonly send: (event: LogEntryEvent) => void;\n\n  constructor(opts: WsLogSinkOptions) {\n    this.send = opts.send;\n  }\n\n  write(entry: LogEntry): void {\n    try {\n      this.send({ type: \"log_entry\", entry });\n    } catch {\n      // Logging must never break the agent — drop on transport failure.\n    }\n  }\n\n  writeBatch(entries: LogEntry[]): void {\n    for (const e of entries) this.write(e);\n  }\n\n  close(): void {\n    /* nothing to release — transport lifecycle is owned by the caller */\n  }\n}\n"]}

package/dist/{chunk-HCYS7GFP.js → chunk-V2DXZYBB.js}

@@ -1,5 +1,5 @@
 import { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { openSqlite } from './chunk-JMKB7IB4.js';
+import { openSqlite } from './chunk-UMVKJM4Q.js';
 import { registryEntries, isEntryEnabled, parseCredentialRef } from './chunk-MJHSLODD.js';
 import { lstatSync, realpathSync, existsSync, chmodSync, rmSync, writeFileSync, renameSync, mkdirSync, readdirSync, readFileSync } from 'fs';
 import { isAbsolute, resolve, dirname, join, relative } from 'path';
@@ -353,5 +353,5 @@ function codexInstanceEnvironment(input, home) {
 }
 
 export { activateNativeApprovalPolicy, allowsNativeApprovalPath, codexInstanceEnvironment, isNativeApprovalPolicyActive, managedCodexRegistryViolation, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult, prepareCodexInstance, prepareNativePolicy };
-//# sourceMappingURL=chunk-HCYS7GFP.js.map
-//# sourceMappingURL=chunk-HCYS7GFP.js.map
+//# sourceMappingURL=chunk-V2DXZYBB.js.map
+//# sourceMappingURL=chunk-V2DXZYBB.js.map

package/dist/{chunk-HCYS7GFP.js.map → chunk-V2DXZYBB.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/codex/native-policy.ts","../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts"],"names":["invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync","source"],"mappings":";;;;;;;;AAGA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAM,MAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAAC,UAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAM,SAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAAS,OAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAAS,OAAA,EAAQ;AAChE,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,SAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACE,OAAO,GAAA,EAAK,WAAW,KACvB,MAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAAC,OAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAO,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAAC,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAA,SAAA,CAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQ,YAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAAC,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACzIA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAMA,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAMC,OAAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAACC,UAAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAASC,WAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAOC,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAML,QAAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAML,QAAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAACG,UAAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAACA,UAAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAMH,QAAAA,EAAQ;AAChB,EAAAI,UAAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAOE,YAAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAMA,YAAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAIL,OAAAA,CAAO,MAAM,GAAG,CAAA,IAAKA,QAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAACK,SAAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAML,QAAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,MAAA,EAAQ,qBAAA;AAAA,QACR,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAAI,WAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAAA,WAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAAA,WAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAGA,UAAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAMJ,QAAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAASM,YAAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAIL,OAAAA,CAAO,QAAQ,MAAM,CAAA,IAAKA,QAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACO,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAMP,QAAAA,EAAQ;AACpC,QAAA,IAAIK,UAAUE,OAAM,CAAA,CAAE,cAAA,EAAe,QAASP,QAAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYO,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAMP,QAAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAYA,QAAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAYA,QAAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF","file":"chunk-HCYS7GFP.js","sourcesContent":["import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n  const rel = relative(parent, child);\n  return rel === \"\" || (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n  [...path].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n  if (!isAbsolute(path) || hasControl(path)) throw invalid();\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) throw invalid();\n  return realpathSync(path);\n};\n\n/** Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. */\nexport function prepareNativePolicy(input: {\n  cwd: string;\n  privateRoot: string;\n  privateDirectory: string;\n  sandboxMode: \"read-only\" | \"workspace-write\";\n}) {\n  const cwd = directory(input.cwd);\n  const privateRoot = directory(input.privateRoot);\n  const privateDirectory = directory(input.privateDirectory);\n  if (\n    within(cwd, privateRoot) ||\n    within(privateRoot, cwd) ||\n    !within(privateDirectory, privateRoot) ||\n    privateDirectory === privateRoot ||\n    (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n  )\n    throw invalid();\n  const stat = lstatSync(privateRoot);\n  if (stat.mode & 0o077 || (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n    throw invalid();\n  const filesystem = Object.freeze({\n    [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n    [privateRoot]: \"deny\",\n  });\n  const config = Object.freeze({\n    default_permissions: \"managed\",\n    features: Object.freeze({ use_legacy_landlock: false }),\n    permissions: Object.freeze({\n      managed: Object.freeze({\n        extends: \":read-only\",\n        filesystem,\n        network: Object.freeze({ enabled: false }),\n      }),\n    }),\n  });\n  // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n  const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join(\", \")} }, network = { enabled = false } } }`;\n  const policy = Object.freeze({\n    config,\n    cliArgs: Object.freeze([\n      \"-c\",\n      'default_permissions=\"managed\"',\n      \"-c\",\n      \"features.use_legacy_landlock=false\",\n      \"-c\",\n      `permissions=${profile}`,\n    ]),\n  });\n  prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n  return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/** Confirms composition and native selection, not live OS isolation (G1/G2 remain required). */\nexport function activateNativeApprovalPolicy(\n  policy: PreparedNativePolicy,\n  response: unknown,\n  signal: AbortSignal,\n): NativeApprovalPolicy {\n  const binding = prepared.get(policy);\n  if (\n    !binding ||\n    signal.aborted ||\n    !record(response) ||\n    !record(response.thread) ||\n    typeof response.thread.id !== \"string\" ||\n    !response.thread.id ||\n    response.cwd !== binding.cwd ||\n    !record(response.activePermissionProfile) ||\n    response.activePermissionProfile.id !== \"managed\" ||\n    response.activePermissionProfile.extends !== \":read-only\"\n  )\n    throw invalid();\n  const token = Object.freeze({}) as NativeApprovalPolicy;\n  active.set(token, { ...binding, threadId: response.thread.id, signal });\n  return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n  policy: unknown,\n  threadId: string,\n): policy is NativeApprovalPolicy {\n  if (!record(policy)) return false;\n  const binding = active.get(policy);\n  return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/** Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n  policy: NativeApprovalPolicy | undefined,\n  path: string,\n  access: \"read\" | \"write\",\n): boolean {\n  if (!policy) return false;\n  const binding = active.get(policy);\n  if (\n    !binding ||\n    binding.signal.aborted ||\n    !isAbsolute(path) ||\n    hasControl(path) ||\n    (access !== \"read\" && access !== \"write\") ||\n    (access === \"write\" && !binding.writable)\n  )\n    return false;\n  try {\n    let existing = resolve(path);\n    const suffix: string[] = [];\n    while (true) {\n      try {\n        lstatSync(existing);\n        break;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" || dirname(existing) === existing)\n          return false;\n        suffix.unshift(existing.slice(dirname(existing).length + 1));\n        existing = dirname(existing);\n      }\n    }\n    const canonical = resolve(realpathSync(existing), ...suffix);\n    return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n  } catch {\n    return false;\n  }\n}\n","import {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseCredentialRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n  CodexCredentialDelivery,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n  configId: identifier,\n  credentialVersion: z.number().int().nonnegative().safe(),\n  mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n  ...common,\n  kind: z.literal(\"codex-subscription\"),\n  accessToken: z.string().min(1).max(65536),\n  chatgptAccountId: identifier,\n  chatgptPlanType: identifier.optional(),\n  expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n  subscription,\n  z.strictObject({\n    ...common,\n    kind: z.literal(\"openai-api-key\"),\n    apiKey: z.string().min(1).max(65536),\n  }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. */\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n  const parsed = delivery.safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n  const credential = parsed.data;\n  const mintedAt = Date.parse(credential.mintedAt);\n  // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n  if (\n    mintedAt > now + 60_000 ||\n    (credential.kind === \"codex-subscription\" &&\n      (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))\n  )\n    throw new Error(\"Invalid managed AI credential timestamps\");\n  return credential;\n}\n\n/** Validate runtime-only refresh input against the authenticated session's pinned delivery. */\nexport function parseCodexRefreshInput(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n  const parsed = z\n    .strictObject({\n      kind: z.literal(\"codex-subscription\"),\n      configId: identifier,\n      credentialVersion: common.credentialVersion,\n      reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n    })\n    .safeParse(value);\n  if (\n    !parsed.success ||\n    parsed.data.configId !== pinned.configId ||\n    parsed.data.credentialVersion !== pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return parsed.data;\n}\n\n/** Accept refreshed subscription credentials only within the existing config/account binding. */\nexport function parseCodexRefreshResult(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n  now = Date.now(),\n): CodexSubscriptionRefreshResult {\n  const parsed = z\n    .discriminatedUnion(\"ok\", [\n      z.strictObject({ ok: z.literal(true), credential: subscription }),\n      z.strictObject({\n        ok: z.literal(false),\n        code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n        message: z.string(),\n      }),\n    ])\n    .safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n  if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n  const credential = parseCodexCredential(parsed.data.credential, now);\n  if (\n    credential.kind !== \"codex-subscription\" ||\n    credential.configId !== pinned.configId ||\n    credential.chatgptAccountId !== pinned.chatgptAccountId ||\n    credential.credentialVersion < pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return { ok: true, credential };\n}\n\n/**\n * The AI provider registry a managed-codex session may carry (plan §2.2).\n *\n * Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot *also* be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n *\n * `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n *\n * An absent or empty registry is *not* a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n *\n * @returns the reason the registry is inadmissible, or `undefined` when it is.\n */\nexport function managedCodexRegistryViolation(\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined,\n): string | undefined {\n  if (!registry) return undefined;\n  const entries = registryEntries(registry);\n  if (entries.length === 0) return undefined;\n  if (entries.length > 1)\n    return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n  const [id, entry] = entries[0];\n  if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n  if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n  const surface = (entry as AIProviderLlmEntry).surface;\n  if (surface !== \"openai-codex-responses\")\n    return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n  const credential = entry.credential;\n  if (credential?.kind !== \"oauth\")\n    return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n  const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n  if (!ref || ref.form !== \"platform\")\n    return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n  return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n  const rel = relative(root, path);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n  if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n  const stat = lstatSync(path);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw invalid();\n  return readFileSync(path);\n}\n\n/** Session-owned state lock and account-bound native resume metadata; never stores credentials. */\nexport function prepareCodexInstance(\n  config: AgentConfig,\n  options: CodexManagedRuntimeOptions,\n  credential: CodexCredentialDelivery,\n) {\n  if (!isAbsolute(options.privateDirectory) || !isAbsolute(config.cwd) || !config.sessionId)\n    throw invalid();\n  directory(options.privateDirectory);\n  const root = realpathSync(options.privateDirectory);\n  const cwd = realpathSync(config.cwd);\n  if (within(root, cwd) || within(cwd, root)) throw invalid();\n  const lock = join(root, \".active\");\n  const leasePath = join(root, \"lease.db\");\n  if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n  const lease = openSqlite(leasePath);\n  try {\n    lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n    chmodSync(leasePath, 0o600);\n    // The OS releases the database lease on crashes; this marker never owns the lock.\n    rmSync(lock, { force: true });\n    writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n  } catch (error) {\n    lease.close();\n    throw error;\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    released = true;\n    try {\n      rmSync(lock, { force: true });\n    } finally {\n      lease.close();\n    }\n  };\n  try {\n    const key = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          driver: \"codex-app-server-v1\",\n          session: config.sessionId,\n          config: credential.configId,\n          kind: credential.kind,\n          account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n        }),\n      )\n      .digest(\"hex\");\n    const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n    directory(slots);\n    const stateRoot = join(slots, key);\n    directory(stateRoot);\n    for (const name of [\"instructions.new\", \"binding.new\"])\n      rmSync(join(stateRoot, name), { force: true });\n    const bindingPath = join(stateRoot, \"binding.json\");\n    if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n    if (existsSync(bindingPath)) {\n      // Filesystem authority failures (including symlinks) are fatal, not missing state.\n      const bytes = readRegular(bindingPath, 4096);\n      if (config.resumeSessionId) {\n        let binding: unknown;\n        try {\n          binding = JSON.parse(bytes.toString(\"utf8\"));\n        } catch {\n          throw new CodexNativeStateUnavailable();\n        }\n        if (\n          !binding ||\n          typeof binding !== \"object\" ||\n          Array.isArray(binding) ||\n          Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" ||\n          (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT ||\n          (binding as Record<string, unknown>).key !== key ||\n          (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n        )\n          throw new CodexNativeStateUnavailable();\n      }\n    }\n    const home = join(stateRoot, \"home\");\n    if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n    directory(home);\n    for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n    // Auth persistence is forbidden even if a previous external process left a carrier here.\n    if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n      throw invalid();\n    const instructionFile = join(stateRoot, \"instructions.md\");\n    const instructions = [\n      ...(options.instructionFiles ?? []).map((path) =>\n        readRegular(path, 1024 * 1024).toString(\"utf8\"),\n      ),\n      ...(config.systemPrompt ? [config.systemPrompt] : []),\n    ].join(\"\\n\\n---\\n\\n\");\n    const temporary = join(stateRoot, \"instructions.new\");\n    writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n    renameSync(temporary, instructionFile);\n    const target = join(home, \"skills\");\n    if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n    if (options.skillsDirectory) {\n      const source = realpathSync(options.skillsDirectory);\n      if (within(target, source) || within(source, target)) throw invalid();\n      if (existsSync(target)) rmSync(target, { recursive: true });\n      let files = 0;\n      let entries = 0;\n      let bytes = 0;\n      const copy = (source: string, destination: string) => {\n        if (++entries > 1024) throw invalid();\n        if (lstatSync(source).isSymbolicLink()) throw invalid();\n        mkdirSync(destination, { mode: 0o700 });\n        for (const entry of readdirSync(source, { withFileTypes: true })) {\n          const src = join(source, entry.name);\n          const dst = join(destination, entry.name);\n          if (entry.isSymbolicLink()) throw invalid();\n          if (entry.isDirectory()) copy(src, dst);\n          else {\n            const content = readRegular(src, 1024 * 1024);\n            bytes += content.byteLength;\n            if (++files > 512 || bytes > 8 * 1024 * 1024) throw invalid();\n            writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n          }\n        }\n      };\n      copy(options.skillsDirectory, target);\n    }\n    const bindThread = (threadId: string) => {\n      if (!threadId || threadId.length > 4096) throw invalid();\n      const next = join(stateRoot, \"binding.new\");\n      writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(next, bindingPath);\n    };\n    const setToolInstructions = (text: string) => {\n      writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n      renameSync(temporary, instructionFile);\n    };\n    return {\n      root,\n      stateRoot,\n      cwd,\n      home,\n      instructionFile,\n      bindThread,\n      release,\n      setToolInstructions,\n    };\n  } catch (error) {\n    release();\n    throw error;\n  }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. */\nexport function codexInstanceEnvironment(\n  input: Record<string, string>,\n  home: string,\n): Record<string, string> {\n  const allowed = new Set([\n    \"PATH\",\n    \"LANG\",\n    \"LC_ALL\",\n    \"TZ\",\n    \"SSL_CERT_FILE\",\n    \"SSL_CERT_DIR\",\n    \"HTTPS_PROXY\",\n    \"HTTP_PROXY\",\n    \"NO_PROXY\",\n  ]);\n  if (\n    !input ||\n    Object.entries(input).some(([key, value]) => !allowed.has(key) || typeof value !== \"string\")\n  )\n    throw invalid();\n  return {\n    ...input,\n    HOME: home,\n    CODEX_HOME: home,\n    XDG_CONFIG_HOME: join(home, \"config\"),\n    XDG_CACHE_HOME: join(home, \"cache\"),\n    XDG_DATA_HOME: join(home, \"data\"),\n    TMPDIR: join(home, \"tmp\"),\n  };\n}\n"]}
+{"version":3,"sources":["../bridge/src/codex/native-policy.ts","../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts"],"names":["invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync","source"],"mappings":";;;;;;;;AAGA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAM,MAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAAC,UAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAM,SAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAAS,OAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAAS,OAAA,EAAQ;AAChE,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAc,SAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmB,SAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACE,OAAO,GAAA,EAAK,WAAW,KACvB,MAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAAC,OAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAO,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAAC,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAA,SAAA,CAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQ,YAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAO,MAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAAC,MAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;ACzIA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAMA,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAMC,OAAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAACC,UAAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAASC,WAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAOC,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAML,QAAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAML,QAAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAACG,UAAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAACA,UAAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAMH,QAAAA,EAAQ;AAChB,EAAAI,UAAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAOE,YAAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAMA,YAAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAIL,OAAAA,CAAO,MAAM,GAAG,CAAA,IAAKA,QAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAACK,SAAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAML,QAAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,MAAA,EAAQ,qBAAA;AAAA,QACR,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAAI,WAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAAA,WAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAAA,WAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAGA,UAAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAMJ,QAAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAASM,YAAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAIL,OAAAA,CAAO,QAAQ,MAAM,CAAA,IAAKA,QAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAMD,QAAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACO,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAMP,QAAAA,EAAQ;AACpC,QAAA,IAAIK,UAAUE,OAAM,CAAA,CAAE,cAAA,EAAe,QAASP,QAAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYO,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAMP,QAAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAYA,QAAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAYA,QAAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF","file":"chunk-V2DXZYBB.js","sourcesContent":["import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n  const rel = relative(parent, child);\n  return rel === \"\" || (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n  [...path].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n  if (!isAbsolute(path) || hasControl(path)) throw invalid();\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) throw invalid();\n  return realpathSync(path);\n};\n\n/** Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. */\nexport function prepareNativePolicy(input: {\n  cwd: string;\n  privateRoot: string;\n  privateDirectory: string;\n  sandboxMode: \"read-only\" | \"workspace-write\";\n}) {\n  const cwd = directory(input.cwd);\n  const privateRoot = directory(input.privateRoot);\n  const privateDirectory = directory(input.privateDirectory);\n  if (\n    within(cwd, privateRoot) ||\n    within(privateRoot, cwd) ||\n    !within(privateDirectory, privateRoot) ||\n    privateDirectory === privateRoot ||\n    (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n  )\n    throw invalid();\n  const stat = lstatSync(privateRoot);\n  if (stat.mode & 0o077 || (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n    throw invalid();\n  const filesystem = Object.freeze({\n    [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n    [privateRoot]: \"deny\",\n  });\n  const config = Object.freeze({\n    default_permissions: \"managed\",\n    features: Object.freeze({ use_legacy_landlock: false }),\n    permissions: Object.freeze({\n      managed: Object.freeze({\n        extends: \":read-only\",\n        filesystem,\n        network: Object.freeze({ enabled: false }),\n      }),\n    }),\n  });\n  // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n  const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join(\", \")} }, network = { enabled = false } } }`;\n  const policy = Object.freeze({\n    config,\n    cliArgs: Object.freeze([\n      \"-c\",\n      'default_permissions=\"managed\"',\n      \"-c\",\n      \"features.use_legacy_landlock=false\",\n      \"-c\",\n      `permissions=${profile}`,\n    ]),\n  });\n  prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n  return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/** Confirms composition and native selection, not live OS isolation (G1/G2 remain required). */\nexport function activateNativeApprovalPolicy(\n  policy: PreparedNativePolicy,\n  response: unknown,\n  signal: AbortSignal,\n): NativeApprovalPolicy {\n  const binding = prepared.get(policy);\n  if (\n    !binding ||\n    signal.aborted ||\n    !record(response) ||\n    !record(response.thread) ||\n    typeof response.thread.id !== \"string\" ||\n    !response.thread.id ||\n    response.cwd !== binding.cwd ||\n    !record(response.activePermissionProfile) ||\n    response.activePermissionProfile.id !== \"managed\" ||\n    response.activePermissionProfile.extends !== \":read-only\"\n  )\n    throw invalid();\n  const token = Object.freeze({}) as NativeApprovalPolicy;\n  active.set(token, { ...binding, threadId: response.thread.id, signal });\n  return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n  policy: unknown,\n  threadId: string,\n): policy is NativeApprovalPolicy {\n  if (!record(policy)) return false;\n  const binding = active.get(policy);\n  return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/** Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n  policy: NativeApprovalPolicy | undefined,\n  path: string,\n  access: \"read\" | \"write\",\n): boolean {\n  if (!policy) return false;\n  const binding = active.get(policy);\n  if (\n    !binding ||\n    binding.signal.aborted ||\n    !isAbsolute(path) ||\n    hasControl(path) ||\n    (access !== \"read\" && access !== \"write\") ||\n    (access === \"write\" && !binding.writable)\n  )\n    return false;\n  try {\n    let existing = resolve(path);\n    const suffix: string[] = [];\n    while (true) {\n      try {\n        lstatSync(existing);\n        break;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" || dirname(existing) === existing)\n          return false;\n        suffix.unshift(existing.slice(dirname(existing).length + 1));\n        existing = dirname(existing);\n      }\n    }\n    const canonical = resolve(realpathSync(existing), ...suffix);\n    return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n  } catch {\n    return false;\n  }\n}\n","import {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseCredentialRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n  CodexCredentialDelivery,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n  configId: identifier,\n  credentialVersion: z.number().int().nonnegative().safe(),\n  mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n  ...common,\n  kind: z.literal(\"codex-subscription\"),\n  accessToken: z.string().min(1).max(65536),\n  chatgptAccountId: identifier,\n  chatgptPlanType: identifier.optional(),\n  expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n  subscription,\n  z.strictObject({\n    ...common,\n    kind: z.literal(\"openai-api-key\"),\n    apiKey: z.string().min(1).max(65536),\n  }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. */\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n  const parsed = delivery.safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n  const credential = parsed.data;\n  const mintedAt = Date.parse(credential.mintedAt);\n  // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n  if (\n    mintedAt > now + 60_000 ||\n    (credential.kind === \"codex-subscription\" &&\n      (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))\n  )\n    throw new Error(\"Invalid managed AI credential timestamps\");\n  return credential;\n}\n\n/** Validate runtime-only refresh input against the authenticated session's pinned delivery. */\nexport function parseCodexRefreshInput(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n  const parsed = z\n    .strictObject({\n      kind: z.literal(\"codex-subscription\"),\n      configId: identifier,\n      credentialVersion: common.credentialVersion,\n      reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n    })\n    .safeParse(value);\n  if (\n    !parsed.success ||\n    parsed.data.configId !== pinned.configId ||\n    parsed.data.credentialVersion !== pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return parsed.data;\n}\n\n/** Accept refreshed subscription credentials only within the existing config/account binding. */\nexport function parseCodexRefreshResult(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n  now = Date.now(),\n): CodexSubscriptionRefreshResult {\n  const parsed = z\n    .discriminatedUnion(\"ok\", [\n      z.strictObject({ ok: z.literal(true), credential: subscription }),\n      z.strictObject({\n        ok: z.literal(false),\n        code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n        message: z.string(),\n      }),\n    ])\n    .safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n  if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n  const credential = parseCodexCredential(parsed.data.credential, now);\n  if (\n    credential.kind !== \"codex-subscription\" ||\n    credential.configId !== pinned.configId ||\n    credential.chatgptAccountId !== pinned.chatgptAccountId ||\n    credential.credentialVersion < pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return { ok: true, credential };\n}\n\n/**\n * The AI provider registry a managed-codex session may carry (plan §2.2).\n *\n * Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot *also* be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n *\n * `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n *\n * An absent or empty registry is *not* a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n *\n * @returns the reason the registry is inadmissible, or `undefined` when it is.\n */\nexport function managedCodexRegistryViolation(\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined,\n): string | undefined {\n  if (!registry) return undefined;\n  const entries = registryEntries(registry);\n  if (entries.length === 0) return undefined;\n  if (entries.length > 1)\n    return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n  const [id, entry] = entries[0];\n  if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n  if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n  const surface = (entry as AIProviderLlmEntry).surface;\n  if (surface !== \"openai-codex-responses\")\n    return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n  const credential = entry.credential;\n  if (credential?.kind !== \"oauth\")\n    return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n  const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n  if (!ref || ref.form !== \"platform\")\n    return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n  return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n  const rel = relative(root, path);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n  if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n  const stat = lstatSync(path);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw invalid();\n  return readFileSync(path);\n}\n\n/** Session-owned state lock and account-bound native resume metadata; never stores credentials. */\nexport function prepareCodexInstance(\n  config: AgentConfig,\n  options: CodexManagedRuntimeOptions,\n  credential: CodexCredentialDelivery,\n) {\n  if (!isAbsolute(options.privateDirectory) || !isAbsolute(config.cwd) || !config.sessionId)\n    throw invalid();\n  directory(options.privateDirectory);\n  const root = realpathSync(options.privateDirectory);\n  const cwd = realpathSync(config.cwd);\n  if (within(root, cwd) || within(cwd, root)) throw invalid();\n  const lock = join(root, \".active\");\n  const leasePath = join(root, \"lease.db\");\n  if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n  const lease = openSqlite(leasePath);\n  try {\n    lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n    chmodSync(leasePath, 0o600);\n    // The OS releases the database lease on crashes; this marker never owns the lock.\n    rmSync(lock, { force: true });\n    writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n  } catch (error) {\n    lease.close();\n    throw error;\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    released = true;\n    try {\n      rmSync(lock, { force: true });\n    } finally {\n      lease.close();\n    }\n  };\n  try {\n    const key = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          driver: \"codex-app-server-v1\",\n          session: config.sessionId,\n          config: credential.configId,\n          kind: credential.kind,\n          account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n        }),\n      )\n      .digest(\"hex\");\n    const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n    directory(slots);\n    const stateRoot = join(slots, key);\n    directory(stateRoot);\n    for (const name of [\"instructions.new\", \"binding.new\"])\n      rmSync(join(stateRoot, name), { force: true });\n    const bindingPath = join(stateRoot, \"binding.json\");\n    if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n    if (existsSync(bindingPath)) {\n      // Filesystem authority failures (including symlinks) are fatal, not missing state.\n      const bytes = readRegular(bindingPath, 4096);\n      if (config.resumeSessionId) {\n        let binding: unknown;\n        try {\n          binding = JSON.parse(bytes.toString(\"utf8\"));\n        } catch {\n          throw new CodexNativeStateUnavailable();\n        }\n        if (\n          !binding ||\n          typeof binding !== \"object\" ||\n          Array.isArray(binding) ||\n          Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" ||\n          (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT ||\n          (binding as Record<string, unknown>).key !== key ||\n          (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n        )\n          throw new CodexNativeStateUnavailable();\n      }\n    }\n    const home = join(stateRoot, \"home\");\n    if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n    directory(home);\n    for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n    // Auth persistence is forbidden even if a previous external process left a carrier here.\n    if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n      throw invalid();\n    const instructionFile = join(stateRoot, \"instructions.md\");\n    const instructions = [\n      ...(options.instructionFiles ?? []).map((path) =>\n        readRegular(path, 1024 * 1024).toString(\"utf8\"),\n      ),\n      ...(config.systemPrompt ? [config.systemPrompt] : []),\n    ].join(\"\\n\\n---\\n\\n\");\n    const temporary = join(stateRoot, \"instructions.new\");\n    writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n    renameSync(temporary, instructionFile);\n    const target = join(home, \"skills\");\n    if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n    if (options.skillsDirectory) {\n      const source = realpathSync(options.skillsDirectory);\n      if (within(target, source) || within(source, target)) throw invalid();\n      if (existsSync(target)) rmSync(target, { recursive: true });\n      let files = 0;\n      let entries = 0;\n      let bytes = 0;\n      const copy = (source: string, destination: string) => {\n        if (++entries > 1024) throw invalid();\n        if (lstatSync(source).isSymbolicLink()) throw invalid();\n        mkdirSync(destination, { mode: 0o700 });\n        for (const entry of readdirSync(source, { withFileTypes: true })) {\n          const src = join(source, entry.name);\n          const dst = join(destination, entry.name);\n          if (entry.isSymbolicLink()) throw invalid();\n          if (entry.isDirectory()) copy(src, dst);\n          else {\n            const content = readRegular(src, 1024 * 1024);\n            bytes += content.byteLength;\n            if (++files > 512 || bytes > 8 * 1024 * 1024) throw invalid();\n            writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n          }\n        }\n      };\n      copy(options.skillsDirectory, target);\n    }\n    const bindThread = (threadId: string) => {\n      if (!threadId || threadId.length > 4096) throw invalid();\n      const next = join(stateRoot, \"binding.new\");\n      writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(next, bindingPath);\n    };\n    const setToolInstructions = (text: string) => {\n      writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n      renameSync(temporary, instructionFile);\n    };\n    return {\n      root,\n      stateRoot,\n      cwd,\n      home,\n      instructionFile,\n      bindThread,\n      release,\n      setToolInstructions,\n    };\n  } catch (error) {\n    release();\n    throw error;\n  }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. */\nexport function codexInstanceEnvironment(\n  input: Record<string, string>,\n  home: string,\n): Record<string, string> {\n  const allowed = new Set([\n    \"PATH\",\n    \"LANG\",\n    \"LC_ALL\",\n    \"TZ\",\n    \"SSL_CERT_FILE\",\n    \"SSL_CERT_DIR\",\n    \"HTTPS_PROXY\",\n    \"HTTP_PROXY\",\n    \"NO_PROXY\",\n  ]);\n  if (\n    !input ||\n    Object.entries(input).some(([key, value]) => !allowed.has(key) || typeof value !== \"string\")\n  )\n    throw invalid();\n  return {\n    ...input,\n    HOME: home,\n    CODEX_HOME: home,\n    XDG_CONFIG_HOME: join(home, \"config\"),\n    XDG_CACHE_HOME: join(home, \"cache\"),\n    XDG_DATA_HOME: join(home, \"data\"),\n    TMPDIR: join(home, \"tmp\"),\n  };\n}\n"]}

package/dist/{chunk-KYXOGHY6.js → chunk-W5DWWE4Y.js}

@@ -1,6 +1,6 @@
-import { findAiAssetsRoot } from './chunk-45VFGT7A.js';
+import { findAiAssetsRoot } from './chunk-4PTSR4UU.js';
 import { okJson, err, ok } from './chunk-X5YPJV4N.js';
-import { parseSkillRequirements, validateRequirements, buildRequiresPreamble, parseSkillFrontmatter } from './chunk-ZBBM6O6P.js';
+import { parseSkillRequirements, validateRequirements, buildRequiresPreamble, parseSkillFrontmatter } from './chunk-CGT45WN7.js';
 import { findKindDirs } from './chunk-A2ULN3KX.js';
 import fs from 'fs/promises';
 import path from 'path';
@@ -136,5 +136,5 @@ async function skillGetPreamble(projectDir, skillId) {
 }
 
 export { skillCheckRequirements, skillGetPreamble, skillList, skillSearch, skillShow };
-//# sourceMappingURL=chunk-KYXOGHY6.js.map
-//# sourceMappingURL=chunk-KYXOGHY6.js.map
+//# sourceMappingURL=chunk-W5DWWE4Y.js.map
+//# sourceMappingURL=chunk-W5DWWE4Y.js.map