@skaile/workspaces 6.8.0 → 6.9.0

package/dist/{chunk-Y6LC5PEZ.js → chunk-GYBDWW6K.js}

@@ -1,9 +1,9 @@
-import { unresolvedProviderCredentials, providerCredentialEnvName } from './chunk-SILFO5RY.js';
+import { unresolvedProviderCredentials, providerCredentialEnvName } from './chunk-SQMDFM4N.js';
 import { getProviderPreset } from './chunk-6UP2EDFN.js';
 import { globalSkaileDir } from './chunk-L5VSIPQD.js';
 import { registryEntries, parseModelRef, isEntryEnabled, resolveEntryBaseUrl } from './chunk-RXGPFAMN.js';
 import { createHash } from 'crypto';
-import { mkdirSync, rmSync, writeFileSync, renameSync, existsSync } from 'fs';
+import { mkdirSync, rmSync, writeFileSync, renameSync, readFileSync, existsSync } from 'fs';
 import { join, resolve } from 'path';
 import { stringify } from 'smol-toml';
 import { homedir } from 'os';
@@ -121,6 +121,15 @@ function writeCodexConfigToml(home, document) {
   renameSync(temporary, path);
   return path;
 }
+function isChatgptLogin(file) {
+  if (!file) return false;
+  try {
+    const doc = JSON.parse(readFileSync(file, "utf8"));
+    return doc.auth_mode === "chatgpt";
+  } catch {
+    return false;
+  }
+}
 function codexLoginFile(env) {
   const home = env.CODEX_HOME?.trim() || join(env.HOME || homedir(), ".codex");
   const file = join(home, "auth.json");
@@ -146,6 +155,6 @@ function codexLoginFallbackNotice(session, env) {
   return `provider 'openai' is not used: ${unresolved?.reason ?? "its credential is not set"}; codex uses its own login or OPENAI_API_KEY instead (check with \`skaile providers test openai\`)`;
 }
 
-export { buildCodexConfigDocument, codexLoginFallbackNotice, codexLoginFile, codexProviderTableId, codexSessionHome, usesCodexOwnAuth, writeCodexConfigToml };
-//# sourceMappingURL=chunk-Y6LC5PEZ.js.map
-//# sourceMappingURL=chunk-Y6LC5PEZ.js.map
+export { buildCodexConfigDocument, codexLoginFallbackNotice, codexLoginFile, codexProviderTableId, codexSessionHome, isChatgptLogin, usesCodexOwnAuth, writeCodexConfigToml };
+//# sourceMappingURL=chunk-GYBDWW6K.js.map
+//# sourceMappingURL=chunk-GYBDWW6K.js.map

package/dist/chunk-GYBDWW6K.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../bridge/src/codex/config-toml.ts","../bridge/src/codex/login-fallback.ts"],"names":["stringifyToml","join"],"mappings":";;;;;;;;;;AAyDA,IAAM,cAAA,GAA6D;AAAA,EACjE,wBAAA,EAA0B,WAAA;AAAA,EAC1B,kBAAA,EAAoB,WAAA;AAAA,EACpB,wBAAA,EAA0B;AAC5B,CAAA;AAQA,IAAM,8CAAmD,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,QAAA,EAAU,UAAU,CAAC,CAAA;AAM1F,SAAS,qBAAqB,EAAA,EAAoB;AACvD,EAAA,OAAO,4BAA4B,GAAA,CAAI,EAAE,CAAA,GAAI,CAAA,OAAA,EAAU,EAAE,CAAA,CAAA,GAAK,EAAA;AAChE;AAGA,IAAM,yBAAA,GAAkD;AAAA,EACtD,cAAA,EAAgB,IAAA;AAAA,EAChB,MAAA,EAAQ,IAAA;AAAA,EACR,OAAA,EAAS;AACX,CAAA;AAyDA,SAAS,mBAAA,CACP,KAAA,EACA,QAAA,EACA,QAAA,EACS;AACT,EAAA,IAAI,QAAA,CAAS,IAAA,IAAQ,QAAA,CAAS,OAAA,KAAY,QAAW,OAAO,IAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,EAAU,IAAA,MAAU,KAAA,CAAM,KAAA,EAAO,MAAK,IAAK,EAAA;AAClE,EAAA,IAAI,SAAS,UAAA,CAAW,CAAA,EAAG,SAAS,UAAU,CAAA,CAAA,CAAG,GAAG,OAAO,IAAA;AAC3D,EAAA,MAAM,KAAA,GAAQ,eAAA,CAAgB,QAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,EAAE,CAAA,KAAM,EAAA,KAAO,QAAA,CAAS,UAAU,IAAI,CAAC,CAAA;AAGtF,EAAA,MAAM,UAAU,QAAA,CAAS,OAAA;AACzB,EAAA,OACE,OAAA,KAAY,MAAA,KACX,KAAA,EAAO,SAAA,GAAY,OAAO,MAAM,MAAA,IAAa,KAAA,EAAO,YAAA,GAAe,OAAO,CAAA,KAAM,MAAA,CAAA;AAErF;AAiBO,SAAS,wBAAA,CACd,IACA,KAAA,EAC0D;AAC1D,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,GAAG,OAAO,EAAE,SAAS,mBAAA,EAAoB;AAClE,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,OAAA;AACzC,IAAA,OAAO,EAAE,OAAA,EAAS,CAAA,MAAA,EAAS,KAAA,CAAM,IAAI,CAAA,yBAAA,CAAA,EAA4B;AACnE,EAAA,MAAM,GAAA,GAAM,KAAA;AAIZ,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA,GAAS,iBAAA,CAAkB,KAAA,CAAM,MAAM,CAAA,GAAI,MAAA;AAChE,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,IAAW,MAAA,EAAQ,OAAA;AACvC,EAAA,MAAM,OAAA,GAAU,OAAA,GAAU,cAAA,CAAe,OAAO,CAAA,GAAI,MAAA;AACpD,EAAA,IAAI,CAAC,OAAA;AACH,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,OAAA,GACL,CAAA,mCAAA,EAAsC,OAAO,CAAA,CAAA,CAAA,GAC7C;AAAA,KACN;AACF,EAAA,MAAM,cAAA,GAAiB,MAAM,UAAA,EAAY,IAAA;AACzC,EAAA,MAAM,KAAA,GAAiC,EAAE,IAAA,EAAM,KAAA,CAAM,SAAS,EAAA,EAAG;AACjE,EAAA,MAAM,OAAA,GAAU,mBAAA,CAAoB,KAAK,CAAA,IAAK,MAAA,EAAQ,QAAA;AACtD,EAAA,IAAI,OAAA,QAAe,QAAA,GAAW,OAAA;AAC9B,EAAA,IAAI,cAAA,IAAkB,0BAA0B,cAAc,CAAA;AAC5D,IAAA,KAAA,CAAM,OAAA,GAAU,0BAA0B,EAAE,CAAA;AAC9C,EAAA,KAAA,CAAM,QAAA,GAAW,OAAA;AACjB,EAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAA,CAAM,oBAAA,GAAuB,IAAA;AAC7D,EAAA,IAAI,IAAI,YAAA,IAAgB,MAAA,CAAO,KAAK,GAAA,CAAI,YAAY,EAAE,MAAA,GAAS,CAAA;AAC7D,IAAA,KAAA,CAAM,YAAA,GAAe,EAAE,GAAG,GAAA,CAAI,YAAA,EAAa;AAC7C,EAAA,IAAI,MAAM,OAAA,IAAW,MAAA,CAAO,KAAK,KAAA,CAAM,OAAO,EAAE,MAAA,GAAS,CAAA;AACvD,IAAA,KAAA,CAAM,YAAA,GAAe,EAAE,GAAG,KAAA,CAAM,OAAA,EAAQ;AAC1C,EAAA,OAAO,EAAE,KAAA,EAAM;AACjB;AAMO,SAAS,yBAAyB,KAAA,EAA2C;AAClF,EAAA,MAAM,QAAA,GAAgC,EAAE,eAAA,EAAiB,EAAC,EAAE;AAC5D,EAAA,MAAM,UAA+B,EAAC;AACtC,EAAA,MAAM,UAAU,KAAA,CAAM,QAAA,GAAW,gBAAgB,KAAA,CAAM,QAAQ,IAAI,EAAC;AACpE,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,OAAA,EAAS;AACjC,IAAA,MAAM,QAAA,GAAW,wBAAA,CAAyB,EAAA,EAAI,KAAK,CAAA;AACnD,IAAA,IAAI,SAAA,IAAa,UAAU,OAAA,CAAQ,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,EAAQ,QAAA,CAAS,OAAA,EAAS,CAAA;AAAA,kBAC1D,eAAA,CAAgB,oBAAA,CAAqB,EAAE,CAAC,IAAI,QAAA,CAAS,KAAA;AAAA,EACrE;AAEA,EAAA,IAAI,CAAC,MAAM,QAAA,EAAU,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,QAAA,EAAU,EAAC,EAAE;AAI9D,EAAA,MAAM,QAAA,GAAW,aAAA;AAAA,IACf,MAAM,QAAA,EAAU,IAAA,MAAU,KAAA,CAAM,KAAA,EAAO,MAAK,IAAK,EAAA;AAAA,IACjD,KAAA,CAAM,QAAA;AAAA,IACN,KAAA,CAAM;AAAA,GACR;AACA,EAAA,IAAI,CAAC,UAAU,OAAO,EAAE,UAAU,OAAA,EAAS,QAAA,EAAU,EAAC,EAAE;AACxD,EAAA,MAAM,WAAW,QAAA,CAAS,QAAA;AAC1B,EAAA,MAAM,OAAA,GAAU,oBAAA,CAAqB,QAAA,CAAS,UAAU,CAAA;AACxD,EAAA,IAAI,CAAC,QAAA,CAAS,eAAA,CAAgB,OAAO,CAAA,EAAG;AAMtC,IAAA,MAAM,MAAA,GAAS,QAAQ,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,EAAA,KAAO,QAAA,CAAS,UAAU,CAAA,EAAG,MAAA;AAClE,IAAA,IAAI,UAAU,mBAAA,CAAoB,KAAA,EAAO,QAAA,EAAU,KAAA,CAAM,QAAQ,CAAA,EAAG;AAClE,MAAA,OAAO;AAAA,QACL,QAAA;AAAA,QACA,OAAA;AAAA,QACA,QAAA;AAAA,QACA,aAAA,EAAe,EAAE,EAAA,EAAI,QAAA,CAAS,YAAY,MAAA;AAAO,OACnD;AAAA,IACF;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,EAAS,QAAA,EAAS;AAAA,EACvC;AACA,EAAA,QAAA,CAAS,cAAA,GAAiB,OAAA;AAC1B,EAAA,IAAI,QAAA,CAAS,eAAA,EAAiB,QAAA,CAAS,KAAA,GAAQ,QAAA,CAAS,eAAA;AACxD,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,YAAY,QAAA,CAAS,UAAA;AAAA,IACrB,GAAI,SAAS,eAAA,GAAkB,EAAE,OAAO,QAAA,CAAS,eAAA,KAAoB,EAAC;AAAA,IACtE,OAAA;AAAA,IACA;AAAA,GACF;AACF;AAGO,SAAS,sBAAsB,QAAA,EAAuC;AAC3E,EAAA,MAAM,UAAmC,EAAC;AAC1C,EAAA,IAAI,QAAA,CAAS,cAAA,EAAgB,OAAA,CAAQ,cAAA,GAAiB,QAAA,CAAS,cAAA;AAC/D,EAAA,IAAI,QAAA,CAAS,KAAA,EAAO,OAAA,CAAQ,KAAA,GAAQ,QAAA,CAAS,KAAA;AAC7C,EAAA,OAAA,CAAQ,kBAAkB,QAAA,CAAS,eAAA;AACnC,EAAA,OAAO,CAAA,EAAGA,SAAA,CAAc,OAAO,CAAC;AAAA,CAAA;AAClC;AAWO,SAAS,iBAAiB,MAAA,EAAqD;AACpF,EAAA,MAAM,GAAA,GACJ,MAAA,CAAO,SAAA,IAAa,yBAAA,CAA0B,IAAA,CAAK,OAAO,SAAS,CAAA,GAC/D,MAAA,CAAO,SAAA,GACP,UAAA,CAAW,QAAQ,EAChB,MAAA,CAAO,MAAA,CAAO,SAAA,IAAa,MAAA,CAAO,GAAG,CAAA,CACrC,OAAO,KAAK,CAAA,CACZ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACpB,EAAA,OAAO,IAAA,CAAK,eAAA,EAAgB,EAAG,OAAA,EAAS,GAAG,CAAA;AAC7C;AAeO,SAAS,oBAAA,CACd,MACA,QAAA,EACoB;AACpB,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,aAAa,CAAA;AAGrC,EAAA,SAAA,CAAU,MAAM,EAAE,SAAA,EAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAChD,EAAA,IAAI,OAAO,IAAA,CAAK,QAAA,CAAS,eAAe,CAAA,CAAE,WAAW,CAAA,EAAG;AACtD,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,iBAAiB,CAAA;AAC9C,EAAA,MAAA,CAAO,SAAA,EAAW,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AACjC,EAAA,aAAA,CAAc,SAAA,EAAW,sBAAsB,QAAQ,CAAA,EAAG,EAAE,IAAA,EAAM,GAAA,EAAO,IAAA,EAAM,IAAA,EAAM,CAAA;AACrF,EAAA,UAAA,CAAW,WAAW,IAAI,CAAA;AAC1B,EAAA,OAAO,IAAA;AACT;ACtSO,SAAS,eAAe,IAAA,EAAmC;AAChE,EAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,EAAA,IAAI;AACF,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,MAAM,CAAC,CAAA;AACjD,IAAA,OAAO,IAAI,SAAA,KAAc,SAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAOO,SAAS,eAAe,GAAA,EAA6D;AAC1F,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,UAAA,EAAY,IAAA,EAAK,IAAKC,KAAK,GAAA,CAAI,IAAA,IAAQ,OAAA,EAAQ,EAAG,QAAQ,CAAA;AAC3E,EAAA,MAAM,IAAA,GAAOA,IAAAA,CAAK,IAAA,EAAM,WAAW,CAAA;AACnC,EAAA,OAAO,UAAA,CAAW,IAAI,CAAA,GAAI,OAAA,CAAQ,IAAI,CAAA,GAAI,MAAA;AAC5C;AAWO,SAAS,gBAAA,CACd,KAAA,EACA,GAAA,EACA,SAAA,EACS;AACT,EAAA,IAAI,KAAA,CAAM,UAAA,KAAe,QAAA,EAAU,OAAO,KAAA;AAC1C,EAAA,MAAM,QAAQ,KAAA,CAAM,QAAA,CAAS,eAAA,CAAgB,oBAAA,CAAqB,QAAQ,CAAC,CAAA;AAC3E,EAAA,IAAI,CAAC,OAAO,OAAA,IAAW,KAAA,CAAM,wBAAwB,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA,EAAG,OAAO,KAAA;AAChF,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,cAAA,IAAkB,GAAA,CAAI,iBAAiB,SAAS,CAAA;AACrE;AASO,SAAS,wBAAA,CACd,SACA,GAAA,EACoB;AACpB,EAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,EAAU,OAAO,MAAA;AAC9B,EAAA,MAAM,QAAQ,wBAAA,CAAyB;AAAA,IACrC,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,GAAI,QAAQ,QAAA,GAAW,EAAE,UAAU,OAAA,CAAQ,QAAA,KAAa;AAAC,GAC1D,CAAA;AACD,EAAA,IAAI,CAAC,iBAAiB,KAAA,EAAO,GAAA,EAAK,eAAe,GAAG,CAAC,GAAG,OAAO,MAAA;AAC/D,EAAA,MAAM,UAAA,GAAa,6BAAA,CAA8B,OAAA,CAAQ,QAAA,EAAU;AAAA,IACjE,GAAA;AAAA,IACA,UAAA,EAAY;AAAA,GACb,EAAE,CAAC,CAAA;AACJ,EAAA,OAAO,CAAA,+BAAA,EAAkC,UAAA,EAAY,MAAA,IAAU,2BAA2B,CAAA,kGAAA,CAAA;AAC5F","file":"chunk-GYBDWW6K.js","sourcesContent":["/**\n * Codex's `config.toml` adapter — the AI provider registry materialized into\n * the only provider surface the Codex CLI reads (plan §2.3, codex rows).\n *\n * Codex is a **file-shaped** harness: it takes its endpoints from\n * `$CODEX_HOME/config.toml`, never from per-request options. Both codex modes\n * therefore get a session-private `CODEX_HOME` holding a rendered document:\n *\n * - every addressable registry entry becomes `[model_providers.<id>]` with\n *   `base_url`, `env_key`, `wire_api`, `query_params` and `http_headers`\n *   mapping 1:1 onto the entry's `base_url`, `credential`, `surface`,\n *   `query_params` and `headers`;\n * - `model_provider` and `model` at the top level name the selected entry.\n *\n * The rendered file never contains a credential **value** — `env_key` holds\n * the *name* of the per-entry variable (`SKAILE_AIP_<ID>_KEY`, minted by\n * {@link providerCredentialEnvName}), and the value rides in the child\n * environment. An `oauth` entry has no env carrier at all: it gets\n * `requires_openai_auth`, which routes codex to its own auth manager.\n *\n * **Surface coverage.** Codex names the wire protocol `wire_api` and, as of\n * codex-cli 0.154, accepts exactly one value: `responses`. `chat` was removed\n * (\"`wire_api = \\\"chat\\\"` is no longer supported\", openai/codex#7782), and an\n * unknown value fails the *whole* document at load time — one unaddressable\n * entry would take the rest of the registry down with it. Entries whose\n * surface codex cannot speak (`openai-completions`, `anthropic-messages`,\n * `bedrock-converse-stream`, `google-*`) are therefore left out and reported\n * in {@link CodexConfigBuild.skipped} for the harness to log.\n *\n * @docLink packages/bridge/harnesses#codex-harness\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdirSync, renameSync, rmSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { globalSkaileDir } from \"@skaile/workspaces/core\";\nimport {\n  type AIProviderEntry,\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  type AIProviderSurface,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseModelRef,\n  registryEntries,\n  type ResolvedModelRef,\n  resolveEntryBaseUrl,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport { stringify as stringifyToml } from \"smol-toml\";\nimport { getProviderPreset } from \"../provider-catalog.js\";\nimport { providerCredentialEnvName } from \"../provider-materialize/credential-env.js\";\n\n/**\n * `surface` → codex `wire_api`. Only the responses-flavoured surfaces have a\n * codex spelling; see the module docstring for why `openai-completions` is\n * absent rather than mapped to the removed `chat` value.\n */\nconst CODEX_WIRE_API: Partial<Record<AIProviderSurface, string>> = {\n  \"openai-codex-responses\": \"responses\",\n  \"openai-responses\": \"responses\",\n  \"azure-openai-responses\": \"responses\",\n};\n\n/**\n * Provider ids codex reserves for its own built-ins. A `[model_providers.<id>]`\n * table under one of them fails the whole document (\"model_providers contains\n * reserved built-in provider IDs\"), so such an entry is rendered under\n * {@link codexProviderTableId}.\n */\nconst CODEX_RESERVED_PROVIDER_IDS: ReadonlySet<string> = new Set([\"openai\", \"ollama\", \"lmstudio\"]);\n\n/**\n * The `[model_providers.<id>]` table name for a registry entry: the entry id,\n * or `skaile-<id>` when codex reserves that id (the `openai` preset).\n */\nexport function codexProviderTableId(id: string): string {\n  return CODEX_RESERVED_PROVIDER_IDS.has(id) ? `skaile-${id}` : id;\n}\n\n/** Credential kinds whose value the adapter hands over in an env var. */\nconst ENV_DELIVERED_CREDENTIALS: Record<string, true> = {\n  api_key_header: true,\n  bearer: true,\n  command: true,\n};\n\n/** One `[model_providers.<id>]` table, in codex's own vocabulary. */\nexport interface CodexModelProviderTable {\n  /** Display name. Codex rejects a provider table without one. */\n  name: string;\n  base_url?: string;\n  /** Name of the variable carrying the credential — never the credential. */\n  env_key?: string;\n  wire_api?: string;\n  /** Routes codex to its own auth manager (ChatGPT subscription / stored key). */\n  requires_openai_auth?: boolean;\n  query_params?: Record<string, string>;\n  http_headers?: Record<string, string>;\n}\n\n/** The subset of codex's `config.toml` this adapter owns. */\nexport interface CodexConfigDocument {\n  /** Table id the session addresses (see {@link codexProviderTableId}); absent when nothing rendered. */\n  model_provider?: string;\n  /** Provider-side model id. */\n  model?: string;\n  model_providers: Record<string, CodexModelProviderTable>;\n}\n\n/** An entry codex cannot address, and why. */\nexport interface CodexSkippedEntry {\n  id: string;\n  reason: string;\n}\n\n/** Result of {@link buildCodexConfigDocument}. */\nexport interface CodexConfigBuild {\n  document: CodexConfigDocument;\n  /** Selected registry entry id (not the table id), when it rendered. */\n  providerId?: string;\n  /** Provider-side model id of the selection, when the selector named one. */\n  model?: string;\n  /**\n   * Entries left out of the document. Non-fatal: codex keeps its built-in\n   * providers, so a session whose selection was skipped behaves exactly as it\n   * did before the registry existed.\n   */\n  skipped: CodexSkippedEntry[];\n  /** Notes from `modelRef` resolution (dangling role, disabled provider, …). */\n  warnings: string[];\n  /**\n   * Set when the selector named an entry codex cannot address: the session\n   * must stop with `reason`, not fall back to codex's built-in providers.\n   */\n  unaddressable?: { id: string; reason: string };\n}\n\n/**\n * Whether the session's selector named the entry `selected` resolved to, rather\n * than reaching it by registry order alone.\n */\nfunction selectionNamesEntry(\n  input: CodexConfigInput,\n  selected: ResolvedModelRef,\n  registry: AIProviderRegistry | MergedAIProviderRegistry,\n): boolean {\n  if (selected.role && selected.modelId !== undefined) return true;\n  const selector = input.modelRef?.trim() || input.model?.trim() || \"\";\n  if (selector.startsWith(`${selected.providerId}/`)) return true;\n  const entry = registryEntries(registry).find(([id]) => id === selected.providerId)?.[1] as\n    | AIProviderLlmEntry\n    | undefined;\n  const modelId = selected.modelId;\n  return (\n    modelId !== undefined &&\n    (entry?.model_map?.[modelId] !== undefined || entry?.capabilities?.[modelId] !== undefined)\n  );\n}\n\n/** Inputs {@link buildCodexConfigDocument} reads off an `AgentConfig`. */\nexport interface CodexConfigInput {\n  registry?: AIProviderRegistry | MergedAIProviderRegistry;\n  /** `\"<providerId>/<modelId>\"`, a bare model id, or `\"@role\"`. */\n  modelRef?: string;\n  /** Legacy model field, used as the selector when `modelRef` is absent. */\n  model?: string;\n  /** Roles table (`skaile.yaml`), consulted for an `@role` selector. */\n  roles?: Record<string, string>;\n}\n\n/**\n * Render one entry as a codex provider table, or explain why codex cannot\n * address it.\n */\nexport function renderCodexProviderTable(\n  id: string,\n  entry: AIProviderEntry,\n): { table: CodexModelProviderTable } | { skipped: string } {\n  if (!isEntryEnabled(entry)) return { skipped: \"entry is disabled\" };\n  if (entry.kind !== \"llm\" && entry.kind !== \"embed\")\n    return { skipped: `kind '${entry.kind}' is not a model endpoint` };\n  const llm = entry as AIProviderLlmEntry;\n  // `surface` and `base_url` may live on the catalog preset the entry names —\n  // the catalog layer fills them during a merge, but an entry handed straight\n  // to a harness has not necessarily been through one.\n  const preset = entry.preset ? getProviderPreset(entry.preset) : undefined;\n  const surface = llm.surface ?? preset?.surface;\n  const wireApi = surface ? CODEX_WIRE_API[surface] : undefined;\n  if (!wireApi)\n    return {\n      skipped: surface\n        ? `codex has no wire_api for surface '${surface}'`\n        : \"entry declares no surface\",\n    };\n  const credentialKind = entry.credential?.kind;\n  const table: CodexModelProviderTable = { name: entry.label ?? id };\n  const baseUrl = resolveEntryBaseUrl(entry) ?? preset?.base_url;\n  if (baseUrl) table.base_url = baseUrl;\n  if (credentialKind && ENV_DELIVERED_CREDENTIALS[credentialKind])\n    table.env_key = providerCredentialEnvName(id);\n  table.wire_api = wireApi;\n  if (credentialKind === \"oauth\") table.requires_openai_auth = true;\n  if (llm.query_params && Object.keys(llm.query_params).length > 0)\n    table.query_params = { ...llm.query_params };\n  if (entry.headers && Object.keys(entry.headers).length > 0)\n    table.http_headers = { ...entry.headers };\n  return { table };\n}\n\n/**\n * Build the document for a session: every addressable entry, plus the\n * selection when it resolved to one of them.\n */\nexport function buildCodexConfigDocument(input: CodexConfigInput): CodexConfigBuild {\n  const document: CodexConfigDocument = { model_providers: {} };\n  const skipped: CodexSkippedEntry[] = [];\n  const entries = input.registry ? registryEntries(input.registry) : [];\n  for (const [id, entry] of entries) {\n    const rendered = renderCodexProviderTable(id, entry);\n    if (\"skipped\" in rendered) skipped.push({ id, reason: rendered.skipped });\n    else document.model_providers[codexProviderTableId(id)] = rendered.table;\n  }\n\n  if (!input.registry) return { document, skipped, warnings: [] };\n  // An empty selector resolves the same way a bare one does — first entry in\n  // registry order. A session that configured an endpoint and named no model\n  // still means that endpoint, not codex's built-in default.\n  const selected = parseModelRef(\n    input.modelRef?.trim() || input.model?.trim() || \"\",\n    input.registry,\n    input.roles,\n  );\n  if (!selected) return { document, skipped, warnings: [] };\n  const warnings = selected.warnings;\n  const tableId = codexProviderTableId(selected.providerId);\n  if (!document.model_providers[tableId]) {\n    // A selector that names the entry (`ollama/llama3`, a role or a model its\n    // `model_map` lists) and cannot be rendered must not fall through to\n    // codex's built-in OpenAI: the prompt would go to a provider the user did\n    // not pick. A bare model id that matched no entry only landed on the first\n    // entry by registry order, so codex's own providers stay the right answer.\n    const reason = skipped.find((s) => s.id === selected.providerId)?.reason;\n    if (reason && selectionNamesEntry(input, selected, input.registry)) {\n      return {\n        document,\n        skipped,\n        warnings,\n        unaddressable: { id: selected.providerId, reason },\n      };\n    }\n    return { document, skipped, warnings };\n  }\n  document.model_provider = tableId;\n  if (selected.providerModelId) document.model = selected.providerModelId;\n  return {\n    document,\n    providerId: selected.providerId,\n    ...(selected.providerModelId ? { model: selected.providerModelId } : {}),\n    skipped,\n    warnings,\n  };\n}\n\n/** Serialize a document to TOML. Deterministic: registry order throughout. */\nexport function renderCodexConfigToml(document: CodexConfigDocument): string {\n  const ordered: Record<string, unknown> = {};\n  if (document.model_provider) ordered.model_provider = document.model_provider;\n  if (document.model) ordered.model = document.model;\n  ordered.model_providers = document.model_providers;\n  return `${stringifyToml(ordered)}\\n`;\n}\n\n/**\n * The session-private codex home.\n *\n * Deliberately outside `cwd`: codex's `workspace-write` sandbox makes the\n * working tree writable by the model, and a config home inside it would let a\n * turn rewrite its own `base_url`. `$SKAILE_HOME` (honoured by\n * {@link globalSkaileDir}) relocates the whole tree, which is also the test\n * seam.\n */\nexport function codexSessionHome(config: { cwd: string; sessionId?: string }): string {\n  const key =\n    config.sessionId && /^[A-Za-z0-9._-]{1,128}$/.test(config.sessionId)\n      ? config.sessionId\n      : createHash(\"sha256\")\n          .update(config.sessionId ?? config.cwd)\n          .digest(\"hex\")\n          .slice(0, 32);\n  return join(globalSkaileDir(), \"codex\", key);\n}\n\n/**\n * Write `<home>/config.toml`, creating the home always. Atomic: a\n * partially written document would fail codex's config load for the whole\n * session.\n *\n * A document with no provider tables says nothing codex does not already\n * know, so nothing is written and a file left by an earlier render is\n * removed — a session that no longer carries a registry must not keep\n * answering to the one it used to have.\n *\n * @returns the absolute path written, or `undefined` when there was nothing\n *   to render.\n */\nexport function writeCodexConfigToml(\n  home: string,\n  document: CodexConfigDocument,\n): string | undefined {\n  const path = join(home, \"config.toml\");\n  // codex exits when CODEX_HOME names a directory that does not exist, so the\n  // home exists before the early return too.\n  mkdirSync(home, { recursive: true, mode: 0o700 });\n  if (Object.keys(document.model_providers).length === 0) {\n    rmSync(path, { force: true });\n    return undefined;\n  }\n  const temporary = join(home, \"config.toml.new\");\n  rmSync(temporary, { force: true });\n  writeFileSync(temporary, renderCodexConfigToml(document), { mode: 0o600, flag: \"wx\" });\n  renameSync(temporary, path);\n  return path;\n}\n","/**\n * The codex CLI's own credentials, and when they stand in for the registry's `openai` entry.\n *\n * An `openai` registry entry whose key variable is not exported cannot be rendered as a working\n * `[model_providers.*]` table. The omp harness then answers with its own login; codex does the\n * same (p1871): it drops the entry and runs on codex's built-in `openai` provider, which uses\n * the ChatGPT login (`~/.codex/auth.json`) or an exported `OPENAI_API_KEY`. Every other entry\n * whose key is missing still refuses, naming the variable to export.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport type {\n  AIProviderRegistry,\n  MergedAIProviderRegistry,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport { unresolvedProviderCredentials } from \"../provider-materialize/credential-env.js\";\nimport {\n  buildCodexConfigDocument,\n  type CodexConfigBuild,\n  codexProviderTableId,\n} from \"./config-toml.js\";\n\n/**\n * Whether the codex login file at `file` is a ChatGPT sign-in (`auth_mode: chatgpt`) and not a\n * stored API key. `false` for no file or one that does not parse.\n */\nexport function isChatgptLogin(file: string | undefined): boolean {\n  if (!file) return false;\n  try {\n    const doc = JSON.parse(readFileSync(file, \"utf8\")) as { auth_mode?: unknown };\n    return doc.auth_mode === \"chatgpt\";\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The codex CLI's ChatGPT login file (`$CODEX_HOME/auth.json`, default `~/.codex/auth.json`) of\n * the user's environment, or `undefined` when there is none. `env` is the parent environment,\n * not the session's: the session's `CODEX_HOME` is the private one, which has no login.\n */\nexport function codexLoginFile(env: Record<string, string | undefined>): string | undefined {\n  const home = env.CODEX_HOME?.trim() || join(env.HOME || homedir(), \".codex\");\n  const file = join(home, \"auth.json\");\n  return existsSync(file) ? resolve(file) : undefined;\n}\n\n/**\n * Whether the session runs on codex's own auth instead of the selected `openai` registry entry:\n * the entry is selected, its key variable (`env_key` of the rendered table) is not set in `env`,\n * and codex has a login file or an exported key to use instead.\n *\n * @param build - The rendered codex config of the session.\n * @param env - The environment the child gets, credential variables included.\n * @param loginFile - The codex login file, when there is one.\n */\nexport function usesCodexOwnAuth(\n  build: CodexConfigBuild,\n  env: Record<string, string | undefined>,\n  loginFile: string | undefined,\n): boolean {\n  if (build.providerId !== \"openai\") return false;\n  const table = build.document.model_providers[codexProviderTableId(\"openai\")];\n  if (!table?.env_key || table.requires_openai_auth || env[table.env_key]) return false;\n  return Boolean(env.OPENAI_API_KEY || env.CODEX_API_KEY || loginFile);\n}\n\n/**\n * The line `run` and `repl` print when a codex session falls back to codex's own auth because\n * the `openai` entry has no key (the `omp` line of the same kind, p1871), or `undefined`.\n *\n * @param session - The session's registry and model selector.\n * @param env - Process environment plus the session's credential variables.\n */\nexport function codexLoginFallbackNotice(\n  session: { registry?: AIProviderRegistry | MergedAIProviderRegistry; modelRef?: string },\n  env: Record<string, string | undefined>,\n): string | undefined {\n  if (!session.registry) return undefined;\n  const build = buildCodexConfigDocument({\n    registry: session.registry,\n    ...(session.modelRef ? { modelRef: session.modelRef } : {}),\n  });\n  if (!usesCodexOwnAuth(build, env, codexLoginFile(env))) return undefined;\n  const unresolved = unresolvedProviderCredentials(session.registry, {\n    env,\n    providerId: \"openai\",\n  })[0];\n  return `provider 'openai' is not used: ${unresolved?.reason ?? \"its credential is not set\"}; codex uses its own login or OPENAI_API_KEY instead (check with \\`skaile providers test openai\\`)`;\n}\n"]}

package/dist/{chunk-CMXDFTA2.js → chunk-GYPPVANR.js}

@@ -1,6 +1,6 @@
 import { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { registryEntries, isEntryEnabled, parseCredentialRef } from './chunk-RXGPFAMN.js';
-import { openSqlite } from './chunk-SGI5MRKP.js';
+import { openSqlite } from './chunk-MDCI4RSG.js';
 import * as z from 'zod';
 import { createHash } from 'crypto';
 import { realpathSync, existsSync, lstatSync, chmodSync, rmSync, writeFileSync, renameSync, mkdirSync, readdirSync, readFileSync } from 'fs';
@@ -353,5 +353,5 @@ function allowsNativeApprovalPath(policy, path, access) {
 }
 
 export { activateNativeApprovalPolicy, allowsNativeApprovalPath, codexInstanceEnvironment, isNativeApprovalPolicyActive, managedCodexRegistryViolation, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult, prepareCodexInstance, prepareNativePolicy };
-//# sourceMappingURL=chunk-CMXDFTA2.js.map
-//# sourceMappingURL=chunk-CMXDFTA2.js.map
+//# sourceMappingURL=chunk-GYPPVANR.js.map
+//# sourceMappingURL=chunk-GYPPVANR.js.map

package/dist/{chunk-CMXDFTA2.js.map → chunk-GYPPVANR.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts","../bridge/src/codex/native-policy.ts"],"names":["source","invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync"],"mappings":";;;;;;;;AAcA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAC,UAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAAS,UAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAM,OAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAM,OAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAAC,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,SAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAI,MAAA,CAAO,MAAM,GAAG,CAAA,IAAK,OAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAM,OAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAAC,SAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAM,OAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,OAAA,EAAS,qBAAA;AAAA,QACT,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAA,SAAA,CAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAA,SAAA,CAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAG,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAM,OAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,IAAK,OAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAM,OAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACA,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAM,OAAA,EAAQ;AACpC,QAAA,IAAI,UAAUA,OAAM,CAAA,CAAE,cAAA,EAAe,QAAS,OAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYA,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAM,OAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAY,OAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAY,OAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF;ACvNA,IAAMC,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAMC,OAAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAACC,UAAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAMC,UAAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAACD,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAASH,QAAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAASL,QAAAA,EAAQ;AAChE,EAAA,OAAOM,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAMF,UAAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAcA,UAAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmBA,UAAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACEH,QAAO,GAAA,EAAK,WAAW,KACvBA,OAAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAACA,QAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAMD,QAAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAOK,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAML,QAAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAACG,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAAE,UAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQC,YAAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAOL,OAAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAACA,OAAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"chunk-CMXDFTA2.js","sourcesContent":["import {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseCredentialRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n  CodexCredentialDelivery,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n  configId: identifier,\n  credentialVersion: z.number().int().nonnegative().safe(),\n  mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n  ...common,\n  kind: z.literal(\"codex-subscription\"),\n  accessToken: z.string().min(1).max(65536),\n  chatgptAccountId: identifier,\n  chatgptPlanType: identifier.optional(),\n  expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n  subscription,\n  z.strictObject({\n    ...common,\n    kind: z.literal(\"openai-api-key\"),\n    apiKey: z.string().min(1).max(65536),\n  }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. */\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n  const parsed = delivery.safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n  const credential = parsed.data;\n  const mintedAt = Date.parse(credential.mintedAt);\n  // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n  if (\n    mintedAt > now + 60_000 ||\n    (credential.kind === \"codex-subscription\" &&\n      (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))\n  )\n    throw new Error(\"Invalid managed AI credential timestamps\");\n  return credential;\n}\n\n/** Validate runtime-only refresh input against the authenticated session's pinned delivery. */\nexport function parseCodexRefreshInput(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n  const parsed = z\n    .strictObject({\n      kind: z.literal(\"codex-subscription\"),\n      configId: identifier,\n      credentialVersion: common.credentialVersion,\n      reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n    })\n    .safeParse(value);\n  if (\n    !parsed.success ||\n    parsed.data.configId !== pinned.configId ||\n    parsed.data.credentialVersion !== pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return parsed.data;\n}\n\n/** Accept refreshed subscription credentials only within the existing config/account binding. */\nexport function parseCodexRefreshResult(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n  now = Date.now(),\n): CodexSubscriptionRefreshResult {\n  const parsed = z\n    .discriminatedUnion(\"ok\", [\n      z.strictObject({ ok: z.literal(true), credential: subscription }),\n      z.strictObject({\n        ok: z.literal(false),\n        code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n        message: z.string(),\n      }),\n    ])\n    .safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n  if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n  const credential = parseCodexCredential(parsed.data.credential, now);\n  if (\n    credential.kind !== \"codex-subscription\" ||\n    credential.configId !== pinned.configId ||\n    credential.chatgptAccountId !== pinned.chatgptAccountId ||\n    credential.credentialVersion < pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return { ok: true, credential };\n}\n\n/**\n * The AI provider registry a managed-codex session may carry (plan §2.2).\n *\n * Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot *also* be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n *\n * `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n *\n * An absent or empty registry is *not* a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n *\n * @returns the reason the registry is inadmissible, or `undefined` when it is.\n */\nexport function managedCodexRegistryViolation(\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined,\n): string | undefined {\n  if (!registry) return undefined;\n  const entries = registryEntries(registry);\n  if (entries.length === 0) return undefined;\n  if (entries.length > 1)\n    return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n  const [id, entry] = entries[0];\n  if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n  if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n  const surface = (entry as AIProviderLlmEntry).surface;\n  if (surface !== \"openai-codex-responses\")\n    return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n  const credential = entry.credential;\n  if (credential?.kind !== \"oauth\")\n    return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n  const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n  if (!ref || ref.form !== \"platform\")\n    return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n  return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n  const rel = relative(root, path);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n  if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n  const stat = lstatSync(path);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw invalid();\n  return readFileSync(path);\n}\n\n/** Session-owned state lock and account-bound native resume metadata; never stores credentials. */\nexport function prepareCodexInstance(\n  config: AgentConfig,\n  options: CodexManagedRuntimeOptions,\n  credential: CodexCredentialDelivery,\n) {\n  if (!isAbsolute(options.privateDirectory) || !isAbsolute(config.cwd) || !config.sessionId)\n    throw invalid();\n  directory(options.privateDirectory);\n  const root = realpathSync(options.privateDirectory);\n  const cwd = realpathSync(config.cwd);\n  if (within(root, cwd) || within(cwd, root)) throw invalid();\n  const lock = join(root, \".active\");\n  const leasePath = join(root, \"lease.db\");\n  if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n  const lease = openSqlite(leasePath);\n  try {\n    lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n    chmodSync(leasePath, 0o600);\n    // The OS releases the database lease on crashes; this marker never owns the lock.\n    rmSync(lock, { force: true });\n    writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n  } catch (error) {\n    lease.close();\n    throw error;\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    released = true;\n    try {\n      rmSync(lock, { force: true });\n    } finally {\n      lease.close();\n    }\n  };\n  try {\n    const key = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          harness: \"codex-app-server-v1\",\n          session: config.sessionId,\n          config: credential.configId,\n          kind: credential.kind,\n          account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n        }),\n      )\n      .digest(\"hex\");\n    const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n    directory(slots);\n    const stateRoot = join(slots, key);\n    directory(stateRoot);\n    for (const name of [\"instructions.new\", \"binding.new\"])\n      rmSync(join(stateRoot, name), { force: true });\n    const bindingPath = join(stateRoot, \"binding.json\");\n    if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n    if (existsSync(bindingPath)) {\n      // Filesystem authority failures (including symlinks) are fatal, not missing state.\n      const bytes = readRegular(bindingPath, 4096);\n      if (config.resumeSessionId) {\n        let binding: unknown;\n        try {\n          binding = JSON.parse(bytes.toString(\"utf8\"));\n        } catch {\n          throw new CodexNativeStateUnavailable();\n        }\n        if (\n          !binding ||\n          typeof binding !== \"object\" ||\n          Array.isArray(binding) ||\n          Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" ||\n          (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT ||\n          (binding as Record<string, unknown>).key !== key ||\n          (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n        )\n          throw new CodexNativeStateUnavailable();\n      }\n    }\n    const home = join(stateRoot, \"home\");\n    if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n    directory(home);\n    for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n    // Auth persistence is forbidden even if a previous external process left a carrier here.\n    if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n      throw invalid();\n    const instructionFile = join(stateRoot, \"instructions.md\");\n    const instructions = [\n      ...(options.instructionFiles ?? []).map((path) =>\n        readRegular(path, 1024 * 1024).toString(\"utf8\"),\n      ),\n      ...(config.systemPrompt ? [config.systemPrompt] : []),\n    ].join(\"\\n\\n---\\n\\n\");\n    const temporary = join(stateRoot, \"instructions.new\");\n    writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n    renameSync(temporary, instructionFile);\n    const target = join(home, \"skills\");\n    if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n    if (options.skillsDirectory) {\n      const source = realpathSync(options.skillsDirectory);\n      if (within(target, source) || within(source, target)) throw invalid();\n      if (existsSync(target)) rmSync(target, { recursive: true });\n      let files = 0;\n      let entries = 0;\n      let bytes = 0;\n      const copy = (source: string, destination: string) => {\n        if (++entries > 1024) throw invalid();\n        if (lstatSync(source).isSymbolicLink()) throw invalid();\n        mkdirSync(destination, { mode: 0o700 });\n        for (const entry of readdirSync(source, { withFileTypes: true })) {\n          const src = join(source, entry.name);\n          const dst = join(destination, entry.name);\n          if (entry.isSymbolicLink()) throw invalid();\n          if (entry.isDirectory()) copy(src, dst);\n          else {\n            const content = readRegular(src, 1024 * 1024);\n            bytes += content.byteLength;\n            if (++files > 512 || bytes > 8 * 1024 * 1024) throw invalid();\n            writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n          }\n        }\n      };\n      copy(options.skillsDirectory, target);\n    }\n    const bindThread = (threadId: string) => {\n      if (!threadId || threadId.length > 4096) throw invalid();\n      const next = join(stateRoot, \"binding.new\");\n      writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(next, bindingPath);\n    };\n    const setToolInstructions = (text: string) => {\n      writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n      renameSync(temporary, instructionFile);\n    };\n    return {\n      root,\n      stateRoot,\n      cwd,\n      home,\n      instructionFile,\n      bindThread,\n      release,\n      setToolInstructions,\n    };\n  } catch (error) {\n    release();\n    throw error;\n  }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. */\nexport function codexInstanceEnvironment(\n  input: Record<string, string>,\n  home: string,\n): Record<string, string> {\n  const allowed = new Set([\n    \"PATH\",\n    \"LANG\",\n    \"LC_ALL\",\n    \"TZ\",\n    \"SSL_CERT_FILE\",\n    \"SSL_CERT_DIR\",\n    \"HTTPS_PROXY\",\n    \"HTTP_PROXY\",\n    \"NO_PROXY\",\n  ]);\n  if (\n    !input ||\n    Object.entries(input).some(([key, value]) => !allowed.has(key) || typeof value !== \"string\")\n  )\n    throw invalid();\n  return {\n    ...input,\n    HOME: home,\n    CODEX_HOME: home,\n    XDG_CONFIG_HOME: join(home, \"config\"),\n    XDG_CACHE_HOME: join(home, \"cache\"),\n    XDG_DATA_HOME: join(home, \"data\"),\n    TMPDIR: join(home, \"tmp\"),\n  };\n}\n","import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n  const rel = relative(parent, child);\n  return rel === \"\" || (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n  [...path].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n  if (!isAbsolute(path) || hasControl(path)) throw invalid();\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) throw invalid();\n  return realpathSync(path);\n};\n\n/** Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. */\nexport function prepareNativePolicy(input: {\n  cwd: string;\n  privateRoot: string;\n  privateDirectory: string;\n  sandboxMode: \"read-only\" | \"workspace-write\";\n}) {\n  const cwd = directory(input.cwd);\n  const privateRoot = directory(input.privateRoot);\n  const privateDirectory = directory(input.privateDirectory);\n  if (\n    within(cwd, privateRoot) ||\n    within(privateRoot, cwd) ||\n    !within(privateDirectory, privateRoot) ||\n    privateDirectory === privateRoot ||\n    (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n  )\n    throw invalid();\n  const stat = lstatSync(privateRoot);\n  if (stat.mode & 0o077 || (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n    throw invalid();\n  const filesystem = Object.freeze({\n    [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n    [privateRoot]: \"deny\",\n  });\n  const config = Object.freeze({\n    default_permissions: \"managed\",\n    features: Object.freeze({ use_legacy_landlock: false }),\n    permissions: Object.freeze({\n      managed: Object.freeze({\n        extends: \":read-only\",\n        filesystem,\n        network: Object.freeze({ enabled: false }),\n      }),\n    }),\n  });\n  // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n  const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join(\", \")} }, network = { enabled = false } } }`;\n  const policy = Object.freeze({\n    config,\n    cliArgs: Object.freeze([\n      \"-c\",\n      'default_permissions=\"managed\"',\n      \"-c\",\n      \"features.use_legacy_landlock=false\",\n      \"-c\",\n      `permissions=${profile}`,\n    ]),\n  });\n  prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n  return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/** Confirms composition and native selection, not live OS isolation (G1/G2 remain required). */\nexport function activateNativeApprovalPolicy(\n  policy: PreparedNativePolicy,\n  response: unknown,\n  signal: AbortSignal,\n): NativeApprovalPolicy {\n  const binding = prepared.get(policy);\n  if (\n    !binding ||\n    signal.aborted ||\n    !record(response) ||\n    !record(response.thread) ||\n    typeof response.thread.id !== \"string\" ||\n    !response.thread.id ||\n    response.cwd !== binding.cwd ||\n    !record(response.activePermissionProfile) ||\n    response.activePermissionProfile.id !== \"managed\" ||\n    response.activePermissionProfile.extends !== \":read-only\"\n  )\n    throw invalid();\n  const token = Object.freeze({}) as NativeApprovalPolicy;\n  active.set(token, { ...binding, threadId: response.thread.id, signal });\n  return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n  policy: unknown,\n  threadId: string,\n): policy is NativeApprovalPolicy {\n  if (!record(policy)) return false;\n  const binding = active.get(policy);\n  return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/** Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n  policy: NativeApprovalPolicy | undefined,\n  path: string,\n  access: \"read\" | \"write\",\n): boolean {\n  if (!policy) return false;\n  const binding = active.get(policy);\n  if (\n    !binding ||\n    binding.signal.aborted ||\n    !isAbsolute(path) ||\n    hasControl(path) ||\n    (access !== \"read\" && access !== \"write\") ||\n    (access === \"write\" && !binding.writable)\n  )\n    return false;\n  try {\n    let existing = resolve(path);\n    const suffix: string[] = [];\n    while (true) {\n      try {\n        lstatSync(existing);\n        break;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" || dirname(existing) === existing)\n          return false;\n        suffix.unshift(existing.slice(dirname(existing).length + 1));\n        existing = dirname(existing);\n      }\n    }\n    const canonical = resolve(realpathSync(existing), ...suffix);\n    return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n  } catch {\n    return false;\n  }\n}\n"]}
+{"version":3,"sources":["../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts","../bridge/src/codex/native-policy.ts"],"names":["source","invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync"],"mappings":";;;;;;;;AAcA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAC,UAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAAS,UAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAM,OAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAM,OAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAAC,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,SAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAI,MAAA,CAAO,MAAM,GAAG,CAAA,IAAK,OAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAM,OAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAAC,SAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAM,OAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,OAAA,EAAS,qBAAA;AAAA,QACT,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAA,SAAA,CAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAA,SAAA,CAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAG,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAM,OAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,IAAK,OAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAM,OAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACA,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAM,OAAA,EAAQ;AACpC,QAAA,IAAI,UAAUA,OAAM,CAAA,CAAE,cAAA,EAAe,QAAS,OAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYA,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAM,OAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAY,OAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAY,OAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF;ACvNA,IAAMC,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAMC,OAAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAACC,UAAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAMC,UAAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAACD,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAASH,QAAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAASL,QAAAA,EAAQ;AAChE,EAAA,OAAOM,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAMF,UAAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAcA,UAAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmBA,UAAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACEH,QAAO,GAAA,EAAK,WAAW,KACvBA,OAAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAACA,QAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAMD,QAAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAOK,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAML,QAAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAACG,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAAE,UAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQC,YAAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAOL,OAAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAACA,OAAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"chunk-GYPPVANR.js","sourcesContent":["import {\n  type AIProviderLlmEntry,\n  type AIProviderRegistry,\n  isEntryEnabled,\n  type MergedAIProviderRegistry,\n  parseCredentialRef,\n  registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n  CodexCredentialDelivery,\n  CodexSubscriptionRefreshInput,\n  CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n  configId: identifier,\n  credentialVersion: z.number().int().nonnegative().safe(),\n  mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n  ...common,\n  kind: z.literal(\"codex-subscription\"),\n  accessToken: z.string().min(1).max(65536),\n  chatgptAccountId: identifier,\n  chatgptPlanType: identifier.optional(),\n  expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n  subscription,\n  z.strictObject({\n    ...common,\n    kind: z.literal(\"openai-api-key\"),\n    apiKey: z.string().min(1).max(65536),\n  }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. */\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n  const parsed = delivery.safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n  const credential = parsed.data;\n  const mintedAt = Date.parse(credential.mintedAt);\n  // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n  if (\n    mintedAt > now + 60_000 ||\n    (credential.kind === \"codex-subscription\" &&\n      (Date.parse(credential.expiresAt) <= now || Date.parse(credential.expiresAt) <= mintedAt))\n  )\n    throw new Error(\"Invalid managed AI credential timestamps\");\n  return credential;\n}\n\n/** Validate runtime-only refresh input against the authenticated session's pinned delivery. */\nexport function parseCodexRefreshInput(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n  const parsed = z\n    .strictObject({\n      kind: z.literal(\"codex-subscription\"),\n      configId: identifier,\n      credentialVersion: common.credentialVersion,\n      reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n    })\n    .safeParse(value);\n  if (\n    !parsed.success ||\n    parsed.data.configId !== pinned.configId ||\n    parsed.data.credentialVersion !== pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return parsed.data;\n}\n\n/** Accept refreshed subscription credentials only within the existing config/account binding. */\nexport function parseCodexRefreshResult(\n  value: unknown,\n  pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n  now = Date.now(),\n): CodexSubscriptionRefreshResult {\n  const parsed = z\n    .discriminatedUnion(\"ok\", [\n      z.strictObject({ ok: z.literal(true), credential: subscription }),\n      z.strictObject({\n        ok: z.literal(false),\n        code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n        message: z.string(),\n      }),\n    ])\n    .safeParse(value);\n  if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n  if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n  const credential = parseCodexCredential(parsed.data.credential, now);\n  if (\n    credential.kind !== \"codex-subscription\" ||\n    credential.configId !== pinned.configId ||\n    credential.chatgptAccountId !== pinned.chatgptAccountId ||\n    credential.credentialVersion < pinned.credentialVersion\n  )\n    throw new Error(\"Invalid managed AI refresh binding\");\n  return { ok: true, credential };\n}\n\n/**\n * The AI provider registry a managed-codex session may carry (plan §2.2).\n *\n * Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot *also* be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n *\n * `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n *\n * An absent or empty registry is *not* a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n *\n * @returns the reason the registry is inadmissible, or `undefined` when it is.\n */\nexport function managedCodexRegistryViolation(\n  registry: AIProviderRegistry | MergedAIProviderRegistry | undefined,\n): string | undefined {\n  if (!registry) return undefined;\n  const entries = registryEntries(registry);\n  if (entries.length === 0) return undefined;\n  if (entries.length > 1)\n    return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n  const [id, entry] = entries[0];\n  if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n  if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n  const surface = (entry as AIProviderLlmEntry).surface;\n  if (surface !== \"openai-codex-responses\")\n    return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n  const credential = entry.credential;\n  if (credential?.kind !== \"oauth\")\n    return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n  const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n  if (!ref || ref.form !== \"platform\")\n    return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n  return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  renameSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n  const rel = relative(root, path);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n  if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n  const stat = lstatSync(path);\n  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > limit) throw invalid();\n  return readFileSync(path);\n}\n\n/** Session-owned state lock and account-bound native resume metadata; never stores credentials. */\nexport function prepareCodexInstance(\n  config: AgentConfig,\n  options: CodexManagedRuntimeOptions,\n  credential: CodexCredentialDelivery,\n) {\n  if (!isAbsolute(options.privateDirectory) || !isAbsolute(config.cwd) || !config.sessionId)\n    throw invalid();\n  directory(options.privateDirectory);\n  const root = realpathSync(options.privateDirectory);\n  const cwd = realpathSync(config.cwd);\n  if (within(root, cwd) || within(cwd, root)) throw invalid();\n  const lock = join(root, \".active\");\n  const leasePath = join(root, \"lease.db\");\n  if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n  const lease = openSqlite(leasePath);\n  try {\n    lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n    chmodSync(leasePath, 0o600);\n    // The OS releases the database lease on crashes; this marker never owns the lock.\n    rmSync(lock, { force: true });\n    writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n  } catch (error) {\n    lease.close();\n    throw error;\n  }\n  let released = false;\n  const release = () => {\n    if (released) return;\n    released = true;\n    try {\n      rmSync(lock, { force: true });\n    } finally {\n      lease.close();\n    }\n  };\n  try {\n    const key = createHash(\"sha256\")\n      .update(\n        JSON.stringify({\n          harness: \"codex-app-server-v1\",\n          session: config.sessionId,\n          config: credential.configId,\n          kind: credential.kind,\n          account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n        }),\n      )\n      .digest(\"hex\");\n    const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n    directory(slots);\n    const stateRoot = join(slots, key);\n    directory(stateRoot);\n    for (const name of [\"instructions.new\", \"binding.new\"])\n      rmSync(join(stateRoot, name), { force: true });\n    const bindingPath = join(stateRoot, \"binding.json\");\n    if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n    if (existsSync(bindingPath)) {\n      // Filesystem authority failures (including symlinks) are fatal, not missing state.\n      const bytes = readRegular(bindingPath, 4096);\n      if (config.resumeSessionId) {\n        let binding: unknown;\n        try {\n          binding = JSON.parse(bytes.toString(\"utf8\"));\n        } catch {\n          throw new CodexNativeStateUnavailable();\n        }\n        if (\n          !binding ||\n          typeof binding !== \"object\" ||\n          Array.isArray(binding) ||\n          Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" ||\n          (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT ||\n          (binding as Record<string, unknown>).key !== key ||\n          (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n        )\n          throw new CodexNativeStateUnavailable();\n      }\n    }\n    const home = join(stateRoot, \"home\");\n    if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n    directory(home);\n    for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n    // Auth persistence is forbidden even if a previous external process left a carrier here.\n    if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n      throw invalid();\n    const instructionFile = join(stateRoot, \"instructions.md\");\n    const instructions = [\n      ...(options.instructionFiles ?? []).map((path) =>\n        readRegular(path, 1024 * 1024).toString(\"utf8\"),\n      ),\n      ...(config.systemPrompt ? [config.systemPrompt] : []),\n    ].join(\"\\n\\n---\\n\\n\");\n    const temporary = join(stateRoot, \"instructions.new\");\n    writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n    renameSync(temporary, instructionFile);\n    const target = join(home, \"skills\");\n    if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n    if (options.skillsDirectory) {\n      const source = realpathSync(options.skillsDirectory);\n      if (within(target, source) || within(source, target)) throw invalid();\n      if (existsSync(target)) rmSync(target, { recursive: true });\n      let files = 0;\n      let entries = 0;\n      let bytes = 0;\n      const copy = (source: string, destination: string) => {\n        if (++entries > 1024) throw invalid();\n        if (lstatSync(source).isSymbolicLink()) throw invalid();\n        mkdirSync(destination, { mode: 0o700 });\n        for (const entry of readdirSync(source, { withFileTypes: true })) {\n          const src = join(source, entry.name);\n          const dst = join(destination, entry.name);\n          if (entry.isSymbolicLink()) throw invalid();\n          if (entry.isDirectory()) copy(src, dst);\n          else {\n            const content = readRegular(src, 1024 * 1024);\n            bytes += content.byteLength;\n            if (++files > 512 || bytes > 8 * 1024 * 1024) throw invalid();\n            writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n          }\n        }\n      };\n      copy(options.skillsDirectory, target);\n    }\n    const bindThread = (threadId: string) => {\n      if (!threadId || threadId.length > 4096) throw invalid();\n      const next = join(stateRoot, \"binding.new\");\n      writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n        mode: 0o600,\n        flag: \"wx\",\n      });\n      renameSync(next, bindingPath);\n    };\n    const setToolInstructions = (text: string) => {\n      writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n      renameSync(temporary, instructionFile);\n    };\n    return {\n      root,\n      stateRoot,\n      cwd,\n      home,\n      instructionFile,\n      bindThread,\n      release,\n      setToolInstructions,\n    };\n  } catch (error) {\n    release();\n    throw error;\n  }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. */\nexport function codexInstanceEnvironment(\n  input: Record<string, string>,\n  home: string,\n): Record<string, string> {\n  const allowed = new Set([\n    \"PATH\",\n    \"LANG\",\n    \"LC_ALL\",\n    \"TZ\",\n    \"SSL_CERT_FILE\",\n    \"SSL_CERT_DIR\",\n    \"HTTPS_PROXY\",\n    \"HTTP_PROXY\",\n    \"NO_PROXY\",\n  ]);\n  if (\n    !input ||\n    Object.entries(input).some(([key, value]) => !allowed.has(key) || typeof value !== \"string\")\n  )\n    throw invalid();\n  return {\n    ...input,\n    HOME: home,\n    CODEX_HOME: home,\n    XDG_CONFIG_HOME: join(home, \"config\"),\n    XDG_CACHE_HOME: join(home, \"cache\"),\n    XDG_DATA_HOME: join(home, \"data\"),\n    TMPDIR: join(home, \"tmp\"),\n  };\n}\n","import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n  value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n  const rel = relative(parent, child);\n  return rel === \"\" || (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n  [...path].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n  if (!isAbsolute(path) || hasControl(path)) throw invalid();\n  const stat = lstatSync(path);\n  if (!stat.isDirectory() || stat.isSymbolicLink()) throw invalid();\n  return realpathSync(path);\n};\n\n/** Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. */\nexport function prepareNativePolicy(input: {\n  cwd: string;\n  privateRoot: string;\n  privateDirectory: string;\n  sandboxMode: \"read-only\" | \"workspace-write\";\n}) {\n  const cwd = directory(input.cwd);\n  const privateRoot = directory(input.privateRoot);\n  const privateDirectory = directory(input.privateDirectory);\n  if (\n    within(cwd, privateRoot) ||\n    within(privateRoot, cwd) ||\n    !within(privateDirectory, privateRoot) ||\n    privateDirectory === privateRoot ||\n    (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n  )\n    throw invalid();\n  const stat = lstatSync(privateRoot);\n  if (stat.mode & 0o077 || (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n    throw invalid();\n  const filesystem = Object.freeze({\n    [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n    [privateRoot]: \"deny\",\n  });\n  const config = Object.freeze({\n    default_permissions: \"managed\",\n    features: Object.freeze({ use_legacy_landlock: false }),\n    permissions: Object.freeze({\n      managed: Object.freeze({\n        extends: \":read-only\",\n        filesystem,\n        network: Object.freeze({ enabled: false }),\n      }),\n    }),\n  });\n  // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n  const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n    .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n    .join(\", \")} }, network = { enabled = false } } }`;\n  const policy = Object.freeze({\n    config,\n    cliArgs: Object.freeze([\n      \"-c\",\n      'default_permissions=\"managed\"',\n      \"-c\",\n      \"features.use_legacy_landlock=false\",\n      \"-c\",\n      `permissions=${profile}`,\n    ]),\n  });\n  prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n  return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/** Confirms composition and native selection, not live OS isolation (G1/G2 remain required). */\nexport function activateNativeApprovalPolicy(\n  policy: PreparedNativePolicy,\n  response: unknown,\n  signal: AbortSignal,\n): NativeApprovalPolicy {\n  const binding = prepared.get(policy);\n  if (\n    !binding ||\n    signal.aborted ||\n    !record(response) ||\n    !record(response.thread) ||\n    typeof response.thread.id !== \"string\" ||\n    !response.thread.id ||\n    response.cwd !== binding.cwd ||\n    !record(response.activePermissionProfile) ||\n    response.activePermissionProfile.id !== \"managed\" ||\n    response.activePermissionProfile.extends !== \":read-only\"\n  )\n    throw invalid();\n  const token = Object.freeze({}) as NativeApprovalPolicy;\n  active.set(token, { ...binding, threadId: response.thread.id, signal });\n  return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n  policy: unknown,\n  threadId: string,\n): policy is NativeApprovalPolicy {\n  if (!record(policy)) return false;\n  const binding = active.get(policy);\n  return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/** Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n  policy: NativeApprovalPolicy | undefined,\n  path: string,\n  access: \"read\" | \"write\",\n): boolean {\n  if (!policy) return false;\n  const binding = active.get(policy);\n  if (\n    !binding ||\n    binding.signal.aborted ||\n    !isAbsolute(path) ||\n    hasControl(path) ||\n    (access !== \"read\" && access !== \"write\") ||\n    (access === \"write\" && !binding.writable)\n  )\n    return false;\n  try {\n    let existing = resolve(path);\n    const suffix: string[] = [];\n    while (true) {\n      try {\n        lstatSync(existing);\n        break;\n      } catch (error) {\n        if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" || dirname(existing) === existing)\n          return false;\n        suffix.unshift(existing.slice(dirname(existing).length + 1));\n        existing = dirname(existing);\n      }\n    }\n    const canonical = resolve(realpathSync(existing), ...suffix);\n    return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/{chunk-G44FFUMA.js → chunk-GZL6RN4Z.js}

@@ -1,8 +1,8 @@
-import { readManifestSourceConfig, discoverAssetsInTree, barePublisher, createDefaultKindRegistry, sharesItsFolder, SEMVER_RE, invalidSemverMessage, parseManifestFile } from './chunk-O5Y7VMVQ.js';
+import { readManifestSourceConfig, discoverAssetsInTree, barePublisher, createDefaultKindRegistry, sharesItsFolder, SEMVER_RE, invalidSemverMessage, parseManifestFile } from './chunk-5KWQMCH7.js';
 import { installFromManifest, assertSafeManifestPath } from './chunk-OSABUEWA.js';
-import { PresetManifestSchema } from './chunk-VT6G5AJV.js';
-import { defaultLibraryDir, resolveLibraryDir, GLOBAL_INSTALL_DIR_NAME, readLock, buildLibraryLockEntries, writeLock, mergeLockFile, buildLockFile, ManifestYamlEditor } from './chunk-TMJBEGS4.js';
-import { getGlobalCacheDir, storeManifestSlug, priorStoreManifestSlugs, resolveSourcePublisher } from './chunk-O7ADRMCR.js';
+import { PresetManifestSchema } from './chunk-WS3BOCAT.js';
+import { defaultLibraryDir, resolveLibraryDir, GLOBAL_INSTALL_DIR_NAME, readLock, buildLibraryLockEntries, writeLock, mergeLockFile, buildLockFile, ManifestYamlEditor } from './chunk-4KPQ6ILH.js';
+import { getGlobalCacheDir, storeManifestSlug, priorStoreManifestSlugs, resolveSourcePublisher } from './chunk-FZO64PLQ.js';
 import { userConfigPath, globalSkaileDir, mergeLegacyEntriesInto, migrateLegacyDir, globalCacheRoot } from './chunk-L5VSIPQD.js';
 import { encodeSkaileManifest, expandManifestFiles, SKAILE_MANIFEST_FILENAME, librarySymlinkMessage, loadSkPublishManifest } from './chunk-QC5BYUED.js';
 import { scanDirectory } from './chunk-GNUA7XT2.js';
@@ -3398,20 +3398,33 @@ var TarballHashMismatchError = class extends Error {
   actual;
 };
 var OfflineError = class extends Error {
-  constructor(message) {
-    super(`${message} (air-gapped mode; run \`skaile update\` to refresh the cache)`);
+  /**
+   * @param refreshable - `false` for what a refresh never caches (install manifests, digests):
+   *   the advice is then to turn the cache TTL on, not to run `skaile update --catalog-only`.
+   */
+  constructor(message, refreshable = true) {
+    super(
+      refreshable ? `${message} (air-gapped mode; run \`skaile update --catalog-only\` to refresh the cache)` : `${message} (air-gapped mode; the cache holds no install manifests: set catalog.cache_ttl above 0)`
+    );
     this.name = "OfflineError";
   }
 };
 var CatalogHttpError = class extends Error {
-  constructor(message, status, url) {
+  /**
+   * @param notCatalog - The host answered, but not as a catalog does (a 404 whose body is not a
+   *   JSON document: a web server that does not know the route). A catalog that has no such
+   *   asset answers 404 with a JSON error body.
+   */
+  constructor(message, status, url, notCatalog = false) {
     super(message);
     this.status = status;
     this.url = url;
+    this.notCatalog = notCatalog;
     this.name = "CatalogHttpError";
   }
   status;
   url;
+  notCatalog;
 };
 function describeCatalogError(err, baseUrl) {
   if (err instanceof OfflineError) return err.message;
@@ -3420,7 +3433,8 @@ function describeCatalogError(err, baseUrl) {
   }
   const e = err;
   if (e?.name === "TimeoutError" || e?.name === "AbortError") {
-    return `no answer from ${baseUrl} within ${CATALOG_REQUEST_TIMEOUT_MS / 1e3} s`;
+    const timeoutMs = e.timeoutMs ?? CATALOG_REQUEST_TIMEOUT_MS;
+    return `no answer from ${baseUrl} within ${timeoutMs / 1e3} s`;
   }
   const cause = e?.cause;
   const why = cause?.code ?? cause?.message ?? e?.message ?? String(err);
@@ -3712,7 +3726,7 @@ var RemoteCatalogSource = class {
    */
   async getInstallManifest(ref) {
     if (this.cache.airGapped) {
-      throw new OfflineError(`Install manifest of '${ref}' is not cached`);
+      throw new OfflineError(`Install manifest of '${ref}' is not cached`, false);
     }
     const url = trpcGetUrl(this.baseUrl, "catalog.getInstallManifest", { ref });
     const res = await this.httpClient(url, {
@@ -3723,7 +3737,8 @@ var RemoteCatalogSource = class {
       throw new CatalogHttpError(
         `catalog.getInstallManifest ${ref} failed: ${res.status} ${res.statusText}`,
         res.status,
-        url
+        url,
+        res.status === 404 && !await isJsonDocument(res)
       );
     }
     const data = await parseTrpcGet(res);
@@ -3752,7 +3767,7 @@ var RemoteCatalogSource = class {
    */
   async getCanonicalDigest(ref) {
     if (this.cache.airGapped) {
-      throw new OfflineError(`Canonical digest of '${ref}' is not cached`);
+      throw new OfflineError(`Canonical digest of '${ref}' is not cached`, false);
     }
     const url = trpcGetUrl(this.baseUrl, "catalog.getCanonicalDigest", { ref });
     const res = await this.httpClient(url, {
@@ -3985,6 +4000,14 @@ function pickString(r, key) {
   return typeof v === "string" ? v : void 0;
 }
 var CATALOG_REQUEST_TIMEOUT_MS = 1e4;
+async function isJsonDocument(res) {
+  try {
+    const body = JSON.parse(await res.text());
+    return typeof body === "object" && body !== null;
+  } catch {
+    return false;
+  }
+}
 var defaultFetch = async (url, init) => {
   if (typeof fetch === "undefined") {
     throw new Error("global fetch is not available; pass an httpClient explicitly");
@@ -3995,6 +4018,61 @@ var defaultFetch = async (url, init) => {
     signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS)
   });
 };
+var STORE_PROBE_TIMEOUT_MS = 5e3;
+var STORE_FAILURE_MEMO_MS = 3e4;
+var StoreProbe = class {
+  stores = /* @__PURE__ */ new Map();
+  /** A `fetch` for the catalog at `baseUrl` that shares this probe's verdict. */
+  httpClient(baseUrl, fetchImpl = defaultFetch) {
+    const key = baseUrl.replace(/\/+$/, "");
+    return async (url, init) => {
+      let state = this.stores.get(key);
+      if (!state) {
+        state = { answered: false };
+        this.stores.set(key, state);
+      }
+      if (state.pending) await state.pending;
+      if (state.failure && Date.now() - (state.failedAt ?? 0) < STORE_FAILURE_MEMO_MS) {
+        throw state.failure;
+      }
+      if (state.answered) return fetchImpl(url, init);
+      let settle;
+      state.pending = new Promise((resolve6) => {
+        settle = resolve6;
+      });
+      state.failure = void 0;
+      try {
+        const res = await fetchImpl(url, {
+          ...init,
+          signal: init?.signal ?? AbortSignal.timeout(STORE_PROBE_TIMEOUT_MS)
+        });
+        state.answered = true;
+        return res;
+      } catch (err) {
+        if (init?.signal?.aborted) throw err;
+        state.failure = init?.signal ? asError(err) : describeProbeFailure(err);
+        state.failedAt = Date.now();
+        throw state.failure;
+      } finally {
+        state.pending = void 0;
+        settle();
+      }
+    };
+  }
+};
+function describeProbeFailure(err) {
+  const e = err;
+  if (e?.name === "TimeoutError" || e?.name === "AbortError") {
+    return Object.assign(new Error(`no answer within ${STORE_PROBE_TIMEOUT_MS / 1e3} s`), {
+      name: "TimeoutError",
+      timeoutMs: STORE_PROBE_TIMEOUT_MS
+    });
+  }
+  return asError(err);
+}
+function asError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
 
 // library/src/remote/rest-catalog-source.ts
 var DEFAULT_TTL_MS2 = 864e5;
@@ -5003,6 +5081,6 @@ function detectWorkspaceVersion(dir, filename = "skaile.yaml") {
   return raw.version === 2 ? 2 : 1;
 }
 
-export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, TarballHashMismatchError, UNLISTED_SCAN_SKIP_DIRS, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, assertManifestEditable, assertValidLibraryName, assetRootProblem, classifyRef, cloneOrInitGitRepo, commitStoreManifest, conflictingAssetRoot, createEmptyLockFile, curatedManifestOverlay, deriveSlug, describeCatalogError, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, ensureGitRepo, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filesEntryPaths, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, installLibraryAsset, interpolate, isGitRepo, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, lastLibraryName, libraryDirMissing, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, markLibraryUnregistered, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, missingLibraryDirMessage, missingRootAssets, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, pruneMissingRootAssets, queryInstancePickerChoices, recordLibraryRename, renamedLibraryName, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, scanAuthoringLibraries, scanLibraryRoot, scanUnlistedAssets, setManifestPublisher, setOriginUrl, sha256Hex, stampManifestPublisher, storeManifestFile, storeSecrets, syncManifestWithDisk, trackOriginBranch, trpcGetUrl, unparsableAssetFiles, unregisteredLibraryNames, upsertManifestAsset, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeCuratedManifest };
-//# sourceMappingURL=chunk-G44FFUMA.js.map
-//# sourceMappingURL=chunk-G44FFUMA.js.map
+export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, STORE_PROBE_TIMEOUT_MS, SidecarGit, SkaileConfigSchema, SourceNotFoundError, StoreProbe, TarballHashMismatchError, UNLISTED_SCAN_SKIP_DIRS, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, assertManifestEditable, assertValidLibraryName, assetRootProblem, classifyRef, cloneOrInitGitRepo, commitStoreManifest, conflictingAssetRoot, createEmptyLockFile, curatedManifestOverlay, deriveSlug, describeCatalogError, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, ensureGitRepo, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filesEntryPaths, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, installLibraryAsset, interpolate, isGitRepo, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, lastLibraryName, libraryDirMissing, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, markLibraryUnregistered, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, missingLibraryDirMessage, missingRootAssets, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, pruneMissingRootAssets, queryInstancePickerChoices, recordLibraryRename, renamedLibraryName, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, scanAuthoringLibraries, scanLibraryRoot, scanUnlistedAssets, setManifestPublisher, setOriginUrl, sha256Hex, stampManifestPublisher, storeManifestFile, storeSecrets, syncManifestWithDisk, trackOriginBranch, trpcGetUrl, unparsableAssetFiles, unregisteredLibraryNames, upsertManifestAsset, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeCuratedManifest };
+//# sourceMappingURL=chunk-GZL6RN4Z.js.map
+//# sourceMappingURL=chunk-GZL6RN4Z.js.map