npm - @skaile/workspaces - Versions diffs - 6.8.1 → 6.9.1 - Mend

@skaile/workspaces 6.8.1 → 6.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (319) hide show

package/dist/{chunk-CMXDFTA2.js.map → chunk-GYPPVANR.js.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts","../bridge/src/codex/native-policy.ts"],"names":["source","invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync"],"mappings":";;;;;;;;AAcA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAC,UAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAAS,UAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAM,OAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAM,OAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAAC,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,SAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAI,MAAA,CAAO,MAAM,GAAG,CAAA,IAAK,OAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAM,OAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAAC,SAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAM,OAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,OAAA,EAAS,qBAAA;AAAA,QACT,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAA,SAAA,CAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAA,SAAA,CAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAG,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAM,OAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,IAAK,OAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAM,OAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACA,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAM,OAAA,EAAQ;AACpC,QAAA,IAAI,UAAUA,OAAM,CAAA,CAAE,cAAA,EAAe,QAAS,OAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYA,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAM,OAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAY,OAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAY,OAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF;ACvNA,IAAMC,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAMC,OAAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAACC,UAAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAMC,UAAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAACD,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAASH,QAAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAASL,QAAAA,EAAQ;AAChE,EAAA,OAAOM,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAMF,UAAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAcA,UAAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmBA,UAAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACEH,QAAO,GAAA,EAAK,WAAW,KACvBA,OAAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAACA,QAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAMD,QAAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAOK,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAML,QAAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAACG,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAAE,UAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQC,YAAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAOL,OAAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAACA,OAAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"chunk-CMXDFTA2.js","sourcesContent":["import {\n type AIProviderLlmEntry,\n type AIProviderRegistry,\n isEntryEnabled,\n type MergedAIProviderRegistry,\n parseCredentialRef,\n registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n CodexCredentialDelivery,\n CodexSubscriptionRefreshInput,\n CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n configId: identifier,\n credentialVersion: z.number().int().nonnegative().safe(),\n mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n ...common,\n kind: z.literal(\"codex-subscription\"),\n accessToken: z.string().min(1).max(65536),\n chatgptAccountId: identifier,\n chatgptPlanType: identifier.optional(),\n expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n subscription,\n z.strictObject({\n ...common,\n kind: z.literal(\"openai-api-key\"),\n apiKey: z.string().min(1).max(65536),\n }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. /\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n const parsed = delivery.safeParse(value);\n if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n const credential = parsed.data;\n const mintedAt = Date.parse(credential.mintedAt);\n // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n if (\n mintedAt > now + 60_000 \|\|\n (credential.kind === \"codex-subscription\" &&\n (Date.parse(credential.expiresAt) <= now \|\| Date.parse(credential.expiresAt) <= mintedAt))\n )\n throw new Error(\"Invalid managed AI credential timestamps\");\n return credential;\n}\n\n/* Validate runtime-only refresh input against the authenticated session's pinned delivery. /\nexport function parseCodexRefreshInput(\n value: unknown,\n pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n const parsed = z\n .strictObject({\n kind: z.literal(\"codex-subscription\"),\n configId: identifier,\n credentialVersion: common.credentialVersion,\n reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n })\n .safeParse(value);\n if (\n !parsed.success \|\|\n parsed.data.configId !== pinned.configId \|\|\n parsed.data.credentialVersion !== pinned.credentialVersion\n )\n throw new Error(\"Invalid managed AI refresh binding\");\n return parsed.data;\n}\n\n/* Accept refreshed subscription credentials only within the existing config/account binding. /\nexport function parseCodexRefreshResult(\n value: unknown,\n pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n now = Date.now(),\n): CodexSubscriptionRefreshResult {\n const parsed = z\n .discriminatedUnion(\"ok\", [\n z.strictObject({ ok: z.literal(true), credential: subscription }),\n z.strictObject({\n ok: z.literal(false),\n code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n message: z.string(),\n }),\n ])\n .safeParse(value);\n if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n const credential = parseCodexCredential(parsed.data.credential, now);\n if (\n credential.kind !== \"codex-subscription\" \|\|\n credential.configId !== pinned.configId \|\|\n credential.chatgptAccountId !== pinned.chatgptAccountId \|\|\n credential.credentialVersion < pinned.credentialVersion\n )\n throw new Error(\"Invalid managed AI refresh binding\");\n return { ok: true, credential };\n}\n\n/\n The AI provider registry a managed-codex session may carry (plan §2.2).\n \n Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot also be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n \n `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n \n An absent or empty registry is not a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n \n @returns the reason the registry is inadmissible, or `undefined` when it is.\n /\nexport function managedCodexRegistryViolation(\n registry: AIProviderRegistry \| MergedAIProviderRegistry \| undefined,\n): string \| undefined {\n if (!registry) return undefined;\n const entries = registryEntries(registry);\n if (entries.length === 0) return undefined;\n if (entries.length > 1)\n return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n const [id, entry] = entries[0];\n if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n const surface = (entry as AIProviderLlmEntry).surface;\n if (surface !== \"openai-codex-responses\")\n return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n const credential = entry.credential;\n if (credential?.kind !== \"oauth\")\n return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n if (!ref \|\| ref.form !== \"platform\")\n return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n chmodSync,\n existsSync,\n lstatSync,\n mkdirSync,\n readFileSync,\n readdirSync,\n realpathSync,\n renameSync,\n rmSync,\n writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n const rel = relative(root, path);\n return rel === \"\" \|\| (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n const stat = lstatSync(path);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink() \|\| stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n const stat = lstatSync(path);\n if (!stat.isFile() \|\| stat.isSymbolicLink() \|\| stat.size > limit) throw invalid();\n return readFileSync(path);\n}\n\n/* Session-owned state lock and account-bound native resume metadata; never stores credentials. /\nexport function prepareCodexInstance(\n config: AgentConfig,\n options: CodexManagedRuntimeOptions,\n credential: CodexCredentialDelivery,\n) {\n if (!isAbsolute(options.privateDirectory) \|\| !isAbsolute(config.cwd) \|\| !config.sessionId)\n throw invalid();\n directory(options.privateDirectory);\n const root = realpathSync(options.privateDirectory);\n const cwd = realpathSync(config.cwd);\n if (within(root, cwd) \|\| within(cwd, root)) throw invalid();\n const lock = join(root, \".active\");\n const leasePath = join(root, \"lease.db\");\n if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n const lease = openSqlite(leasePath);\n try {\n lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n chmodSync(leasePath, 0o600);\n // The OS releases the database lease on crashes; this marker never owns the lock.\n rmSync(lock, { force: true });\n writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n } catch (error) {\n lease.close();\n throw error;\n }\n let released = false;\n const release = () => {\n if (released) return;\n released = true;\n try {\n rmSync(lock, { force: true });\n } finally {\n lease.close();\n }\n };\n try {\n const key = createHash(\"sha256\")\n .update(\n JSON.stringify({\n harness: \"codex-app-server-v1\",\n session: config.sessionId,\n config: credential.configId,\n kind: credential.kind,\n account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n }),\n )\n .digest(\"hex\");\n const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n directory(slots);\n const stateRoot = join(slots, key);\n directory(stateRoot);\n for (const name of [\"instructions.new\", \"binding.new\"])\n rmSync(join(stateRoot, name), { force: true });\n const bindingPath = join(stateRoot, \"binding.json\");\n if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n if (existsSync(bindingPath)) {\n // Filesystem authority failures (including symlinks) are fatal, not missing state.\n const bytes = readRegular(bindingPath, 4096);\n if (config.resumeSessionId) {\n let binding: unknown;\n try {\n binding = JSON.parse(bytes.toString(\"utf8\"));\n } catch {\n throw new CodexNativeStateUnavailable();\n }\n if (\n !binding \|\|\n typeof binding !== \"object\" \|\|\n Array.isArray(binding) \|\|\n Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" \|\|\n (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT \|\|\n (binding as Record<string, unknown>).key !== key \|\|\n (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n )\n throw new CodexNativeStateUnavailable();\n }\n }\n const home = join(stateRoot, \"home\");\n if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n directory(home);\n for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n // Auth persistence is forbidden even if a previous external process left a carrier here.\n if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n throw invalid();\n const instructionFile = join(stateRoot, \"instructions.md\");\n const instructions = [\n ...(options.instructionFiles ?? []).map((path) =>\n readRegular(path, 1024 1024).toString(\"utf8\"),\n ),\n ...(config.systemPrompt ? [config.systemPrompt] : []),\n ].join(\"\\n\\n---\\n\\n\");\n const temporary = join(stateRoot, \"instructions.new\");\n writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n renameSync(temporary, instructionFile);\n const target = join(home, \"skills\");\n if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n if (options.skillsDirectory) {\n const source = realpathSync(options.skillsDirectory);\n if (within(target, source) \|\| within(source, target)) throw invalid();\n if (existsSync(target)) rmSync(target, { recursive: true });\n let files = 0;\n let entries = 0;\n let bytes = 0;\n const copy = (source: string, destination: string) => {\n if (++entries > 1024) throw invalid();\n if (lstatSync(source).isSymbolicLink()) throw invalid();\n mkdirSync(destination, { mode: 0o700 });\n for (const entry of readdirSync(source, { withFileTypes: true })) {\n const src = join(source, entry.name);\n const dst = join(destination, entry.name);\n if (entry.isSymbolicLink()) throw invalid();\n if (entry.isDirectory()) copy(src, dst);\n else {\n const content = readRegular(src, 1024 * 1024);\n bytes += content.byteLength;\n if (++files > 512 \|\| bytes > 8 * 1024 * 1024) throw invalid();\n writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n }\n }\n };\n copy(options.skillsDirectory, target);\n }\n const bindThread = (threadId: string) => {\n if (!threadId \|\| threadId.length > 4096) throw invalid();\n const next = join(stateRoot, \"binding.new\");\n writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n mode: 0o600,\n flag: \"wx\",\n });\n renameSync(next, bindingPath);\n };\n const setToolInstructions = (text: string) => {\n writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n renameSync(temporary, instructionFile);\n };\n return {\n root,\n stateRoot,\n cwd,\n home,\n instructionFile,\n bindThread,\n release,\n setToolInstructions,\n };\n } catch (error) {\n release();\n throw error;\n }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. /\nexport function codexInstanceEnvironment(\n input: Record<string, string>,\n home: string,\n): Record<string, string> {\n const allowed = new Set([\n \"PATH\",\n \"LANG\",\n \"LC_ALL\",\n \"TZ\",\n \"SSL_CERT_FILE\",\n \"SSL_CERT_DIR\",\n \"HTTPS_PROXY\",\n \"HTTP_PROXY\",\n \"NO_PROXY\",\n ]);\n if (\n !input \|\|\n Object.entries(input).some(([key, value]) => !allowed.has(key) \|\| typeof value !== \"string\")\n )\n throw invalid();\n return {\n ...input,\n HOME: home,\n CODEX_HOME: home,\n XDG_CONFIG_HOME: join(home, \"config\"),\n XDG_CACHE_HOME: join(home, \"cache\"),\n XDG_DATA_HOME: join(home, \"data\"),\n TMPDIR: join(home, \"tmp\"),\n };\n}\n","import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n const rel = relative(parent, child);\n return rel === \"\" \|\| (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n [...path].some((character) => character.charCodeAt(0) < 32 \|\| character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n if (!isAbsolute(path) \|\| hasControl(path)) throw invalid();\n const stat = lstatSync(path);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink()) throw invalid();\n return realpathSync(path);\n};\n\n/* Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. /\nexport function prepareNativePolicy(input: {\n cwd: string;\n privateRoot: string;\n privateDirectory: string;\n sandboxMode: \"read-only\" \| \"workspace-write\";\n}) {\n const cwd = directory(input.cwd);\n const privateRoot = directory(input.privateRoot);\n const privateDirectory = directory(input.privateDirectory);\n if (\n within(cwd, privateRoot) \|\|\n within(privateRoot, cwd) \|\|\n !within(privateDirectory, privateRoot) \|\|\n privateDirectory === privateRoot \|\|\n (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n )\n throw invalid();\n const stat = lstatSync(privateRoot);\n if (stat.mode & 0o077 \|\| (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n throw invalid();\n const filesystem = Object.freeze({\n [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n [privateRoot]: \"deny\",\n });\n const config = Object.freeze({\n default_permissions: \"managed\",\n features: Object.freeze({ use_legacy_landlock: false }),\n permissions: Object.freeze({\n managed: Object.freeze({\n extends: \":read-only\",\n filesystem,\n network: Object.freeze({ enabled: false }),\n }),\n }),\n });\n // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n .join(\", \")} }, network = { enabled = false } } }`;\n const policy = Object.freeze({\n config,\n cliArgs: Object.freeze([\n \"-c\",\n 'default_permissions=\"managed\"',\n \"-c\",\n \"features.use_legacy_landlock=false\",\n \"-c\",\n `permissions=${profile}`,\n ]),\n });\n prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/* Confirms composition and native selection, not live OS isolation (G1/G2 remain required). /\nexport function activateNativeApprovalPolicy(\n policy: PreparedNativePolicy,\n response: unknown,\n signal: AbortSignal,\n): NativeApprovalPolicy {\n const binding = prepared.get(policy);\n if (\n !binding \|\|\n signal.aborted \|\|\n !record(response) \|\|\n !record(response.thread) \|\|\n typeof response.thread.id !== \"string\" \|\|\n !response.thread.id \|\|\n response.cwd !== binding.cwd \|\|\n !record(response.activePermissionProfile) \|\|\n response.activePermissionProfile.id !== \"managed\" \|\|\n response.activePermissionProfile.extends !== \":read-only\"\n )\n throw invalid();\n const token = Object.freeze({}) as NativeApprovalPolicy;\n active.set(token, { ...binding, threadId: response.thread.id, signal });\n return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n policy: unknown,\n threadId: string,\n): policy is NativeApprovalPolicy {\n if (!record(policy)) return false;\n const binding = active.get(policy);\n return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/* Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n policy: NativeApprovalPolicy \| undefined,\n path: string,\n access: \"read\" \| \"write\",\n): boolean {\n if (!policy) return false;\n const binding = active.get(policy);\n if (\n !binding \|\|\n binding.signal.aborted \|\|\n !isAbsolute(path) \|\|\n hasControl(path) \|\|\n (access !== \"read\" && access !== \"write\") \|\|\n (access === \"write\" && !binding.writable)\n )\n return false;\n try {\n let existing = resolve(path);\n const suffix: string[] = [];\n while (true) {\n try {\n lstatSync(existing);\n break;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" \|\| dirname(existing) === existing)\n return false;\n suffix.unshift(existing.slice(dirname(existing).length + 1));\n existing = dirname(existing);\n }\n }\n const canonical = resolve(realpathSync(existing), ...suffix);\n return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n } catch {\n return false;\n }\n}\n"]}
1	+ {"version":3,"sources":["../bridge/src/codex/credentials.ts","../bridge/src/codex/instance-state.ts","../bridge/src/codex/native-policy.ts"],"names":["source","invalid","within","relative","isAbsolute","directory","lstatSync","realpathSync"],"mappings":";;;;;;;;AAcA,IAAM,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,IAAI,CAAA;AAC7C,IAAM,YAAc,CAAA,CAAA,GAAA,CAAI,QAAA,CAAS,EAAE,MAAA,EAAQ,MAAM,CAAA;AACjD,IAAM,MAAA,GAAS;AAAA,EACb,QAAA,EAAU,UAAA;AAAA,EACV,mBAAqB,CAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,WAAA,GAAc,IAAA,EAAK;AAAA,EACvD,QAAA,EAAU;AACZ,CAAA;AACA,IAAM,eAAiB,CAAA,CAAA,YAAA,CAAa;AAAA,EAClC,GAAG,MAAA;AAAA,EACH,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,EACpC,aAAe,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA;AAAA,EACxC,gBAAA,EAAkB,UAAA;AAAA,EAClB,eAAA,EAAiB,WAAW,QAAA,EAAS;AAAA,EACrC,SAAA,EAAW;AACb,CAAC,CAAA;AACD,IAAM,QAAA,GAAa,qBAAmB,MAAA,EAAQ;AAAA,EAC5C,YAAA;AAAA,EACE,CAAA,CAAA,YAAA,CAAa;AAAA,IACb,GAAG,MAAA;AAAA,IACH,IAAA,EAAQ,UAAQ,gBAAgB,CAAA;AAAA,IAChC,QAAU,CAAA,CAAA,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,KAAK;AAAA,GACpC;AACH,CAAC,CAAA;AAGM,SAAS,oBAAA,CAAqB,KAAA,EAAgB,GAAA,GAAM,IAAA,CAAK,KAAI,EAA4B;AAC9F,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,SAAA,CAAU,KAAK,CAAA;AACvC,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,+BAA+B,CAAA;AACpE,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,QAAQ,CAAA;AAE/C,EAAA,IACE,WAAW,GAAA,GAAM,GAAA,IAChB,UAAA,CAAW,IAAA,KAAS,yBAClB,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,KAAK,GAAA,IAAO,IAAA,CAAK,KAAA,CAAM,UAAA,CAAW,SAAS,CAAA,IAAK,QAAA,CAAA;AAElF,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAC5D,EAAA,OAAO,UAAA;AACT;AAGO,SAAS,sBAAA,CACd,OACA,MAAA,EAC+B;AAC/B,EAAA,MAAM,SACH,CAAA,CAAA,YAAA,CAAa;AAAA,IACZ,IAAA,EAAQ,UAAQ,oBAAoB,CAAA;AAAA,IACpC,QAAA,EAAU,UAAA;AAAA,IACV,mBAAmB,MAAA,CAAO,iBAAA;AAAA,IAC1B,QAAU,CAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,SAAA,EAAW,WAAW,CAAC;AAAA,GACnD,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IACE,CAAC,MAAA,CAAO,OAAA,IACR,MAAA,CAAO,IAAA,CAAK,QAAA,KAAa,MAAA,CAAO,QAAA,IAChC,MAAA,CAAO,IAAA,CAAK,iBAAA,KAAsB,MAAA,CAAO,iBAAA;AAEzC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,MAAA,CAAO,IAAA;AAChB;AAGO,SAAS,wBACd,KAAA,EACA,MAAA,EACA,GAAA,GAAM,IAAA,CAAK,KAAI,EACiB;AAChC,EAAA,MAAM,MAAA,GACH,qBAAmB,IAAA,EAAM;AAAA,IACtB,CAAA,CAAA,YAAA,CAAa,EAAE,EAAA,EAAM,CAAA,CAAA,OAAA,CAAQ,IAAI,CAAA,EAAG,UAAA,EAAY,cAAc,CAAA;AAAA,IAC9D,CAAA,CAAA,YAAA,CAAa;AAAA,MACb,EAAA,EAAM,UAAQ,KAAK,CAAA;AAAA,MACnB,MAAQ,CAAA,CAAA,IAAA,CAAK,CAAC,kBAAkB,SAAA,EAAW,gBAAA,EAAkB,eAAe,CAAC,CAAA;AAAA,MAC7E,SAAW,CAAA,CAAA,MAAA;AAAO,KACnB;AAAA,GACF,CAAA,CACA,SAAA,CAAU,KAAK,CAAA;AAClB,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,EAAS,MAAM,IAAI,MAAM,mCAAmC,CAAA;AACxE,EAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,OAAO,EAAE,GAAG,MAAA,CAAO,IAAA,EAAM,OAAA,EAAS,qCAAA,EAAsC;AAC7F,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,MAAA,CAAO,IAAA,CAAK,YAAY,GAAG,CAAA;AACnE,EAAA,IACE,UAAA,CAAW,IAAA,KAAS,oBAAA,IACpB,UAAA,CAAW,QAAA,KAAa,MAAA,CAAO,QAAA,IAC/B,UAAA,CAAW,gBAAA,KAAqB,MAAA,CAAO,gBAAA,IACvC,UAAA,CAAW,oBAAoB,MAAA,CAAO,iBAAA;AAEtC,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AACtD,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,UAAA,EAAW;AAChC;AA0BO,SAAS,8BACd,QAAA,EACoB;AACpB,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA;AACtB,EAAA,MAAM,OAAA,GAAU,gBAAgB,QAAQ,CAAA;AACxC,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AACjC,EAAA,IAAI,QAAQ,MAAA,GAAS,CAAA;AACnB,IAAA,OAAO,CAAA,iBAAA,EAAoB,QAAQ,MAAM,CAAA,0CAAA,CAAA;AAC3C,EAAA,MAAM,CAAC,EAAA,EAAI,KAAK,CAAA,GAAI,QAAQ,CAAC,CAAA;AAC7B,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG,OAAO,UAAU,EAAE,CAAA,aAAA,CAAA;AAC/C,EAAA,IAAI,KAAA,CAAM,SAAS,KAAA,EAAO,OAAO,UAAU,EAAE,CAAA,QAAA,EAAW,MAAM,IAAI,CAAA,0BAAA,CAAA;AAClE,EAAA,MAAM,UAAW,KAAA,CAA6B,OAAA;AAC9C,EAAA,IAAI,OAAA,KAAY,wBAAA;AACd,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,oBAAA,EAAuB,OAAA,IAAW,MAAM,CAAA,mDAAA,CAAA;AAC7D,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA;AACzB,EAAA,IAAI,YAAY,IAAA,KAAS,OAAA;AACvB,IAAA,OAAO,CAAA,OAAA,EAAU,EAAE,CAAA,aAAA,EAAgB,UAAA,EAAY,QAAQ,MAAM,CAAA,4EAAA,CAAA;AAC/D,EAAA,MAAM,MAAM,UAAA,CAAW,GAAA,GAAM,kBAAA,CAAmB,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA;AAClE,EAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,IAAA,KAAS,UAAA;AACvB,IAAA,OAAO,UAAU,EAAE,CAAA,sGAAA,CAAA;AACrB,EAAA,OAAO,MAAA;AACT;AClIA,IAAM,OAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,IAAA,EAAc,IAAA,KAAiB;AAC7C,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,EAAM,IAAI,CAAA;AAC/B,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAC,UAAA,CAAW,GAAG,CAAA;AAChE,CAAA;AACA,SAAS,UAAU,IAAA,EAAoB;AACrC,EAAA,IAAI,CAAC,WAAW,IAAI,CAAA,YAAa,IAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,WAAA,EAAY,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,EAAA,EAAO,MAAM,OAAA,EAAQ;AACvF;AACA,SAAS,WAAA,CAAY,MAAc,KAAA,EAAuB;AACxD,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAA,CAAK,MAAA,EAAO,IAAK,IAAA,CAAK,cAAA,EAAe,IAAK,IAAA,CAAK,IAAA,GAAO,KAAA,EAAO,MAAM,OAAA,EAAQ;AAChF,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;AAGO,SAAS,oBAAA,CACd,MAAA,EACA,OAAA,EACA,UAAA,EACA;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,OAAA,CAAQ,gBAAgB,CAAA,IAAK,CAAC,UAAA,CAAW,MAAA,CAAO,GAAG,CAAA,IAAK,CAAC,MAAA,CAAO,SAAA;AAC9E,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,SAAA,CAAU,QAAQ,gBAAgB,CAAA;AAClC,EAAA,MAAM,IAAA,GAAO,YAAA,CAAa,OAAA,CAAQ,gBAAgB,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA;AACnC,EAAA,IAAI,MAAA,CAAO,MAAM,GAAG,CAAA,IAAK,OAAO,GAAA,EAAK,IAAI,CAAA,EAAG,MAAM,OAAA,EAAQ;AAC1D,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,EAAM,SAAS,CAAA;AACjC,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,IAAA,EAAM,UAAU,CAAA;AACvC,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,IAAK,CAAC,SAAA,CAAU,SAAS,CAAA,CAAE,MAAA,EAAO,EAAG,MAAM,OAAA,EAAQ;AAC3E,EAAA,MAAM,KAAA,GAAQ,WAAW,SAAS,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,KAAA,CAAM,KAAK,wCAAwC,CAAA;AACnD,IAAA,SAAA,CAAU,WAAW,GAAK,CAAA;AAE1B,IAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC5B,IAAA,aAAA,CAAc,MAAM,QAAA,EAAU,EAAE,MAAM,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAAA,EAC3D,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,EAAM;AACZ,IAAA,MAAM,KAAA;AAAA,EACR;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,MAAM,UAAU,MAAM;AACpB,IAAA,IAAI,QAAA,EAAU;AACd,IAAA,QAAA,GAAW,IAAA;AACX,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,EAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC9B,CAAA,SAAE;AACA,MAAA,KAAA,CAAM,KAAA,EAAM;AAAA,IACd;AAAA,EACF,CAAA;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,QAAQ,CAAA,CAC5B,MAAA;AAAA,MACC,KAAK,SAAA,CAAU;AAAA,QACb,OAAA,EAAS,qBAAA;AAAA,QACT,SAAS,MAAA,CAAO,SAAA;AAAA,QAChB,QAAQ,UAAA,CAAW,QAAA;AAAA,QACnB,MAAM,UAAA,CAAW,IAAA;AAAA,QACjB,OAAA,EAAS,UAAA,CAAW,IAAA,KAAS,oBAAA,GAAuB,WAAW,gBAAA,GAAmB;AAAA,OACnF;AAAA,KACH,CACC,OAAO,KAAK,CAAA;AACf,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,EAAM,yBAAyB,CAAA;AAClD,IAAA,SAAA,CAAU,KAAK,CAAA;AACf,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,GAAG,CAAA;AACjC,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,kBAAA,EAAoB,aAAa,CAAA;AACnD,MAAA,MAAA,CAAO,KAAK,SAAA,EAAW,IAAI,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,EAAW,cAAc,CAAA;AAClD,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AAC9F,IAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAE3B,MAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,WAAA,EAAa,IAAI,CAAA;AAC3C,MAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,QAAA,IAAI,OAAA;AACJ,QAAA,IAAI;AACF,UAAA,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,QAAA,CAAS,MAAM,CAAC,CAAA;AAAA,QAC7C,CAAA,CAAA,MAAQ;AACN,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,QACxC;AACA,QAAA,IACE,CAAC,OAAA,IACD,OAAO,OAAA,KAAY,QAAA,IACnB,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,IACrB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA,KAAM,qBAAA,IACzC,OAAA,CAAoC,MAAA,KAAW,yBAAA,IAC/C,OAAA,CAAoC,GAAA,KAAQ,GAAA,IAC5C,OAAA,CAAoC,QAAA,KAAa,MAAA,CAAO,eAAA;AAEzD,UAAA,MAAM,IAAI,2BAAA,EAA4B;AAAA,MAC1C;AAAA,IACF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,MAAM,CAAA;AACnC,IAAA,IAAI,MAAA,CAAO,mBAAmB,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG,MAAM,IAAI,2BAAA,EAA4B;AACvF,IAAA,SAAA,CAAU,IAAI,CAAA;AACd,IAAA,KAAA,MAAW,MAAA,IAAU,CAAC,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,EAAG,SAAA,CAAU,IAAA,CAAK,IAAA,EAAM,MAAM,CAAC,CAAA;AAErF,IAAA,IAAI,CAAC,WAAA,EAAa,mBAAmB,CAAA,CAAE,IAAA,CAAK,CAAC,IAAA,KAAS,UAAA,CAAW,IAAA,CAAK,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAChF,MAAA,MAAM,OAAA,EAAQ;AAChB,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,SAAA,EAAW,iBAAiB,CAAA;AACzD,IAAA,MAAM,YAAA,GAAe;AAAA,MACnB,GAAA,CAAI,OAAA,CAAQ,gBAAA,IAAoB,EAAC,EAAG,GAAA;AAAA,QAAI,CAAC,SACvC,WAAA,CAAY,IAAA,EAAM,OAAO,IAAI,CAAA,CAAE,SAAS,MAAM;AAAA,OAChD;AAAA,MACA,GAAI,MAAA,CAAO,YAAA,GAAe,CAAC,MAAA,CAAO,YAAY,IAAI;AAAC,KACrD,CAAE,KAAK,aAAa,CAAA;AACpB,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,SAAA,EAAW,kBAAkB,CAAA;AACpD,IAAA,aAAA,CAAc,WAAW,YAAA,EAAc,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClE,IAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAClC,IAAA,IAAI,CAAC,OAAA,CAAQ,eAAA,IAAmB,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,MAAA,EAAQ,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AACtF,IAAA,IAAI,QAAQ,eAAA,EAAiB;AAC3B,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,eAAe,CAAA;AACnD,MAAA,IAAI,MAAA,CAAO,QAAQ,MAAM,CAAA,IAAK,OAAO,MAAA,EAAQ,MAAM,CAAA,EAAG,MAAM,OAAA,EAAQ;AACpE,MAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,MAAA,MAAM,IAAA,GAAO,CAACA,OAAAA,EAAgB,WAAA,KAAwB;AACpD,QAAA,IAAI,EAAE,OAAA,GAAU,IAAA,EAAM,MAAM,OAAA,EAAQ;AACpC,QAAA,IAAI,UAAUA,OAAM,CAAA,CAAE,cAAA,EAAe,QAAS,OAAA,EAAQ;AACtD,QAAA,SAAA,CAAU,WAAA,EAAa,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AACtC,QAAA,KAAA,MAAW,SAAS,WAAA,CAAYA,OAAAA,EAAQ,EAAE,aAAA,EAAe,IAAA,EAAM,CAAA,EAAG;AAChE,UAAA,MAAM,GAAA,GAAM,IAAA,CAAKA,OAAAA,EAAQ,KAAA,CAAM,IAAI,CAAA;AACnC,UAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,EAAa,KAAA,CAAM,IAAI,CAAA;AACxC,UAAA,IAAI,KAAA,CAAM,cAAA,EAAe,EAAG,MAAM,OAAA,EAAQ;AAC1C,UAAA,IAAI,KAAA,CAAM,WAAA,EAAY,EAAG,IAAA,CAAK,KAAK,GAAG,CAAA;AAAA,eACjC;AACH,YAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,EAAK,IAAA,GAAO,IAAI,CAAA;AAC5C,YAAA,KAAA,IAAS,OAAA,CAAQ,UAAA;AACjB,YAAA,IAAI,EAAE,QAAQ,GAAA,IAAO,KAAA,GAAQ,IAAI,IAAA,GAAO,IAAA,QAAY,OAAA,EAAQ;AAC5D,YAAA,aAAA,CAAc,KAAK,OAAA,EAAS,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAA;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,iBAAiB,MAAM,CAAA;AAAA,IACtC;AACA,IAAA,MAAM,UAAA,GAAa,CAAC,QAAA,KAAqB;AACvC,MAAA,IAAI,CAAC,QAAA,IAAY,QAAA,CAAS,MAAA,GAAS,IAAA,QAAY,OAAA,EAAQ;AACvD,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,EAAW,aAAa,CAAA;AAC1C,MAAA,aAAA,CAAc,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,QAAQ,yBAAA,EAA2B,GAAA,EAAK,QAAA,EAAU,CAAA,EAAG;AAAA,QACxF,IAAA,EAAM,GAAA;AAAA,QACN,IAAA,EAAM;AAAA,OACP,CAAA;AACD,MAAA,UAAA,CAAW,MAAM,WAAW,CAAA;AAAA,IAC9B,CAAA;AACA,IAAA,MAAM,mBAAA,GAAsB,CAAC,IAAA,KAAiB;AAC5C,MAAA,aAAA,CAAc,SAAA,EAAW,GAAG,YAAY;;AAAA,EAAO,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,GAAA,EAAO,IAAA,EAAM,MAAM,CAAA;AAClF,MAAA,UAAA,CAAW,WAAW,eAAe,CAAA;AAAA,IACvC,CAAA;AACA,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,SAAA;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAA;AAAA,MACA,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAA,EAAQ;AACR,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAGO,SAAS,wBAAA,CACd,OACA,IAAA,EACwB;AACxB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAI;AAAA,IACtB,MAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,IAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IACE,CAAC,KAAA,IACD,MAAA,CAAO,QAAQ,KAAK,CAAA,CAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAA,KAAM,CAAC,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA,IAAK,OAAO,UAAU,QAAQ,CAAA;AAE3F,IAAA,MAAM,OAAA,EAAQ;AAChB,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,IAAA;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,eAAA,EAAiB,IAAA,CAAK,IAAA,EAAM,QAAQ,CAAA;AAAA,IACpC,cAAA,EAAgB,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAAA,IAClC,aAAA,EAAe,IAAA,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAChC,MAAA,EAAQ,IAAA,CAAK,IAAA,EAAM,KAAK;AAAA,GAC1B;AACF;ACvNA,IAAMC,QAAAA,GAAU,MAAM,IAAI,KAAA,CAAM,oBAAoB,CAAA;AACpD,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACrE,IAAMC,OAAAA,GAAS,CAAC,KAAA,EAAe,MAAA,KAAmB;AAChD,EAAA,MAAM,GAAA,GAAMC,QAAAA,CAAS,MAAA,EAAQ,KAAK,CAAA;AAClC,EAAA,OAAO,GAAA,KAAQ,EAAA,IAAO,CAAC,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,IAAK,GAAA,KAAQ,IAAA,IAAQ,CAACC,UAAAA,CAAW,GAAG,CAAA;AACjF,CAAA;AACA,IAAM,aAAa,CAAC,IAAA,KAClB,CAAC,GAAG,IAAI,EAAE,IAAA,CAAK,CAAC,cAAc,SAAA,CAAU,UAAA,CAAW,CAAC,CAAA,GAAI,EAAA,IAAM,UAAU,UAAA,CAAW,CAAC,MAAM,GAAG,CAAA;AAC/F,IAAMC,UAAAA,GAAY,CAAC,IAAA,KAAiB;AAClC,EAAA,IAAI,CAACD,WAAW,IAAI,CAAA,IAAK,WAAW,IAAI,CAAA,QAASH,QAAAA,EAAQ;AACzD,EAAA,MAAM,IAAA,GAAOK,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,CAAC,KAAK,WAAA,EAAY,IAAK,KAAK,cAAA,EAAe,QAASL,QAAAA,EAAQ;AAChE,EAAA,OAAOM,aAAa,IAAI,CAAA;AAC1B,CAAA;AAGO,SAAS,oBAAoB,KAAA,EAKjC;AACD,EAAA,MAAM,GAAA,GAAMF,UAAAA,CAAU,KAAA,CAAM,GAAG,CAAA;AAC/B,EAAA,MAAM,WAAA,GAAcA,UAAAA,CAAU,KAAA,CAAM,WAAW,CAAA;AAC/C,EAAA,MAAM,gBAAA,GAAmBA,UAAAA,CAAU,KAAA,CAAM,gBAAgB,CAAA;AACzD,EAAA,IACEH,QAAO,GAAA,EAAK,WAAW,KACvBA,OAAAA,CAAO,WAAA,EAAa,GAAG,CAAA,IACvB,CAACA,QAAO,gBAAA,EAAkB,WAAW,KACrC,gBAAA,KAAqB,WAAA,IACpB,MAAM,WAAA,KAAgB,WAAA,IAAe,MAAM,WAAA,KAAgB,iBAAA;AAE5D,IAAA,MAAMD,QAAAA,EAAQ;AAChB,EAAA,MAAM,IAAA,GAAOK,UAAU,WAAW,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,IAAA,GAAO,EAAA,IAAU,OAAA,CAAQ,MAAA,IAAU,IAAA,CAAK,GAAA,KAAQ,CAAA,IAAK,IAAA,CAAK,GAAA,KAAQ,OAAA,CAAQ,MAAA,EAAO;AACxF,IAAA,MAAML,QAAAA,EAAQ;AAChB,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,CAAC,GAAG,GAAG,KAAA,CAAM,WAAA,KAAgB,oBAAoB,OAAA,GAAU,MAAA;AAAA,IAC3D,CAAC,WAAW,GAAG;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,mBAAA,EAAqB,SAAA;AAAA,IACrB,UAAU,MAAA,CAAO,MAAA,CAAO,EAAE,mBAAA,EAAqB,OAAO,CAAA;AAAA,IACtD,WAAA,EAAa,OAAO,MAAA,CAAO;AAAA,MACzB,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,QACrB,OAAA,EAAS,YAAA;AAAA,QACT,UAAA;AAAA,QACA,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,OAAA,EAAS,OAAO;AAAA,OAC1C;AAAA,KACF;AAAA,GACF,CAAA;AAED,EAAA,MAAM,OAAA,GAAU,CAAA,qDAAA,EAAwD,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAC9F,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,KAAK,SAAA,CAAU,IAAI,CAAC,CAAA,GAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,CAAE,CAAA,CAC7E,IAAA,CAAK,IAAI,CAAC,CAAA,qCAAA,CAAA;AACb,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA,EAAS,OAAO,MAAA,CAAO;AAAA,MACrB,IAAA;AAAA,MACA,+BAAA;AAAA,MACA,IAAA;AAAA,MACA,oCAAA;AAAA,MACA,IAAA;AAAA,MACA,eAAe,OAAO,CAAA;AAAA,KACvB;AAAA,GACF,CAAA;AACD,EAAA,QAAA,CAAS,GAAA,CAAI,QAAQ,EAAE,GAAA,EAAK,aAAa,QAAA,EAAU,KAAA,CAAM,WAAA,KAAgB,iBAAA,EAAmB,CAAA;AAC5F,EAAA,OAAO,MAAA;AACT;AAIA,IAAM,QAAA,uBAAe,OAAA,EAAyB;AAG9C,IAAM,MAAA,uBAAa,OAAA,EAAqE;AAGjF,SAAS,4BAAA,CACd,MAAA,EACA,QAAA,EACA,MAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA;AACnC,EAAA,IACE,CAAC,OAAA,IACD,MAAA,CAAO,OAAA,IACP,CAAC,OAAO,QAAQ,CAAA,IAChB,CAAC,MAAA,CAAO,SAAS,MAAM,CAAA,IACvB,OAAO,QAAA,CAAS,OAAO,EAAA,KAAO,QAAA,IAC9B,CAAC,QAAA,CAAS,OAAO,EAAA,IACjB,QAAA,CAAS,GAAA,KAAQ,OAAA,CAAQ,OACzB,CAAC,MAAA,CAAO,QAAA,CAAS,uBAAuB,KACxC,QAAA,CAAS,uBAAA,CAAwB,OAAO,SAAA,IACxC,QAAA,CAAS,wBAAwB,OAAA,KAAY,YAAA;AAE7C,IAAA,MAAMA,QAAAA,EAAQ;AAChB,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA;AAC9B,EAAA,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,EAAE,GAAG,OAAA,EAAS,UAAU,QAAA,CAAS,MAAA,CAAO,EAAA,EAAI,MAAA,EAAQ,CAAA;AACtE,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,4BAAA,CACd,QACA,QAAA,EACgC;AAChC,EAAA,IAAI,CAAC,MAAA,CAAO,MAAM,CAAA,EAAG,OAAO,KAAA;AAC5B,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,OAAO,OAAA,CAAQ,WAAW,CAAC,OAAA,CAAQ,OAAO,OAAA,IAAW,OAAA,CAAQ,aAAa,QAAQ,CAAA;AACpF;AAGO,SAAS,wBAAA,CACd,MAAA,EACA,IAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,QAAQ,OAAO,KAAA;AACpB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AACjC,EAAA,IACE,CAAC,OAAA,IACD,OAAA,CAAQ,OAAO,OAAA,IACf,CAACG,WAAW,IAAI,CAAA,IAChB,WAAW,IAAI,CAAA,IACd,WAAW,MAAA,IAAU,MAAA,KAAW,WAChC,MAAA,KAAW,OAAA,IAAW,CAAC,OAAA,CAAQ,QAAA;AAEhC,IAAA,OAAO,KAAA;AACT,EAAA,IAAI;AACF,IAAA,IAAI,QAAA,GAAW,QAAQ,IAAI,CAAA;AAC3B,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,OAAO,IAAA,EAAM;AACX,MAAA,IAAI;AACF,QAAAE,UAAU,QAAQ,CAAA;AAClB,QAAA;AAAA,MACF,SAAS,KAAA,EAAO;AACd,QAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,QAAQ,CAAA,KAAM,QAAA;AAC9E,UAAA,OAAO,KAAA;AACT,QAAA,MAAA,CAAO,OAAA,CAAQ,SAAS,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,CAAE,MAAA,GAAS,CAAC,CAAC,CAAA;AAC3D,QAAA,QAAA,GAAW,QAAQ,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AACA,IAAA,MAAM,YAAY,OAAA,CAAQC,YAAAA,CAAa,QAAQ,CAAA,EAAG,GAAG,MAAM,CAAA;AAC3D,IAAA,OAAOL,OAAAA,CAAO,WAAW,OAAA,CAAQ,GAAG,KAAK,CAACA,OAAAA,CAAO,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAAA,EACjF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"chunk-GYPPVANR.js","sourcesContent":["import {\n type AIProviderLlmEntry,\n type AIProviderRegistry,\n isEntryEnabled,\n type MergedAIProviderRegistry,\n parseCredentialRef,\n registryEntries,\n} from \"@skaile/workspaces/core/provider-registry\";\nimport type {\n CodexCredentialDelivery,\n CodexSubscriptionRefreshInput,\n CodexSubscriptionRefreshResult,\n} from \"@skaile/workspaces/types\";\nimport * as z from \"zod\";\nconst identifier = z.string().min(1).max(4096);\nconst timestamp = z.iso.datetime({ offset: true });\nconst common = {\n configId: identifier,\n credentialVersion: z.number().int().nonnegative().safe(),\n mintedAt: timestamp,\n};\nconst subscription = z.strictObject({\n ...common,\n kind: z.literal(\"codex-subscription\"),\n accessToken: z.string().min(1).max(65536),\n chatgptAccountId: identifier,\n chatgptPlanType: identifier.optional(),\n expiresAt: timestamp,\n});\nconst delivery = z.discriminatedUnion(\"kind\", [\n subscription,\n z.strictObject({\n ...common,\n kind: z.literal(\"openai-api-key\"),\n apiKey: z.string().min(1).max(65536),\n }),\n]);\n\n/** Validate credential shape and provenance without including input values in errors. /\nexport function parseCodexCredential(value: unknown, now = Date.now()): CodexCredentialDelivery {\n const parsed = delivery.safeParse(value);\n if (!parsed.success) throw new Error(\"Invalid managed AI credential\");\n const credential = parsed.data;\n const mintedAt = Date.parse(credential.mintedAt);\n // Issuer and runtime clocks may differ slightly; expiry remains strictly unexpired.\n if (\n mintedAt > now + 60_000 \|\|\n (credential.kind === \"codex-subscription\" &&\n (Date.parse(credential.expiresAt) <= now \|\| Date.parse(credential.expiresAt) <= mintedAt))\n )\n throw new Error(\"Invalid managed AI credential timestamps\");\n return credential;\n}\n\n/* Validate runtime-only refresh input against the authenticated session's pinned delivery. /\nexport function parseCodexRefreshInput(\n value: unknown,\n pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n): CodexSubscriptionRefreshInput {\n const parsed = z\n .strictObject({\n kind: z.literal(\"codex-subscription\"),\n configId: identifier,\n credentialVersion: common.credentialVersion,\n reason: z.enum([\"initial\", \"refresh\", \"retry-401\"]),\n })\n .safeParse(value);\n if (\n !parsed.success \|\|\n parsed.data.configId !== pinned.configId \|\|\n parsed.data.credentialVersion !== pinned.credentialVersion\n )\n throw new Error(\"Invalid managed AI refresh binding\");\n return parsed.data;\n}\n\n/* Accept refreshed subscription credentials only within the existing config/account binding. /\nexport function parseCodexRefreshResult(\n value: unknown,\n pinned: Extract<CodexCredentialDelivery, { kind: \"codex-subscription\" }>,\n now = Date.now(),\n): CodexSubscriptionRefreshResult {\n const parsed = z\n .discriminatedUnion(\"ok\", [\n z.strictObject({ ok: z.literal(true), credential: subscription }),\n z.strictObject({\n ok: z.literal(false),\n code: z.enum([\"not-configured\", \"revoked\", \"provider-error\", \"backend-error\"]),\n message: z.string(),\n }),\n ])\n .safeParse(value);\n if (!parsed.success) throw new Error(\"Invalid managed AI refresh result\");\n if (!parsed.data.ok) return { ...parsed.data, message: \"Managed subscription refresh failed\" };\n const credential = parseCodexCredential(parsed.data.credential, now);\n if (\n credential.kind !== \"codex-subscription\" \|\|\n credential.configId !== pinned.configId \|\|\n credential.chatgptAccountId !== pinned.chatgptAccountId \|\|\n credential.credentialVersion < pinned.credentialVersion\n )\n throw new Error(\"Invalid managed AI refresh binding\");\n return { ok: true, credential };\n}\n\n/\n The AI provider registry a managed-codex session may carry (plan §2.2).\n \n Managed codex runs on a platform-minted, short-lived credential that the\n * host never writes to disk and never puts in the child environment. That\n * isolation is only meaningful if the session cannot also be told to talk\n * somewhere else, or to pick a credential up from the environment. Restated\n * on the registry, the admissible shape is exactly one enabled `llm` entry,\n * on codex's own OpenAI surface, whose credential is a platform-injected\n * `oauth` reference. A second entry, a different surface, or an `env:` /\n * `cmd:` / `keyring:` reference is an invalid AI profile.\n \n `surface` is read literally — no catalog-preset fallback. No preset\n * declares `openai-codex-responses`, so a preset-shaped entry reaching here\n * is a mis-provisioned session, not a terse one.\n \n An absent or empty registry is not a violation: nothing was configured,\n * and the credential the platform minted is the only one the session has.\n * Every configured entry is judged, whichever layer it came from — the\n * control-plane session layer, the user/workspace `providers.yml` files, or\n * a runtime override.\n \n @returns the reason the registry is inadmissible, or `undefined` when it is.\n /\nexport function managedCodexRegistryViolation(\n registry: AIProviderRegistry \| MergedAIProviderRegistry \| undefined,\n): string \| undefined {\n if (!registry) return undefined;\n const entries = registryEntries(registry);\n if (entries.length === 0) return undefined;\n if (entries.length > 1)\n return `registry carries ${entries.length} entries; managed codex admits exactly one`;\n const [id, entry] = entries[0];\n if (!isEntryEnabled(entry)) return `entry '${id}' is disabled`;\n if (entry.kind !== \"llm\") return `entry '${id}' is a '${entry.kind}' endpoint, not an llm one`;\n const surface = (entry as AIProviderLlmEntry).surface;\n if (surface !== \"openai-codex-responses\")\n return `entry '${id}' declares surface '${surface ?? \"none\"}'; managed codex admits only openai-codex-responses`;\n const credential = entry.credential;\n if (credential?.kind !== \"oauth\")\n return `entry '${id}' carries a '${credential?.kind ?? \"none\"}' credential; managed codex admits only a platform-injected oauth credential`;\n const ref = credential.ref ? parseCredentialRef(credential.ref) : undefined;\n if (!ref \|\| ref.form !== \"platform\")\n return `entry '${id}' resolves its credential outside the control plane; managed codex admits only a 'platform:' reference`;\n return undefined;\n}\n","import { createHash } from \"node:crypto\";\nimport {\n chmodSync,\n existsSync,\n lstatSync,\n mkdirSync,\n readFileSync,\n readdirSync,\n realpathSync,\n renameSync,\n rmSync,\n writeFileSync,\n} from \"node:fs\";\nimport { isAbsolute, join, relative } from \"node:path\";\nimport { openSqlite } from \"../../../core/src/logging/sinks/sqlite-runtime.js\";\nimport type { CodexCredentialDelivery } from \"@skaile/workspaces/types\";\nimport type { AgentConfig, CodexManagedRuntimeOptions } from \"../types.js\";\n\nimport { CODEX_NATIVE_STATE_FORMAT, CodexNativeStateUnavailable } from \"./native-state.js\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst within = (path: string, root: string) => {\n const rel = relative(root, path);\n return rel === \"\" \|\| (!rel.startsWith(\"..\") && !isAbsolute(rel));\n};\nfunction directory(path: string): void {\n if (!existsSync(path)) mkdirSync(path, { mode: 0o700 });\n const stat = lstatSync(path);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink() \|\| stat.mode & 0o077) throw invalid();\n}\nfunction readRegular(path: string, limit: number): Buffer {\n const stat = lstatSync(path);\n if (!stat.isFile() \|\| stat.isSymbolicLink() \|\| stat.size > limit) throw invalid();\n return readFileSync(path);\n}\n\n/* Session-owned state lock and account-bound native resume metadata; never stores credentials. /\nexport function prepareCodexInstance(\n config: AgentConfig,\n options: CodexManagedRuntimeOptions,\n credential: CodexCredentialDelivery,\n) {\n if (!isAbsolute(options.privateDirectory) \|\| !isAbsolute(config.cwd) \|\| !config.sessionId)\n throw invalid();\n directory(options.privateDirectory);\n const root = realpathSync(options.privateDirectory);\n const cwd = realpathSync(config.cwd);\n if (within(root, cwd) \|\| within(cwd, root)) throw invalid();\n const lock = join(root, \".active\");\n const leasePath = join(root, \"lease.db\");\n if (existsSync(leasePath) && !lstatSync(leasePath).isFile()) throw invalid();\n const lease = openSqlite(leasePath);\n try {\n lease.exec(\"PRAGMA busy_timeout=0; BEGIN EXCLUSIVE\");\n chmodSync(leasePath, 0o600);\n // The OS releases the database lease on crashes; this marker never owns the lock.\n rmSync(lock, { force: true });\n writeFileSync(lock, \"active\", { flag: \"wx\", mode: 0o600 });\n } catch (error) {\n lease.close();\n throw error;\n }\n let released = false;\n const release = () => {\n if (released) return;\n released = true;\n try {\n rmSync(lock, { force: true });\n } finally {\n lease.close();\n }\n };\n try {\n const key = createHash(\"sha256\")\n .update(\n JSON.stringify({\n harness: \"codex-app-server-v1\",\n session: config.sessionId,\n config: credential.configId,\n kind: credential.kind,\n account: credential.kind === \"codex-subscription\" ? credential.chatgptAccountId : null,\n }),\n )\n .digest(\"hex\");\n const slots = join(root, CODEX_NATIVE_STATE_FORMAT);\n directory(slots);\n const stateRoot = join(slots, key);\n directory(stateRoot);\n for (const name of [\"instructions.new\", \"binding.new\"])\n rmSync(join(stateRoot, name), { force: true });\n const bindingPath = join(stateRoot, \"binding.json\");\n if (config.resumeSessionId && !existsSync(bindingPath)) throw new CodexNativeStateUnavailable();\n if (existsSync(bindingPath)) {\n // Filesystem authority failures (including symlinks) are fatal, not missing state.\n const bytes = readRegular(bindingPath, 4096);\n if (config.resumeSessionId) {\n let binding: unknown;\n try {\n binding = JSON.parse(bytes.toString(\"utf8\"));\n } catch {\n throw new CodexNativeStateUnavailable();\n }\n if (\n !binding \|\|\n typeof binding !== \"object\" \|\|\n Array.isArray(binding) \|\|\n Object.keys(binding).sort().join(\",\") !== \"format,key,threadId\" \|\|\n (binding as Record<string, unknown>).format !== CODEX_NATIVE_STATE_FORMAT \|\|\n (binding as Record<string, unknown>).key !== key \|\|\n (binding as Record<string, unknown>).threadId !== config.resumeSessionId\n )\n throw new CodexNativeStateUnavailable();\n }\n }\n const home = join(stateRoot, \"home\");\n if (config.resumeSessionId && !existsSync(home)) throw new CodexNativeStateUnavailable();\n directory(home);\n for (const subdir of [\"config\", \"cache\", \"data\", \"tmp\"]) directory(join(home, subdir));\n // Auth persistence is forbidden even if a previous external process left a carrier here.\n if ([\"auth.json\", \".credentials.json\"].some((name) => existsSync(join(home, name))))\n throw invalid();\n const instructionFile = join(stateRoot, \"instructions.md\");\n const instructions = [\n ...(options.instructionFiles ?? []).map((path) =>\n readRegular(path, 1024 1024).toString(\"utf8\"),\n ),\n ...(config.systemPrompt ? [config.systemPrompt] : []),\n ].join(\"\\n\\n---\\n\\n\");\n const temporary = join(stateRoot, \"instructions.new\");\n writeFileSync(temporary, instructions, { mode: 0o600, flag: \"wx\" });\n renameSync(temporary, instructionFile);\n const target = join(home, \"skills\");\n if (!options.skillsDirectory && existsSync(target)) rmSync(target, { recursive: true });\n if (options.skillsDirectory) {\n const source = realpathSync(options.skillsDirectory);\n if (within(target, source) \|\| within(source, target)) throw invalid();\n if (existsSync(target)) rmSync(target, { recursive: true });\n let files = 0;\n let entries = 0;\n let bytes = 0;\n const copy = (source: string, destination: string) => {\n if (++entries > 1024) throw invalid();\n if (lstatSync(source).isSymbolicLink()) throw invalid();\n mkdirSync(destination, { mode: 0o700 });\n for (const entry of readdirSync(source, { withFileTypes: true })) {\n const src = join(source, entry.name);\n const dst = join(destination, entry.name);\n if (entry.isSymbolicLink()) throw invalid();\n if (entry.isDirectory()) copy(src, dst);\n else {\n const content = readRegular(src, 1024 * 1024);\n bytes += content.byteLength;\n if (++files > 512 \|\| bytes > 8 * 1024 * 1024) throw invalid();\n writeFileSync(dst, content, { mode: 0o600, flag: \"wx\" });\n }\n }\n };\n copy(options.skillsDirectory, target);\n }\n const bindThread = (threadId: string) => {\n if (!threadId \|\| threadId.length > 4096) throw invalid();\n const next = join(stateRoot, \"binding.new\");\n writeFileSync(next, JSON.stringify({ format: CODEX_NATIVE_STATE_FORMAT, key, threadId }), {\n mode: 0o600,\n flag: \"wx\",\n });\n renameSync(next, bindingPath);\n };\n const setToolInstructions = (text: string) => {\n writeFileSync(temporary, `${instructions}\\n\\n${text}`, { mode: 0o600, flag: \"wx\" });\n renameSync(temporary, instructionFile);\n };\n return {\n root,\n stateRoot,\n cwd,\n home,\n instructionFile,\n bindThread,\n release,\n setToolInstructions,\n };\n } catch (error) {\n release();\n throw error;\n }\n}\n\n/** A replacement environment; managed auth never reads or mutates ambient process.env. /\nexport function codexInstanceEnvironment(\n input: Record<string, string>,\n home: string,\n): Record<string, string> {\n const allowed = new Set([\n \"PATH\",\n \"LANG\",\n \"LC_ALL\",\n \"TZ\",\n \"SSL_CERT_FILE\",\n \"SSL_CERT_DIR\",\n \"HTTPS_PROXY\",\n \"HTTP_PROXY\",\n \"NO_PROXY\",\n ]);\n if (\n !input \|\|\n Object.entries(input).some(([key, value]) => !allowed.has(key) \|\| typeof value !== \"string\")\n )\n throw invalid();\n return {\n ...input,\n HOME: home,\n CODEX_HOME: home,\n XDG_CONFIG_HOME: join(home, \"config\"),\n XDG_CACHE_HOME: join(home, \"cache\"),\n XDG_DATA_HOME: join(home, \"data\"),\n TMPDIR: join(home, \"tmp\"),\n };\n}\n","import { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\n\nconst invalid = () => new Error(\"AI_PROFILE_INVALID\");\nconst record = (value: unknown): value is Record<string, unknown> =>\n value !== null && typeof value === \"object\" && !Array.isArray(value);\nconst within = (child: string, parent: string) => {\n const rel = relative(parent, child);\n return rel === \"\" \|\| (!rel.startsWith(\"../\") && rel !== \"..\" && !isAbsolute(rel));\n};\nconst hasControl = (path: string) =>\n [...path].some((character) => character.charCodeAt(0) < 32 \|\| character.charCodeAt(0) === 127);\nconst directory = (path: string) => {\n if (!isAbsolute(path) \|\| hasControl(path)) throw invalid();\n const stat = lstatSync(path);\n if (!stat.isDirectory() \|\| stat.isSymbolicLink()) throw invalid();\n return realpathSync(path);\n};\n\n/* Fixed pinned-native policy. No caller-supplied profile or sandbox override is admitted. /\nexport function prepareNativePolicy(input: {\n cwd: string;\n privateRoot: string;\n privateDirectory: string;\n sandboxMode: \"read-only\" \| \"workspace-write\";\n}) {\n const cwd = directory(input.cwd);\n const privateRoot = directory(input.privateRoot);\n const privateDirectory = directory(input.privateDirectory);\n if (\n within(cwd, privateRoot) \|\|\n within(privateRoot, cwd) \|\|\n !within(privateDirectory, privateRoot) \|\|\n privateDirectory === privateRoot \|\|\n (input.sandboxMode !== \"read-only\" && input.sandboxMode !== \"workspace-write\")\n )\n throw invalid();\n const stat = lstatSync(privateRoot);\n if (stat.mode & 0o077 \|\| (process.getuid && stat.uid !== 0 && stat.uid !== process.getuid()))\n throw invalid();\n const filesystem = Object.freeze({\n [cwd]: input.sandboxMode === \"workspace-write\" ? \"write\" : \"read\",\n [privateRoot]: \"deny\",\n });\n const config = Object.freeze({\n default_permissions: \"managed\",\n features: Object.freeze({ use_legacy_landlock: false }),\n permissions: Object.freeze({\n managed: Object.freeze({\n extends: \":read-only\",\n filesystem,\n network: Object.freeze({ enabled: false }),\n }),\n }),\n });\n // Native -c parses TOML, not JSON objects. Quote paths as TOML basic strings.\n const profile = `{ managed = { extends = \":read-only\", filesystem = { ${Object.entries(filesystem)\n .map(([path, access]) => `${JSON.stringify(path)} = ${JSON.stringify(access)}`)\n .join(\", \")} }, network = { enabled = false } } }`;\n const policy = Object.freeze({\n config,\n cliArgs: Object.freeze([\n \"-c\",\n 'default_permissions=\"managed\"',\n \"-c\",\n \"features.use_legacy_landlock=false\",\n \"-c\",\n `permissions=${profile}`,\n ]),\n });\n prepared.set(policy, { cwd, privateRoot, writable: input.sandboxMode === \"workspace-write\" });\n return policy;\n}\n\ntype PreparedNativePolicy = ReturnType<typeof prepareNativePolicy>;\ntype Binding = { cwd: string; privateRoot: string; writable: boolean };\nconst prepared = new WeakMap<object, Binding>();\ndeclare const admissionBrand: unique symbol;\nexport type NativeApprovalPolicy = { readonly [admissionBrand]: true };\nconst active = new WeakMap<object, Binding & { threadId: string; signal: AbortSignal }>();\n\n/* Confirms composition and native selection, not live OS isolation (G1/G2 remain required). /\nexport function activateNativeApprovalPolicy(\n policy: PreparedNativePolicy,\n response: unknown,\n signal: AbortSignal,\n): NativeApprovalPolicy {\n const binding = prepared.get(policy);\n if (\n !binding \|\|\n signal.aborted \|\|\n !record(response) \|\|\n !record(response.thread) \|\|\n typeof response.thread.id !== \"string\" \|\|\n !response.thread.id \|\|\n response.cwd !== binding.cwd \|\|\n !record(response.activePermissionProfile) \|\|\n response.activePermissionProfile.id !== \"managed\" \|\|\n response.activePermissionProfile.extends !== \":read-only\"\n )\n throw invalid();\n const token = Object.freeze({}) as NativeApprovalPolicy;\n active.set(token, { ...binding, threadId: response.thread.id, signal });\n return token;\n}\n\nexport function isNativeApprovalPolicyActive(\n policy: unknown,\n threadId: string,\n): policy is NativeApprovalPolicy {\n if (!record(policy)) return false;\n const binding = active.get(policy);\n return Boolean(binding && !binding.signal.aborted && binding.threadId === threadId);\n}\n\n/* Resolve existing ancestors too, so new files cannot escape via a project symlink. */\nexport function allowsNativeApprovalPath(\n policy: NativeApprovalPolicy \| undefined,\n path: string,\n access: \"read\" \| \"write\",\n): boolean {\n if (!policy) return false;\n const binding = active.get(policy);\n if (\n !binding \|\|\n binding.signal.aborted \|\|\n !isAbsolute(path) \|\|\n hasControl(path) \|\|\n (access !== \"read\" && access !== \"write\") \|\|\n (access === \"write\" && !binding.writable)\n )\n return false;\n try {\n let existing = resolve(path);\n const suffix: string[] = [];\n while (true) {\n try {\n lstatSync(existing);\n break;\n } catch (error) {\n if ((error as NodeJS.ErrnoException).code !== \"ENOENT\" \|\| dirname(existing) === existing)\n return false;\n suffix.unshift(existing.slice(dirname(existing).length + 1));\n existing = dirname(existing);\n }\n }\n const canonical = resolve(realpathSync(existing), ...suffix);\n return within(canonical, binding.cwd) && !within(canonical, binding.privateRoot);\n } catch {\n return false;\n }\n}\n"]}

package/dist/{chunk-G44FFUMA.js → chunk-GZL6RN4Z.js} RENAMED Viewed

@@ -1,8 +1,8 @@
-import { readManifestSourceConfig, discoverAssetsInTree, barePublisher, createDefaultKindRegistry, sharesItsFolder, SEMVER_RE, invalidSemverMessage, parseManifestFile } from './chunk-O5Y7VMVQ.js';
+import { readManifestSourceConfig, discoverAssetsInTree, barePublisher, createDefaultKindRegistry, sharesItsFolder, SEMVER_RE, invalidSemverMessage, parseManifestFile } from './chunk-5KWQMCH7.js';
 import { installFromManifest, assertSafeManifestPath } from './chunk-OSABUEWA.js';
-import { PresetManifestSchema } from './chunk-VT6G5AJV.js';
-import { defaultLibraryDir, resolveLibraryDir, GLOBAL_INSTALL_DIR_NAME, readLock, buildLibraryLockEntries, writeLock, mergeLockFile, buildLockFile, ManifestYamlEditor } from './chunk-TMJBEGS4.js';
-import { getGlobalCacheDir, storeManifestSlug, priorStoreManifestSlugs, resolveSourcePublisher } from './chunk-O7ADRMCR.js';
+import { PresetManifestSchema } from './chunk-WS3BOCAT.js';
+import { defaultLibraryDir, resolveLibraryDir, GLOBAL_INSTALL_DIR_NAME, readLock, buildLibraryLockEntries, writeLock, mergeLockFile, buildLockFile, ManifestYamlEditor } from './chunk-4KPQ6ILH.js';
+import { getGlobalCacheDir, storeManifestSlug, priorStoreManifestSlugs, resolveSourcePublisher } from './chunk-FZO64PLQ.js';
 import { userConfigPath, globalSkaileDir, mergeLegacyEntriesInto, migrateLegacyDir, globalCacheRoot } from './chunk-L5VSIPQD.js';
 import { encodeSkaileManifest, expandManifestFiles, SKAILE_MANIFEST_FILENAME, librarySymlinkMessage, loadSkPublishManifest } from './chunk-QC5BYUED.js';
 import { scanDirectory } from './chunk-GNUA7XT2.js';
@@ -3398,20 +3398,33 @@ var TarballHashMismatchError = class extends Error {
   actual;
 };
 var OfflineError = class extends Error {
-  constructor(message) {
-    super(`${message} (air-gapped mode; run \`skaile update\` to refresh the cache)`);
+  /**
+   * @param refreshable - `false` for what a refresh never caches (install manifests, digests):
+   *   the advice is then to turn the cache TTL on, not to run `skaile update --catalog-only`.
+   */
+  constructor(message, refreshable = true) {
+    super(
+      refreshable ? `${message} (air-gapped mode; run \`skaile update --catalog-only\` to refresh the cache)` : `${message} (air-gapped mode; the cache holds no install manifests: set catalog.cache_ttl above 0)`
+    );
     this.name = "OfflineError";
   }
 };
 var CatalogHttpError = class extends Error {
-  constructor(message, status, url) {
+  /**
+   * @param notCatalog - The host answered, but not as a catalog does (a 404 whose body is not a
+   *   JSON document: a web server that does not know the route). A catalog that has no such
+   *   asset answers 404 with a JSON error body.
+   */
+  constructor(message, status, url, notCatalog = false) {
     super(message);
     this.status = status;
     this.url = url;
+    this.notCatalog = notCatalog;
     this.name = "CatalogHttpError";
   }
   status;
   url;
+  notCatalog;
 };
 function describeCatalogError(err, baseUrl) {
   if (err instanceof OfflineError) return err.message;
@@ -3420,7 +3433,8 @@ function describeCatalogError(err, baseUrl) {
   }
   const e = err;
   if (e?.name === "TimeoutError" || e?.name === "AbortError") {
-    return `no answer from ${baseUrl} within ${CATALOG_REQUEST_TIMEOUT_MS / 1e3} s`;
+    const timeoutMs = e.timeoutMs ?? CATALOG_REQUEST_TIMEOUT_MS;
+    return `no answer from ${baseUrl} within ${timeoutMs / 1e3} s`;
   }
   const cause = e?.cause;
   const why = cause?.code ?? cause?.message ?? e?.message ?? String(err);
@@ -3712,7 +3726,7 @@ var RemoteCatalogSource = class {
    */
   async getInstallManifest(ref) {
     if (this.cache.airGapped) {
-      throw new OfflineError(`Install manifest of '${ref}' is not cached`);
+      throw new OfflineError(`Install manifest of '${ref}' is not cached`, false);
     }
     const url = trpcGetUrl(this.baseUrl, "catalog.getInstallManifest", { ref });
     const res = await this.httpClient(url, {
@@ -3723,7 +3737,8 @@ var RemoteCatalogSource = class {
       throw new CatalogHttpError(
         `catalog.getInstallManifest ${ref} failed: ${res.status} ${res.statusText}`,
         res.status,
-        url
+        url,
+        res.status === 404 && !await isJsonDocument(res)
       );
     }
     const data = await parseTrpcGet(res);
@@ -3752,7 +3767,7 @@ var RemoteCatalogSource = class {
    */
   async getCanonicalDigest(ref) {
     if (this.cache.airGapped) {
-      throw new OfflineError(`Canonical digest of '${ref}' is not cached`);
+      throw new OfflineError(`Canonical digest of '${ref}' is not cached`, false);
     }
     const url = trpcGetUrl(this.baseUrl, "catalog.getCanonicalDigest", { ref });
     const res = await this.httpClient(url, {
@@ -3985,6 +4000,14 @@ function pickString(r, key) {
   return typeof v === "string" ? v : void 0;
 }
 var CATALOG_REQUEST_TIMEOUT_MS = 1e4;
+async function isJsonDocument(res) {
+  try {
+    const body = JSON.parse(await res.text());
+    return typeof body === "object" && body !== null;
+  } catch {
+    return false;
+  }
+}
 var defaultFetch = async (url, init) => {
   if (typeof fetch === "undefined") {
     throw new Error("global fetch is not available; pass an httpClient explicitly");
@@ -3995,6 +4018,61 @@ var defaultFetch = async (url, init) => {
     signal: requestInit.signal ?? AbortSignal.timeout(CATALOG_REQUEST_TIMEOUT_MS)
   });
 };
+var STORE_PROBE_TIMEOUT_MS = 5e3;
+var STORE_FAILURE_MEMO_MS = 3e4;
+var StoreProbe = class {
+  stores = /* @__PURE__ */ new Map();
+  /** A `fetch` for the catalog at `baseUrl` that shares this probe's verdict. */
+  httpClient(baseUrl, fetchImpl = defaultFetch) {
+    const key = baseUrl.replace(/\/+$/, "");
+    return async (url, init) => {
+      let state = this.stores.get(key);
+      if (!state) {
+        state = { answered: false };
+        this.stores.set(key, state);
+      }
+      if (state.pending) await state.pending;
+      if (state.failure && Date.now() - (state.failedAt ?? 0) < STORE_FAILURE_MEMO_MS) {
+        throw state.failure;
+      }
+      if (state.answered) return fetchImpl(url, init);
+      let settle;
+      state.pending = new Promise((resolve6) => {
+        settle = resolve6;
+      });
+      state.failure = void 0;
+      try {
+        const res = await fetchImpl(url, {
+          ...init,
+          signal: init?.signal ?? AbortSignal.timeout(STORE_PROBE_TIMEOUT_MS)
+        });
+        state.answered = true;
+        return res;
+      } catch (err) {
+        if (init?.signal?.aborted) throw err;
+        state.failure = init?.signal ? asError(err) : describeProbeFailure(err);
+        state.failedAt = Date.now();
+        throw state.failure;
+      } finally {
+        state.pending = void 0;
+        settle();
+      }
+    };
+  }
+};
+function describeProbeFailure(err) {
+  const e = err;
+  if (e?.name === "TimeoutError" || e?.name === "AbortError") {
+    return Object.assign(new Error(`no answer within ${STORE_PROBE_TIMEOUT_MS / 1e3} s`), {
+      name: "TimeoutError",
+      timeoutMs: STORE_PROBE_TIMEOUT_MS
+    });
+  }
+  return asError(err);
+}
+function asError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
 // library/src/remote/rest-catalog-source.ts
 var DEFAULT_TTL_MS2 = 864e5;
@@ -5003,6 +5081,6 @@ function detectWorkspaceVersion(dir, filename = "skaile.yaml") {
   return raw.version === 2 ? 2 : 1;
 }
-export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, SidecarGit, SkaileConfigSchema, SourceNotFoundError, TarballHashMismatchError, UNLISTED_SCAN_SKIP_DIRS, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, assertManifestEditable, assertValidLibraryName, assetRootProblem, classifyRef, cloneOrInitGitRepo, commitStoreManifest, conflictingAssetRoot, createEmptyLockFile, curatedManifestOverlay, deriveSlug, describeCatalogError, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, ensureGitRepo, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filesEntryPaths, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, installLibraryAsset, interpolate, isGitRepo, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, lastLibraryName, libraryDirMissing, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, markLibraryUnregistered, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, missingLibraryDirMessage, missingRootAssets, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, pruneMissingRootAssets, queryInstancePickerChoices, recordLibraryRename, renamedLibraryName, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, scanAuthoringLibraries, scanLibraryRoot, scanUnlistedAssets, setManifestPublisher, setOriginUrl, sha256Hex, stampManifestPublisher, storeManifestFile, storeSecrets, syncManifestWithDisk, trackOriginBranch, trpcGetUrl, unparsableAssetFiles, unregisteredLibraryNames, upsertManifestAsset, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeCuratedManifest };
-//# sourceMappingURL=chunk-G44FFUMA.js.map
-//# sourceMappingURL=chunk-G44FFUMA.js.map
+export { AssignmentNotFoundError, CatalogCache, CatalogConfigSchema, CatalogHttpError, DuplicateAssignmentError, DuplicateLibraryNameError, GitSyncDriver, InstanceHasConsumersError, InstanceNotFoundError, InterpolationError, KnowledgeManifestSchema, LIBRARY_BACKENDS, LIBRARY_OWNERSHIPS, LOCAL_CATALOG_URL, LibraryConfigSchema, LibraryError, LibraryInstanceRefSchema, LibraryManager, LibrarySectionSchema, LibrarySyncError, LocalCatalogSource, LocalIndex, LocalSyncDriver, LockAssignmentSchema, LockFileSchema, OfflineError, OperationNotPermittedError, PIN_POLICIES, PinPolicySchema, PresetAppliedSchema, PresetExpandedSchema, RemoteCatalogSource, RequiresEdgeSchema, RestCatalogSource, STORE_PROBE_TIMEOUT_MS, SidecarGit, SkaileConfigSchema, SourceNotFoundError, StoreProbe, TarballHashMismatchError, UNLISTED_SCAN_SKIP_DIRS, UserLibraryNotFoundError, WorkspaceConfigV2Schema, applyNonStructuralUpgrade, applyPreset, applyPresetFromData, assertManifestEditable, assertValidLibraryName, assetRootProblem, classifyRef, cloneOrInitGitRepo, commitStoreManifest, conflictingAssetRoot, createEmptyLockFile, curatedManifestOverlay, deriveSlug, describeCatalogError, detectChanges, detectNestedPresetRefs, detectWorkspaceVersion, ensureGitRepo, evaluateUpgrade, extractLibraryInstanceId, extractReferencedKeys, filesEntryPaths, filterKey, getConfigDefaults, getDefaultValue, getSidecarRoot, getStoreManifestsDir, getStoreRoot, hasInterpolationTokens, installLibraryAsset, interpolate, isGitRepo, isLocalCatalogUrl, isSecretPlaceholder, knowledgeKindProvider, lastLibraryName, libraryDirMissing, listSidecarSlugsOnDisk, loadLockFile, loadWorkspaceV2, markLibraryUnregistered, migrateSidecarsToStoreIfNeeded, migrateWorkspaceConfig, missingLibraryDirMessage, missingRootAssets, parsePreset, parsePresetYaml, parseWorkspaceV2, projectConfigPath, pruneMissingRootAssets, queryInstancePickerChoices, recordLibraryRename, renamedLibraryName, resolveAllItems, resolveConfig, resolveIndexPath, resolveItem, resolvePin, resolveSidecarPaths, saveConfig, saveLockFile, saveWorkspaceV2, scanAuthoringLibraries, scanLibraryRoot, scanUnlistedAssets, setManifestPublisher, setOriginUrl, sha256Hex, stampManifestPublisher, storeManifestFile, storeSecrets, syncManifestWithDisk, trackOriginBranch, trpcGetUrl, unparsableAssetFiles, unregisteredLibraryNames, upsertManifestAsset, validateAllPlaceholders, validateKnowledge, validateNestingDepth, validatePlaceholder, writeCuratedManifest };
+//# sourceMappingURL=chunk-GZL6RN4Z.js.map
+//# sourceMappingURL=chunk-GZL6RN4Z.js.map