@theokit/agents 14.3.0 → 14.5.0

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 # @theokit/agents
 
+## 14.5.0
+
+### Minor Changes
+
+- 604ecab: `loadPersonalMcpServers` — MCP servers an operator registered for themselves, in `~/.claude.json`,
+  are now read alongside the project-scope servers from `.mcp.json`.
+
+  The surface table recorded this as measuring zero and therefore not worth closing. Re-measured
+  2026-09-15 on the machine the original number came from: the file carried 2 personal-scope servers.
+  A measurement that justifies inaction has to stay current, and that one had expired — the gap costs
+  an operator the servers they registered for themselves.
+
+  Never throws: `~/.claude.json` is shared with another tool that writes it, so an unreadable or
+  surprising file yields no servers rather than failing the run that merely wanted to read them.
+
+- 604ecab: `applySubagentMemory` — a subagent's `memory:` declaration now reaches the prompt it governs.
+
+  `@theokit/sdk` carries the declaration and deliberately stops there: which of three roots a note
+  lives under is a decision about who can see it, and a second copy of that rule in that package is
+  how two packages drift into disagreeing about privacy. `resolveAgentMemory` owned that decision
+  here — and owned it with no caller. The reader and the declaration were one call apart for as long
+  as both existed.
+
+  The three roots are decided together, because they differ in exactly one way — who can see the
+  notes — so defaulting an unrecognised scope would publish, on the next commit, something somebody
+  wrote expecting privacy. An unrecognised scope therefore throws rather than guessing.
+
+## 14.4.0
+
+### Minor Changes
+
+- 309c717: The agent can declare the work it is judged on.
+
+  The runtime already modelled tasks and already emitted their lifecycle — `Task.submit` is published,
+  `task_started` / `task_updated` / `task_completed` reach a consumer, and B-018 shipped moderation for
+  `task_progress.text`. What was missing was the way in: measured, `packages/agents/src` emitted
+  `task_started` in **0** files, so the channel was reachable by the embedder and by nothing the model
+  could call. A UI could draw a task list the agent had no way to populate.
+
+  ```ts
+  import { createTaskDeclareTool, createTaskCompleteTool } from '@theokit/agents/tools'
+  import { createPlanOnlyGate, PlanOnlyRefusalError } from '@theokit/agents/auth'
+  import { resolveDecomposition } from '@theokit/agents'
+  ```
+
+  **A plan-only run may decompose and may not act.** The SDK already declared
+  `PermissionMode = "default" | "plan" | ...`, and measured across this package: `default` appeared 4
+  times, `acceptEdits` once, `bypass` once, and **`plan` zero** — of five modes the type carries, the
+  one meaning "do not act" was the only one nothing here mentioned. So this does not invent a mode; it
+  makes the declared one refuse.
+
+  ```ts
+  pre_tool_call: async (ctx) => (await planOnly(ctx)) ?? (await mine(ctx))
+  ```
+
+  The gate returns `undefined` outside plan mode, so it COMPOSES rather than replacing a handler you
+  already have — `pre_tool_call` is a single field, and assigning over it loses one silently.
+
+  **Refusing is not skipping.** A skipped call leaves the agent believing it succeeded and the plan
+  reading as executed, which is the one outcome nobody can detect afterwards. `PlanOnlyRefusalError`
+  names both the mode and the tool. Declaring stays allowed: a gate that refused everything would
+  produce a mode that yields no plan.
+
+  **The agent's decomposition is what the judge reads.** A caller-supplied `GoalOptions.subgoals` is a
+  starting value, never a verdict — which is what stops a breakdown somebody else wrote from being
+  charged to the agent as failure.
+
+  **A declaration is a DEFERRED task, and that is the design rather than an accident.** `Task.submit`
+  takes a work FUNCTION — it was built to run work, and a declaration has none: the work is the agent,
+  across turns. So the submitted work returns a promise that stays pending until `task_complete`
+  resolves it.
+
+  The naive alternative is worth naming because it looks correct: work that returns immediately emits
+  `task_started` and `task_completed` in the same tick, so every declaration is born finished and
+  "declared and still open" can never be told from "never declared".
+
+  **Completing an id that was never declared RAISES**, naming the id. A silent no-op would leave the
+  agent believing the unit closed while the list still shows it open — the one outcome nobody can
+  detect afterwards.
+
+  **A registry that refuses is reported to the model**, not thrown: a registry being down is not a
+  reason for the run to end.
+
 ## 14.3.0
 
 ### Minor Changes

package/README.md

@@ -90,19 +90,20 @@ configuration that had no effect.
 
 | Surface | State |
 |---|---|
-| `CLAUDE.md` | read |
+| `CLAUDE.md` | **read when the host names it** — see below |
 | `settings.json` — `permissions` | translated into the SDK's `PermissionRule[]`; an entry that cannot be rendered faithfully is reported and excluded |
-| `settings.json` — `env`, `outputStyle` | read |
+| `settings.json` — `outputStyle` | read | 
+| `settings.json` — `env` | **parsed, not applied** — see below |
 | `settings.local.json` | read, layered above `settings.json` |
 | `skills/`, `agents/`, `commands/`, `plugins/` | read when the dialect is declared |
 | `.mcp.json` | read; a field this runtime does not carry is reported |
 | `output-styles/*.md` | read, selected by `settings.json` |
-| `agent-memory/` | read — see below |
+| `agent-memory/` | **resolvable** — the SDK carries the declaration, `applySubagentMemory` applies it, and the host decides whether to call it. Measured 2026-09-15: no consumer does yet |
 | `workflows/*.js` | **refused**, and reported. Every other surface is data; a workflow is code, and executing JavaScript found under a caller-supplied directory is a decision that belongs to you |
-| `keybindings.json` | **out of scope** — `@theokit/tui` |
-| `themes/*.json` | **out of scope** — `@theokit/tui` |
+| `keybindings.json` | **out of scope HERE** — read by the consumer, see below |
+| `themes/*.json` | **out of scope** — nobody reads it, in any of the three packages |
 | `~/.claude.json` — OAuth state, UI toggles | **out of scope** — a CLI's own state |
-| `~/.claude.json` — personal-scope MCP servers | **not read yet**, and in scope |
+| `~/.claude.json` — personal-scope MCP servers | **read** — `loadPersonalMcpServers` |
 
 
 ### Out of scope, and who owns it instead
@@ -112,27 +113,109 @@ were measured on 2026-09-12 — `keybindings`, `themes/` and `.claude.json` each
 across every package source tree, against a control of 31 for `skills` — and each one is a decision
 rather than a gap.
 
-**`keybindings.json` and `themes/*.json` belong to `@theokit/tui`.** A framework has no keyboard and
+**`keybindings.json` and `themes/*.json` are not this package's.** A framework has no keyboard and
 no colour: it produces text and tool calls, and the process that renders them owns which key does
 what and which escape codes it emits. Reading them here would let this package hold configuration it
 cannot act on, which is the accepted-and-ignored failure the table above exists to prevent.
 
+**Where they actually go is the consumer, not `@theokit/tui`.** Re-measured 2026-09-15: the toolkit
+carries internal keybindings and reads no file; `theocode` reads `~/.claude/keybindings.json` itself,
+in `terminal-io/keybindings.ts`, against a format it measured against the published documentation.
+Naming the toolkit as the owner sent a reader to the package that does the least with it — and the
+row said `out of scope` without saying out of scope FOR WHOM, which is the half that misleads.
+
+`themes/*.json` is read by nobody, in any of the three packages. That is a genuine gap rather than a
+delegation, and it is stated here rather than implied by an ownership that does not exist.
+
 **`~/.claude.json` is two things under one name, and the split is the point.** Its OAuth state and UI
 toggles are a CLI's own state — that file is written by a specific program about its own session, and
 a library reading another program's login state would be reaching into something it neither owns nor
 can refresh. Its **personal-scope MCP servers** are a different matter: an MCP server the operator
 registered for themselves is a framework concern, this package already reads project-scope servers
-from `.mcp.json`, and the personal scope measures 0. That half is **not refused — it is not done**,
-and saying so is the distinction this section exists to make.
+from `.mcp.json`, and the personal scope measured 0 when this was written. **It does not any more:** on the machine this was re-measured on, 2026-09-15, `~/.claude.json` carried 2 personal-scope servers. The gap cost an operator the servers they registered for themselves, which is the difference between a
+gap worth declaring and one worth closing — so it was closed. `loadPersonalMcpServers` reads that key
+and only that key, and returns empty on a malformed file rather than throwing, because one stray comma
+in a shared home file must not break every project on the machine.
+
+Both MCP readers are called by the host, not from inside this package — `loadMcpJson` has no internal
+caller either, and a library with no `main()` cannot have one. That is why both rows say **read** while
+`agent-memory/` says **resolvable**: the difference is not who calls, it is whether the chain is intact.
+A `memory:` declaration was DROPPED by `@theokit/sdk` before any reader could see it; nothing drops an
+MCP server.
 
 The registry entry that prompted this counts four decisions across three files, because
 `~/.claude.json` is split. That is the count, stated so nobody goes looking for a fourth file.
 
+### `themes/*.json`
+
+Read by none of the three packages, measured 2026-09-15. After `keybindings.json` turned out to be
+read by the consumer rather than by the package it was attributed to, the obvious next move was to
+treat this as the same finding. It is not.
+
+This package has no colour at all — a grep for `color`, `chalk` or `theme` across its source returns
+nothing, the one apparent hit being `ansi` inside `stateTransitionHistory`. It produces text and tool
+calls; a palette here would be configuration nothing could act on. The toolkit reads no theme file
+either, so naming an owner would repeat the mistake the `keybindings.json` row already made.
+
+### `CLAUDE.md`
+
+The instruction tree accepts any file list: `input.fileNames`, falling back to a default of
+`['THEO.md', 'AGENTS.md', 'THEO.local.md', 'AGENTS.local.md']`. `CLAUDE.md` is not in it, and
+`instruction-tree.ts` says so while explaining why `CLAUDE.local.md` is absent too: "a private
+companion to a file this does not read would pair with nothing".
+
+A consumer that wants it passes it. Measured 2026-09-15 while auditing this table row by row:
+`CLAUDE.md`, `settings.json` → `env` and `agent-memory/` are each resolvable by the host, and each
+was listed as `read`. The word describes the mechanism existing; a reader takes it as the behaviour
+happening.
+
+### `settings.json` — `env`
+
+`outputStyle` is read AND applied: `loadSettings` returns it and `resolveOutputStyle` hands it to
+`loadOutputStyle`, which is the mechanism this package documents.
+
+`env` is parsed and goes no further here. Measured 2026-09-15: the schema accepts it, the only
+consumer of a `loadSettings` result in this package reads `outputStyle`, and nothing applies the
+parsed values to `process.env`. A host that wants them can read `settings.values.env` and apply
+them itself — the same shape as `agent-memory/` above, and stated for the same reason.
+
+Grouping it with `outputStyle` under one `read` claimed for both what is true of one. The rule this
+table serves is that a surface is read, or refused with a reason, and never accepted and ignored;
+a key that is parsed and dropped is the third state, and it was in this file's own table.
+
+## Why `env` is not applied, rather than not yet applied
+
+This is a refusal with a reason, not a gap waiting for someone.
+
+`env` under `.claude/` sets environment variables, and a variable is not inert. `NODE_OPTIONS`
+alone is code execution — `--require ./anything.js` runs a file before the program does — and
+`LD_PRELOAD`, `PATH` and `NODE_PATH` each reach the same place by another route. Anything this
+package spawns inherits the process environment: hook commands, and the stdio MCP servers whose
+`${VAR}` references `expandEnvReferences` already resolves against `process.env`.
+
+`.claude/settings.json` usually arrives with the clone. Applying its `env` would let a repository
+choose what runs inside every subprocess of anyone who opens it — the same threat the `hooks` row
+above is gated for, arriving by a quieter door. A consumer that wants those values can read
+`settings.values.env` and decide for itself, which is where a trust decision of that size belongs.
+
+The honest form of this is what the table now says: parsed, so an author is told the key was seen,
+and not applied, so nobody believes it took effect.
+
 ### `agent-memory/`
 
-A subagent whose frontmatter declares `memory:` gets a directory it reads and writes. The first
-**200 lines, capped at 25KB**, of its `MEMORY.md` are loaded when it runs — both caps apply, and
-truncation is reported rather than silent.
+`resolveAgentMemory()` resolves the directory a subagent reads and writes, and returns the first
+**200 lines, capped at 25KB**, of its `MEMORY.md` — both caps apply, and truncation is reported
+rather than silent.
+
+**The host calls it. Nothing here calls it for you, and `memory:` in subagent frontmatter does not
+reach it.** Measured 2026-09-15: `resolveAgentMemory` has no caller in this repository outside its
+own tests, and `@theokit/sdk` — which is the package that loads `.claude/agents/*.md`, and does not
+depend on this one — lists `memory` among the fields it refuses, so a file declaring it is skipped
+with a diagnostic rather than granted a directory.
+
+Saying "read" in the table above, as this document did until that measurement, put this surface in
+the same column as `CLAUDE.md` and implied a wiring that does not exist. The reader is real and the
+three roots below are real; what an author supplies is the call.
 
 | `memory:` | Root | Who can see it |
 |---|---|---|

package/dist/auth.d.ts

@@ -617,4 +617,72 @@ interface Veto {
  */
 declare function grantGate(store: PermissionStore, classify: (ctx: GrantGateContext) => Classification): (ctx: GrantGateContext) => Promise<Veto | undefined>;
 
-export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type Classification, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Governed, type Grant, type GrantGateContext, type GrantOptions, type NotGoverned, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type RunCredentialHelperOptions, type SourceOrigin, type Veto, credentialSources, grantGate, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential, resolveOperatorApiKey };
+/**
+ * B-080 — a run in which the agent may plan and may not act.
+ *
+ * ## The mode already had a name, and nothing honoured it
+ *
+ * The SDK declares `PermissionMode = "default" | "plan" | "acceptEdits" | "bypass" |
+ * "bypassPermissions"`. Measured 2026-09-14 across `packages/agents/src`: `default` 4 times,
+ * `acceptEdits` once, `bypass` once, and **`plan` zero times** — of the five modes the type carries,
+ * the one meaning "do not act" is the single one this layer never mentioned. Accepted by the type
+ * and consulted by nobody, which is the shape this backlog keeps closing.
+ *
+ * So nothing here invents a mode. It makes the declared one refuse.
+ *
+ * ## Refusing, never skipping
+ *
+ * A silently skipped call leaves the agent believing it succeeded, so the plan reads as executed.
+ * That is the one outcome nobody can detect afterwards — worse than an error, which is why this
+ * throws a typed error naming both the mode and the tool (`rules/error-handling.md` § 2).
+ *
+ * ## Compose, never assign
+ *
+ * `auth/permission-gate.ts` states the hazard in its own docblock: `HookHandlers.pre_tool_call` is a
+ * SINGLE field, so assigning this over an existing handler loses one of the two silently — *"and
+ * worse here because the handler that loses may be the one that refuses."* The documented shape is:
+ *
+ * ```ts
+ * pre_tool_call: async (ctx) => (await planOnly(ctx)) ?? (await mine(ctx))
+ * ```
+ *
+ * First veto wins; `undefined` falls through. No helper ships for that: it is one line, and a
+ * `composePreToolCall` would be a second way to do what `??` already does.
+ *
+ * ## What counts as state-changing is the CONSUMER's decision
+ *
+ * `permission-gate.ts` already established why: a context carries `{ name, args }` with no notion of
+ * which argument is the command, and that differs per tool. The classifier is passed in rather than
+ * guessed, and this module does not invent a second taxonomy of dangerous tools.
+ */
+
+/** Refused because the run is in `plan` mode. Typed so a consumer can catch this and only this. */
+declare class PlanOnlyRefusalError extends TheokitAgentError {
+    readonly name = "PlanOnlyRefusalError";
+    /** The tool whose call was refused, so a handler can report it without parsing the message. */
+    readonly tool: string;
+    constructor(tool: string);
+}
+/** The slice of a pre-tool-call context this gate reads. Structural, so it fits the SDK's shape. */
+interface PlanOnlyContext {
+    readonly name: string;
+    readonly permissionMode?: string;
+}
+interface PlanOnlyGateOptions {
+    /**
+     * Does calling this tool change state that outlives the turn?
+     *
+     * The consumer's decision, for the reason `permission-gate.ts` records: the package cannot know
+     * which argument is the command, and a guessed taxonomy would be wrong per tool.
+     */
+    readonly isStateChanging: (toolName: string) => boolean;
+}
+/**
+ * A `pre_tool_call` handler that refuses state-changing calls while the run is in `plan` mode.
+ *
+ * Returns `undefined` in every other case, so it composes with `??` rather than replacing whatever
+ * handler a consumer already has.
+ */
+declare function createPlanOnlyGate(options: PlanOnlyGateOptions): (ctx: PlanOnlyContext) => Promise<undefined>;
+
+export { type AgentCredentialInput, type AuthMethod, AuthProvider, CODEX_CLIENT_ID_ENV_VAR, CODEX_PROVIDER, type Classification, CredentialNotFoundError, type ProviderDescriptor as CredentialProviderDescriptor, type CredentialResolution, type CredentialSourcesInput, DEFAULT_PROVIDERS, DeclaredProviderError, type DeviceAuthProvider, type Governed, type Grant, type GrantGateContext, type GrantOptions, type NotGoverned, type PermissionQuery, PermissionStore, type PermissionStoreOptions, type PlanOnlyContext, type PlanOnlyGateOptions, PlanOnlyRefusalError, type PromptHooks, ProviderKeyMismatchError, ProviderPrefixMismatchError, type ResolveCredentialInput, type RunCredentialHelperOptions, type SourceOrigin, type Veto, createPlanOnlyGate, credentialSources, grantGate, loginWithDevice, requireCredential, resolveAgentCredential, resolveCredential, resolveOperatorApiKey };

package/dist/auth.js

@@ -662,6 +662,31 @@ function grantGate(store, classify) {
   };
 }
 __name(grantGate, "grantGate");
+
+// src/loop/plan-only.ts
+import { TheokitAgentError as TheokitAgentError2 } from "@theokit/sdk/errors";
+var PlanOnlyRefusalError = class extends TheokitAgentError2 {
+  static {
+    __name(this, "PlanOnlyRefusalError");
+  }
+  name = "PlanOnlyRefusalError";
+  /** The tool whose call was refused, so a handler can report it without parsing the message. */
+  tool;
+  constructor(tool) {
+    super(`refusing to run '${tool}': this run is in 'plan' permission mode, where the agent may decompose the work and may not change state. This is a REFUSAL, not a skip \u2014 a skipped call would leave the agent believing it succeeded and the plan reading as executed, which is the one outcome nobody can detect afterwards. Declare the work instead, and let the caller decide whether to leave plan mode.`, {
+      code: "PLAN_ONLY_REFUSAL"
+    });
+    this.tool = tool;
+  }
+};
+function createPlanOnlyGate(options) {
+  return async (ctx) => {
+    if (ctx.permissionMode !== "plan") return void 0;
+    if (!options.isStateChanging(ctx.name)) return void 0;
+    throw new PlanOnlyRefusalError(ctx.name);
+  };
+}
+__name(createPlanOnlyGate, "createPlanOnlyGate");
 export {
   AuthProvider,
   CODEX_CLIENT_ID_ENV_VAR,
@@ -671,10 +696,12 @@ export {
   DEFAULT_PROVIDERS,
   DeclaredProviderError,
   PermissionStore,
+  PlanOnlyRefusalError,
   ProviderKeyMismatchError,
   ProviderPrefixMismatchError,
   assertSecureModes,
   authFilePath2 as authFilePath,
+  createPlanOnlyGate,
   credentialHome,
   credentialSources,
   deviceLogin,

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/credential-helper.ts","../src/auth/permission-store.ts","../src/auth/permission-gate.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAC7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EACF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACnLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAgBrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EApGjD,OAoGiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAhH9C,OAgH8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAlI3C,OAkI2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAhJ7C,OAgJ6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;ACnjBhB,SAASC,gBAAgB;AAMzB,IAAMC,qBAAqB;AAsB3B,eAAsBC,oBACpBC,SACAC,UAAsC,CAAC,GAAC;AAExC,QAAMC,YAAYD,QAAQC,aAAaJ;AACvC,QAAMK,UAAU,MAAM,IAAIC,QAAgB,CAACC,SAASC,WAAAA;AAYlDC;MACEP;MACA,CAAA;MACA;QAAEQ,OAAO;QAAMC,SAASP;QAAWQ,KAAKT,QAAQS;QAAKC,UAAU;MAAO;;;MAGtE,CAACC,OAAOC,WAAAA;AACN,YAAID,UAAU,MAAM;AAClBP,kBAAQQ,MAAAA;AACR;QACF;AAGA,YAAID,MAAME,WAAW,MAAM;AACzBR,iBACE,IAAIS,mBACF,0BAA0Bf,OAAAA,qBAA4BE,SAAAA,wJAGtD;YAAEc,MAAM;UAA4B,CAAA,CAAA;AAGxC;QACF;AACA,cAAMA,OAAO,OAAOJ,MAAMI,SAAS,WAAWJ,MAAMI,OAAO;AAC3DV,eACE,IAAIS,mBACF,0BAA0Bf,OAAAA,YAAmBgB,IAAAA,sHAE7C;UAAEA,MAAM;QAA2B,CAAA,CAAA;MAGzC;IAAA;EAEJ,CAAA;AAEA,QAAMC,aAAad,QAAQe,KAAI;AAC/B,MAAID,WAAWE,WAAW,GAAG;AAC3B,UAAM,IAAIJ,mBACR,0BAA0Bf,OAAAA,gNAG1B;MAAEgB,MAAM;IAA0B,CAAA;EAEtC;AACA,SAAOC;AACT;AA/DsBlB;AA8EtB,eAAsBqB,sBACpBC,MACApB,UAAsC,CAAC,GAAC;AAExC,QAAM,EAAEqB,aAAY,IAAKC,sBAAsBF,IAAAA;AAC/C,MAAIC,iBAAiBE,OAAW,QAAOA;AACvC,SAAOzB,oBAAoBuB,cAAcrB,OAAAA;AAC3C;AAPsBmB;;;ACzDtB,SAASK,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA1Hb,OA0HaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;;;ACtFO,SAASwB,UACdC,OACAC,UAAmD;AAEnD,SAAO,CAACC,QAAAA;AACN,QAAI;AACF,YAAMC,iBAAiCF,SAASC,GAAAA;AAkBhD,UAAIC,eAAeC,aAAa,MAAO,QAAOC,QAAQC,QAAQC,MAAAA;AAC9D,UAAIP,MAAMQ,UAAUL,eAAeM,KAAK,EAAG,QAAOJ,QAAQC,QAAQC,MAAAA;AAIlE,YAAMG,UACJV,MAAMW,kBAAkBJ,SACpB,8BACA;AAQNK,eAAS,oCAAoC;QAC3CC,MAAMX,IAAIY;QACVC,OAAOZ,eAAeM,MAAMM;QAC5BL;MACF,CAAA;AACA,aAAOL,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,IAAIf,IAAIY,IAAI,yBAAyBX,eAAeM,MAAMM,KAAK,KAAKL,OAAAA;MAC/E,CAAA;IACF,SAASQ,OAAO;AAGd,YAAMC,MAAMD,iBAAiBE,QAAQF,MAAMD,UAAUI,OAAOH,KAAAA;AAI5DN,eAAS,gDAAgD;QAAEC,MAAMX,IAAIY;QAAMK;MAAI,CAAA;AAC/E,aAAOd,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,uCAAuCf,IAAIY,IAAI,MAAMK,GAAAA;MAChE,CAAA;IACF;EACF;AACF;AA/DgBpB;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","execFile","DEFAULT_TIMEOUT_MS","runCredentialHelper","command","options","timeoutMs","printed","Promise","resolve","reject","execFile","shell","timeout","cwd","encoding","error","stdout","killed","ConfigurationError","code","credential","trim","length","resolveOperatorApiKey","warn","apiKeyHelper","currentOperatorPolicy","undefined","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify","grantGate","store","classify","ctx","classification","governed","Promise","resolve","undefined","isGranted","query","because","lastReadError","debugLog","tool","name","scope","block","message","cause","why","Error","String"]}
+{"version":3,"sources":["../src/auth/auth-provider.ts","../src/auth-entry.ts","../src/auth/device-provider.ts","../src/auth/resolve-credential.ts","../src/auth/credential-helper.ts","../src/auth/permission-store.ts","../src/auth/permission-gate.ts","../src/loop/plan-only.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SACEA,cACAC,uBACAC,mBACAC,oBACAC,uBACK;AAQP,SAASC,oBAAoB;AAkCtB,IAAMC,iBAAN,cAA6BC,MAAAA;EAhDpC,OAgDoCA;;;;EAClC,YACEC,SAESC,WACT;AACA,UAAMD,OAAAA,GAAAA,KAFGC,YAAAA;AAGT,SAAKC,OAAO;EACd;AACF;AAMA,IAAMC,oBAAoB;EACxB;EACA;EACA;EACA;EACA;EACA;;AAIK,SAASC,uBAAuBC,KAAY;AACjD,QAAMC,OAAOD,eAAeN,QAAQ,GAAGM,IAAIH,IAAI,KAAKG,IAAIL,OAAO,KAAKO,OAAOF,GAAAA;AAC3E,MAAI,qDAAqDG,KAAKF,IAAAA,GAAO;AACnE,WAAO,IAAIR,eACT,mGACA,KAAA;EAEJ;AACA,QAAMG,YACJE,kBAAkBM,KAAK,CAACC,MAAMJ,KAAKK,SAASD,CAAAA,CAAAA,KAAO,gCAAgCF,KAAKF,IAAAA;AAC1F,SAAO,IAAIR,eACTG,YAAY,gDAAgD,qCAC5DA,SAAAA;AAEJ;AAdgBG;AAiBT,SAASQ,eAAeC,SAAiBC,SAAS,KAAKC,SAASC,KAAKD,QAAM;AAChF,QAAME,OAAOH,SAAS,KAAKD;AAC3B,SAAOG,KAAKE,MAAMD,QAAQ,OAAOF,OAAAA,IAAW,IAAE;AAChD;AAHgBH;AAKT,IAAMO,eAAN,MAAMA,cAAAA;EA/Fb,OA+FaA;;;;;EACX,YACmBC,QACAC,OACjB;SAFiBD,SAAAA;SACAC,QAAAA;EAChB;;;;;;EAOH,MAAMC,YACJC,UACAC,MACAC,KAC6B;AAC7B,QAAIF,SAASG,SAAS,SAAS;AAI7B,aAAOC,sBAAsBJ,UAAU;QAAEH,QAAQ,KAAKA;QAAQC,OAAO,KAAKA;QAAOI;MAAI,GAAGD,IAAAA;IAC1F;AAEA,UAAMI,WAAmBC,aAAa,KAAKR,OAAOI,GAAAA;AAUlD,UAAMK,WAAWX,cAAaY,gBAAgBC,IAAIJ,QAAAA;AAClD,QAAIE,aAAaG,OAAW,QAAOH;AAEnC,UAAMI,UAAU,KAAKC,iBAAiBP,UAAUL,UAAUC,MAAMC,GAAAA;AAChEN,kBAAaY,gBAAgBK,IAAIR,UAAUM,OAAAA;AAC3C,QAAI;AACF,aAAO,MAAMA;IACf,UAAA;AACEf,oBAAaY,gBAAgBM,OAAOT,QAAAA;IACtC;EACF;;EAGA,OAAwBG,kBAAkB,oBAAIO,IAAAA;;;;;;;;;EAUtCH,iBACNP,UACAL,UACAC,MACAC,KAC6B;AAC7B,WAAOc,aAAaX,UAAU,YAAA;AAE5B,YAAMY,UAAUC,gBAAgB,KAAKpB,OAAOI,GAAAA;AAC5C,YAAMiB,UACJF,YAAYP,SACR;QAAE,GAAGV;QAAUoB,QAAQH,QAAQI;QAAQC,WAAWL,QAAQM;MAAQ,IAClEvB;AAQN,YAAMwB,eAAe;AACrB,eAASlC,UAAU,KAAKA,WAAW;AACjC,YAAI;AACF,iBAAO,MAAMc,sBACXe,SACA;YAAEtB,QAAQ,KAAKA;YAAQC,OAAO,KAAKA;YAAOI;UAAI,GAC9CD,IAAAA;QAEJ,SAASnB,KAAK;AACZ,gBAAM2C,UAAU5C,uBAAuBC,GAAAA;AACvC,cAAI,CAAC2C,QAAQ/C,aAAaY,WAAWkC,eAAe,EAAG,OAAMC;AAC7D,gBAAM,IAAIC,QAAQ,CAACC,YAAYC,WAAWD,SAAStC,eAAeC,OAAAA,CAAAA,CAAAA;QACpE;MACF;IACF,CAAA;EACF;;;;;;EAOAuC,YACEC,cACA7B,MACA8B,OACsB;AACtB,WAAOC,kBAAkBF,cAAc7B,MAAM8B,KAAAA;EAC/C;;;;;EAMAE,QAAQC,UAAkBC,QAAqBjC,KAAkD;AAC/F,WAAOkC,mBAAmBF,UAAUC,QAAQ,KAAKrC,OAAOI,GAAAA;EAC1D;AACF;;;ACnLA,SACEmC,mBACAC,gBAAAA,eACAC,iBACAC,gBACAC,gBAAAA,eACAC,mBAAAA,kBACAC,uBACK;AAsBP,SACEC,aACAC,qBAAAA,oBACAC,iBACAC,yBACK;AAwBP,SACEC,yBAAAA,wBACAC,kBACAC,sBAAAA,qBACAC,0BACK;AA2BP,SAASC,4BAAAA,iCAAgC;;;ACjHzC,SAASC,qBAAAA,0BAAyB;AA4ElC,IAAMC,kBAAkB;AACxB,IAAMC,eAAe;AAQd,IAAMC,0BAA0B;AAEvC,IAAMC,cAAmC;EACvCC,UAAU;EACVC,UAAUC,QAAQC,IAAIL,uBAAAA,KAA4BF;EAClDQ,mBAAmB,GAAGP,YAAAA;EACtBQ,eAAe,GAAGR,YAAAA;EAClBS,QAAQ;IAAC;IAAU;IAAW;IAAS;;EACvCC,aAAa,GAAGV,YAAAA;AAClB;AAMA,IAAMW,eAAmC;EACvC,GAAGT;EACHU,wBAAwB,GAAGZ,YAAAA;EAC3Ba,oBAAoB,GAAGb,YAAAA;EACvBc,iBAAiB,GAAGd,YAAAA;AACtB;AASO,IAAMe,iBAAqCC,OAAOC,OAAO;EAC9DC,MAAM;EACNC,OAAOH,OAAOC,OAAOf,WAAAA;EACrBkB,SAASJ,OAAOC,OAAO;IACrBD,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;;;MAGNC,WAAW,wBAACC,MAAkBC,UAC5BC,mBAAkBf,cAAca,MAAMC,KAAAA,GAD7B;IAEb,CAAA;IACAT,OAAOC,OAAO;MACZI,OAAO;MACPC,MAAM;IACR,CAAA;GACD;AACH,CAAA;AAeA,SAASK,YAAYH,MAA0B;AAC7C,SAAO;IACLI,OAAOJ,MAAMI,SAASA;IACtBC,OAAOL,MAAMK,UAAU,CAACC,OAAe,IAAIC,QAAc,CAACC,YAAYC,WAAWD,SAASF,EAAAA,CAAAA;IAC1FI,KAAKV,MAAMU,OAAOC,KAAKD;EACzB;AACF;AANSP;AAqBT,eAAsBS,gBACpBjC,UACAkC,QACAC,OACAb,OACAc,OAA+B,CAAC,GAAC;AAKjC,MAAIpC,SAASiB,QAAQoB,WAAW,GAAG;AACjC,UAAM,IAAIC,UACR,aAAatC,SAASe,IAAI,uEAAkE;EAEhG;AACA,MAAI,CAACf,SAASiB,QAAQsB,SAASL,MAAAA,GAAS;AACtC,UAAM,IAAII,UAAU,WAAWJ,OAAOhB,KAAK,kCAAkClB,SAASe,IAAI,GAAG;EAC/F;AACA,MAAImB,OAAOf,SAAS,SAAS;AAC3B,UAAM,IAAImB,UACR,WAAWJ,OAAOhB,KAAK,yEAAoE;EAE/F;AAEA,QAAMsB,SAAS,MAAMN,OAAOd,UAAUI,YAAYY,KAAKf,IAAI,GAAGC,KAAAA;AAC9D,QAAMmB,OAAO,IAAIC,aAAa1C,SAASgB,OAAOmB,KAAAA,EAAOQ,QAAQ3C,SAASe,MAAMyB,QAAQJ,KAAKjC,GAAG;AAE5F,SAAOqC,OAAOI,cAAcC,SAAY;IAAEJ;EAAK,IAAI;IAAEA;IAAMG,WAAWJ,OAAOI;EAAU;AACzF;AA5BsBX;;;AC9KtB,SAASa,oBAAoB;AAC7B,SAASC,YAAY;AAgBrB,SACEC,0BACAC,oBAEK;AACP,SAASC,yBAAyB;AA8E3B,IAAMC,8BAAN,cAA0CC,kBAAAA;EApGjD,OAoGiDA;;;EAC7BC,OAAO;EACzB,YAAYC,UAAkBC,QAAgBC,OAAe;AAC3D,UACE,UAAUA,KAAAA,qBAA0BF,QAAAA,8CAC/BC,MAAAA,iLAC4F;EAErG;AACF;AAGO,IAAME,2BAAN,cAAuCL,kBAAAA;EAhH9C,OAgH8CA;;;;;;EAC1BC,OAAO;EAEzB,YACWC,UACAI,OACAC,gBACT;AACA,UACE,GAAGD,KAAAA,oCAAyCJ,QAAAA,0BACtCK,cAAAA,iHAEN;MAAEC,MAAM;MAAyBC,aAAa;IAAM,CAAA,GAAA,KAR7CP,WAAAA,UAAAA,KACAI,QAAAA,OAAAA,KACAC,iBAAAA;EAQX;AACF;AAGO,IAAMG,wBAAN,cAAoCV,kBAAAA;EAlI3C,OAkI2CA;;;EACvBC,OAAO;EAEzB,YAAYU,SAAiB;AAC3B,UAAMA,SAAS;MAAEH,MAAM;MAA8BC,aAAa;IAAM,CAAA;EAC1E;AACF;AAQO,IAAMG,0BAAN,cAAsCZ,kBAAAA;EAhJ7C,OAgJ6CA;;;;EACzBC,OAAO;EAEzB,YAAqBY,UAA6B;AAChD,UACE;IACEA,SAASC,IAAI,CAACC,GAAGC,MAAM,KAAKC,OAAOD,IAAI,CAAA,CAAA,KAAOD,CAAAA,EAAG,EAAEG,KAAK,IAAA,GAC1D;MAAEV,MAAM;MAAwBC,aAAa;IAAM,CAAA,GAAA,KAJlCI,WAAAA;EAMrB;AACF;AA4CA,SAASM,cAAcC,MAAY;AACjC,MAAIC;AACJ,MAAI;AAGFA,UAAMC,aAAaF,MAAM,MAAA;EAC3B,QAAQ;AAEN,WAAO,oBAAIG,IAAAA;EACb;AAEA,QAAMC,QAAQ,oBAAID,IAAAA;AAClB,aAAWE,QAAQJ,IAAIK,MAAM,IAAA,GAAO;AAClC,UAAMC,UAAUF,KAAKG,KAAI;AAGzB,QAAID,YAAY,MAAMA,QAAQE,WAAW,GAAA,EAAM;AAE/C,UAAMC,gBAAgBH,QAAQE,WAAW,SAAA,IAAaF,QAAQI,MAAM,UAAUC,MAAM,IAAIL;AACxF,UAAMM,KAAKH,cAAcI,QAAQ,GAAA;AACjC,QAAID,MAAM,EAAG;AACbT,UAAMW,IAAIL,cAAcC,MAAM,GAAGE,EAAAA,EAAIL,KAAI,CAAA;EAC3C;AACA,SAAOJ;AACT;AAxBSL;AAiDF,SAASiB,kBAAkBC,OAA6B;AAC7D,QAAMC,UAAU;OAAID,MAAME;IACvBC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ,EACtC5B,IAAI,CAAC6B,eAAeA,WAAWxC,MAAM;AAIxC,MAAIkC,MAAMO,UAAUC,QAAW;AAC7B,UAAMC,SAAST,MAAMO;AACrBN,YAAQS,KAAK7B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA,CAAA;EACrE;AACA,SAAOX;AACT;AAZgBF;AA4BhB,SAASc,yBACPP,YACAQ,QACA7C,OAAa;AAQb,QAAM8C,WAAWC,yBAAyBF,MAAAA;AAC1C,MAAIC,aAAaP,UAAaO,aAAaT,WAAW1C,MAAM;AAC1D,UAAM,IAAII,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,aAAaF,QAAAA;EACrF;AAEA,MAAIT,WAAWW,cAAcT,OAAW;AACxC,MAAIM,OAAOtB,WAAWc,WAAWW,SAAS,EAAG;AAC7C,QAAM,IAAIjD,yBAAyBsC,WAAW1C,MAAMK,OAAOqC,WAAWW,SAAS;AACjF;AAnBSJ;AA2BT,SAASK,eACPlB,OACAmB,YAAyC;AAEzC,MAAInB,MAAMoB,2BAA2BZ,OAAW,QAAOA;AACvD,QAAMa,WAAWrB,MAAMsB,IAAItB,MAAMoB,sBAAsB,GAAG7B,KAAAA;AAC1D,MAAI8B,aAAab,UAAaa,aAAa,GAAI,QAAOb;AAEtD,QAAMF,aAAaa,WAAWI,KAAK,CAACC,MAAMA,EAAE5D,SAASyD,QAAAA;AACrD,MAAIf,eAAeE,QAAW;AAC5B,UAAM,IAAInC,sBACR,GAAG2B,MAAMoB,sBAAsB,QAAQC,QAAAA,4BAClCF,WAAW1C,IAAI,CAAC+C,MAAMA,EAAE5D,IAAI,EAAEiB,KAAK,IAAA,CAAA,GAAQ;EAEpD;AACA,SAAOyB;AACT;AAhBSY;AAkBF,SAASO,kBAAkBzB,OAA6B;AAC7D,QAAMmB,aAAa;OAAInB,MAAME;IAAWC,KAAK,CAACzB,GAAG0B,MAAM1B,EAAE2B,WAAWD,EAAEC,QAAQ;AAK9E,QAAMqB,SAASR,eAAelB,OAAOmB,UAAAA;AACrC,MAAIO,WAAWlB,QAAW;AACxB,UAAMM,SAASd,MAAMsB,IAAII,OAAO5D,MAAM;AACtC,QAAIgD,WAAWN,UAAaM,WAAW,IAAI;AACzC,YAAM,IAAIzC,sBACR,aAAaqD,OAAO9D,IAAI,mBAAmBgB,OAAOoB,MAAMoB,sBAAsB,CAAA,2CACzCM,OAAO5D,MAAM,gEACxB;IAE9B;AACA+C,6BAAyBa,QAAQZ,QAAQY,OAAO5D,MAAM;AACtD,WAAO;MACL6D,MAAM;MACN9D,UAAU6D,OAAO9D;MACjBkD;MACAc,QAAQC,SAASH,OAAO5D,QAAQkC,MAAM8B,IAAI;MAC1Cf,UAAU;IACZ;EACF;AASA,QAAMgB,YAAYZ,WAAWa,QAAQ,CAAC1B,eAAAA;AACpC,UAAMQ,SAASd,MAAMsB,IAAIhB,WAAWxC,MAAM;AAC1C,WAAOgD,WAAWN,UAAaM,WAAW,KAAK,CAAA,IAAK;MAAC;QAAER;QAAYQ;MAAO;;EAC5E,CAAA;AAEA,QAAMmB,UAAUC,gBAAgBlC,MAAMjC,OAAOoD,UAAAA;AAC7C,QAAMgB,QACJF,YAAYzB,SACRuB,UAAU,CAAA,IACVA,UAAUR,KAAK,CAACa,cAAcA,UAAU9B,eAAe2B,OAAAA;AAE7D,MAAIA,YAAYzB,UAAa2B,UAAU3B,QAAW;AAChD,UAAM,IAAI9C,4BAA4BuE,QAAQrE,MAAMqE,QAAQnE,QAAQkC,MAAMjC,SAAS,EAAA;EACrF;AACA,MAAIoE,UAAU3B,OAAW,QAAO6B,sBAAsBrC,OAAOmB,UAAAA;AAE7DN,2BAAyBsB,MAAM7B,YAAY6B,MAAMrB,QAAQqB,MAAM7B,WAAWxC,MAAM;AAEhF,SAAO;IACL6D,MAAM;IACN9D,UAAUsE,MAAM7B,WAAW1C;IAC3BkD,QAAQqB,MAAMrB;IACdc,QAAQC,SAASM,MAAM7B,WAAWxC,QAAQkC,MAAM8B,IAAI;IACpDf,UAAUkB,YAAYzB;EACxB;AACF;AA1DgBiB;AAmEhB,SAASa,SAAShE,SAAe;AAC/BiE,UAAQC,KAAK,qBAAqBlE,OAAAA,EAAS;AAC7C;AAFSgE;AAkCT,SAASG,WAAWzC,OAA6B;AAC/C,QAAMS,SAAST,MAAMO;AACrB,SAAO1B,KAAK4B,OAAOE,WAAW,YAAYF,OAAOG,YAAY,WAAA;AAC/D;AAHS6B;AAKT,SAASJ,sBACPrC,OACAE,WAAwC;AAExC,MAAIF,MAAMO,UAAUC,OAAW,QAAOA;AAEtC,MAAIkC;AACJ,MAAI;AAKFA,aAASC,aAAa3C,MAAMO,OAAOP,MAAMsB,GAAG;EAC9C,SAASsB,OAAO;AAKdN,aACE,oFACYM,iBAAiBC,QAAQD,MAAMtE,UAAUM,OAAOgE,KAAAA,CAAAA,EAAQ;AAEtE,WAAOpC;EACT;AACA,MAAIkC,WAAWlC,OAAW,QAAOA;AACjC,QAAM2B,QAAQjC,UAAUqB,KAAK,CAACuB,MAAMA,EAAElF,SAAS8E,OAAO7E,QAAQ;AAG9D,MAAIsE,UAAU3B,OAAW,QAAOA;AAMhC,MAAIkC,OAAOK,SAAS,SAAS;AAC3B,UAAMjC,SAAU4B,OAA4CM;AAC5D,QAAI,OAAOlC,WAAW,YAAYA,WAAW,GAAI,QAAON;AACxDK,6BAAyBsB,OAAOrB,QAAQ2B,WAAWzC,KAAAA,CAAAA;AACnD,WAAO;MACL2B,MAAM;MACN9D,UAAUsE,MAAMvE;MAChBkD;MACAc,QAAQ;QAAED,MAAM;QAAQ5C,MAAM0D,WAAWzC,KAAAA;MAAO;;MAEhDe,UAAU;IACZ;EACF;AAIA,MAAI,OAAO2B,OAAOO,WAAW,YAAYP,OAAOO,WAAW,GAAI,QAAOzC;AAEtE,SAAO;IACLmB,MAAM;IACN9D,UAAUsE,MAAMvE;;IAEhBkD,QAAQ4B,OAAOO;IACfrB,QAAQ;MAAED,MAAM;MAAS9D,UAAUsE,MAAMvE;IAAK;;IAE9CmD,UAAU;EACZ;AACF;AA7DSsB;AAsET,SAASH,gBACPnE,OACAmC,WAAwC;AAExC,MAAInC,UAAUyC,OAAW,QAAOA;AAChC,SAAON,UAAUqB,KAAK,CAACuB,MAAMA,EAAEI,gBAAgB1C,UAAazC,MAAMyB,WAAWsD,EAAEI,WAAW,CAAA;AAC5F;AANShB;AAST,SAASL,SAASsB,SAAiBrB,MAAwB;AACzD,MAAIA,SAAStB,OAAW,QAAO;IAAEmB,MAAM;IAAOwB;EAAQ;AACtD,QAAMC,SAASvE,KAAKiD,MAAM,MAAA;AAC1B,SAAOhD,cAAcsE,MAAAA,EAAQC,IAAIF,OAAAA,IAC7B;IAAExB,MAAM;IAAQ5C,MAAMqE;EAAO,IAC7B;IAAEzB,MAAM;IAAOwB;EAAQ;AAC7B;AANStB;AAoBF,SAASyB,kBAAkBtD,OAA6B;AAC7D,QAAMuD,WAAW9B,kBAAkBzB,KAAAA;AACnC,MAAIuD,aAAa/C,OAAW,QAAO+C;AACnC,QAAM,IAAIhF,wBACRwB,kBAAkB;IAChBG,WAAWF,MAAME;IAEjB,GAAIF,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA,CAAA;AAEJ;AAVgB+C;AAiCT,IAAME,oBAAmD;EAC9D;IAAE5F,MAAM;IAAcE,QAAQ;IAAsBuC,UAAU;IAAIY,WAAW;EAAS;EACtF;IAAErD,MAAM;IAAaE,QAAQ;IAAqBuC,UAAU;IAAIY,WAAW;EAAU;EACrF;IAAErD,MAAM;IAAUE,QAAQ;IAAkBuC,UAAU;IAAIY,WAAW;EAAM;;AAgCtE,SAASwC,uBAAuBzD,OAA2B;AAChE,SAAOsD,kBAAkB;IACvBhC,KAAKtB,MAAMsB;IACXpB,WAAWF,MAAME,aAAasD;IAC9BpC,wBAAwBpB,MAAMoB,0BAA0B;IACxD,GAAIpB,MAAM8B,SAAStB,SAAY,CAAC,IAAI;MAAEsB,MAAM9B,MAAM8B;IAAK;IACvD,GAAI9B,MAAMjC,UAAUyC,SAAY,CAAC,IAAI;MAAEzC,OAAOiC,MAAMjC;IAAM;IAE1D,GAAIiC,MAAMO,UAAUC,SAAY,CAAC,IAAI;MAAED,OAAOP,MAAMO;IAAM;EAC5D,CAAA;AACF;AAVgBkD;;;ACnjBhB,SAASC,gBAAgB;AAMzB,IAAMC,qBAAqB;AAsB3B,eAAsBC,oBACpBC,SACAC,UAAsC,CAAC,GAAC;AAExC,QAAMC,YAAYD,QAAQC,aAAaJ;AACvC,QAAMK,UAAU,MAAM,IAAIC,QAAgB,CAACC,SAASC,WAAAA;AAYlDC;MACEP;MACA,CAAA;MACA;QAAEQ,OAAO;QAAMC,SAASP;QAAWQ,KAAKT,QAAQS;QAAKC,UAAU;MAAO;;;MAGtE,CAACC,OAAOC,WAAAA;AACN,YAAID,UAAU,MAAM;AAClBP,kBAAQQ,MAAAA;AACR;QACF;AAGA,YAAID,MAAME,WAAW,MAAM;AACzBR,iBACE,IAAIS,mBACF,0BAA0Bf,OAAAA,qBAA4BE,SAAAA,wJAGtD;YAAEc,MAAM;UAA4B,CAAA,CAAA;AAGxC;QACF;AACA,cAAMA,OAAO,OAAOJ,MAAMI,SAAS,WAAWJ,MAAMI,OAAO;AAC3DV,eACE,IAAIS,mBACF,0BAA0Bf,OAAAA,YAAmBgB,IAAAA,sHAE7C;UAAEA,MAAM;QAA2B,CAAA,CAAA;MAGzC;IAAA;EAEJ,CAAA;AAEA,QAAMC,aAAad,QAAQe,KAAI;AAC/B,MAAID,WAAWE,WAAW,GAAG;AAC3B,UAAM,IAAIJ,mBACR,0BAA0Bf,OAAAA,gNAG1B;MAAEgB,MAAM;IAA0B,CAAA;EAEtC;AACA,SAAOC;AACT;AA/DsBlB;AA8EtB,eAAsBqB,sBACpBC,MACApB,UAAsC,CAAC,GAAC;AAExC,QAAM,EAAEqB,aAAY,IAAKC,sBAAsBF,IAAAA;AAC/C,MAAIC,iBAAiBE,OAAW,QAAOA;AACvC,SAAOzB,oBAAoBuB,cAAcrB,OAAAA;AAC3C;AAPsBmB;;;ACzDtB,SAASK,oBAAoB;AAC7B,SAASC,QAAAA,aAAY;AAsCrB,SAASC,YAAYC,SAAe;AAClC,SAAOA,QAAQC,KAAI,EAAGC,QAAQ,QAAQ,GAAA;AACxC;AAFSH;AAIF,IAAMI,kBAAN,MAAMA;EA1Hb,OA0HaA;;;;EAEFC;;EAGTC;EAES;EAET,YAAYC,SAAiC;AAC3C,SAAKF,OAAOG,MAAKD,QAAQE,MAAM,YAAY,uBAAA;AAC3C,SAAK,OAAOF,QAAQG,OAAOC,KAAKD;EAClC;;;;;;;;EASA,gBAAgBE,OAAa;AAC3B,QAAI;AAEF,aAAOC,aAAaD,KAAAA;IACtB,SAASE,OAAO;AACd,YAAM,IAAIC,MACR,oBAAoBH,KAAAA,2EACRE,iBAAiBC,QAAQD,MAAME,UAAUC,OAAOH,KAAAA,CAAAA,EAAQ;IAExE;EACF;EAEAI,UAAUC,OAAiC;AACzC,QAAIP;AACJ,QAAI;AACFA,cAAQ,KAAK,gBAAgBO,MAAMP,KAAK;IAC1C,QAAQ;AAGN,aAAO;IACT;AAEA,UAAMQ,QAAQ,KAAK,MAAM,KAAK,MAAK,GAAID,MAAME,MAAMT,OAAOZ,YAAYmB,MAAMlB,OAAO,CAAA;AACnF,QAAImB,UAAUE,OAAW,QAAO;AAEhC,QAAIF,MAAMG,cAAcD,UAAaF,MAAMG,aAAa,KAAK,KAAI,EAAI,QAAO;AAC5E,WAAO;EACT;EAEAH,MAAMD,OAAwBZ,UAAwB,CAAC,GAAS;AAC9D,UAAMK,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMY,SAAS,KAAK,MAAK,EAAGC,OAC1B,CAACC,MACC,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAYD,YAAYmB,MAAMlB,OAAO,EAAA;AAE3FuB,WAAOG,KAAK;MACVN,MAAMF,MAAME;MACZT;MACAX,SAASD,YAAYmB,MAAMlB,OAAO;MAClC2B,WAAW,IAAIjB,KAAK,KAAK,KAAI,CAAA,EAAIkB,YAAW;MAC5C,GAAItB,QAAQuB,UAAUR,SAAY,CAAC,IAAI;QAAEC,WAAW,KAAK,KAAI,IAAKhB,QAAQuB;MAAM;IAClF,CAAA;AACA,SAAK,SAASN,MAAAA;EAChB;EAEAO,OAAOZ,OAA8B;AACnC,UAAMP,QAAQ,KAAK,gBAAgBO,MAAMP,KAAK;AAC9C,UAAMoB,YAAYhC,YAAYmB,MAAMlB,OAAO;AAC3C,UAAMgC,OAAO,KAAK,MAAK,EAAGR,OACxB,CAACC,MAAM,EAAEA,EAAEL,SAASF,MAAME,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,UAAQ;AAE/E,SAAK,SAASC,IAAAA;EAChB;;EAGAC,OAAyB;AACvB,WAAO,KAAK,MAAK;EACnB;;;;;;;EAQAC,UAA4B;AAC1B,UAAMzB,MAAM,KAAK,KAAI;AACrB,WAAO,KAAK,MAAK,EAAGe,OAAO,CAACC,MAAMA,EAAEH,cAAcD,UAAaI,EAAEH,aAAab,GAAAA;EAChF;EAEA,MACEc,QACAH,MACAT,OACAoB,WAAiB;AAEjB,WAAOR,OAAOY,KAAK,CAACV,MAAMA,EAAEL,SAASA,QAAQK,EAAEd,UAAUA,SAASc,EAAEzB,YAAY+B,SAAAA;EAClF;EAEA,QAAK;AACH,UAAM,EAAEK,OAAOC,MAAK,IAAKC,eACvB,KAAKlC,MACL,CAACmC,QAAAA;AACC,YAAMC,SAAkBC,KAAKC,MAAMH,GAAAA;AACnC,UAAI,CAACI,MAAMC,QAAQJ,MAAAA,EAAS,OAAM,IAAI1B,MAAM,6BAAA;AAC5C,aAAO0B;IACT,GACA,CAAA,CAAE;AAEJ,SAAKnC,gBAAgBgC;AACrB,WAAOD;EACT;EAEA,SAASb,QAAwB;AAC/BsB,oBAAgB,KAAKzC,MAAM,MAAM,GAAGqC,KAAKK,UAAUvB,QAAQ,MAAM,CAAA,CAAA;CAAM;EACzE;AACF;;;ACtFO,SAASwB,UACdC,OACAC,UAAmD;AAEnD,SAAO,CAACC,QAAAA;AACN,QAAI;AACF,YAAMC,iBAAiCF,SAASC,GAAAA;AAkBhD,UAAIC,eAAeC,aAAa,MAAO,QAAOC,QAAQC,QAAQC,MAAAA;AAC9D,UAAIP,MAAMQ,UAAUL,eAAeM,KAAK,EAAG,QAAOJ,QAAQC,QAAQC,MAAAA;AAIlE,YAAMG,UACJV,MAAMW,kBAAkBJ,SACpB,8BACA;AAQNK,eAAS,oCAAoC;QAC3CC,MAAMX,IAAIY;QACVC,OAAOZ,eAAeM,MAAMM;QAC5BL;MACF,CAAA;AACA,aAAOL,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,IAAIf,IAAIY,IAAI,yBAAyBX,eAAeM,MAAMM,KAAK,KAAKL,OAAAA;MAC/E,CAAA;IACF,SAASQ,OAAO;AAGd,YAAMC,MAAMD,iBAAiBE,QAAQF,MAAMD,UAAUI,OAAOH,KAAAA;AAI5DN,eAAS,gDAAgD;QAAEC,MAAMX,IAAIY;QAAMK;MAAI,CAAA;AAC/E,aAAOd,QAAQC,QAAQ;QACrBU,OAAO;QACPC,SAAS,uCAAuCf,IAAIY,IAAI,MAAMK,GAAAA;MAChE,CAAA;IACF;EACF;AACF;AA/DgBpB;;;ACnHhB,SAASuB,qBAAAA,0BAAyB;AAG3B,IAAMC,uBAAN,cAAmCC,mBAAAA;EAzC1C,OAyC0CA;;;EACtBC,OAAO;;EAEhBC;EAET,YAAYA,MAAc;AACxB,UACE,oBAAoBA,IAAAA,wXAKpB;MAAEC,MAAM;IAAoB,CAAA;AAE9B,SAAKD,OAAOA;EACd;AACF;AAwBO,SAASE,mBAAmBC,SAA4B;AAO7D,SAAO,OAAOC,QAAAA;AAGZ,QAAIA,IAAIC,mBAAmB,OAAQ,QAAOC;AAI1C,QAAI,CAACH,QAAQI,gBAAgBH,IAAIL,IAAI,EAAG,QAAOO;AAE/C,UAAM,IAAIT,qBAAqBO,IAAIL,IAAI;EACzC;AACF;AAlBgBG;","names":["authFilePath","ensureFreshCredential","openaiDeviceLogin","persistOAuthTokens","readStoredOAuth","withFileLock","RefreshFailure","Error","message","transient","name","TRANSIENT_REASONS","classifyRefreshFailure","err","text","String","test","some","m","includes","waitWithJitter","attempt","baseMs","random","Math","base","round","AuthProvider","config","store","ensureFresh","resolved","deps","env","kind","ensureFreshCredential","filePath","authFilePath","inFlight","refreshInFlight","get","undefined","promise","refreshUnderLock","set","delete","Map","withFileLock","doDisco","readStoredOAuth","current","apiKey","access","expiresAt","expires","MAX_ATTEMPTS","failure","Promise","resolve","setTimeout","deviceLogin","deviceConfig","hooks","openaiDeviceLogin","persist","provider","tokens","persistOAuthTokens","assertSecureModes","authFilePath","CredentialError","credentialHome","readAuthFile","readStoredOAuth","writeCredential","deviceLogin","openaiDeviceLogin","pollDeviceToken","requestDeviceCode","ensureFreshCredential","extractAccountId","persistOAuthTokens","refreshOAuthTokens","providerFromApiKeyPrefix","openaiDeviceLogin","CODEX_CLIENT_ID","CODEX_ISSUER","CODEX_CLIENT_ID_ENV_VAR","CODEX_OAUTH","provider","clientId","process","env","authorizeEndpoint","tokenEndpoint","scopes","redirectUri","CODEX_DEVICE","deviceUsercodeEndpoint","devicePollEndpoint","verificationUri","CODEX_PROVIDER","Object","freeze","name","oauth","methods","label","type","authorize","deps","hooks","openaiDeviceLogin","comDefaults","fetch","sleep","ms","Promise","resolve","setTimeout","now","Date","loginWithDevice","method","store","opts","length","TypeError","includes","tokens","path","AuthProvider","persist","accountId","undefined","readFileSync","join","providerFromApiKeyPrefix","readAuthFile","TheokitAgentError","ProviderPrefixMismatchError","TheokitAgentError","name","provider","envKey","model","ProviderKeyMismatchError","where","expectedPrefix","code","isRetryable","DeclaredProviderError","message","CredentialNotFoundError","attempts","map","a","i","String","join","declaredNames","path","raw","readFileSync","Set","names","line","split","trimmed","trim","startsWith","withoutExport","slice","length","eq","indexOf","add","credentialSources","input","sources","providers","sort","b","priority","descriptor","store","undefined","config","push","dirName","fileName","assertKeyMatchesProvider","apiKey","inferred","providerFromApiKeyPrefix","keyPrefix","pinnedProvider","byPriority","declaredProviderEnvVar","declared","env","find","d","resolveCredential","pinned","kind","source","originOf","home","available","flatMap","claimed","claimedProvider","found","candidate","storedOAuthResolution","diagnose","console","warn","filePathOf","stored","readAuthFile","cause","Error","p","type","api_key","access","modelPrefix","varName","dotenv","has","requireCredential","resolved","DEFAULT_PROVIDERS","resolveAgentCredential","execFile","DEFAULT_TIMEOUT_MS","runCredentialHelper","command","options","timeoutMs","printed","Promise","resolve","reject","execFile","shell","timeout","cwd","encoding","error","stdout","killed","ConfigurationError","code","credential","trim","length","resolveOperatorApiKey","warn","apiKeyHelper","currentOperatorPolicy","undefined","realpathSync","join","signatureOf","command","trim","replace","PermissionStore","path","lastReadError","options","join","home","now","Date","scope","realpathSync","cause","Error","message","String","isGranted","query","grant","tool","undefined","expiresAt","grants","filter","g","push","grantedAt","toISOString","ttlMs","revoke","signature","kept","list","expired","find","value","error","readSecureJson","raw","parsed","JSON","parse","Array","isArray","writeSecureJson","stringify","grantGate","store","classify","ctx","classification","governed","Promise","resolve","undefined","isGranted","query","because","lastReadError","debugLog","tool","name","scope","block","message","cause","why","Error","String","TheokitAgentError","PlanOnlyRefusalError","TheokitAgentError","name","tool","code","createPlanOnlyGate","options","ctx","permissionMode","undefined","isStateChanging"]}

package/dist/{bridge-entry-CuiHdpee.d.ts → bridge-entry-kh9JllQT.d.ts}

@@ -1493,6 +1493,31 @@ declare class McpFileError extends TheokitAgentError {
  * Reading is explicit — this module has no import-time side effect.
  */
 declare function loadMcpJson(cwd: string, opts?: LoadMcpJsonOptions): McpServersMap;
+/**
+ * The MCP servers an operator registered for themselves, from `~/.claude.json`.
+ *
+ * `.mcp.json` is a PROJECT's declaration and {@link loadMcpJson} has read it since B-043. This is
+ * the other half: the servers someone registered for their own account, under the same
+ * `mcpServers` key, which nothing here was reading. The surfaces table listed them "not read yet,
+ * and in scope", justified with "the personal scope measures 0" — re-measured 2026-09-15 on the
+ * machine that wrote that note: 2 servers, neither reaching an agent.
+ *
+ * ## Only `mcpServers`, and the rest is deliberately left alone
+ *
+ * That file is two things under one name. Its OAuth state and UI toggles are a specific CLI writing
+ * about its own session; a library reaching into another program's login state would be taking
+ * something it neither owns nor can refresh. The parser already ignores every other key, and a test
+ * pins it by putting a token beside the servers and asserting the result carries nothing but them.
+ *
+ * ## Why this never throws
+ *
+ * {@link loadMcpJson} throws on a malformed project file, because that file is the project's own
+ * declaration and an author who wrote it wants to know. This one is in the operator's home and is
+ * shared with another product: one stray comma there would otherwise break every project on the
+ * machine, for a file this project did not write. It reports and returns nothing instead — the same
+ * trade `readLayer` makes in `config/settings-file.ts`, for the same reason.
+ */
+declare function loadPersonalMcpServers(home: string, opts?: LoadMcpJsonOptions): McpServersMap;
 
 /**
  * Agent manifest generator — build-time JSON describing all agents, tools, guards, policies.
@@ -1639,4 +1664,4 @@ declare function agentsPlugin(opts: AgentsPluginOptions): {
     register(app: PluginApp): void;
 };
 
-export { compileLoadedAgentModule as $, type AgentManifestEntry as A, type BeforeToolCallContext as B, type ContextWindowOptions as C, type DefinitionOrThunk as D, type EphemeralAgent as E, type McpSelection as F, type SdkAgentHandle as G, type HitlDecision as H, type SdkMessage as I, type SdkSendOptions as J, type SdkTurnHandle as K, type LLMCallContext as L, type McpApprovalSpec as M, type Segment as N, type ShouldAutoApproveOptions as O, type ProcessInputContext as P, type ToolHooks as Q, type RuntimeOverrides as R, type SkillsOptions as S, type ToolCallVeto as T, type ToolHooksPlugin as U, agentsPlugin as V, WRITE_SCOPED_TOOLS as W, applyPosture as X, buildModelSelection as Y, compileAgentModule as Z, compileContextWindow as _, type ApprovalPosture as a, compileProjectContext as a0, compileSkills as a1, createAgentExecutionContext as a2, createApiErrorHandler as a3, createSdkAgentStream as a4, createThinkTagExtractor as a5, createToolHooksPlugin as a6, extractThinkTagStream as a7, generateAgentManifest as a8, generateAgentRoutes as a9, isAgentContext as aa, loadMcpJson as ab, mcpRegistry as ac, mcpToolApprovals as ad, projectContextMetadataOnlyKnobs as ae, reasoningEffortOf as af, resolveMcpServers as ag, runWithApiErrorHandling as ah, shouldAutoApprove as ai, toAgentFactory as aj, translateSdkEvent as ak, withClockCap as al, withEphemeralAgent as am, type AgentModule as b, APPROVAL_MODES as c, type AfterToolCallContext as d, AgentBuilder as e, AgentDefinitionError as f, type AgentExecutionContext as g, type AgentManifest as h, type AgentManifestSource as i, type AgentManifestTool as j, type AgentRoute as k, type AgentRouteContext as l, type AgentRunInfo as m, type AgentsPluginOptions as n, type ApiErrorContext as o, type ApiErrorDecision as p, type ApiErrorPolicy as q, type ApprovalMode as r, streamAgentUIMessages as s, type ApprovalRequest as t, type CompiledContextWindow as u, ContextualTool as v, DelegationTimeoutError as w, McpFileError as x, type McpRegistryConfig as y, type McpRequestContext as z };
+export { compileLoadedAgentModule as $, type AgentManifestEntry as A, type BeforeToolCallContext as B, type ContextWindowOptions as C, type DefinitionOrThunk as D, type EphemeralAgent as E, type McpSelection as F, type SdkAgentHandle as G, type HitlDecision as H, type SdkMessage as I, type SdkSendOptions as J, type SdkTurnHandle as K, type LLMCallContext as L, type McpApprovalSpec as M, type Segment as N, type ShouldAutoApproveOptions as O, type ProcessInputContext as P, type ToolHooks as Q, type RuntimeOverrides as R, type SkillsOptions as S, type ToolCallVeto as T, type ToolHooksPlugin as U, agentsPlugin as V, WRITE_SCOPED_TOOLS as W, applyPosture as X, buildModelSelection as Y, compileAgentModule as Z, compileContextWindow as _, type ApprovalPosture as a, compileProjectContext as a0, compileSkills as a1, createAgentExecutionContext as a2, createApiErrorHandler as a3, createSdkAgentStream as a4, createThinkTagExtractor as a5, createToolHooksPlugin as a6, extractThinkTagStream as a7, generateAgentManifest as a8, generateAgentRoutes as a9, isAgentContext as aa, loadMcpJson as ab, loadPersonalMcpServers as ac, mcpRegistry as ad, mcpToolApprovals as ae, projectContextMetadataOnlyKnobs as af, reasoningEffortOf as ag, resolveMcpServers as ah, runWithApiErrorHandling as ai, shouldAutoApprove as aj, toAgentFactory as ak, translateSdkEvent as al, withClockCap as am, withEphemeralAgent as an, type AgentModule as b, APPROVAL_MODES as c, type AfterToolCallContext as d, AgentBuilder as e, AgentDefinitionError as f, type AgentExecutionContext as g, type AgentManifest as h, type AgentManifestSource as i, type AgentManifestTool as j, type AgentRoute as k, type AgentRouteContext as l, type AgentRunInfo as m, type AgentsPluginOptions as n, type ApiErrorContext as o, type ApiErrorDecision as p, type ApiErrorPolicy as q, type ApprovalMode as r, streamAgentUIMessages as s, type ApprovalRequest as t, type CompiledContextWindow as u, ContextualTool as v, DelegationTimeoutError as w, McpFileError as x, type McpRegistryConfig as y, type McpRequestContext as z };

package/dist/bridge.d.ts

@@ -1,4 +1,4 @@
-export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, U as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, V as agentsPlugin, X as applyPosture, Y as buildModelSelection, Z as compileAgentModule, _ as compileContextWindow, $ as compileLoadedAgentModule, a0 as compileProjectContext, a1 as compileSkills, a2 as createAgentExecutionContext, a3 as createApiErrorHandler, a4 as createSdkAgentStream, a5 as createThinkTagExtractor, a6 as createToolHooksPlugin, a7 as extractThinkTagStream, a8 as generateAgentManifest, a9 as generateAgentRoutes, aa as isAgentContext, ab as loadMcpJson, ac as mcpRegistry, ad as mcpToolApprovals, ae as projectContextMetadataOnlyKnobs, af as reasoningEffortOf, ag as resolveMcpServers, ah as runWithApiErrorHandling, ai as shouldAutoApprove, s as streamAgentUIMessages, aj as toAgentFactory, ak as translateSdkEvent, al as withClockCap, am as withEphemeralAgent } from './bridge-entry-CuiHdpee.js';
+export { c as APPROVAL_MODES, d as AfterToolCallContext, e as AgentBuilder, f as AgentDefinitionError, g as AgentExecutionContext, h as AgentManifest, A as AgentManifestEntry, i as AgentManifestSource, j as AgentManifestTool, b as AgentModule, k as AgentRoute, l as AgentRouteContext, m as AgentRunInfo, n as AgentsPluginOptions, o as ApiErrorContext, p as ApiErrorDecision, q as ApiErrorPolicy, r as ApprovalMode, a as ApprovalPosture, B as BeforeToolCallContext, u as CompiledContextWindow, v as ContextualTool, D as DefinitionOrThunk, w as DelegationTimeoutError, E as EphemeralAgent, L as LLMCallContext, M as McpApprovalSpec, x as McpFileError, y as McpRegistryConfig, z as McpRequestContext, F as McpSelection, P as ProcessInputContext, G as SdkAgentHandle, I as SdkMessage, J as SdkSendOptions, K as SdkTurnHandle, N as Segment, O as ShouldAutoApproveOptions, T as ToolCallVeto, Q as ToolHooks, U as ToolHooksPlugin, W as WRITE_SCOPED_TOOLS, V as agentsPlugin, X as applyPosture, Y as buildModelSelection, Z as compileAgentModule, _ as compileContextWindow, $ as compileLoadedAgentModule, a0 as compileProjectContext, a1 as compileSkills, a2 as createAgentExecutionContext, a3 as createApiErrorHandler, a4 as createSdkAgentStream, a5 as createThinkTagExtractor, a6 as createToolHooksPlugin, a7 as extractThinkTagStream, a8 as generateAgentManifest, a9 as generateAgentRoutes, aa as isAgentContext, ab as loadMcpJson, ac as loadPersonalMcpServers, ad as mcpRegistry, ae as mcpToolApprovals, af as projectContextMetadataOnlyKnobs, ag as reasoningEffortOf, ah as resolveMcpServers, ai as runWithApiErrorHandling, aj as shouldAutoApprove, s as streamAgentUIMessages, ak as toAgentFactory, al as translateSdkEvent, am as withClockCap, an as withEphemeralAgent } from './bridge-entry-kh9JllQT.js';
 export { c as CompatImportUnsupportedError, a as CompiledAgentOptions, b as CompiledTool, H as HookApprovalGate, j as HookApprovalRequest, k as HookGateUnsupportedError, T as ToolWalkResult, m as ToolboxWalkResult, n as compileTools } from './agent-compiler-D7-Xd6Zh.js';
 export { A as AgentStopReason, d as AgentStreamEvent, e as AgentTurnMetadata, f as ApprovalRequiredEvent, g as ArtifactChunkEvent, h as ArtifactStartEvent, B as BackgroundDelegation, i as BudgetExceededError, C as CheckpointSavedEvent, k as DelegateFn, a as DelegateOptions, l as DelegationBudgetExceededError, m as DelegationError, n as DelegationPort, c as DelegationResult, D as DelegationTarget, o as DoneEvent, E as ErrorEvent, F as FileEditEvent, I as IterationEvent, P as PartialToolCallEvent, v as RunStartedEvent, w as ScoreVerdict, x as ScoredDelegation, y as Scorer, z as StateUpdateEvent, S as StreamEvent, T as TextDeltaEvent, G as ThinkingEvent, H as ToolCallEvent, J as ToolResultEvent, K as delegate, M as delegateBackground, N as delegateWithScoring, O as isApprovalRequired, Q as isDone, U as isError, V as isPartialToolCall, W as isTextDelta, X as isToolCall, Y as isToolResult, a0 as presentUIMessageStream, a3 as streamAgentResponse } from './delegation-scoring-CH9Mr9NF.js';
 export { a as AGENT_BRAND, A as AgentDefinition, D as DefineAgentConfig, I as InferAgentInput, b as InferAgentToolNames, c as compileAgentDefinition, i as isAgentDefinition } from './define-agent-y3fsG91f.js';

package/dist/bridge.js

@@ -22,6 +22,7 @@ import {
   isToolCall,
   isToolResult,
   loadMcpJson,
+  loadPersonalMcpServers,
   mcpRegistry,
   mcpToolApprovals,
   presentUIMessageStream,
@@ -29,7 +30,7 @@ import {
   runWithApiErrorHandling,
   streamAgentResponse,
   streamAgentUIMessages
-} from "./chunk-G6GCS5XI.js";
+} from "./chunk-DLBGAMHP.js";
 import {
   APPROVAL_MODES,
   BudgetExceededError,
@@ -56,7 +57,7 @@ import {
   translateSdkEvent,
   withClockCap,
   withEphemeralAgent
-} from "./chunk-KZPPH6LC.js";
+} from "./chunk-44IHBFL6.js";
 import "./chunk-MJ6FRILJ.js";
 import {
   AGENT_BRAND,
@@ -117,6 +118,7 @@ export {
   isToolCall,
   isToolResult,
   loadMcpJson,
+  loadPersonalMcpServers,
   mcpRegistry,
   mcpToolApprovals,
   presentUIMessageStream,

package/dist/{chunk-KZPPH6LC.js → chunk-44IHBFL6.js}

@@ -2591,6 +2591,13 @@ function withPreCompaction(strategy, handler, options) {
 }
 __name(withPreCompaction, "withPreCompaction");
 
+// src/loop/decomposition.ts
+function resolveDecomposition(callerSubgoals, declared) {
+  if (declared.length > 0) return declared;
+  return callerSubgoals;
+}
+__name(resolveDecomposition, "resolveDecomposition");
+
 // src/bridge/agent-orchestrator.ts
 function requireApiKey(opts, agentName) {
   if (opts.apiKey === null) return "";
@@ -2837,6 +2844,7 @@ export {
   DEFAULT_HANDLER_TIMEOUT_MS,
   PreCompactionHandlerError,
   withPreCompaction,
+  resolveDecomposition,
   delegate,
   DelegationTimeoutError,
   withClockCap,
@@ -2845,4 +2853,4 @@ export {
   delegateBackground,
   delegateWithScoring
 };
-//# sourceMappingURL=chunk-KZPPH6LC.js.map
+//# sourceMappingURL=chunk-44IHBFL6.js.map