@vibesdotdev/integrations-grok 0.0.0-stage → 1.0.0-rc.1

package/dist/ai/providers/grok/grok-subscription.d.ts

@@ -0,0 +1,116 @@
+import { type GrokSubscriptionCode } from '../../../schemas/subscription.ts';
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+import { type ExecuteResult, type ExecutionOutputLine, type RuntimeExecution } from '@vibesdotdev/kernel/execution';
+import type { FileSystemAdapterInterface } from '@vibesdotdev/filesystem';
+import { type Failure } from '../../../outcome.ts';
+/**
+ * Terminal sign-in for the dedicated profile. The external CLI projector owns
+ * the command; this package does not register an `ai` group of its own.
+ */
+export declare const GROK_SUBSCRIPTION_LOGIN_COMMAND = "vibes dev external grok login";
+/** Read-only check of that same profile. */
+export declare const GROK_SUBSCRIPTION_STATUS_COMMAND = "vibes dev external grok status";
+/**
+ * A device-code sign-in is a person walking to a browser, reading a code, and
+ * confirming it. Five minutes is the wait Grok's own flow expects.
+ */
+export declare const GROK_SUBSCRIPTION_LOGIN_TIMEOUT_MS = 300000;
+/** Every way a subscription operation refuses or fails, by the stable Grok code the surfaces report. */
+export type { GrokSubscriptionCode } from '../../../schemas/subscription.ts';
+/** The `NOT_FOUND` subject kind of the three states in which this host offers no Grok subscription. */
+export declare const GROK_SUBSCRIPTION_KIND = "grok-subscription";
+/**
+ * Confirmed absences of the subscription on a host, by subject id: no consumer
+ * runtime to run it on, no Grok Build binary, and no profile route the owner
+ * can verify. `CapabilityError.isAbsenceOf(error, GROK_SUBSCRIPTION_KIND, id)`
+ * names exactly one of them.
+ */
+export declare const GROK_SUBSCRIPTION_ABSENCE: {
+    readonly consumerRuntime: "consumer-runtime";
+    readonly cli: "cli";
+    readonly route: "verified-route";
+};
+/**
+ * A subscription failure as Runtime's typed outcome. `code`, `reason` and
+ * `details.subscription` name the failure; the Grok code stays readable through
+ * {@link grokSubscriptionCode}. `message` is the one sentence that leaves the
+ * owner. `cause` rides along for logs and `-v` and is never part of a projection,
+ * so only a diagnostic that carries no configuration value belongs there.
+ */
+export declare function grokSubscriptionError(subscription: GrokSubscriptionCode, message: string, options?: {
+    cause?: unknown;
+}): CapabilityError;
+/** The Grok code of a subscription failure, or undefined for any other error. */
+export declare function grokSubscriptionCode(error: Error): GrokSubscriptionCode | undefined;
+/** A subscription operation's failure as the owner reports it. */
+export interface GrokSubscriptionFailure {
+    readonly code: GrokSubscriptionCode;
+    readonly error: CapabilityError;
+}
+/**
+ * The owner's decision for a caught failure: its own typed refusal passes
+ * through; anything else is reported as the fixed unavailability sentence,
+ * because the underlying diagnostic can carry configuration values.
+ */
+export declare function describeGrokSubscriptionFailure(failure: Failure): GrokSubscriptionFailure;
+export interface GrokSubscriptionSession {
+    runtime: RuntimeRef;
+    execution: RuntimeExecution;
+    command: string;
+    home: string;
+    configPath: string;
+    env: Record<string, string>;
+}
+/** The native CLI owns this profile's login state. Vibes does not read auth.json. */
+export declare function prepareGrokSubscription(runtime: RuntimeRef): Promise<GrokSubscriptionSession>;
+export declare function inspectGrokSubscription(session: GrokSubscriptionSession, cwd?: string): Promise<void>;
+/**
+ * Whether the dedicated profile is signed in: `true` (the catalog was listed),
+ * `false` (the CLI said it is signed out), or a typed `STATUS_CHECK_FAILED`
+ * when the check itself failed (a non-zero exit, output that says neither). A
+ * failed check is never reported as "not signed in": the caller would send the
+ * user to sign in again for a failure that signing in does not fix.
+ */
+export declare function checkGrokSubscription(session: GrokSubscriptionSession, timeout: number): Promise<boolean>;
+/** The declared bounds of a buffered native operation's output. */
+export declare const GROK_PROCESS_OUTPUT_LIMITS: {
+    /** Bytes of stdout kept; more stops the child and fails the operation. */
+    readonly maxStdoutBytes: 8388608;
+    /** Characters of stderr kept (the tail); stderr is a diagnostic that never leaves the owner. */
+    readonly maxStderrChars: 65536;
+};
+/** Buffered native operation with real cancellation; raw diagnostics never leave the owner. */
+export declare function runGrokSubscription(session: GrokSubscriptionSession, args: string[], timeout: number, signal?: AbortSignal, onLine?: ExecutionOutputLine): Promise<ExecuteResult>;
+/**
+ * Sign the dedicated profile in.
+ *
+ * With no `onMessage` this is Grok's browser OAuth flow, and the CLI's output
+ * stays inside this boundary as every other subscription operation's does.
+ * With one, it is the device-code flow instead: the verification URL and user
+ * code are streamed to the caller as Grok prints them, because a headless host
+ * has no browser to open and a device code is worthless to anyone who cannot
+ * also answer the prompt. Either way the credential Grok stores afterwards
+ * never crosses this boundary.
+ */
+export declare function loginGrokSubscription(session: GrokSubscriptionSession, options?: {
+    timeout?: number;
+    signal?: AbortSignal;
+    onMessage?: (message: string) => void;
+}): Promise<ExecuteResult>;
+/**
+ * Read one file from the dedicated profile through the consumer host adapter.
+ * Native profile state does not belong to the active workspace projection.
+ */
+export declare function readDedicatedProfileFile(session: GrokSubscriptionSession, path: string): Promise<string>;
+/**
+ * The consumer host's own file adapter for `capability`, never an active
+ * workspace's contained projection, or `undefined` when the host composes none.
+ */
+export declare function resolveHostFilesystem(session: GrokSubscriptionSession, capability: 'read' | 'write'): Promise<FileSystemAdapterInterface | undefined>;
+/**
+ * The typed failure for a subscription operation that failed outside the
+ * owner's own refusals. The underlying diagnostic can carry configuration
+ * values, so only this fixed sentence leaves the owner.
+ */
+export declare function grokSubscriptionUnavailable(): CapabilityError;
+//# sourceMappingURL=grok-subscription.d.ts.map

package/dist/ai/providers/grok/grok-subscription.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-subscription.d.ts","sourceRoot":"","sources":["../../../../src/ai/providers/grok/grok-subscription.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwE,KAAK,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACnJ,OAAO,EACN,eAAe,EAKf,KAAK,UAAU,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEN,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAExB,KAAK,gBAAgB,EACrB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAEX,0BAA0B,EAC1B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAG5D;;;GAGG;AACH,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAE/E,4CAA4C;AAC5C,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,kCAAkC,SAAU,CAAC;AAiC1D,wGAAwG;AACxG,YAAY,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAE7E,uGAAuG;AACvG,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AA0CX;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACpC,YAAY,EAAE,oBAAoB,EAClC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,eAAe,CAMjB;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,oBAAoB,GAAG,SAAS,CAInF;AAED,kEAAkE;AAClE,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,uBAAuB,CAOzF;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,EAAE,UAAU,CAAC;IACpB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,qFAAqF;AACrF,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,UAAU,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAuClC;AAKD,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,uBAAuB,EAChC,GAAG,SAAe,GAChB,OAAO,CAAC,IAAI,CAAC,CAyCf;AA+ED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED,mEAAmE;AACnE,eAAO,MAAM,0BAA0B;IACtC,0EAA0E;;IAE1E,gGAAgG;;CAEvF,CAAC;AAqEX,+FAA+F;AAC/F,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,uBAAuB,EAChC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE,mBAAmB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAoDxB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,uBAAuB,EAChC,OAAO,GAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GACJ,OAAO,CAAC,aAAa,CAAC,CAcxB;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,IAAI,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,uBAAuB,EAChC,UAAU,EAAE,MAAM,GAAG,OAAO,GAC1B,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAcjD;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,eAAe,CAK7D"}

package/dist/ai/providers/grok/grok-subscription.js

@@ -0,0 +1,473 @@
+import { inspectionSchema, nativeBookkeepingSchema, SubscriptionDetailsSchema } from "../../../schemas/subscription.js";
+import { CapabilityError, composeChildEnv, isCapabilityError } from '@vibesdotdev/kernel';
+import { getRuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { getPathRoots, getRuntimePath } from '@vibesdotdev/paths';
+import { parse as parseToml } from 'smol-toml';
+import * as z from 'zod/v4';
+import { attempt } from "../../../outcome.js";
+/**
+ * Terminal sign-in for the dedicated profile. The external CLI projector owns
+ * the command; this package does not register an `ai` group of its own.
+ */
+export const GROK_SUBSCRIPTION_LOGIN_COMMAND = 'vibes dev external grok login';
+/** Read-only check of that same profile. */
+export const GROK_SUBSCRIPTION_STATUS_COMMAND = 'vibes dev external grok status';
+/**
+ * A device-code sign-in is a person walking to a browser, reading a code, and
+ * confirming it. Five minutes is the wait Grok's own flow expects.
+ */
+export const GROK_SUBSCRIPTION_LOGIN_TIMEOUT_MS = 300_000;
+const PASSTHROUGH_ENV = [
+    'PATH',
+    'USER',
+    'LOGNAME',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'SystemRoot',
+    'WINDIR',
+    'APPDATA',
+    'LOCALAPPDATA',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'TERM',
+    'DISPLAY',
+    'WAYLAND_DISPLAY',
+    'XDG_RUNTIME_DIR',
+    'DBUS_SESSION_BUS_ADDRESS',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'ALL_PROXY',
+    'NO_PROXY',
+    'http_proxy',
+    'https_proxy',
+    'all_proxy',
+    'no_proxy',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR'
+];
+/** The `NOT_FOUND` subject kind of the three states in which this host offers no Grok subscription. */
+export const GROK_SUBSCRIPTION_KIND = 'grok-subscription';
+/**
+ * Confirmed absences of the subscription on a host, by subject id: no consumer
+ * runtime to run it on, no Grok Build binary, and no profile route the owner
+ * can verify. `CapabilityError.isAbsenceOf(error, GROK_SUBSCRIPTION_KIND, id)`
+ * names exactly one of them.
+ */
+export const GROK_SUBSCRIPTION_ABSENCE = {
+    consumerRuntime: 'consumer-runtime',
+    cli: 'cli',
+    route: 'verified-route'
+};
+/**
+ * What each failure is to the cross-surface contract. The three absences carry
+ * the `NOT_FOUND` subject `CapabilityError.isAbsenceOf` names.
+ */
+const SUBSCRIPTION_OUTCOMES = {
+    CONSUMER_RUNTIME_REQUIRED: {
+        code: 'NOT_FOUND',
+        reason: 'consumer-runtime-required',
+        subject: { kind: GROK_SUBSCRIPTION_KIND, id: GROK_SUBSCRIPTION_ABSENCE.consumerRuntime }
+    },
+    CLI_UNAVAILABLE: {
+        code: 'NOT_FOUND',
+        reason: 'cli-unavailable',
+        subject: { kind: GROK_SUBSCRIPTION_KIND, id: GROK_SUBSCRIPTION_ABSENCE.cli }
+    },
+    SUBSCRIPTION_ROUTE_UNVERIFIED: {
+        code: 'NOT_FOUND',
+        reason: 'route-unverified',
+        subject: { kind: GROK_SUBSCRIPTION_KIND, id: GROK_SUBSCRIPTION_ABSENCE.route }
+    },
+    SUBSCRIPTION_REQUIRED: { code: 'AUTH_REQUIRED', reason: 'subscription-required', subject: {} },
+    AUTH_TIMEOUT: { code: 'TIMEOUT', reason: 'auth-timeout', subject: {} },
+    GENERATION_TIMEOUT: { code: 'TIMEOUT', reason: 'generation-timeout', subject: {} },
+    AUTH_CANCELLED: { code: 'CANCELLED', reason: 'auth-cancelled', subject: {} },
+    INVALID_REQUEST: { code: 'INVALID_INPUT', reason: 'invalid-request', subject: {} },
+    GENERATION_FAILED: { code: 'UNAVAILABLE', reason: 'generation-failed', subject: {} },
+    STATUS_CHECK_FAILED: { code: 'UNAVAILABLE', reason: 'status-check-failed', subject: {} },
+    SUBSCRIPTION_UNAVAILABLE: { code: 'UNAVAILABLE', reason: 'subscription-unavailable', subject: {} }
+};
+function subscriptionDetails(subscription) {
+    return { subscription, ...SUBSCRIPTION_OUTCOMES[subscription].subject };
+}
+/**
+ * A subscription failure as Runtime's typed outcome. `code`, `reason` and
+ * `details.subscription` name the failure; the Grok code stays readable through
+ * {@link grokSubscriptionCode}. `message` is the one sentence that leaves the
+ * owner. `cause` rides along for logs and `-v` and is never part of a projection,
+ * so only a diagnostic that carries no configuration value belongs there.
+ */
+export function grokSubscriptionError(subscription, message, options = {}) {
+    return new CapabilityError(message, SUBSCRIPTION_OUTCOMES[subscription].code, {
+        reason: SUBSCRIPTION_OUTCOMES[subscription].reason,
+        details: subscriptionDetails(subscription),
+        cause: options.cause
+    });
+}
+/** The Grok code of a subscription failure, or undefined for any other error. */
+export function grokSubscriptionCode(error) {
+    if (!isCapabilityError(error))
+        return undefined;
+    const details = SubscriptionDetailsSchema.safeParse(error.details);
+    return details.success ? details.data.subscription : undefined;
+}
+/**
+ * The owner's decision for a caught failure: its own typed refusal passes
+ * through; anything else is reported as the fixed unavailability sentence,
+ * because the underlying diagnostic can carry configuration values.
+ */
+export function describeGrokSubscriptionFailure(failure) {
+    const caught = z.instanceof(Error).safeParse(failure.cause);
+    if (caught.success && isCapabilityError(caught.data)) {
+        const code = grokSubscriptionCode(caught.data);
+        if (code !== undefined)
+            return { code, error: caught.data };
+    }
+    return { code: 'SUBSCRIPTION_UNAVAILABLE', error: grokSubscriptionUnavailable() };
+}
+/** The native CLI owns this profile's login state. Vibes does not read auth.json. */
+export async function prepareGrokSubscription(runtime) {
+    if (runtime.scope.hardware === 'cloud') {
+        throw grokSubscriptionError('CONSUMER_RUNTIME_REQUIRED', 'Grok subscription execution requires a connected consumer host');
+    }
+    // A host that composes no execution kind cannot run Grok Build. A composed
+    // execution provider that is unavailable or fails is an owner failure and
+    // propagates typed.
+    const execution = runtime.hasKind('runtime/execution')
+        ? await getRuntimeExecution(runtime)
+        : undefined;
+    const command = await execution?.resolveCommand('grok');
+    if (!execution || !command)
+        throw grokSubscriptionError('CLI_UNAVAILABLE', 'Grok Build CLI is unavailable');
+    const roots = getPathRoots(runtime);
+    const paths = await getRuntimePath(runtime);
+    const home = paths.join(roots.dataDir, 'providers', 'grok-subscription');
+    const env = composeChildEnv(runtime, { inheritEnv: [...PASSTHROUGH_ENV], env: {
+            HOME: roots.userHome,
+            GROK_HOME: home,
+            GROK_DISABLE_API_KEY_AUTH: '1',
+            GROK_DISABLE_AUTOUPDATER: '1',
+            GROK_MEMORY: '0'
+        } });
+    const session = {
+        runtime,
+        execution,
+        command,
+        home,
+        configPath: paths.join(home, 'config.toml'),
+        env
+    };
+    // Inspection initializes Grok's native home without reading or copying a login.
+    // The profile may not exist yet. Bootstrap at its filesystem root: using the
+    // user's home makes Grok load ~/.grok/config.toml as project configuration.
+    await inspectGrokSubscription(session, paths.resolve(home, '/'));
+    return session;
+}
+const INSPECTION_UNVERIFIABLE = 'Grok Build reported an inspection this runtime cannot verify: managed machine policy must permit subscription-only use (API-key auth disabled, no configuration warnings).';
+export async function inspectGrokSubscription(session, cwd = session.home) {
+    const result = await session.execution.execute({
+        command: session.command,
+        args: ['inspect', '--json'],
+        cwd,
+        env: session.env,
+        envMode: 'replace',
+        timeout: 5_000
+    });
+    // Four different conditions used to share one sentence, so a machine that
+    // could not run the CLI at all read exactly like a profile carrying an
+    // unsafe key. Each says which one it is; none quotes a configuration value.
+    if (result.timedOut) {
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', `Grok Build did not answer \`inspect\` in time. Run: ${GROK_SUBSCRIPTION_STATUS_COMMAND}`);
+    }
+    if (result.exitCode !== 0) {
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', `Grok Build's \`inspect\` exited ${result.exitCode ?? 'without a code'}. Run: ${GROK_SUBSCRIPTION_STATUS_COMMAND}`);
+    }
+    let inspection;
+    try {
+        inspection = JSON.parse(result.stdout);
+    }
+    catch (error) {
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', INSPECTION_UNVERIFIABLE, { cause: error });
+    }
+    const parsed = inspectionSchema.safeParse(inspection);
+    if (!parsed.success) {
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', INSPECTION_UNVERIFIABLE);
+    }
+    const unsafe = await describeUnsafeNativeConfiguration(session, parsed.data.configSources.layers);
+    if (unsafe) {
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', unsafe);
+    }
+}
+/**
+ * Return null when the dedicated profile carries nothing but the vendor's own
+ * bookkeeping, or a sentence naming WHY it does not. Key PATHS are named (a
+ * key path is not a secret); values never are, because a value can be one.
+ */
+/** Compare profile paths without caring which slash the host or the CLI used. */
+function profilePath(value) {
+    return value.replaceAll('\\', '/').replace(/\/+$/, '');
+}
+/** A layer belongs to the dedicated profile when it sits under its directory. */
+function isInsideProfile(session, path) {
+    const home = profilePath(session.home);
+    const candidate = profilePath(path);
+    return candidate === home || candidate.startsWith(`${home}/`);
+}
+async function describeUnsafeNativeConfiguration(session, layers) {
+    if (layers.length === 0)
+        return null;
+    // Grok discovers its own home layout: running inside the profile it reports
+    // `managed_config.toml` and `requirements.toml` alongside `config.toml`,
+    // both `note: "empty"` (measured 2026-09-06, grok 1.0.21). Empty files that
+    // live inside the dedicated profile carry nothing and are admitted; a layer
+    // outside the profile, or a non-empty layer that is not the profile's own
+    // `config.toml`, is not.
+    const outside = layers.find((layer) => !isInsideProfile(session, layer.path));
+    if (outside) {
+        return 'Grok Build is loading configuration from outside its dedicated Vibes profile, so the subscription route cannot be trusted.';
+    }
+    const substantive = layers.filter((layer) => layer.note !== 'empty');
+    if (substantive.some((layer) => layer.role !== 'user' || profilePath(layer.path) !== profilePath(session.configPath))) {
+        return "Grok Build's dedicated profile carries a configuration layer other than its own user config, so the subscription route cannot be trusted.";
+    }
+    if (substantive.length === 0)
+        return null;
+    let content;
+    try {
+        content = await readDedicatedProfileFile(session, session.configPath);
+    }
+    catch (error) {
+        if (error instanceof Error && grokSubscriptionCode(error) !== undefined)
+            throw error;
+        // Adapter diagnostics can include configuration values: only the sentence leaves.
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', "Grok Build's dedicated profile could not be read on this host.");
+    }
+    const toml = attempt(() => parseToml(content));
+    if (!toml.ok) {
+        // Parser diagnostics quote the offending line, values included: only the sentence leaves.
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', "Grok Build's dedicated profile is not valid TOML.");
+    }
+    const parsed = nativeBookkeepingSchema.safeParse(toml.value);
+    if (parsed.success)
+        return null;
+    // A strict object reports an unrecognized key on the PARENT's path, with the
+    // offending names in `keys`; anything else (a wrong type) is named by its
+    // own path. Neither carries a value.
+    const keys = Array.from(new Set(parsed.error.issues.flatMap((issue) => {
+        const prefix = issue.path.join('.');
+        if (issue.code === 'unrecognized_keys') {
+            return issue.keys.map((key) => (prefix ? `${prefix}.${key}` : key));
+        }
+        return prefix ? [prefix] : [];
+    }))).sort();
+    return keys.length > 0
+        ? `Grok Build's dedicated profile carries configuration outside native bookkeeping (${keys.join(', ')}); only Grok's own bookkeeping is admitted, so the subscription route cannot be trusted.`
+        : "Grok Build's dedicated profile carries configuration outside native bookkeeping, so the subscription route cannot be trusted.";
+}
+/** What the CLI prints when the profile is not signed in. */
+const SIGNED_OUT_OUTPUT = /not authenticated|not signed in|no auth credentials|authentication required|failed to fetch models/i;
+/**
+ * Whether the dedicated profile is signed in: `true` (the catalog was listed),
+ * `false` (the CLI said it is signed out), or a typed `STATUS_CHECK_FAILED`
+ * when the check itself failed (a non-zero exit, output that says neither). A
+ * failed check is never reported as "not signed in": the caller would send the
+ * user to sign in again for a failure that signing in does not fix.
+ */
+export async function checkGrokSubscription(session, timeout) {
+    await inspectGrokSubscription(session);
+    const result = await session.execution.execute({
+        command: session.command,
+        args: ['models'],
+        cwd: session.home,
+        env: session.env,
+        envMode: 'replace',
+        timeout
+    });
+    if (result.timedOut)
+        throw grokSubscriptionError('AUTH_TIMEOUT', 'Grok authentication check timed out');
+    const output = `${result.stdout}\n${result.stderr}`;
+    if (SIGNED_OUT_OUTPUT.test(output))
+        return false;
+    if (result.exitCode === 0 && /Available models:/i.test(output))
+        return true;
+    throw grokSubscriptionError('STATUS_CHECK_FAILED', 'Grok Build could not report the subscription status; this is a failed check, not a sign-out', { cause: new Error(`models exited ${result.exitCode ?? 'without a code'}`) });
+}
+/** The declared bounds of a buffered native operation's output. */
+export const GROK_PROCESS_OUTPUT_LIMITS = {
+    /** Bytes of stdout kept; more stops the child and fails the operation. */
+    maxStdoutBytes: 8_388_608,
+    /** Characters of stderr kept (the tail); stderr is a diagnostic that never leaves the owner. */
+    maxStderrChars: 65_536
+};
+/**
+ * Drain a child's streams within `limits`: stdout past its cap stops the child
+ * (`onOverflow`) and is reported, stderr keeps its tail. Lines go to `onLine`
+ * as they complete.
+ */
+async function collectBoundedOutput(child, limits, onOverflow, onLine) {
+    let overflowed = false;
+    const drain = async (stream, name) => {
+        if (!stream)
+            return '';
+        const reader = stream.getReader();
+        const decoder = new TextDecoder();
+        let kept = '';
+        let bytes = 0;
+        let pending = '';
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (name === 'stdout') {
+                    bytes += value.length;
+                    if (bytes > limits.maxStdoutBytes) {
+                        overflowed = true;
+                        onOverflow();
+                        await reader.cancel();
+                        return kept;
+                    }
+                }
+                const text = decoder.decode(value, { stream: true });
+                kept = name === 'stderr' ? (kept + text).slice(-limits.maxStderrChars) : kept + text;
+                pending += text;
+                const lines = pending.split('\n');
+                pending = (lines.pop() ?? '').slice(-limits.maxStderrChars);
+                // A line is a prompt for the user (a device code), not a log: it is bounded like the output.
+                for (const line of lines)
+                    if (line.length > 0)
+                        onLine?.(name, line.slice(0, limits.maxStderrChars));
+            }
+            const tail = decoder.decode();
+            kept = name === 'stderr' ? (kept + tail).slice(-limits.maxStderrChars) : kept + tail;
+            pending += tail;
+            if (pending.length > 0)
+                onLine?.(name, pending.slice(0, limits.maxStderrChars));
+            return kept;
+        }
+        finally {
+            reader.releaseLock();
+        }
+    };
+    const [exit, stdout, stderr] = await Promise.all([
+        child.exited,
+        drain(child.stdout, 'stdout'),
+        drain(child.stderr, 'stderr')
+    ]);
+    return { code: exit.code, stdout, stderr, overflowed };
+}
+/** Buffered native operation with real cancellation; raw diagnostics never leave the owner. */
+export async function runGrokSubscription(session, args, timeout, signal, onLine) {
+    if (signal?.aborted)
+        throw grokSubscriptionError('AUTH_CANCELLED', 'Grok operation cancelled');
+    const started = Date.now();
+    const child = await session.execution.spawn({
+        command: session.command,
+        args,
+        cwd: session.home,
+        env: session.env,
+        envMode: 'replace',
+        stdin: 'ignore',
+        stdout: 'pipe',
+        stderr: 'pipe'
+    });
+    let timedOut = false;
+    let cancelForceStop;
+    const cancel = () => {
+        child.kill('SIGTERM');
+        if (cancelForceStop)
+            return;
+        const armed = attempt(() => session.runtime.lifecycle.timeout(() => child.kill('SIGKILL'), 1_000));
+        // A runtime that is ending starts no timers, so nothing could wait out the grace: the child is stopped for good now.
+        if (!armed.ok)
+            child.kill('SIGKILL');
+        else
+            cancelForceStop = armed.value;
+    };
+    const cancelTimer = session.runtime.lifecycle.timeout(() => {
+        timedOut = true;
+        cancel();
+    }, timeout);
+    signal?.addEventListener('abort', cancel, { once: true });
+    if (signal?.aborted)
+        cancel();
+    try {
+        const output = await collectBoundedOutput(child, GROK_PROCESS_OUTPUT_LIMITS, cancel, onLine);
+        if (signal?.aborted)
+            throw grokSubscriptionError('AUTH_CANCELLED', 'Grok operation cancelled');
+        if (output.overflowed)
+            throw grokSubscriptionError('GENERATION_FAILED', 'Grok Build wrote more output than the declared maximum');
+        return {
+            exitCode: output.code,
+            stdout: output.stdout,
+            stderr: output.stderr,
+            timedOut,
+            durationMs: Date.now() - started
+        };
+    }
+    finally {
+        cancelTimer();
+        cancelForceStop?.();
+        signal?.removeEventListener('abort', cancel);
+        child.kill('SIGTERM');
+    }
+}
+/**
+ * Sign the dedicated profile in.
+ *
+ * With no `onMessage` this is Grok's browser OAuth flow, and the CLI's output
+ * stays inside this boundary as every other subscription operation's does.
+ * With one, it is the device-code flow instead: the verification URL and user
+ * code are streamed to the caller as Grok prints them, because a headless host
+ * has no browser to open and a device code is worthless to anyone who cannot
+ * also answer the prompt. Either way the credential Grok stores afterwards
+ * never crosses this boundary.
+ */
+export async function loginGrokSubscription(session, options = {}) {
+    const { onMessage } = options;
+    return await runGrokSubscription(session, ['login', onMessage ? '--device-auth' : '--oauth'], options.timeout ?? GROK_SUBSCRIPTION_LOGIN_TIMEOUT_MS, options.signal, onMessage
+        ? (_stream, line) => {
+            const text = line.trim();
+            if (text.length > 0)
+                onMessage(text);
+        }
+        : undefined);
+}
+/**
+ * Read one file from the dedicated profile through the consumer host adapter.
+ * Native profile state does not belong to the active workspace projection.
+ */
+export async function readDedicatedProfileFile(session, path) {
+    const filesystem = await resolveHostFilesystem(session, 'read');
+    if (!filesystem)
+        throw grokSubscriptionError('SUBSCRIPTION_ROUTE_UNVERIFIED', 'No consumer filesystem adapter can read the Grok profile on this host.');
+    const raw = await filesystem.readFile(path, 'utf8');
+    return raw instanceof Uint8Array ? new TextDecoder().decode(raw) : raw;
+}
+/**
+ * The consumer host's own file adapter for `capability`, never an active
+ * workspace's contained projection, or `undefined` when the host composes none.
+ */
+export async function resolveHostFilesystem(session, capability) {
+    const query = session.runtime
+        .query('filesystem/adapter')
+        .enabled();
+    const hostAdapter = query
+        .descriptors()
+        .find((descriptor) => !descriptor.cloudNative &&
+        (!descriptor.hardware || descriptor.hardware.includes('consumer')) &&
+        descriptor.protocols.includes('file') &&
+        descriptor.capabilities.includes(capability));
+    return hostAdapter ? query.withId(hostAdapter.id).resolve() : undefined;
+}
+/**
+ * The typed failure for a subscription operation that failed outside the
+ * owner's own refusals. The underlying diagnostic can carry configuration
+ * values, so only this fixed sentence leaves the owner.
+ */
+export function grokSubscriptionUnavailable() {
+    return grokSubscriptionError('SUBSCRIPTION_UNAVAILABLE', 'Grok subscription execution is unavailable on this consumer host');
+}
+//# sourceMappingURL=grok-subscription.js.map

package/dist/ai/providers/grok/grok-subscription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-subscription.js","sourceRoot":"","sources":["../../../../src/ai/providers/grok/grok-subscription.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,yBAAyB,EAA6B,MAAM,kCAAkC,CAAC;AACnJ,OAAO,EACN,eAAe,EACf,eAAe,EACf,iBAAiB,EAIjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,mBAAmB,EAKnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAKlE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAG5D;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,+BAA+B,CAAC;AAE/E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,OAAO,CAAC;AAE1D,MAAM,eAAe,GAAG;IACvB,MAAM;IACN,MAAM;IACN,SAAS;IACT,QAAQ;IACR,KAAK;IACL,MAAM;IACN,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,cAAc;IACd,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,iBAAiB;IACjB,iBAAiB;IACjB,0BAA0B;IAC1B,YAAY;IACZ,aAAa;IACb,WAAW;IACX,UAAU;IACV,YAAY;IACZ,aAAa;IACb,WAAW;IACX,UAAU;IACV,eAAe;IACf,cAAc;CACL,CAAC;AAKX,uGAAuG;AACvG,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,eAAe,EAAE,kBAAkB;IACnC,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,gBAAgB;CACd,CAAC;AAIX;;;GAGG;AACH,MAAM,qBAAqB,GAAG;IAC7B,yBAAyB,EAAE;QAC1B,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,2BAA2B;QACnC,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,yBAAyB,CAAC,eAAe,EAAE;KACxF;IACD,eAAe,EAAE;QAChB,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,yBAAyB,CAAC,GAAG,EAAE;KAC5E;IACD,6BAA6B,EAAE;QAC9B,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE,yBAAyB,CAAC,KAAK,EAAE;KAC9E;IACD,qBAAqB,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,EAAE;IAC9F,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE;IACtE,kBAAkB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE;IAClF,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE;IAC5E,eAAe,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE;IAClF,iBAAiB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE;IACpF,mBAAmB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,EAAE;IACxF,wBAAwB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,EAAE;CAIlG,CAAC;AAGF,SAAS,mBAAmB,CAAC,YAAkC;IAC9D,OAAO,EAAE,YAAY,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACpC,YAAkC,EAClC,OAAe,EACf,UAA+B,EAAE;IAEjC,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;QAC7E,MAAM,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM;QAClD,OAAO,EAAE,mBAAmB,CAAC,YAAY,CAAC;QAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,KAAY;IAChD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAgB;IAC/D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,CAAC;AACnF,CAAC;AAWD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAmB;IAEnB,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,qBAAqB,CAC1B,2BAA2B,EAC3B,gEAAgE,CAChE,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,oBAAoB;IACpB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACrD,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC;QACpC,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO;QACzB,MAAM,qBAAqB,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE;YAC7E,IAAI,EAAE,KAAK,CAAC,QAAQ;YACpB,SAAS,EAAE,IAAI;YACf,yBAAyB,EAAE,GAAG;YAC9B,wBAAwB,EAAE,GAAG;YAC7B,WAAW,EAAE,GAAG;SAChB,EAAE,CAAC,CAAC;IACL,MAAM,OAAO,GAAG;QACf,OAAO;QACP,SAAS;QACT,OAAO;QACP,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC3C,GAAG;KACH,CAAC;IACF,gFAAgF;IAChF,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,uBAAuB,GAC5B,4KAA4K,CAAC;AAE9K,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAgC,EAChC,GAAG,GAAG,OAAO,CAAC,IAAI;IAElB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC3B,GAAG;QACH,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,KAAK;KACd,CAAC,CAAC;IACH,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,qBAAqB,CAC1B,+BAA+B,EAC/B,uDAAuD,gCAAgC,EAAE,CACzF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,qBAAqB,CAC1B,+BAA+B,EAC/B,mCAAmC,MAAM,CAAC,QAAQ,IAAI,gBAAgB,UAAU,gCAAgC,EAAE,CAClH,CAAC;IACH,CAAC;IACD,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,qBAAqB,CAAC,+BAA+B,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,qBAAqB,CAAC,+BAA+B,EAAE,uBAAuB,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,iCAAiC,CACrD,OAAO,EACP,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAChC,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,qBAAqB,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,iFAAiF;AACjF,SAAS,WAAW,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,OAAgC,EAAE,IAAY;IACtE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC/C,OAAgC,EAChC,MAA4D;IAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,EAAE,CAAC;QACb,OAAO,4HAA4H,CAAC;IACrI,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACrE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvH,OAAO,2IAA2I,CAAC;IACpJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC;QACrF,kFAAkF;QAClF,MAAM,qBAAqB,CAC1B,+BAA+B,EAC/B,gEAAgE,CAChE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACd,0FAA0F;QAC1F,MAAM,qBAAqB,CAAC,+BAA+B,EAAE,mDAAmD,CAAC,CAAC;IACnH,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,6EAA6E;IAC7E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CACtB,IAAI,GAAG,CACN,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/B,CAAC,CAAC,CACF,CACD,CAAC,IAAI,EAAE,CAAC;IACT,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,oFAAoF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0FAA0F;QAC/L,CAAC,CAAC,+HAA+H,CAAC;AACpI,CAAC;AAED,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,qGAAqG,CAAC;AAEhI;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAgC,EAChC,OAAe;IAEf,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,GAAG,EAAE,OAAO,CAAC,IAAI;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,SAAS;QAClB,OAAO;KACP,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ;QAClB,MAAM,qBAAqB,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IACpD,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,qBAAqB,CAC1B,qBAAqB,EACrB,6FAA6F,EAC7F,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC,EAAE,CAC5E,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,0EAA0E;IAC1E,cAAc,EAAE,SAAS;IACzB,gGAAgG;IAChG,cAAc,EAAE,MAAM;CACb,CAAC;AASX;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAClC,KAAoB,EACpB,MAAyC,EACzC,UAAsB,EACtB,MAAuC;IAEvC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,KAAK,GAAG,KAAK,EAClB,MAAyC,EACzC,IAAyB,EACP,EAAE;QACpB,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,SAAS,CAAC;gBACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;oBACtB,IAAI,KAAK,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;wBACnC,UAAU,GAAG,IAAI,CAAC;wBAClB,UAAU,EAAE,CAAC;wBACb,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;wBACtB,OAAO,IAAI,CAAC;oBACb,CAAC;gBACF,CAAC;gBACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;gBACrF,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC5D,6FAA6F;gBAC7F,KAAK,MAAM,IAAI,IAAI,KAAK;oBAAE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;wBAAE,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;YACrF,OAAO,IAAI,IAAI,CAAC;YAChB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YAChF,OAAO,IAAI,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,WAAW,EAAE,CAAC;QACtB,CAAC;IACF,CAAC,CAAC;IACF,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC7B,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAgC,EAChC,IAAc,EACd,OAAe,EACf,MAAoB,EACpB,MAA4B;IAE5B,IAAI,MAAM,EAAE,OAAO;QAClB,MAAM,qBAAqB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,IAAI;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,eAAyC,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,IAAI,eAAe;YAAE,OAAO;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACnG,qHAAqH;QACrH,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;;YAChC,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IACpC,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;QAC1D,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,EAAE,CAAC;IACV,CAAC,EAAE,OAAO,CAAC,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7F,IAAI,MAAM,EAAE,OAAO;YAClB,MAAM,qBAAqB,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,UAAU;YACpB,MAAM,qBAAqB,CAC1B,mBAAmB,EACnB,wDAAwD,CACxD,CAAC;QACH,OAAO;YACN,QAAQ,EAAE,MAAM,CAAC,IAAI;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ;YACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACH,CAAC;YAAS,CAAC;QACV,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,EAAE,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;AACF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAgC,EAChC,UAII,EAAE;IAEN,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC9B,OAAO,MAAM,mBAAmB,CAC/B,OAAO,EACP,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,EAClD,OAAO,CAAC,OAAO,IAAI,kCAAkC,EACrD,OAAO,CAAC,MAAM,EACd,SAAS;QACR,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACF,CAAC,CAAC,SAAS,CACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAgC,EAChC,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU;QACd,MAAM,qBAAqB,CAC1B,+BAA+B,EAC/B,wEAAwE,CACxE,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,OAAO,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAgC,EAChC,UAA4B;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO;SAC3B,KAAK,CAA0D,oBAAoB,CAAC;SACpF,OAAO,EAAE,CAAC;IACZ,MAAM,WAAW,GAAG,KAAK;SACvB,WAAW,EAAE;SACb,IAAI,CACJ,CAAC,UAAU,EAAE,EAAE,CACd,CAAC,UAAU,CAAC,WAAW;QACvB,CAAC,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAClE,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC7C,CAAC;IACH,OAAO,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IAC1C,OAAO,qBAAqB,CAC3B,0BAA0B,EAC1B,kEAAkE,CAClE,CAAC;AACH,CAAC"}