@wrongstack/cli 0.284.1 → 0.286.0

package/README.md

@@ -20,7 +20,7 @@ wstack --tui                  # Ink-based TUI
 wstack desktop                # Electron desktop app (same as --desktop)
 wstack webui                  # project WebUI (same as --webui)
 wstack hq                     # project-independent HQ dashboard (same as --hq)
-wstack --yolo                 # auto-approve normal project work; destructive calls still prompt
+wstack --yolo                 # auto-approve tool calls unless explicitly denied
 wstack "refactor src/auth.ts" # one-shot query (no interactive loop)
 
 wstack --provider <id> --model <id>   # skip the picker
@@ -101,9 +101,9 @@ API keys are encrypted at rest with AES-256-GCM and the key file at `~/.wrongsta
 | `--desktop` | Open WrongStack Desktop (also `wstack desktop`) |
 | `--webui` | Serve the project WebUI (also `wstack webui`) |
 | `--hq` | Start the project-independent HQ dashboard (also `wstack hq`) |
-| `--yolo` | Auto-approve normal in-project tool calls |
-| `--confirm-destructive` | Deprecated; destructive confirmations are always on in YOLO |
-| `--yolo-destructive` | Deprecated compatibility flag; destructive calls still prompt |
+| `--yolo` | Auto-approve tool calls unless explicitly denied |
+| `--confirm-destructive` | Deprecated compatibility flag; YOLO no longer prompts by destructiveness |
+| `--yolo-destructive` | Deprecated compatibility flag; YOLO no longer prompts by destructiveness |
 | `--force-all-yolo` | Deprecated alias for `--yolo-destructive` |
 | `--provider <id>` | Override the configured provider |
 | `--model <id>` | Override the configured model |

package/dist/acp-registry-cache.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Local cache for the official ACP registry snapshot.
+ *
+ * `wstack acp sync` / `/acp sync` call `refreshAcpRegistry`, which fetches the
+ * CDN snapshot (via `@wrongstack/acp`'s `fetchAcpRegistry`) and writes it to
+ * `~/.wrongstack/cache/acp-registry.json`. `loadCachedAcpRegistry` reads it
+ * back into the `AcpLiveCatalog` shape the resolver consumes. No network at
+ * load time; resolution falls back to the bundled static catalog when no
+ * cache exists.
+ */
+import { type ACPAgentDescriptor, type AcpLiveCatalog } from '@wrongstack/acp';
+import type { WstackPaths } from '@wrongstack/core';
+export interface LoadedAcpRegistry {
+    fetchedAt: string;
+    /** Resolver input: registry-id → spawn command. */
+    byId: AcpLiveCatalog;
+    /** Full descriptors, for listing. */
+    agents: ACPAgentDescriptor[];
+}
+/** Where the synced registry snapshot lives. */
+export declare function acpRegistryCachePath(paths: WstackPaths): string;
+/** Read the cached registry, or `null` if it's missing or unreadable. */
+export declare function loadCachedAcpRegistry(paths: WstackPaths): Promise<LoadedAcpRegistry | null>;
+/** Fetch the live registry and persist it. Throws on network/parse failure. */
+export declare function refreshAcpRegistry(paths: WstackPaths, opts?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}): Promise<{
+    count: number;
+    location: string;
+    fetchedAt: string;
+}>;
+//# sourceMappingURL=acp-registry-cache.d.ts.map

package/dist/acp-registry-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acp-registry-cache.d.ts","sourceRoot":"","sources":["../src/acp-registry-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AASpD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,EAAE,cAAc,CAAC;IACrB,qCAAqC;IACrC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,gDAAgD;AAChD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAE/D;AAED,yEAAyE;AACzE,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAkBnC;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,WAAW,EAClB,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAUjE"}

package/dist/acp-server-agent.d.ts

@@ -0,0 +1,66 @@
+/**
+ * ACP server → real WrongStack Agent wiring.
+ *
+ * `wstack acp` exposes WrongStack as an ACP v1 agent so any ACP-capable
+ * client (Zed, JetBrains, VS Code ACP extension, etc.) can drive it. The
+ * server-side `runTurn` adapter (`makeACPServerAgentTurn` in `@wrongstack/acp`)
+ * needs a factory that produces a fresh, isolated `Agent` per session — this
+ * module is that factory, reusing the same boot pieces the interactive CLI
+ * uses (`setupProvider`, `createDefaultContainer`, builtin tools).
+ *
+ * Scope: a minimal but real agent. It deliberately does NOT wire MCP servers,
+ * compaction middleware, model-runtime overlays, or lifecycle hooks — those
+ * belong in the interactive host. The ACP server is a headless single-turn
+ * surface; a future PR can layer richer session behaviour if needed.
+ */
+import { Agent, type Logger, type PermissionDecision, type PermissionPolicy, type Tool } from '@wrongstack/core';
+import type { RunTurnApi } from '@wrongstack/acp/agent';
+import type { SubcommandDeps } from './subcommands/index.js';
+/**
+ * Error thrown when the server cannot start because no model provider is
+ * configured. The CLI handler catches this and prints a actionable message
+ * (`wstack auth`) rather than a stack trace.
+ */
+export declare class AcpServerConfigError extends Error {
+    constructor(message: string);
+}
+export interface AcpAgentFactoryOptions {
+    /** Caller-supplied logger; a minimal stderr logger is created when omitted. */
+    logger?: Logger | undefined;
+}
+/**
+ * Permission policy that routes side-effecting tool calls to the connected
+ * ACP client via `session/request_permission` (the v1-correct behavior),
+ * while auto-approving read-only/safe tools. This replaces the blanket
+ * auto-approve so an editor driving WrongStack-as-agent gets a real
+ * permission prompt before file writes / shell commands run.
+ *
+ * Exported for direct regression testing of the malformed-response path —
+ * `acp-server-agent.test.ts` injects a response whose `optionId` is missing
+ * (which previously threw a TypeError at `outcome.optionId.startsWith(...)`
+ * and was misattributed to "no permission channel" by the surrounding
+ * try/catch). Production callers go through `buildAcpServerAgentFactory`,
+ * which constructs this internally when the client exposes a permission
+ * channel.
+ */
+export declare class ACPClientPermissionPolicy implements PermissionPolicy {
+    private readonly requestPermission;
+    constructor(requestPermission: RunTurnApi['requestPermission']);
+    evaluate(tool: Tool, input: unknown): Promise<PermissionDecision>;
+    trust(): Promise<void>;
+    deny(): Promise<void>;
+    denyOnce(): void;
+    allowOnce(): void;
+    reload(): Promise<void>;
+}
+/**
+ * Build a per-session `Agent` factory suitable for `makeACPServerAgentTurn`.
+ *
+ * The provider registry + container are built once (they're stateless across
+ * sessions); each `agentFor(sessionId, cwd)` call builds a fresh `EventBus`,
+ * `Context`, and `Agent` so sessions stay isolated per the v1 spec.
+ *
+ * Throws `AcpServerConfigError` up front if no provider is configured.
+ */
+export declare function buildAcpServerAgentFactory(deps: SubcommandDeps, options?: AcpAgentFactoryOptions): (sessionId: string, cwd: string, api?: RunTurnApi) => Promise<Agent>;
+//# sourceMappingURL=acp-server-agent.d.ts.map

package/dist/acp-server-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acp-server-agent.d.ts","sourceRoot":"","sources":["../src/acp-server-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,KAAK,EAML,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EAErB,KAAK,IAAI,EAKV,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AASD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAA0B,YAAW,gBAAgB;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAA9C,YAA6B,iBAAiB,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAI;IAE7E,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6BtE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;IAC9B,QAAQ,IAAI,IAAI,CAAG;IACnB,SAAS,IAAI,IAAI,CAAG;IACd,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAG;CACjC;AAmID;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,sBAA2B,GACnC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,KAAK,OAAO,CAAC,KAAK,CAAC,CAmHtE"}

package/dist/arg-parser.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Unified CLI argument parsing. Three parsers that were previously
+ * spread across index.ts, subcommands/index.ts, and slash-commands/index.ts.
+ */
+/** Flags that are boolean-only (no value expected after them). */
+export declare const BOOLEAN_FLAGS: Set<string>;
+export interface ParsedArgs {
+    flags: Record<string, string | boolean>;
+    positional: string[];
+}
+/** Parse top-level `wstack` CLI args. */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export interface AuthFlags {
+    positional: string[];
+    label?: string | undefined;
+    family?: import('@wrongstack/core').WireFamily | undefined;
+    baseUrl?: string | undefined;
+    envVars?: string[] | undefined;
+}
+/** Parse `wstack auth <provider> [--label ...] [--family ...] [...]` flags. */
+export declare function parseAuthFlags(args: string[]): AuthFlags;
+export interface SpawnFlags {
+    description: string;
+    opts: {
+        provider?: string | undefined;
+        model?: string | undefined;
+        tools?: string[] | undefined;
+        name?: string | undefined;
+    };
+}
+/**
+ * Parse `/spawn` flags from the args head. Supported:
+ *   --provider=<id> / -p <id>   override the subagent's provider id
+ *   --model=<id>    / -m <id>   override the subagent's model
+ *   --name=<label>  / -n <label> display name
+ *   --tools=a,b,c               restrict the subagent's tool slice
+ *
+ * Anything after the last flag is the task description.
+ */
+export declare function parseSpawnFlags(input: string): SpawnFlags;
+//# sourceMappingURL=arg-parser.d.ts.map

package/dist/arg-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-parser.d.ts","sourceRoot":"","sources":["../src/arg-parser.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,aAwCxB,CAAC;AAIH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;IACxC,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,yCAAyC;AACzC,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAoCpD;AA6BD,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,kBAAkB,EAAE,UAAU,GAAG,SAAS,CAAC;IAC3D,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAChC;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAyBxD;AAID,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CA8CzD"}

package/dist/auth-menu/add-provider.d.ts

@@ -0,0 +1,15 @@
+import type { ProviderConfig, ResolvedProvider } from '@wrongstack/core';
+import type { AuthMenuDeps } from './types.js';
+export declare function addFromCatalog(deps: AuthMenuDeps): Promise<boolean>;
+/**
+ * Prompt for family/baseUrl/alias overrides, then add a key.
+ * Returns true if a key was added.
+ *
+ * Exported for the TUI auth panel: the panel does its own catalog
+ * selection (searchable list) and then drives this flow through the
+ * prompt bridge for the override/label/key questions.
+ */
+export declare function addKeyForCatalogProvider(deps: AuthMenuDeps, chosen: ResolvedProvider): Promise<boolean>;
+export declare function addCustomProvider(deps: AuthMenuDeps): Promise<boolean>;
+export declare function addKeyForProvider(providerId: string, deps: AuthMenuDeps, template: Partial<ProviderConfig>): Promise<boolean>;
+//# sourceMappingURL=add-provider.d.ts.map

package/dist/auth-menu/add-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-provider.d.ts","sourceRoot":"","sources":["../../src/auth-menu/add-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAc,MAAM,kBAAkB,CAAC;AAerF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,wBAAsB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAwCzE;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CA0ElB;AAMD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAmE5E;AAsCD,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,GAChC,OAAO,CAAC,OAAO,CAAC,CAuClB"}

package/dist/auth-menu/anthropic-oauth.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Anthropic "Sign in with Claude" OAuth (Authorization Code + PKCE) — Claude
+ * Pro/Max subscription login. Parallel to the Codex flow but with Anthropic's
+ * endpoints and quirks:
+ *   - authorize at claude.ai/oauth/authorize (params include `code=true`),
+ *   - the OAuth `state` is the PKCE verifier (Anthropic's convention),
+ *   - JSON (not form) token exchange at platform.claude.com/v1/oauth/token,
+ *   - loopback callback on http://localhost:53692/callback.
+ *
+ * Stored under the canonical `anthropic-oauth` provider (family `anthropic-oauth`)
+ * so it never clobbers an API-key `anthropic` provider. The provider adapter
+ * adds the Bearer + beta headers and the required Claude Code system block.
+ */
+import type { AuthMenuDeps } from './types.js';
+export declare const CLAUDE_PROVIDER_ID = "anthropic-oauth";
+export interface ClaudeTokens {
+    access: string;
+    refresh: string;
+    expires: number;
+}
+export declare function generatePkce(): {
+    verifier: string;
+    challenge: string;
+};
+/** Build the Claude authorize URL. Anthropic uses the PKCE verifier as `state`. */
+export declare function buildAuthorizeUrl(challenge: string, verifier: string): string;
+export declare function parseAuthorizationInput(input: string): {
+    code?: string | undefined;
+    state?: string | undefined;
+};
+/** Exchange an authorization code (+ verifier, reused as state) for tokens. */
+export declare function exchangeAuthorizationCode(code: string, state: string, verifier: string, signal?: AbortSignal): Promise<ClaudeTokens>;
+export interface ClaudeLoginOptions {
+    providerId?: string;
+    /**
+     * External cancellation signal (e.g. the TUI auth panel's Esc). When
+     * provided, the flow does NOT install its own SIGINT handler — the
+     * caller owns cancellation.
+     */
+    signal?: AbortSignal | undefined;
+}
+export declare function runClaudeOAuthLogin(deps: AuthMenuDeps, opts?: ClaudeLoginOptions): Promise<number>;
+//# sourceMappingURL=anthropic-oauth.d.ts.map

package/dist/auth-menu/anthropic-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-oauth.d.ts","sourceRoot":"","sources":["../../src/auth-menu/anthropic-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAW/C,eAAO,MAAM,kBAAkB,oBAAoB,CAAC;AAGpD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAgB,YAAY,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAItE;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAY7E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG;IACtD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAwBA;AAkCD,+EAA+E;AAC/E,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,CAiBvB;AA0KD,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA8GjB"}

package/dist/auth-menu/auth-menu-audit.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Structured audit logger for the `wstack auth local` lifecycle.
+ *
+ * Emits JSON-line events to an injectable sink (default: stdout).
+ * The event names mirror the WebUI's WS message types
+ * (`provider.clear_models` ↔ `auth.local.clear`,
+ * `provider.undo_clear` ↔ `auth.local.undo`) so a downstream
+ * tool that filters on one convention finds the corresponding
+ * events on the other surface.
+ *
+ * Why a dedicated logger (vs. `console.log`)?
+ *   - **Test seam** — tests inject an in-memory array sink and
+ *     assert on the recorded events. `console.log` can't be
+ *     captured cleanly across the test runner / reporter.
+ *   - **Schema stability** — the discriminated union of
+ *     `AuthAuditEvent` types gives downstream consumers a
+ *     contract they can switch on. Plain `console.log` strings
+ *     drift on every commit.
+ *   - **Redaction built in** — every event passes through a
+ *     `SecretScrubber` before reaching the sink, so a Bearer
+ *     token accidentally captured in a payload can't echo to
+ *     stdout / the audit file in plaintext.
+ *
+ * The logger is intentionally minimal: no buffering, no
+ * rotation, no transport. The CLI process is short-lived and
+ * emits at most a handful of events per invocation. A
+ * long-running consumer (file rotation, OTLP export) would
+ * belong in a dedicated audit-sink module, not here.
+ */
+import { type SecretScrubber } from '@wrongstack/core';
+/**
+ * Discriminated union of every event the auth-menu local flow
+ * can emit. New events slot in here as the lifecycle grows —
+ * the `type` field is the stable contract.
+ */
+export type AuthAuditEvent = {
+    type: 'auth.local.add';
+    providerId: string;
+    baseUrl: string;
+    /** The resolved model list saved to disk. Empty when the
+     *  user didn't pass `--model`. */
+    models: string[];
+    /** Label of the saved key entry, if any. */
+    keyLabel?: string | undefined;
+} | {
+    /**
+     * Emitted when the save replaces a previously non-empty
+     * `cfg.models` allowlist with `[]`. Pairs with
+     * `auth.local.undo` — a search for both events in
+     * sequence surfaces a "user changed their mind" pair.
+     */
+    type: 'auth.local.clear';
+    providerId: string;
+    baseUrl: string;
+    /** The list the user just removed. */
+    previousModels: string[];
+} | {
+    /**
+     * Emitted when the save restores a non-empty `cfg.models`
+     * allowlist that was previously `[]` or absent. The
+     * `restoredModels` field carries the new list verbatim.
+     * Pairs with `auth.local.clear`.
+     */
+    type: 'auth.local.undo';
+    providerId: string;
+    baseUrl: string;
+    /** The list the user just restored. */
+    restoredModels: string[];
+} | {
+    /**
+     * Emitted when the `--model` flag was probe-driven
+     * (`'first'` / `'<N>'`) but the probe didn't return
+     * enough ids. The flag is silently ignored in that case
+     * — this event lets the audit log surface the silent
+     * skip.
+     */
+    type: 'auth.local.probe_skip';
+    providerId: string;
+    baseUrl: string;
+    requestedShape: 'first' | string;
+} | {
+    /**
+     * Emitted when the health probe failed AND the user chose
+     * to save anyway. Pairs with the probe result line in
+     * the terminal — the audit event is the durable record
+     * that the provider was saved in a known-bad state.
+     */
+    type: 'auth.local.probe_failed_save';
+    providerId: string;
+    baseUrl: string;
+    probeStatus: string;
+    probeDetail?: string | undefined;
+};
+/**
+ * Sink contract: receives the post-scrub, post-stringify event
+ * line. The default implementation writes to stdout; tests
+ * inject an in-memory array.
+ */
+export interface AuthAuditSink {
+    write(line: string): void;
+}
+/** Default sink: one JSON line per event on stdout. */
+export declare function defaultStdoutSink(): AuthAuditSink;
+/** Stderr sink: one JSON line per event on stderr. */
+export declare function defaultStderrSink(): AuthAuditSink;
+/**
+ * File sink: appends one JSON line per event to the named
+ * path. Uses synchronous append + newline so events are
+ * durable on process exit. Wraps any I/O failure as a thrown
+ * error so the caller can surface it.
+ */
+export declare function fileAuditSink(path: string): AuthAuditSink;
+/**
+ * Resolve the `--audit` flag value (parsed by `parseAuthFlags`)
+ * to a concrete `AuthAuditSink`. Returns `undefined` when the
+ * caller didn't pass `--audit` (no sink is wired and the
+ * audit log is silent).
+ *
+ * Resolution rules:
+ *   - `true` (bare `--audit`)         → stdout
+ *   - `'stdout'`                       → stdout
+ *   - `'stderr'`                       → stderr
+ *   - `'<file-path>'`                  → append to the file
+ *   - `undefined`                      → undefined (no sink)
+ */
+export declare function resolveAuditSink(flag: boolean | string | undefined): AuthAuditSink | undefined;
+/** In-memory sink for tests. Records every line verbatim. */
+export declare function memAuthAuditSink(): AuthAuditSink & {
+    lines: string[];
+};
+export interface AuthAuditLogger {
+    /** Emit an event. The payload is JSON-serialized, scrubbed,
+     *  and written to the sink. No-ops when the sink is
+     *  `undefined` (tests that don't care about the audit log
+     *  can pass `audit: undefined`). */
+    emit(event: AuthAuditEvent): void;
+}
+/** No-op logger for tests that don't need the audit log. */
+export declare const NOOP_AUDIT_LOGGER: AuthAuditLogger;
+/**
+ * Build the canonical logger. The `scrubber` runs over the
+ * serialized event so a Bearer token accidentally included
+ * in a payload (e.g. an echo from a misbehaving server) is
+ * redacted before reaching the sink.
+ */
+export declare function createAuthAuditLogger(sink: AuthAuditSink | undefined, scrubber?: SecretScrubber): AuthAuditLogger;
+/**
+ * Decide which audit event(s) to emit given the previous saved
+ * state and the new save's resolved values. Pure function —
+ * the caller is responsible for the actual `emit()` call so
+ * the same input always produces the same event list (and the
+ * test suite can pin it).
+ *
+ *   - `previousModels` is `undefined` when no prior entry
+ *     existed. `[]` means "the user previously cleared".
+ *   - `newModels` is `null` when the `--model` flag wasn't
+ *     passed (don't touch `cfg.models`). `[]` means "the user
+ *     passed `--model ''` to clear". A non-empty list is the
+ *     resolved list (probe-driven or literal).
+ */
+export declare function decideAuthLocalEvents(opts: {
+    providerId: string;
+    baseUrl: string;
+    previousModels: string[] | undefined;
+    newModels: string[] | null;
+    keyLabel: string | undefined;
+    probeSkip?: {
+        shape: 'first' | string;
+    } | undefined;
+    probeFailedSave?: {
+        status: string;
+        detail?: string;
+    } | undefined;
+}): AuthAuditEvent[];
+//# sourceMappingURL=auth-menu-audit.d.ts.map

package/dist/auth-menu/auth-menu-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-menu-audit.d.ts","sourceRoot":"","sources":["../../src/auth-menu/auth-menu-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,KAAK,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB;sCACkC;IAClC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,GACD;IACE;;;;;;OAMG;IACH,IAAI,EAAE,uBAAuB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,GAAG,MAAM,CAAC;CAClC,GACD;IACE;;;;;OAKG;IACH,IAAI,EAAE,8BAA8B,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,IAAI,aAAa,CAUjD;AAED,sDAAsD;AACtD,wBAAgB,iBAAiB,IAAI,aAAa,CAMjD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAWzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GACjC,aAAa,GAAG,SAAS,CAa3B;AAED,6DAA6D;AAC7D,wBAAgB,gBAAgB,IAAI,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAQtE;AAED,MAAM,WAAW,eAAe;IAC9B;;;wCAGoC;IACpC,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;CACnC;AAED,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,EAAE,eAE/B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,QAAQ,GAAE,cAA4C,GACrD,eAAe,CAYjB;AA0DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACpD,eAAe,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACnE,GAAG,cAAc,EAAE,CA4FnB"}

package/dist/auth-menu/direct.d.ts

@@ -0,0 +1,15 @@
+import type { WireFamily } from '@wrongstack/core';
+import type { AuthMenuDeps } from './types.js';
+/**
+ * One-shot add: used by `wstack auth <provider>` to skip the menu and
+ * append a single key. Honors --label / --family / --base-url / --env
+ * flags. If the label collides, we suffix with a counter.
+ */
+export declare function runAuthDirect(deps: AuthMenuDeps, opts: {
+    providerId: string;
+    label?: string | undefined;
+    family?: WireFamily | undefined;
+    baseUrl?: string | undefined;
+    envVars?: string[] | undefined;
+}): Promise<number>;
+//# sourceMappingURL=direct.d.ts.map

package/dist/auth-menu/direct.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct.d.ts","sourceRoot":"","sources":["../../src/auth-menu/direct.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AASnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;IACJ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,MAAM,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAChC,GACA,OAAO,CAAC,MAAM,CAAC,CA2DjB"}

package/dist/auth-menu/github-copilot-oauth.d.ts

@@ -0,0 +1,73 @@
+/**
+ * GitHub Copilot login — GitHub OAuth **device flow** (no loopback server).
+ *
+ *   1. POST github.com/login/device/code → user_code + verification_uri.
+ *   2. User opens the URL, enters the code; we poll login/oauth/access_token
+ *      until GitHub returns a long-lived OAuth token.
+ *   3. Exchange that token at api.github.com/copilot_internal/v2/token for a
+ *      short-lived Copilot token (the chat access token).
+ *
+ * Stored under the canonical `github-copilot` provider (family `github-copilot`,
+ * an OpenAI chat/completions-compatible wire). The GitHub OAuth token is the
+ * refresh token; the provider mints fresh Copilot tokens from it transparently.
+ */
+import type { AuthMenuDeps } from './types.js';
+export declare const COPILOT_PROVIDER_ID = "github-copilot";
+interface DeviceCode {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    interval: number;
+    expires_in: number;
+}
+/** Start the GitHub device flow. */
+export declare function startDeviceFlow(signal?: AbortSignal): Promise<DeviceCode>;
+/** Poll until the user authorizes; returns the GitHub OAuth token. */
+export declare function pollForGitHubToken(device: DeviceCode, signal: AbortSignal): Promise<string>;
+/** Shape of the fields we read from a `/models` entry (everything optional). */
+interface CopilotModelEntry {
+    id?: unknown;
+    model_picker_enabled?: unknown;
+    is_chat_default?: unknown;
+    is_chat_fallback?: unknown;
+    vendor?: unknown;
+    supported_endpoints?: unknown;
+    policy?: {
+        state?: unknown;
+    } | undefined;
+    capabilities?: {
+        type?: unknown;
+        supports?: {
+            tool_calls?: unknown;
+        } | undefined;
+    } | undefined;
+}
+/**
+ * Decide whether a Copilot `/models` entry is a chat model we can actually
+ * drive over this provider's wire.
+ *
+ * The provider POSTs to `…/chat/completions`, so the discriminators are:
+ *   - `capabilities.type === 'chat'` — drops embeddings and completion-only ids.
+ *   - `capabilities.supports.tool_calls` — the agent loop needs tool calling.
+ *   - `supported_endpoints` (when present) must include `/chat/completions`.
+ *     This is the key fix: `/responses`-only ids (the `*-picker` router models,
+ *     `gpt-5.4-mini-free-auto`, `mai-code-1-flash*`) advertise themselves in the
+ *     model picker but 400 on `/chat/completions`. Absent field ⇒ legacy chat
+ *     model (gpt-4o, gpt-4.1) ⇒ allowed.
+ *   - `policy.state !== 'disabled'` — disabled means the user hasn't enabled the
+ *     model in their GitHub Copilot settings; calling it would 403.
+ *   - `vendor !== 'Experimental'` — drops internal previews (trajectory-compaction).
+ */
+export declare function isUsableCopilotChatModel(item: CopilotModelEntry): boolean;
+export interface CopilotLoginOptions {
+    providerId?: string;
+    /**
+     * External cancellation signal (e.g. the TUI auth panel's Esc). When
+     * provided, the flow does NOT install its own SIGINT handler — the
+     * caller owns cancellation.
+     */
+    signal?: AbortSignal | undefined;
+}
+export declare function runCopilotOAuthLogin(deps: AuthMenuDeps, opts?: CopilotLoginOptions): Promise<number>;
+export {};
+//# sourceMappingURL=github-copilot-oauth.d.ts.map

package/dist/auth-menu/github-copilot-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-copilot-oauth.d.ts","sourceRoot":"","sources":["../../src/auth-menu/github-copilot-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAY/C,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,UAAU,UAAU;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAkCD,oCAAoC;AACpC,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAuC/E;AAED,sEAAsE;AACtE,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAqCjG;AAED,gFAAgF;AAChF,UAAU,iBAAiB;IACzB,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IACzC,YAAY,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAChG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAUzE;AAoCD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,YAAY,EAClB,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAkEjB"}

package/dist/auth-menu/helpers.d.ts

@@ -0,0 +1,7 @@
+import type { ProviderConfig } from '@wrongstack/core';
+import type { AuthMenuDeps } from './types.js';
+/** Thin wrapper — delegates to the shared config provider loader. */
+export declare function loadProviders(deps: AuthMenuDeps): Promise<Record<string, ProviderConfig>>;
+/** Thin wrapper — delegates to the shared atomic config mutator. */
+export declare function mutateProviders(deps: AuthMenuDeps, mutator: (providers: Record<string, ProviderConfig>) => void): Promise<void>;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/auth-menu/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/auth-menu/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,qEAAqE;AACrE,wBAAsB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAI/F;AAED,oEAAoE;AACpE,wBAAsB,eAAe,CACnC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,IAAI,GAC3D,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/auth-menu/index.d.ts

@@ -0,0 +1,8 @@
+export { runAuthDirect } from './direct.js';
+export { runTopMenu as runAuthMenu } from './top-menu.js';
+export type { AuthMenuDeps } from './types.js';
+export { runCodexOAuthLogin, refreshCodexToken, extractAccountId, fetchCodexModels, resolveCodexModels, FALLBACK_CODEX_MODELS, CODEX_CATALOG_FAMILIES, fallbackCodexModelIds, fallbackCodexProviderModels, filterCurrentCodexModelIds, isCodexCatalogModel, CODEX_PROVIDER_ID, CODEX_BASE_URL, type CodexLoginOptions, type CodexTokens, } from './openai-codex-oauth.js';
+export { runClaudeOAuthLogin, CLAUDE_PROVIDER_ID, type ClaudeLoginOptions, type ClaudeTokens, } from './anthropic-oauth.js';
+export { runCopilotOAuthLogin, COPILOT_PROVIDER_ID, type CopilotLoginOptions, } from './github-copilot-oauth.js';
+export { runAuthLocal, resolveModelList, probeLocalLlm, LOCAL_LLM_PRESETS, type RunAuthLocalOptions, type LocalLlmPresetEntry, type ProbeOptions, type ProbeResult, } from './local.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth-menu/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth-menu/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,IAAI,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}

package/dist/auth-menu/local-presets.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Local-LLM server presets — the single source of truth shared by the
+ * `wstack auth local` quick-add flow (`./local.ts`) and the startup
+ * provider picker (`../picker.ts`).
+ *
+ * This module holds ONLY the preset data + its type, with no runtime
+ * dependencies (no probe, no config vault). That lets the picker import
+ * the presets to surface keyless local gateways without dragging in the
+ * heavier auth-flow machinery. Keep these entries in sync with the
+ * wire-format presets in `@wrongstack/providers`.
+ */
+export interface LocalLlmPresetEntry {
+    /** Stable id used both for the config key and the --name flag. */
+    id: string;
+    /** Display name shown in the picker. */
+    label: string;
+    /** Default base URL for this server. */
+    defaultBaseUrl: string;
+    /**
+     * When true, no API key is needed — the shortcut saves the provider
+     * without prompting for a key. Use for servers that reject any
+     * Authorization header (Ollama).
+     */
+    noAuth: boolean;
+    /**
+     * Human-readable hint shown next to the entry — typically the upstream
+     * doc URL or the local port.
+     */
+    hint: string;
+}
+/**
+ * Single source of truth for the `wstack auth local` picker. Keep this
+ * in sync with the wire-format presets in `@wrongstack/providers`.
+ */
+export declare const LOCAL_LLM_PRESETS: readonly LocalLlmPresetEntry[];
+//# sourceMappingURL=local-presets.d.ts.map

package/dist/auth-menu/local-presets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-presets.d.ts","sourceRoot":"","sources":["../../src/auth-menu/local-presets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,mBAAmB,EA6BlD,CAAC"}