@xopcai/xopc 0.0.100 → 0.0.102

package/dist/src/agent/mcp/bundle-mcp-materialize.js

@@ -1,6 +1,6 @@
-import { init_string_coerce, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_string_coerce, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { buildSafeToolName, normalizeReservedToolNames } from "./bundle-mcp-names.js";
 import { setPluginToolMeta } from "./mcp-tool-meta.js";
 import crypto from "node:crypto";

package/dist/src/agent/mcp/bundle-mcp-runtime.js

@@ -1,6 +1,6 @@
-import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { resolveGlobalSingleton } from "../../utils/global-singleton.js";
 import { sanitizeServerName } from "./bundle-mcp-names.js";
 import { resolveConnectorSecretReferences } from "../../connectors/secret-store.js";

package/dist/src/agent/mcp/mcp-transport-config.js

@@ -1,6 +1,6 @@
-import { init_string_coerce, normalizeLowercaseStringOrEmpty } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_string_coerce, normalizeLowercaseStringOrEmpty } from "../../utils/string-coerce.js";
 import { resolveXopcMcpTransportAlias } from "../../config/mcp-config-normalize.js";
 import { sanitizeForLog } from "../../utils/sanitize-log.js";
 import { describeHttpMcpServerLaunchConfig, resolveHttpMcpServerLaunchConfig } from "./mcp-http.js";

package/dist/src/agent/mcp/mcp-transport.js

@@ -1,6 +1,6 @@
-import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { XopcStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";

package/dist/src/agent/memory/builtin-memory-store.js

@@ -1,6 +1,6 @@
-import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 import lockfile from "proper-lockfile";
 //#region src/agent/memory/builtin-memory-store.ts
 /**

package/dist/src/agent/memory/dreaming/deep-promotion.js

@@ -4,8 +4,8 @@ import { MEMORY_MD_FILENAME } from "./constants.js";
 import { clamp01, compareCandidatesByScore, computeCandidateScore, extractPromotionMarkers, isContaminatedSnippet, isExpiredEntry, isoDay, readFileLines, resolveDeepDefaults, sliceRange, snippetHash } from "./utils.js";
 import { loadDreamingStore, saveDreamingStore, withDreamingPromotionLock } from "./short-term-store.js";
 import { emptyDeepPhaseSkipped, writeDreamingDeepLastRun } from "./last-run.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/deep-promotion.ts
 init_logger();
 const log = createLogger("Dreaming:Deep");

package/dist/src/agent/memory/dreaming/events.js

@@ -1,6 +1,6 @@
 import { DREAMING_DIR_RELATIVE, DREAMING_EVENTS_LOG_RELATIVE } from "./constants.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/events.ts
 /**
 * Append a single event line to `memory/.dreams/events.jsonl`.

package/dist/src/agent/memory/dreaming/last-run.js

@@ -1,6 +1,6 @@
 import { DREAMING_LAST_RUN_RELATIVE } from "./constants.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/last-run.ts
 const DREAMING_LAST_RUN_FORMAT_VERSION = 2;
 function isRecord(v) {

package/dist/src/agent/memory/dreaming/light-sweep.js

@@ -4,8 +4,8 @@ import { DREAMING_DIR_RELATIVE } from "./constants.js";
 import { buildEntryKey, isoDay, normalizeMemoryPath, normalizeSnippetForHash, snippetHash } from "./utils.js";
 import { bumpEntryPhaseSignal, loadDreamingStore, saveDreamingStore } from "./short-term-store.js";
 import "./last-run.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/light-sweep.ts
 init_logger();
 const log = createLogger("Dreaming:Light");

package/dist/src/agent/memory/dreaming/preview.js

@@ -1,8 +1,8 @@
 import { MEMORY_MD_FILENAME } from "./constants.js";
 import { clamp01, compareCandidatesByScore, computeCandidateScore, extractPromotionMarkers, isContaminatedSnippet, isExpiredEntry, readFileLines, resolveDeepDefaults, sliceRange, snippetHash } from "./utils.js";
 import { loadDreamingStore } from "./short-term-store.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/preview.ts
 async function previewDreamingDeepPromotion(params) {
 	const cfg = resolveDeepDefaults(params.config);

package/dist/src/agent/memory/dreaming/rem-patterns.js

@@ -4,8 +4,8 @@ import { DREAMING_DIR_RELATIVE, DREAMS_MD_FILENAME, MS_PER_DAY } from "./constan
 import { isoDay } from "./utils.js";
 import { bumpEntryPhaseSignal, loadDreamingStore, saveDreamingStore } from "./short-term-store.js";
 import "./last-run.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/rem-patterns.ts
 init_logger();
 const log = createLogger("Dreaming:REM");

package/dist/src/agent/memory/dreaming/short-term-store.js

@@ -2,9 +2,9 @@ import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { SHORT_TERM_PROMOTION_LOCK_RELATIVE, SHORT_TERM_RECALL_STORE_RELATIVE } from "./constants.js";
 import { buildEntryKey, clamp01, isoDay, normalizeMemoryPath } from "./utils.js";
-import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/short-term-store.ts
 init_logger();
 const log = createLogger("Dreaming:Store");

package/dist/src/agent/memory/dreaming/utils.js

@@ -1,7 +1,7 @@
 import { DEFAULT_DEEP_CRON, DIVERSITY_WEIGHT, MS_PER_DAY, REINFORCEMENT_WEIGHT } from "./constants.js";
-import path from "node:path";
 import { createHash } from "node:crypto";
 import fs from "node:fs/promises";
+import path from "node:path";
 //#region src/agent/memory/dreaming/utils.ts
 /** Normalize a workspace-relative memory path: forward slashes, no odd ../ escapes at start. */
 function normalizeMemoryPath(rel) {

package/dist/src/agent/memory/memory-flush.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
 //#region src/agent/memory/memory-flush.ts
 init_logger();
 const log = createLogger("MemoryFlush");

package/dist/src/agent/memory/plugin-discovery.js

@@ -1,5 +1,5 @@
-import { dirname, join } from "node:path";
 import { readdir, stat } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region src/agent/memory/plugin-discovery.ts
 async function discoverMemoryPlugins() {

package/dist/src/agent/models/manager.js

@@ -1,6 +1,6 @@
-import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { getAllModels, getDefaultModelSync, init_providers, resolveModel } from "../../providers/index.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed, maybeRetryTurnAfterTransientLlmFailure } from "../orchestration/llm-turn-retry.js";

package/dist/src/agent/prompt/service-prompt-builder.js

@@ -1,6 +1,6 @@
-import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { DEFAULT_USER_FILENAME } from "../context/workspace.js";
 import { resolveSystemPromptBuildParams } from "./system-prompt-params.js";
@@ -9,8 +9,8 @@ import { createSkillConfigManager } from "../skills/config.js";
 import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { selectSkillsVisibleInPrompt } from "../skills/format-skills-prompt.js";
-import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 //#region src/agent/prompt/service-prompt-builder.ts
 /**
 * System Prompt Builder - Builds the complete system prompt

package/dist/src/agent/reply/post-compaction-context.js

@@ -1,7 +1,7 @@
 import { init_agent_scope, resolveAgentProfileDir } from "../agent-scope.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
-import { join, resolve } from "node:path";
 import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
 //#region src/agent/reply/post-compaction-context.ts
 init_agent_scope();
 const MAX_CONTEXT_CHARS = 1800;

package/dist/src/agent/reply/workspace-boundary-read.js

@@ -1,5 +1,5 @@
-import { resolve } from "node:path";
 import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
 //#region src/agent/reply/workspace-boundary-read.ts
 /**
 * Read a file relative to workspace root with path traversal guard and byte cap.

package/dist/src/agent/sandbox/path-policy.js

@@ -1,6 +1,6 @@
-import { homedir } from "node:os";
-import { isAbsolute, normalize, resolve, sep } from "node:path";
 import { realpathSync } from "node:fs";
+import { isAbsolute, normalize, resolve, sep } from "node:path";
+import { homedir } from "node:os";
 //#region src/agent/sandbox/path-policy.ts
 /**
 * Path safety validation for sandbox isolation.

package/dist/src/agent/service.js

@@ -1,9 +1,9 @@
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
-import { createLogger } from "../utils/logger/index.js";
-import { init_logger } from "../utils/logger.js";
 import { extractTextContent } from "./context/workspace.js";
 import { getWorkflowProgressBroker } from "./workflow/progress-broker.js";
 import "./workflow/index.js";
@@ -60,8 +60,8 @@ import { parseOutboundSessionKey } from "./service/parse-outbound-session-key.js
 import { cleanTrailingErrors } from "./memory/message-sanitizer.js";
 import { MemoryFlushService } from "./memory/memory-flush.js";
 import { tryApplySessionTranscriptHygiene } from "./transcript/transcript-hygiene.js";
-import { join } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 //#region src/agent/service.ts
 init_schema();
 init_logger();

package/dist/src/agent/session/session-inspector.js

@@ -1,6 +1,6 @@
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { resolveEffectiveReasoningLevel, resolveEffectiveThinkingLevel } from "../../session/thinking-resolve.js";
 import { effectiveWorkspacePathForSession } from "../../session/session-workspace.js";
 import "../../session/index.js";

package/dist/src/agent/skills/config.js

@@ -1,7 +1,7 @@
 import { __toCommonJS } from "../../../_virtual/_rolldown/runtime.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { init_installer, installer_exports } from "./installer.js";
 import { join } from "path";
 import { existsSync, readFileSync } from "fs";

package/dist/src/agent/skills/hub-hash.js

@@ -1,6 +1,6 @@
-import { join, relative } from "node:path";
-import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { createHash } from "node:crypto";
+import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
 //#region src/agent/skills/hub-hash.ts
 /**
 * Deterministic content hash for a skill directory (for hub lock / drift detection).

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
+import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/skills/hub-pull.js

@@ -4,9 +4,9 @@ import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { getSkillsLockEntry, recordSkillsHubInstall } from "./hub-lock.js";
 import { installSkillFromZip, isValidSkillId } from "./managed-store.js";
 import { computeSkillTreeHashSync } from "./hub-hash.js";
-import { tmpdir } from "node:os";
-import { basename, join, normalize, resolve, sep } from "node:path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, join, normalize, resolve, sep } from "node:path";
+import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { fetch } from "undici";

package/dist/src/agent/skills/index.js

@@ -1,6 +1,6 @@
-import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { findInstallSpec, getDefaultInstallerPreferences, hasBinary, init_installer, installSkill } from "./installer.js";

package/dist/src/agent/skills/managed-store.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { loadSkillsLock } from "./hub-lock.js";
-import { dirname, join, resolve, sep } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve, sep } from "node:path";
 import AdmZip from "adm-zip";
 //#region src/agent/skills/managed-store.ts
 /**

package/dist/src/agent/skills/scanner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { join } from "path";
 import { readFile, readdir } from "fs/promises";
+import { join } from "path";
 //#region src/agent/skills/scanner.ts
 /**
 * Skill security scanner — scans skill directories for potentially dangerous code patterns.

package/dist/src/agent/skills/skill-manage-ops.js

@@ -2,9 +2,9 @@ import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
+import { mkdir, writeFile } from "fs/promises";
 import { join, resolve, sep } from "path";
 import { existsSync, realpathSync } from "fs";
-import { mkdir, writeFile } from "fs/promises";
 //#region src/agent/skills/skill-manage-ops.ts
 /**
 * Shared logic for the skill_manage agent tool (create / edit / patch / delete / write_file / remove_file).

package/dist/src/agent/skills/skill-manager.js

@@ -1,6 +1,6 @@
-import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths, resolveBundledSkillsDir } from "../../config/paths.js";
 import { createSkillConfigManager, isSkillEnabled } from "./config.js";
 import { formatSkillsForPrompt, selectSkillsVisibleInPrompt } from "./format-skills-prompt.js";

package/dist/src/agent/tools/dreaming-tool.js

@@ -3,8 +3,8 @@ import { init_logger } from "../../utils/logger.js";
 import { SHORT_TERM_PROMOTION_LOCK_RELATIVE, SHORT_TERM_RECALL_STORE_RELATIVE } from "../memory/dreaming/constants.js";
 import { loadDreamingStore, saveDreamingStore } from "../memory/dreaming/short-term-store.js";
 import { resolveDreamingConfig } from "../memory/dreaming/config.js";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/dreaming-tool.ts
 init_logger();

package/dist/src/agent/tools/factory.js

@@ -1,6 +1,6 @@
-import { init_session_key, parseSessionKey } from "../../routing/session-key.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_session_key, parseSessionKey } from "../../routing/session-key.js";
 import { createReadFileTool } from "./read.js";
 import { createWriteFileTool } from "./write.js";
 import { createEditFileTool } from "./edit.js";

package/dist/src/agent/tools/image-generate-tool.js

@@ -4,9 +4,9 @@ import { isFailoverError } from "../failover-error.js";
 import { imageAssetFromDataUrl, imageFileExtensionForMimeType, mimeTypeFromFileName, parseImageDataUrl, sniffImageMimeType } from "../image/generation/image-assets.js";
 import { getImageGenerationProvider } from "../image/generation/provider-registry.js";
 import { generateImage, listImageGenerationProvidersSummary } from "../image/generation/runtime.js";
-import path from "node:path";
 import { randomBytes } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/image-generate-tool.ts
 const DEFAULT_COUNT = 1;

package/dist/src/agent/tools/send-media.js

@@ -1,7 +1,7 @@
 import { checkFileSafety } from "../prompt/safety.js";
 import { resolvePathUnderWorkspace } from "./tool-paths.js";
-import { basename } from "node:path";
 import { readFile } from "fs/promises";
+import { basename } from "node:path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/send-media.ts
 const SendMediaSchema = Type.Object({

package/dist/src/agent/tools/skill-manage-tool.js

@@ -2,9 +2,9 @@ import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { createSkillConfigManager } from "../skills/config.js";
 import { applyPatchToContent, atomicWriteUtf8, effectiveAgentWritePolicy, ensureCategorySegment, isPathInsideDir, maxSkillMdChars, maxSupportFileBytes, mutatableSkillOrNull, resolveCreateSkillDir, scanSkillDirOrError, validateSkillMdContent, validateSkillNameSegment, validateSupportingRelativePath } from "../skills/skill-manage-ops.js";
+import { readFile, rm } from "fs/promises";
 import { join } from "path";
 import { existsSync, rmSync } from "fs";
-import { readFile, rm } from "fs/promises";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/skill-manage-tool.ts
 init_paths();

package/dist/src/agent/tools/workflow-tool.js

@@ -1,6 +1,6 @@
-import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { extractProfileAgentId } from "../../config/agent-profile.js";
 import { parseWorkflowScript } from "../workflow/parser.js";
 import "../workflow/index.js";
 import { Type } from "@sinclair/typebox";

package/dist/src/agent/tools/write.js

@@ -1,8 +1,8 @@
 import { checkFileSafety } from "../prompt/safety.js";
 import { isBareProfileMarkdownFileName, resolvePathUnderWorkspace, resolveProfileMarkdownPathIfBareName } from "./tool-paths.js";
 import { evaluateFilePolicy } from "../sandbox/exec-policy.js";
-import { dirname } from "path";
 import { mkdir, writeFile } from "fs/promises";
+import { dirname } from "path";
 import { Type } from "@sinclair/typebox";
 //#region src/agent/tools/write.ts
 const MAX_FILE_SIZE = 10 * 1024 * 1024;

package/dist/src/agent/workflow/catalog.js

@@ -1,8 +1,8 @@
 import { init_paths_state, resolveStateDir } from "../../config/paths-state.js";
 import { BUILTIN_WORKFLOWS } from "./builtins/index.js";
 import { parseWorkflowScript } from "./parser.js";
-import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 //#region src/agent/workflow/catalog.ts
 /**
 * Catalog for named workflows.

package/dist/src/auth/credentials.js

@@ -1,11 +1,11 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
-import { dirname, join } from "path";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { mkdir, readFile, rm } from "fs/promises";
+import { dirname, join } from "path";
 //#region src/auth/credentials.ts
 function getCredentialResolver(options) {
 	return new CredentialResolver(options);
@@ -73,7 +73,6 @@ var init_credentials = __esmMin((() => {
 				}, "Resolved API key from environment");
 				return envKey;
 			}
-			log.debug({ provider }, "No API key found");
 			return null;
 		}
 		/**

package/dist/src/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    log.debug({ provider }, 'No API key found');\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    await this.deleteProfile(`${normalizedProvider}:default`);\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAyaA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBAtbsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,OAAI,MAAM,EAAE,UAAU,EAAE,mBAAmB;AAC3C,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;AACjD,SAAM,KAAK,cAAc,GAAG,mBAAmB,UAAU;AACzD,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    await this.deleteProfile(`${normalizedProvider}:default`);\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAwaA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBArbsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;AACjD,SAAM,KAAK,cAAc,GAAG,mBAAmB,UAAU;AACzD,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}

package/dist/src/auth/profiles/store.js

@@ -1,6 +1,6 @@
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
-import path from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import path from "node:path";
 import { homedir } from "os";
 //#region src/auth/profiles/store.ts
 /**

package/dist/src/auth/sync-provider-auth.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/browser/cache-dir-policy.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { homedir } from "node:os";
 import { isAbsolute, relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
 //#region src/browser/cache-dir-policy.ts
 function expandHome(input) {
 	if (input === "~") return homedir();

package/dist/src/browser/cdp-local-launcher.js

@@ -2,10 +2,10 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { loadPlaywrightCoreModule } from "./providers/playwright-doctor.js";
 import { pickFreePort } from "./free-port.js";
-import { homedir, platform } from "node:os";
-import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { mkdir, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir, platform } from "node:os";
 import { spawn } from "node:child_process";
 //#region src/browser/cdp-local-launcher.ts
 /**