apex-code 0.0.1-alpha.8 → 0.0.4

package/dist/core/auth-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAU/G,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAElD,KAAK,UAAU,CAAC,CAAC,IAAI;IACpB,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAkBF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAE,MAAsB,EAE3C;IAED,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,wBAAwB;IA2BhC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAmBjE;YAEa,gBAAgB;IAyCxB,aAAa,CAAC,CAAC,EACpB,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAyCZ;CACD;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAE,MAAsB,EAAE,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,EAGxF;IAED,OAAO,CAAC,IAAI;IA+CN,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAa9F;IAEK,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAQ7E;IAEK,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACzE,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEjC;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;CACD;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACpE,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,UAAU,CAAuC;IAEzD,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAMjE;IAED,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAcZ;CACD;AAED;;GAEG;AACH,qBAAa,WAAY,YAAW,eAAe;IAClD,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,SAAS,CAAoB;IAErC,OAAO,eAaN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAE,MAAsB,GAAG,WAAW,CAG3D;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,MAAM,IAAI,IAAI,CAab;YAEa,sBAAsB;YAStB,cAAc;IAwCtB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAM5F;IAEK,MAAM,CACX,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAkBjC;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5E;IAED,wEAAwE;IAClE,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAI7E;CACD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAsB,GAAG,UAAU,GAAG,SAAS,CAOjH","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\nimport { dirname } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { setTimeout as sleep } from \"timers/promises\";\nimport { getAuthPath } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileRevision, normalizePath } from \"../utils/paths.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = getAuthPath()) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t\tchmodSync(this.authPath, 0o600);\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst maxAttempts = 10;\n\t\tconst delayMs = 20;\n\t\tlet lastError: unknown;\n\n\t\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { realpath: false });\n\t\t\t} catch (error) {\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tlastError = error;\n\t\t\t\tconst start = Date.now();\n\t\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\t\t// Sleep synchronously to avoid changing callers to async.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tthrow (lastError as Error) ?? new Error(\"Failed to acquire auth storage lock\");\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t\tchmodSync(this.authPath, 0o600);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tconst staleMs = 30_000;\n\t\tconst maxDelayMs = 2_000;\n\t\tconst deadline = Date.now() + staleMs;\n\t\tlet retry = 0;\n\t\twhile (true) {\n\t\t\tsignal?.throwIfAborted();\n\t\t\tlet release: (() => Promise<void>) | undefined;\n\t\t\ttry {\n\t\t\t\trelease = await lockfile.lock(this.authPath, {\n\t\t\t\t\trealpath: false,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tstale: staleMs,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tconst remainingMs = deadline - Date.now();\n\t\t\t\tif (code !== \"ELOCKED\" || remainingMs <= 0) throw error;\n\t\t\t\tconst baseDelayMs = Math.min(10 * 2 ** retry, maxDelayMs / 2);\n\t\t\t\tretry++;\n\t\t\t\tconst delayMs = Math.min(Math.round(baseDelayMs * (1 + Math.random())), remainingMs);\n\t\t\t\tif (signal) await sleep(delayMs, undefined, { signal });\n\t\t\t\telse await sleep(delayMs);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (signal?.aborted) {\n\t\t\t\tawait release();\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t}\n\t\t\treturn release;\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t\tchmodSync(this.authPath, 0o600);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate readonly resolveCommands: boolean;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = getAuthPath(), options: { resolveCommands?: boolean } = {}) {\n\t\tthis.authPath = normalizePath(authPath);\n\t\tthis.resolveCommands = options.resolveCommands ?? false;\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(readFileSync(this.authPath, \"utf-8\"));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = parsed as AuthStorageData;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credential = this.load()[providerId];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (\n\t\t\tcredential.type !== \"api_key\" ||\n\t\t\tcredential.key === undefined ||\n\t\t\t(!this.resolveCommands && isCommandConfigValue(credential.key))\n\t\t) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = getAuthPath()): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as AuthStorageData;\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet content: string | undefined;\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tcontent = current;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(this.parseStorageData(content), revision);\n\t\t} catch {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t}\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst revision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\tthis.updateReadState(currentData, revision);\n\t\t\treturn { result: currentData };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\tconst reload = this.reloadFromStorageAsync(options);\n\t\t\treturn options?.signal ? reload : reload.catch(() => this.readState.data);\n\t\t}\n\t\tconst revision = getFileRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\tconst result = raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\treturn options?.signal ? await result : await result.catch(() => this.readState.data);\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = Object.entries(await this.readLatestData(options));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn entries.map(([providerId, credential]) => ({ providerId, type: credential.type }));\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(providerId: string, authPath: string = getAuthPath()): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(readFileSync(normalizePath(authPath), \"utf-8\")) as AuthStorageData;\n\t\treturn data[providerId];\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}
+{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAW/G,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAElD,KAAK,UAAU,CAAC,CAAC,IAAI;IACpB,MAAM,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAmBF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAChE,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAE,MAAsB,EAE3C;IAED,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,wBAAwB;IA2BhC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAkBjE;YAEa,gBAAgB;IAyCxB,aAAa,CAAC,CAAC,EACpB,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAwCZ;CACD;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAE,MAAsB,EAAE,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,EAGxF;IAED,OAAO,CAAC,IAAI;IA+CN,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAa9F;IAEK,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAQ7E;IAEK,MAAM,CACX,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACzE,QAAQ,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAEjC;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhF;CACD;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IACpE,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,UAAU,CAAuC;IAEzD,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAMjE;IAED,aAAa,CAAC,CAAC,EACd,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAC3D,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAcZ;CACD;AAED;;GAEG;AACH,qBAAa,WAAY,YAAW,eAAe;IAClD,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,SAAS,CAAoB;IAErC,OAAO,eAaN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAE,MAAsB,GAAG,WAAW,CAG3D;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,MAAM,IAAI,IAAI,CAab;YAEa,sBAAsB;YAStB,cAAc;IAwCtB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAM5F;IAEK,MAAM,CACX,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,EACxE,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAkBjC;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5E;IAED,wEAAwE;IAClE,IAAI,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAI7E;CACD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAsB,GAAG,UAAU,GAAG,SAAS,CAOjH","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\nimport { dirname } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { setTimeout as sleep } from \"timers/promises\";\nimport { getAuthPath } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileRevision, normalizePath } from \"../utils/paths.ts\";\nimport { stripBom } from \"../utils/text.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\n// The mode applies only on creation so administrator-managed modes and ACLs remain intact.\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = getAuthPath()) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst maxAttempts = 10;\n\t\tconst delayMs = 20;\n\t\tlet lastError: unknown;\n\n\t\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { realpath: false });\n\t\t\t} catch (error) {\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tlastError = error;\n\t\t\t\tconst start = Date.now();\n\t\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\t\t// Sleep synchronously to avoid changing callers to async.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tthrow (lastError as Error) ?? new Error(\"Failed to acquire auth storage lock\");\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tconst staleMs = 30_000;\n\t\tconst maxDelayMs = 2_000;\n\t\tconst deadline = Date.now() + staleMs;\n\t\tlet retry = 0;\n\t\twhile (true) {\n\t\t\tsignal?.throwIfAborted();\n\t\t\tlet release: (() => Promise<void>) | undefined;\n\t\t\ttry {\n\t\t\t\trelease = await lockfile.lock(this.authPath, {\n\t\t\t\t\trealpath: false,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tstale: staleMs,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tconst remainingMs = deadline - Date.now();\n\t\t\t\tif (code !== \"ELOCKED\" || remainingMs <= 0) throw error;\n\t\t\t\tconst baseDelayMs = Math.min(10 * 2 ** retry, maxDelayMs / 2);\n\t\t\t\tretry++;\n\t\t\t\tconst delayMs = Math.min(Math.round(baseDelayMs * (1 + Math.random())), remainingMs);\n\t\t\t\tif (signal) await sleep(delayMs, undefined, { signal });\n\t\t\t\telse await sleep(delayMs);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (signal?.aborted) {\n\t\t\t\tawait release();\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t}\n\t\t\treturn release;\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate readonly resolveCommands: boolean;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = getAuthPath(), options: { resolveCommands?: boolean } = {}) {\n\t\tthis.authPath = normalizePath(authPath);\n\t\tthis.resolveCommands = options.resolveCommands ?? false;\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(stripBom(readFileSync(this.authPath, \"utf-8\")));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = parsed as AuthStorageData;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credential = this.load()[providerId];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (\n\t\t\tcredential.type !== \"api_key\" ||\n\t\t\tcredential.key === undefined ||\n\t\t\t(!this.resolveCommands && isCommandConfigValue(credential.key))\n\t\t) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = getAuthPath()): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(stripBom(content)) as AuthStorageData;\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet content: string | undefined;\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tcontent = current;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(this.parseStorageData(content), revision);\n\t\t} catch {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t}\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst revision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\tthis.updateReadState(currentData, revision);\n\t\t\treturn { result: currentData };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\tconst reload = this.reloadFromStorageAsync(options);\n\t\t\treturn options?.signal ? reload : reload.catch(() => this.readState.data);\n\t\t}\n\t\tconst revision = getFileRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\tconst result = raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\treturn options?.signal ? await result : await result.catch(() => this.readState.data);\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = Object.entries(await this.readLatestData(options));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn entries.map(([providerId, credential]) => ({ providerId, type: credential.type }));\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(providerId: string, authPath: string = getAuthPath()): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), \"utf-8\"))) as AuthStorageData;\n\t\treturn data[providerId];\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/core/auth-storage.js

@@ -2,14 +2,16 @@
  * CredentialStore implementation backed by auth.json.
  * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { dirname } from "path";
 import lockfile from "proper-lockfile";
 import { setTimeout as sleep } from "timers/promises";
 import { getAuthPath } from "../config.js";
 import { raceWithAbortSignal } from "../utils/abort.js";
 import { getFileRevision, normalizePath } from "../utils/paths.js";
+import { stripBom } from "../utils/text.js";
 import { isCommandConfigValue, resolveConfigValue } from "./resolve-config-value.js";
+// The mode applies only on creation so administrator-managed modes and ACLs remain intact.
 const AUTH_FILE_WRITE_OPTIONS = { encoding: "utf-8", mode: 0o600 };
 let sharedAuthFileReadState;
 export class FileAuthStorageBackend {
@@ -26,7 +28,6 @@ export class FileAuthStorageBackend {
     ensureFileExists() {
         if (!existsSync(this.authPath)) {
             writeFileSync(this.authPath, "{}", AUTH_FILE_WRITE_OPTIONS);
-            chmodSync(this.authPath, 0o600);
         }
     }
     acquireLockSyncWithRetry(path) {
@@ -63,7 +64,6 @@ export class FileAuthStorageBackend {
             const { result, next } = fn(current);
             if (next !== undefined) {
                 writeFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);
-                chmodSync(this.authPath, 0o600);
             }
             return result;
         }
@@ -138,7 +138,6 @@ export class FileAuthStorageBackend {
             options?.signal?.throwIfAborted();
             if (next !== undefined) {
                 writeFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);
-                chmodSync(this.authPath, 0o600);
             }
             throwIfCompromised();
             return result;
@@ -168,7 +167,7 @@ export class ReadOnlyAuthStorage {
             return this.data;
         let parsed;
         try {
-            parsed = JSON.parse(readFileSync(this.authPath, "utf-8"));
+            parsed = JSON.parse(stripBom(readFileSync(this.authPath, "utf-8")));
         }
         catch (error) {
             if (error.code === "ENOENT") {
@@ -300,7 +299,7 @@ export class AuthStorage {
         if (!content) {
             return {};
         }
-        return JSON.parse(content);
+        return JSON.parse(stripBom(content));
     }
     updateReadState(data, revision) {
         this.readState.data = data;
@@ -421,7 +420,7 @@ export class AuthStorage {
  */
 export function readStoredCredential(providerId, authPath = getAuthPath()) {
     try {
-        const data = JSON.parse(readFileSync(normalizePath(authPath), "utf-8"));
+        const data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), "utf-8")));
         return data[providerId];
     }
     catch {

package/dist/core/auth-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AASrF,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAc5E,IAAI,uBAAuF,CAAC;AAU5F,MAAM,OAAO,sBAAsB;IAC1B,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAW,WAAW,EAAE,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAAA,CACxC;IAEO,eAAe,GAAS;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IAAA,CACD;IAEO,gBAAgB,GAAS;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC5D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IAAA,CACD;IAEO,wBAAwB,CAAC,IAAY,EAAc;QAC1D,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,IAAI,SAAkB,CAAC;QAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC;gBACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;oBAC7D,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;oBAC5C,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;oBACnD,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,EAAE,CAAC;oBACrC,0DAA0D;gBAC3D,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAO,SAAmB,IAAI,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAAA,CAC/E;IAED,QAAQ,CAAI,EAAkD,EAAK;QAClE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;gBAC5D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAA+B,EAC/B,aAAqC,EACN;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACtC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;YACb,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,OAA0C,CAAC;YAC/C,IAAI,CAAC;gBACJ,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAC5C,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,OAAO;oBACd,aAAa;iBACb,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,MAAM,IAAI,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;oBAC7D,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;oBAC5C,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;gBAC9D,KAAK,EAAE,CAAC;gBACR,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBACrF,IAAI,MAAM;oBAAE,MAAM,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;;oBACnD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC1B,SAAS;YACV,CAAC;YACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrB,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM,CAAC,cAAc,EAAE,CAAC;YACzB,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC;IAAA,CACD;IAED,KAAK,CAAC,aAAa,CAClB,EAA2D,EAC3D,OAA8B,EACjB;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAA0C,CAAC;QAC/C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,oBAAuC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC;YAChC,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,oBAAoB,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9E,CAAC;QAAA,CACD,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjE,eAAe,GAAG,IAAI,CAAC;gBACvB,oBAAoB,GAAG,KAAK,CAAC;YAAA,CAC7B,CAAC,CAAC;YAEH,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;gBAC5D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,OAAO,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,iDAAiD;gBAClD,CAAC;YACF,CAAC;QACF,CAAC;IAAA,CACD;CACD;AAED,MAAM,OAAO,mBAAmB;IACd,QAAQ,CAAS;IACjB,eAAe,CAAU;IAClC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAW,WAAW,EAAE,EAAE,OAAO,GAAkC,EAAE,EAAE;QAC1F,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC;IAAA,CACxD;IAEO,IAAI,GAAoB;QAC/B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAEhC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAG,UAAqC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC;gBAC1E,MAAM,QAAQ,GACb,KAAK,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAC7B,KAAK,CAAC,GAAG,KAAK,IAAI;wBAClB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;wBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACxE,IAAI,QAAQ,IAAI,QAAQ;oBAAE,SAAS;YACpC,CAAC;iBAAM,IACN,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAChC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,CAAC;gBACF,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,MAAyB,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC;IAAA,CACjB;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA8B,EAAmC;QAC/F,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IACC,UAAU,CAAC,IAAI,KAAK,SAAS;YAC7B,UAAU,CAAC,GAAG,KAAK,SAAS;YAC5B,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAC9D,CAAC;YACF,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IAAA,CAClF;IAED,KAAK,CAAC,IAAI,CAAC,OAA8B,EAAsC;QAC9E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,UAAU;YACV,IAAI,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IAAA,CACnB;IAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,GAAyE,EACzE,QAA+B,EACG;QAClC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAAA,CACxE;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAA+B,EAAiB;QACjF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAAA,CACxE;CACD;AAED,MAAM,OAAO,0BAA0B;IAC9B,KAAK,CAAqB;IAC1B,UAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEzD,QAAQ,CAAI,EAAkD,EAAK;QAClE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;IAED,aAAa,CACZ,EAA2D,EAC3D,OAA8B,EACjB;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,CAAC;QAAA,CACd,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAC5C,OAAO,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAAA,CACvD;CACD;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACf,OAAO,CAAqB;IAC5B,QAAQ,CAAqB;IAC7B,SAAS,CAAoB;IAErC,YAAoB,OAA2B,EAAE,QAAiB,EAAE;QACnE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS;YACb,QAAQ,IAAI,uBAAuB,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/G,IAAI,QAAQ,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1C,uBAAuB,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,OAAO;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IAAA,CACd;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAW,WAAW,EAAE,EAAe;QAC5D,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAAA,CAC3F;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B,EAAe;QAC5D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CAChC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE,EAAe;QACxD,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CACxC;IAEO,gBAAgB,CAAC,OAA2B,EAAmB;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAAA,CAC9C;IAEO,eAAe,CAAC,IAAqB,EAAE,QAAiB,EAAQ;QACvE,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAAA,CACnC;IAED;;OAEG;IACH,MAAM,GAAS;QACd,IAAI,OAA2B,CAAC;QAChC,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC;gBAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAAA,CAC7B,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACR,8CAA8C;QAC/C,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,sBAAsB,CAAC,OAA8B,EAA4B;QAC9F,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAAA,CAC/B,EAAE,OAAO,CAAC,CAAC;IAAA,CACZ;IAEO,KAAK,CAAC,cAAc,CAAC,OAA8B,EAA4B;QACtF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,MAAM,GAAmB;gBAC9B,UAAU;gBACV,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;aACV,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CACvB,GAAG,EAAE,CAAC;gBACL,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YAAA,CACxE,EACD,GAAG,EAAE,CAAC;gBACL,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YAAA,CACxE,CACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;gBAClC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IAAA,CACD;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAA8B,EAAmC;QAC7F,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACpD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IAAA,CAClF;IAED,KAAK,CAAC,MAAM,CACX,QAAgB,EAChB,EAAwE,EACxE,OAA8B,EACI;QAClC,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,IAAI,QAA4B,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YAClE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,GAAG,WAAW,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACrE,UAAU,GAAG,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAAA,CAC/D,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAAA,CACd;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA8B,EAAiB;QAC7E,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAAA,CACzE,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAAA,CACjC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,OAA8B,EAAsC;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAAA,CAC1F;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,QAAQ,GAAW,WAAW,EAAE,EAA0B;IAClH,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAoB,CAAC;QAC3F,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\nimport { dirname } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { setTimeout as sleep } from \"timers/promises\";\nimport { getAuthPath } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileRevision, normalizePath } from \"../utils/paths.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = getAuthPath()) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t\tchmodSync(this.authPath, 0o600);\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst maxAttempts = 10;\n\t\tconst delayMs = 20;\n\t\tlet lastError: unknown;\n\n\t\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { realpath: false });\n\t\t\t} catch (error) {\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tlastError = error;\n\t\t\t\tconst start = Date.now();\n\t\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\t\t// Sleep synchronously to avoid changing callers to async.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tthrow (lastError as Error) ?? new Error(\"Failed to acquire auth storage lock\");\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t\tchmodSync(this.authPath, 0o600);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tconst staleMs = 30_000;\n\t\tconst maxDelayMs = 2_000;\n\t\tconst deadline = Date.now() + staleMs;\n\t\tlet retry = 0;\n\t\twhile (true) {\n\t\t\tsignal?.throwIfAborted();\n\t\t\tlet release: (() => Promise<void>) | undefined;\n\t\t\ttry {\n\t\t\t\trelease = await lockfile.lock(this.authPath, {\n\t\t\t\t\trealpath: false,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tstale: staleMs,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tconst remainingMs = deadline - Date.now();\n\t\t\t\tif (code !== \"ELOCKED\" || remainingMs <= 0) throw error;\n\t\t\t\tconst baseDelayMs = Math.min(10 * 2 ** retry, maxDelayMs / 2);\n\t\t\t\tretry++;\n\t\t\t\tconst delayMs = Math.min(Math.round(baseDelayMs * (1 + Math.random())), remainingMs);\n\t\t\t\tif (signal) await sleep(delayMs, undefined, { signal });\n\t\t\t\telse await sleep(delayMs);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (signal?.aborted) {\n\t\t\t\tawait release();\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t}\n\t\t\treturn release;\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t\tchmodSync(this.authPath, 0o600);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate readonly resolveCommands: boolean;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = getAuthPath(), options: { resolveCommands?: boolean } = {}) {\n\t\tthis.authPath = normalizePath(authPath);\n\t\tthis.resolveCommands = options.resolveCommands ?? false;\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(readFileSync(this.authPath, \"utf-8\"));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = parsed as AuthStorageData;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credential = this.load()[providerId];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (\n\t\t\tcredential.type !== \"api_key\" ||\n\t\t\tcredential.key === undefined ||\n\t\t\t(!this.resolveCommands && isCommandConfigValue(credential.key))\n\t\t) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = getAuthPath()): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as AuthStorageData;\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet content: string | undefined;\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tcontent = current;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(this.parseStorageData(content), revision);\n\t\t} catch {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t}\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst revision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\tthis.updateReadState(currentData, revision);\n\t\t\treturn { result: currentData };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\tconst reload = this.reloadFromStorageAsync(options);\n\t\t\treturn options?.signal ? reload : reload.catch(() => this.readState.data);\n\t\t}\n\t\tconst revision = getFileRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\tconst result = raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\treturn options?.signal ? await result : await result.catch(() => this.readState.data);\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = Object.entries(await this.readLatestData(options));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn entries.map(([providerId, credential]) => ({ providerId, type: credential.type }));\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(providerId: string, authPath: string = getAuthPath()): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(readFileSync(normalizePath(authPath), \"utf-8\")) as AuthStorageData;\n\t\treturn data[providerId];\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}
+{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AASrF,2FAA2F;AAC3F,MAAM,uBAAuB,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAc5E,IAAI,uBAAuF,CAAC;AAU5F,MAAM,OAAO,sBAAsB;IAC1B,QAAQ,CAAS;IAEzB,YAAY,QAAQ,GAAW,WAAW,EAAE,EAAE;QAC7C,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAAA,CACxC;IAEO,eAAe,GAAS;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;IAAA,CACD;IAEO,gBAAgB,GAAS;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC7D,CAAC;IAAA,CACD;IAEO,wBAAwB,CAAC,IAAY,EAAc;QAC1D,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,IAAI,SAAkB,CAAC;QAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC;gBACJ,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;oBAC7D,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;oBAC5C,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;oBACnD,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,EAAE,CAAC;oBACrC,0DAA0D;gBAC3D,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAO,SAAmB,IAAI,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAAA,CAC/E;IAED,QAAQ,CAAI,EAAkD,EAAK;QAClE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAA+B,EAC/B,aAAqC,EACN;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACtC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;YACb,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,OAA0C,CAAC;YAC/C,IAAI,CAAC;gBACJ,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAC5C,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,OAAO;oBACd,aAAa;iBACb,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,MAAM,IAAI,GACT,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;oBAC7D,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,CAAC;oBAC5C,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,IAAI,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACxD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;gBAC9D,KAAK,EAAE,CAAC;gBACR,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBACrF,IAAI,MAAM;oBAAE,MAAM,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;;oBACnD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC1B,SAAS;YACV,CAAC;YACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrB,MAAM,OAAO,EAAE,CAAC;gBAChB,MAAM,CAAC,cAAc,EAAE,CAAC;YACzB,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC;IAAA,CACD;IAED,KAAK,CAAC,aAAa,CAClB,EAA2D,EAC3D,OAA8B,EACjB;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,IAAI,OAA0C,CAAC;QAC/C,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,IAAI,oBAAuC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC;YAChC,IAAI,eAAe,EAAE,CAAC;gBACrB,MAAM,oBAAoB,IAAI,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9E,CAAC;QAAA,CACD,CAAC;QAEF,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjE,eAAe,GAAG,IAAI,CAAC;gBACvB,oBAAoB,GAAG,KAAK,CAAC;YAAA,CAC7B,CAAC,CAAC;YAEH,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;YAC7D,CAAC;YACD,kBAAkB,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QACf,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,OAAO,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACR,iDAAiD;gBAClD,CAAC;YACF,CAAC;QACF,CAAC;IAAA,CACD;CACD;AAED,MAAM,OAAO,mBAAmB;IACd,QAAQ,CAAS;IACjB,eAAe,CAAU;IAClC,IAAI,CAA8B;IAE1C,YAAY,QAAQ,GAAW,WAAW,EAAE,EAAE,OAAO,GAAkC,EAAE,EAAE;QAC1F,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC;IAAA,CACxD;IAEO,IAAI,GAAoB;QAC/B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAEhC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,IAAI,CAAC;YAClB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAG,UAAqC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC;gBAC1E,MAAM,QAAQ,GACb,KAAK,CAAC,GAAG,KAAK,SAAS;oBACvB,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAC7B,KAAK,CAAC,GAAG,KAAK,IAAI;wBAClB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;wBACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACxE,IAAI,QAAQ,IAAI,QAAQ;oBAAE,SAAS;YACpC,CAAC;iBAAM,IACN,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAChC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACjC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC7B,CAAC;gBACF,SAAS;YACV,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,MAAyB,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC;IAAA,CACjB;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA8B,EAAmC;QAC/F,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAClC,IACC,UAAU,CAAC,IAAI,KAAK,SAAS;YAC7B,UAAU,CAAC,GAAG,KAAK,SAAS;YAC5B,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAC9D,CAAC;YACF,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IAAA,CAClF;IAED,KAAK,CAAC,IAAI,CAAC,OAA8B,EAAsC;QAC9E,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,UAAU;YACV,IAAI,EAAE,UAAU,CAAC,IAAI;SACrB,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,WAAW,CAAC;IAAA,CACnB;IAED,KAAK,CAAC,MAAM,CACX,WAAmB,EACnB,GAAyE,EACzE,QAA+B,EACG;QAClC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAAA,CACxE;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAA+B,EAAiB;QACjF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAAA,CACxE;CACD;AAED,MAAM,OAAO,0BAA0B;IAC9B,KAAK,CAAqB;IAC1B,UAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEzD,QAAQ,CAAI,EAAkD,EAAK;QAClE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAAA,CACd;IAED,aAAa,CACZ,EAA2D,EAC3D,OAA8B,EACjB;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,CAAC;QAAA,CACd,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAC5C,OAAO,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAAA,CACvD;CACD;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACf,OAAO,CAAqB;IAC5B,QAAQ,CAAqB;IAC7B,SAAS,CAAoB;IAErC,YAAoB,OAA2B,EAAE,QAAiB,EAAE;QACnE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS;YACb,QAAQ,IAAI,uBAAuB,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/G,IAAI,QAAQ,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC1C,uBAAuB,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;gBAAE,OAAO;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;IAAA,CACd;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAW,WAAW,EAAE,EAAe;QAC5D,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAAA,CAC3F;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B,EAAe;QAC5D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CAChC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE,EAAe;QACxD,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAAA,CACxC;IAEO,gBAAgB,CAAC,OAA2B,EAAmB;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB,CAAC;IAAA,CACxD;IAEO,eAAe,CAAC,IAAqB,EAAE,QAAiB,EAAQ;QACvE,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAAA,CACnC;IAED;;OAEG;IACH,MAAM,GAAS;QACd,IAAI,OAA2B,CAAC;QAChC,IAAI,QAA4B,CAAC;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC;gBAClB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAAA,CAC7B,CAAC,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACR,8CAA8C;QAC/C,CAAC;IAAA,CACD;IAEO,KAAK,CAAC,sBAAsB,CAAC,OAA8B,EAA4B;QAC9F,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAAA,CAC/B,EAAE,OAAO,CAAC,CAAC;IAAA,CACZ;IAEO,KAAK,CAAC,cAAc,CAAC,OAA8B,EAA4B;QACtF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,MAAM,GAAmB;gBAC9B,UAAU;gBACV,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBACnE,OAAO,EAAE,CAAC;aACV,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;YAC/B,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,CACvB,GAAG,EAAE,CAAC;gBACL,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YAAA,CACxE,EACD,GAAG,EAAE,CAAC;gBACL,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;YAAA,CACxE,CACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACrC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACV,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;gBAClC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;QACF,CAAC;IAAA,CACD;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAA8B,EAAmC;QAC7F,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACpD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IAAA,CAClF;IAED,KAAK,CAAC,MAAM,CACX,QAAgB,EAChB,EAAwE,EACxE,OAA8B,EACI;QAClC,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,IAAI,QAA4B,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YAClE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,GAAG,WAAW,CAAC;gBACzB,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACrE,UAAU,GAAG,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAAA,CAC/D,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC;IAAA,CACd;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA8B,EAAiB;QAC7E,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7B,UAAU,GAAG,WAAW,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAAA,CACzE,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAAA,CACjC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI,CAAC,OAA8B,EAAsC;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAAA,CAC1F;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,QAAQ,GAAW,WAAW,EAAE,EAA0B;IAClH,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAoB,CAAC;QACrG,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"fs\";\nimport { dirname } from \"path\";\nimport lockfile from \"proper-lockfile\";\nimport { setTimeout as sleep } from \"timers/promises\";\nimport { getAuthPath } from \"../config.ts\";\nimport { raceWithAbortSignal } from \"../utils/abort.ts\";\nimport { getFileRevision, normalizePath } from \"../utils/paths.ts\";\nimport { stripBom } from \"../utils/text.ts\";\nimport { isCommandConfigValue, resolveConfigValue } from \"./resolve-config-value.ts\";\n\ntype AuthStorageData = Record<string, Credential>;\n\ntype LockResult<T> = {\n\tresult: T;\n\tnext?: string;\n};\n\n// The mode applies only on creation so administrator-managed modes and ACLs remain intact.\nconst AUTH_FILE_WRITE_OPTIONS = { encoding: \"utf-8\", mode: 0o600 } as const;\n\ntype AuthFileReload = {\n\tcontroller: AbortController;\n\tpromise: Promise<AuthStorageData>;\n\treaders: number;\n};\n\ntype AuthFileReadState = {\n\tdata: AuthStorageData;\n\trevision?: string;\n\treload?: AuthFileReload;\n};\n\nlet sharedAuthFileReadState: { authPath: string; readState: AuthFileReadState } | undefined;\n\nexport interface AuthStorageBackend {\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T;\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T>;\n}\n\nexport class FileAuthStorageBackend implements AuthStorageBackend {\n\tprivate authPath: string;\n\n\tconstructor(authPath: string = getAuthPath()) {\n\t\tthis.authPath = normalizePath(authPath);\n\t}\n\n\tprivate ensureParentDir(): void {\n\t\tconst dir = dirname(this.authPath);\n\t\tif (!existsSync(dir)) {\n\t\t\tmkdirSync(dir, { recursive: true, mode: 0o700 });\n\t\t}\n\t}\n\n\tprivate ensureFileExists(): void {\n\t\tif (!existsSync(this.authPath)) {\n\t\t\twriteFileSync(this.authPath, \"{}\", AUTH_FILE_WRITE_OPTIONS);\n\t\t}\n\t}\n\n\tprivate acquireLockSyncWithRetry(path: string): () => void {\n\t\tconst maxAttempts = 10;\n\t\tconst delayMs = 20;\n\t\tlet lastError: unknown;\n\n\t\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\t\ttry {\n\t\t\t\treturn lockfile.lockSync(path, { realpath: false });\n\t\t\t} catch (error) {\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tlastError = error;\n\t\t\t\tconst start = Date.now();\n\t\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\t\t// Sleep synchronously to avoid changing callers to async.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tthrow (lastError as Error) ?? new Error(\"Failed to acquire auth storage lock\");\n\t}\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => void) | undefined;\n\t\ttry {\n\t\t\trelease = this.acquireLockSyncWithRetry(this.authPath);\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = fn(current);\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\trelease();\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async acquireLockAsync(\n\t\tsignal: AbortSignal | undefined,\n\t\tonCompromised: (error: Error) => void,\n\t): Promise<() => Promise<void>> {\n\t\tconst staleMs = 30_000;\n\t\tconst maxDelayMs = 2_000;\n\t\tconst deadline = Date.now() + staleMs;\n\t\tlet retry = 0;\n\t\twhile (true) {\n\t\t\tsignal?.throwIfAborted();\n\t\t\tlet release: (() => Promise<void>) | undefined;\n\t\t\ttry {\n\t\t\t\trelease = await lockfile.lock(this.authPath, {\n\t\t\t\t\trealpath: false,\n\t\t\t\t\tretries: 0,\n\t\t\t\t\tstale: staleMs,\n\t\t\t\t\tonCompromised,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\tconst code =\n\t\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t\t: undefined;\n\t\t\t\tconst remainingMs = deadline - Date.now();\n\t\t\t\tif (code !== \"ELOCKED\" || remainingMs <= 0) throw error;\n\t\t\t\tconst baseDelayMs = Math.min(10 * 2 ** retry, maxDelayMs / 2);\n\t\t\t\tretry++;\n\t\t\t\tconst delayMs = Math.min(Math.round(baseDelayMs * (1 + Math.random())), remainingMs);\n\t\t\t\tif (signal) await sleep(delayMs, undefined, { signal });\n\t\t\t\telse await sleep(delayMs);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (signal?.aborted) {\n\t\t\t\tawait release();\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t}\n\t\t\treturn release;\n\t\t}\n\t}\n\n\tasync withLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tthis.ensureParentDir();\n\t\tthis.ensureFileExists();\n\n\t\tlet release: (() => Promise<void>) | undefined;\n\t\tlet lockCompromised = false;\n\t\tlet lockCompromisedError: Error | undefined;\n\t\tconst throwIfCompromised = () => {\n\t\t\tif (lockCompromised) {\n\t\t\t\tthrow lockCompromisedError ?? new Error(\"Auth storage lock was compromised\");\n\t\t\t}\n\t\t};\n\n\t\ttry {\n\t\t\trelease = await this.acquireLockAsync(options?.signal, (error) => {\n\t\t\t\tlockCompromised = true;\n\t\t\t\tlockCompromisedError = error;\n\t\t\t});\n\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst current = existsSync(this.authPath) ? readFileSync(this.authPath, \"utf-8\") : undefined;\n\t\t\tconst { result, next } = await fn(current);\n\t\t\tthrowIfCompromised();\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\twriteFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);\n\t\t\t}\n\t\t\tthrowIfCompromised();\n\t\t\treturn result;\n\t\t} finally {\n\t\t\tif (release) {\n\t\t\t\ttry {\n\t\t\t\t\tawait release();\n\t\t\t\t} catch {\n\t\t\t\t\t// Ignore unlock errors when lock is compromised.\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n\nexport class ReadOnlyAuthStorage implements CredentialStore {\n\tprivate readonly authPath: string;\n\tprivate readonly resolveCommands: boolean;\n\tprivate data: AuthStorageData | undefined;\n\n\tconstructor(authPath: string = getAuthPath(), options: { resolveCommands?: boolean } = {}) {\n\t\tthis.authPath = normalizePath(authPath);\n\t\tthis.resolveCommands = options.resolveCommands ?? false;\n\t}\n\n\tprivate load(): AuthStorageData {\n\t\tif (this.data) return this.data;\n\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(stripBom(readFileSync(this.authPath, \"utf-8\")));\n\t\t} catch (error) {\n\t\t\tif ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n\t\t\t\tthis.data = {};\n\t\t\t\treturn this.data;\n\t\t\t}\n\t\t\tthrow new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);\n\t\t}\n\n\t\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\t\tthrow new Error(\"Invalid auth.json: expected an object\");\n\t\t}\n\t\tfor (const [providerId, credential] of Object.entries(parsed)) {\n\t\t\tif (typeof credential !== \"object\" || credential === null || Array.isArray(credential)) {\n\t\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t\t}\n\t\t\tconst value = credential as Record<string, unknown>;\n\t\t\tif (value.type === \"api_key\") {\n\t\t\t\tconst validKey = value.key === undefined || typeof value.key === \"string\";\n\t\t\t\tconst validEnv =\n\t\t\t\t\tvalue.env === undefined ||\n\t\t\t\t\t(typeof value.env === \"object\" &&\n\t\t\t\t\t\tvalue.env !== null &&\n\t\t\t\t\t\t!Array.isArray(value.env) &&\n\t\t\t\t\t\tObject.values(value.env).every((entry) => typeof entry === \"string\"));\n\t\t\t\tif (validKey && validEnv) continue;\n\t\t\t} else if (\n\t\t\t\tvalue.type === \"oauth\" &&\n\t\t\t\ttypeof value.access === \"string\" &&\n\t\t\t\ttypeof value.refresh === \"string\" &&\n\t\t\t\ttypeof value.expires === \"number\" &&\n\t\t\t\tNumber.isFinite(value.expires)\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthrow new Error(`Invalid auth.json credential for provider \"${providerId}\"`);\n\t\t}\n\n\t\tthis.data = parsed as AuthStorageData;\n\t\treturn this.data;\n\t}\n\n\tasync read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credential = this.load()[providerId];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!credential) return undefined;\n\t\tif (\n\t\t\tcredential.type !== \"api_key\" ||\n\t\t\tcredential.key === undefined ||\n\t\t\t(!this.resolveCommands && isCommandConfigValue(credential.key))\n\t\t) {\n\t\t\treturn structuredClone(credential);\n\t\t}\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tconst credentials = Object.entries(this.load()).map(([providerId, credential]) => ({\n\t\t\tproviderId,\n\t\t\ttype: credential.type,\n\t\t}));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn credentials;\n\t}\n\n\tasync modify(\n\t\t_providerId: string,\n\t\t_fn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\t_options?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n\n\tasync delete(_providerId: string, _options?: AuthOperationOptions): Promise<void> {\n\t\tthrow new Error(\"Read-only credential storage cannot modify auth.json\");\n\t}\n}\n\nexport class InMemoryAuthStorageBackend implements AuthStorageBackend {\n\tprivate value: string | undefined;\n\tprivate asyncChain: Promise<unknown> = Promise.resolve();\n\n\twithLock<T>(fn: (current: string | undefined) => LockResult<T>): T {\n\t\tconst { result, next } = fn(this.value);\n\t\tif (next !== undefined) {\n\t\t\tthis.value = next;\n\t\t}\n\t\treturn result;\n\t}\n\n\twithLockAsync<T>(\n\t\tfn: (current: string | undefined) => Promise<LockResult<T>>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<T> {\n\t\tconst previous = this.asyncChain;\n\t\tconst operation = (async () => {\n\t\t\tawait previous.catch(() => {});\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tconst { result, next } = await fn(this.value);\n\t\t\toptions?.signal?.throwIfAborted();\n\t\t\tif (next !== undefined) {\n\t\t\t\tthis.value = next;\n\t\t\t}\n\t\t\treturn result;\n\t\t})();\n\t\tthis.asyncChain = operation.catch(() => {});\n\t\treturn raceWithAbortSignal(operation, options?.signal);\n\t}\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage implements CredentialStore {\n\tprivate storage: AuthStorageBackend;\n\tprivate authPath: string | undefined;\n\tprivate readState: AuthFileReadState;\n\n\tprivate constructor(storage: AuthStorageBackend, authPath?: string) {\n\t\tthis.storage = storage;\n\t\tthis.authPath = authPath;\n\t\tthis.readState =\n\t\t\tauthPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };\n\t\tif (authPath && !sharedAuthFileReadState) {\n\t\t\tsharedAuthFileReadState = { authPath, readState: this.readState };\n\t\t}\n\t\tif (authPath) {\n\t\t\tconst revision = getFileRevision(authPath);\n\t\t\tif (revision !== undefined && revision === this.readState.revision) return;\n\t\t}\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath: string = getAuthPath()): AuthStorage {\n\t\tconst normalizedAuthPath = normalizePath(authPath);\n\t\treturn new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(stripBom(content)) as AuthStorageData;\n\t}\n\n\tprivate updateReadState(data: AuthStorageData, revision?: string): void {\n\t\tthis.readState.data = data;\n\t\tthis.readState.revision = revision;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\tlet content: string | undefined;\n\t\tlet revision: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tcontent = current;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: undefined };\n\t\t\t});\n\t\t\tthis.updateReadState(this.parseStorageData(content), revision);\n\t\t} catch {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t}\n\t}\n\n\tprivate async reloadFromStorageAsync(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\treturn this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst revision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\tthis.updateReadState(currentData, revision);\n\t\t\treturn { result: currentData };\n\t\t}, options);\n\t}\n\n\tprivate async readLatestData(options?: AuthOperationOptions): Promise<AuthStorageData> {\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (!this.authPath) {\n\t\t\tconst reload = this.reloadFromStorageAsync(options);\n\t\t\treturn options?.signal ? reload : reload.catch(() => this.readState.data);\n\t\t}\n\t\tconst revision = getFileRevision(this.authPath);\n\t\tif (revision !== undefined && revision === this.readState.revision) return this.readState.data;\n\t\tif (!this.readState.reload) {\n\t\t\tconst controller = new AbortController();\n\t\t\tconst reload: AuthFileReload = {\n\t\t\t\tcontroller,\n\t\t\t\tpromise: this.reloadFromStorageAsync({ signal: controller.signal }),\n\t\t\t\treaders: 0,\n\t\t\t};\n\t\t\tthis.readState.reload = reload;\n\t\t\tvoid reload.promise.then(\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t\t() => {\n\t\t\t\t\tif (this.readState.reload === reload) this.readState.reload = undefined;\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tconst reload = this.readState.reload;\n\t\treload.readers++;\n\t\ttry {\n\t\t\tconst result = raceWithAbortSignal(reload.promise, options?.signal);\n\t\t\treturn options?.signal ? await result : await result.catch(() => this.readState.data);\n\t\t} finally {\n\t\t\treload.readers--;\n\t\t\tif (reload.readers === 0 && this.readState.reload === reload) {\n\t\t\t\tthis.readState.reload = undefined;\n\t\t\t\treload.controller.abort();\n\t\t\t}\n\t\t}\n\t}\n\n\tasync read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined> {\n\t\tconst credential = (await this.readLatestData(options))[provider];\n\t\toptions?.signal?.throwIfAborted();\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t\toptions?: AuthOperationOptions,\n\t): Promise<Credential | undefined> {\n\t\tlet latestData = this.readState.data;\n\t\tlet revision: string | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tlatestData = currentData;\n\t\t\t\trevision = this.authPath ? getFileRevision(this.authPath) : undefined;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tlatestData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData, revision);\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string, options?: AuthOperationOptions): Promise<void> {\n\t\tlet latestData = this.readState.data;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tlatestData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t}, options);\n\t\tthis.updateReadState(latestData);\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]> {\n\t\tconst entries = Object.entries(await this.readLatestData(options));\n\t\toptions?.signal?.throwIfAborted();\n\t\treturn entries.map(([providerId, credential]) => ({ providerId, type: credential.type }));\n\t}\n}\n\n/**\n * One-off synchronous read of a stored credential from an auth.json file,\n * without instantiating a store or resolving configured key values.\n */\nexport function readStoredCredential(providerId: string, authPath: string = getAuthPath()): Credential | undefined {\n\ttry {\n\t\tconst data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), \"utf-8\"))) as AuthStorageData;\n\t\treturn data[providerId];\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/core/bash-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash-executor.d.ts","sourceRoot":"","sources":["../../src/core/bash-executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOtD,MAAM,WAAW,mBAAmB;IACnC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,mCAAmC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IAC1B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;IACnB,uCAAuC;IACvC,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAqGrB","sourcesContent":["/**\n * Bash command execution with streaming support and cancellation.\n *\n * This module provides a unified bash execution implementation used by:\n * - AgentSession.executeBash() for interactive and RPC modes\n * - Direct calls from modes that need bash execution\n */\n\nimport { randomBytes } from \"node:crypto\";\nimport { createWriteStream, type WriteStream } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { finished } from \"node:stream/promises\";\nimport { stripAnsi } from \"../utils/ansi.ts\";\nimport { sanitizeBinaryOutput } from \"../utils/shell.ts\";\nimport type { BashOperations } from \"./tools/bash.ts\";\nimport { DEFAULT_MAX_BYTES, truncateTail } from \"./tools/truncate.ts\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface BashExecutorOptions {\n\t/** Callback for streaming output chunks (already sanitized) */\n\tonChunk?: (chunk: string) => void;\n\t/** AbortSignal for cancellation */\n\tsignal?: AbortSignal;\n}\n\nexport interface BashResult {\n\t/** Combined stdout + stderr output (sanitized, possibly truncated) */\n\toutput: string;\n\t/** Process exit code (undefined if killed/cancelled) */\n\texitCode: number | undefined;\n\t/** Whether the command was cancelled via signal */\n\tcancelled: boolean;\n\t/** Whether the output was truncated */\n\ttruncated: boolean;\n\t/** Path to temp file containing full output (if output exceeded truncation threshold) */\n\tfullOutputPath?: string;\n}\n\n// ============================================================================\n// Implementation\n// ============================================================================\n\n/**\n * Execute a bash command using custom BashOperations.\n * Used for remote execution (SSH, containers, etc.).\n */\nexport async function executeBashWithOperations(\n\tcommand: string,\n\tcwd: string,\n\toperations: BashOperations,\n\toptions?: BashExecutorOptions,\n): Promise<BashResult> {\n\tconst outputChunks: string[] = [];\n\tlet outputBytes = 0;\n\tconst maxOutputBytes = DEFAULT_MAX_BYTES * 2;\n\n\tlet tempFilePath: string | undefined;\n\tlet tempFileStream: WriteStream | undefined;\n\tlet totalBytes = 0;\n\n\tconst ensureTempFile = () => {\n\t\tif (tempFilePath) {\n\t\t\treturn;\n\t\t}\n\t\tconst id = randomBytes(8).toString(\"hex\");\n\t\ttempFilePath = join(tmpdir(), `apex-code-bash-${id}.log`);\n\t\ttempFileStream = createWriteStream(tempFilePath);\n\t\tfor (const chunk of outputChunks) {\n\t\t\ttempFileStream.write(chunk);\n\t\t}\n\t};\n\n\tconst decoder = new TextDecoder();\n\n\tconst onData = (data: Buffer) => {\n\t\ttotalBytes += data.length;\n\n\t\t// Sanitize: strip ANSI, replace binary garbage, normalize newlines\n\t\tconst text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\\r/g, \"\");\n\n\t\t// Start writing to temp file if exceeds threshold\n\t\tif (totalBytes > DEFAULT_MAX_BYTES) {\n\t\t\tensureTempFile();\n\t\t}\n\n\t\tif (tempFileStream) {\n\t\t\ttempFileStream.write(text);\n\t\t}\n\n\t\t// Keep rolling buffer\n\t\toutputChunks.push(text);\n\t\toutputBytes += text.length;\n\t\twhile (outputBytes > maxOutputBytes && outputChunks.length > 1) {\n\t\t\tconst removed = outputChunks.shift()!;\n\t\t\toutputBytes -= removed.length;\n\t\t}\n\n\t\t// Stream to callback\n\t\tif (options?.onChunk) {\n\t\t\toptions.onChunk(text);\n\t\t}\n\t};\n\n\tconst closeTempFile = async () => {\n\t\tif (!tempFileStream) return;\n\t\ttempFileStream.end();\n\t\tawait finished(tempFileStream);\n\t};\n\n\ttry {\n\t\tconst result = await operations.exec(command, cwd, {\n\t\t\tonData,\n\t\t\tsignal: options?.signal,\n\t\t});\n\n\t\tconst fullOutput = outputChunks.join(\"\");\n\t\tconst truncationResult = truncateTail(fullOutput);\n\t\tif (truncationResult.truncated) {\n\t\t\tensureTempFile();\n\t\t}\n\t\tawait closeTempFile();\n\t\tconst cancelled = options?.signal?.aborted ?? false;\n\n\t\treturn {\n\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\texitCode: cancelled ? undefined : (result.exitCode ?? undefined),\n\t\t\tcancelled,\n\t\t\ttruncated: truncationResult.truncated,\n\t\t\tfullOutputPath: tempFilePath,\n\t\t};\n\t} catch (err) {\n\t\t// Check if it was an abort\n\t\tif (options?.signal?.aborted) {\n\t\t\tconst fullOutput = outputChunks.join(\"\");\n\t\t\tconst truncationResult = truncateTail(fullOutput);\n\t\t\tif (truncationResult.truncated) {\n\t\t\t\tensureTempFile();\n\t\t\t}\n\t\t\tawait closeTempFile();\n\t\t\treturn {\n\t\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\t\texitCode: undefined,\n\t\t\t\tcancelled: true,\n\t\t\t\ttruncated: truncationResult.truncated,\n\t\t\t\tfullOutputPath: tempFilePath,\n\t\t\t};\n\t\t}\n\n\t\tawait closeTempFile();\n\n\t\tthrow err;\n\t}\n}\n"]}
+{"version":3,"file":"bash-executor.d.ts","sourceRoot":"","sources":["../../src/core/bash-executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOtD,MAAM,WAAW,mBAAmB;IACnC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,mCAAmC;IACnC,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IAC1B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,mDAAmD;IACnD,SAAS,EAAE,OAAO,CAAC;IACnB,uCAAuC;IACvC,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,UAAU,CAAC,CA4GrB","sourcesContent":["/**\n * Bash command execution with streaming support and cancellation.\n *\n * This module provides a unified bash execution implementation used by:\n * - AgentSession.executeBash() for interactive and RPC modes\n * - Direct calls from modes that need bash execution\n */\n\nimport { randomBytes } from \"node:crypto\";\nimport { createWriteStream, type WriteStream } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { finished } from \"node:stream/promises\";\nimport { stripAnsi } from \"../utils/ansi.ts\";\nimport { sanitizeBinaryOutput } from \"../utils/shell.ts\";\nimport type { BashOperations } from \"./tools/bash.ts\";\nimport { DEFAULT_MAX_BYTES, truncateTail } from \"./tools/truncate.ts\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface BashExecutorOptions {\n\t/** Callback for streaming output chunks (already sanitized) */\n\tonChunk?: (chunk: string) => void;\n\t/** AbortSignal for cancellation */\n\tsignal?: AbortSignal;\n}\n\nexport interface BashResult {\n\t/** Combined stdout + stderr output (sanitized, possibly truncated) */\n\toutput: string;\n\t/** Process exit code (undefined if killed/cancelled) */\n\texitCode: number | undefined;\n\t/** Whether the command was cancelled via signal */\n\tcancelled: boolean;\n\t/** Whether the output was truncated */\n\ttruncated: boolean;\n\t/** Path to temp file containing full output (if output exceeded truncation threshold) */\n\tfullOutputPath?: string;\n}\n\n// ============================================================================\n// Implementation\n// ============================================================================\n\n/**\n * Execute a bash command using custom BashOperations.\n * Used for remote execution (SSH, containers, etc.).\n */\nexport async function executeBashWithOperations(\n\tcommand: string,\n\tcwd: string,\n\toperations: BashOperations,\n\toptions?: BashExecutorOptions,\n): Promise<BashResult> {\n\tconst outputChunks: string[] = [];\n\tlet outputBytes = 0;\n\tconst maxOutputBytes = DEFAULT_MAX_BYTES * 2;\n\n\tlet tempFilePath: string | undefined;\n\tlet tempFileStream: WriteStream | undefined;\n\tlet totalBytes = 0;\n\n\tconst ensureTempFile = () => {\n\t\tif (tempFilePath) {\n\t\t\treturn;\n\t\t}\n\t\tconst id = randomBytes(8).toString(\"hex\");\n\t\ttempFilePath = join(tmpdir(), `apex-code-bash-${id}.log`);\n\t\ttempFileStream = createWriteStream(tempFilePath);\n\t\t// A stream 'error' event (ENOSPC, EACCES) with no listener crashes the\n\t\t// whole process mid-command; full-output capture is best-effort, so\n\t\t// drop the capture and the reported path together.\n\t\ttempFileStream.on(\"error\", () => {\n\t\t\ttempFileStream = undefined;\n\t\t\ttempFilePath = undefined;\n\t\t});\n\t\tfor (const chunk of outputChunks) {\n\t\t\ttempFileStream.write(chunk);\n\t\t}\n\t};\n\n\tconst decoder = new TextDecoder();\n\n\tconst onData = (data: Buffer) => {\n\t\ttotalBytes += data.length;\n\n\t\t// Sanitize: strip ANSI, replace binary garbage, normalize newlines\n\t\tconst text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\\r/g, \"\");\n\n\t\t// Start writing to temp file if exceeds threshold\n\t\tif (totalBytes > DEFAULT_MAX_BYTES) {\n\t\t\tensureTempFile();\n\t\t}\n\n\t\tif (tempFileStream) {\n\t\t\ttempFileStream.write(text);\n\t\t}\n\n\t\t// Keep rolling buffer\n\t\toutputChunks.push(text);\n\t\toutputBytes += text.length;\n\t\twhile (outputBytes > maxOutputBytes && outputChunks.length > 1) {\n\t\t\tconst removed = outputChunks.shift()!;\n\t\t\toutputBytes -= removed.length;\n\t\t}\n\n\t\t// Stream to callback\n\t\tif (options?.onChunk) {\n\t\t\toptions.onChunk(text);\n\t\t}\n\t};\n\n\tconst closeTempFile = async () => {\n\t\tif (!tempFileStream) return;\n\t\ttempFileStream.end();\n\t\tawait finished(tempFileStream);\n\t};\n\n\ttry {\n\t\tconst result = await operations.exec(command, cwd, {\n\t\t\tonData,\n\t\t\tsignal: options?.signal,\n\t\t});\n\n\t\tconst fullOutput = outputChunks.join(\"\");\n\t\tconst truncationResult = truncateTail(fullOutput);\n\t\tif (truncationResult.truncated) {\n\t\t\tensureTempFile();\n\t\t}\n\t\tawait closeTempFile();\n\t\tconst cancelled = options?.signal?.aborted ?? false;\n\n\t\treturn {\n\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\texitCode: cancelled ? undefined : (result.exitCode ?? undefined),\n\t\t\tcancelled,\n\t\t\ttruncated: truncationResult.truncated,\n\t\t\tfullOutputPath: tempFilePath,\n\t\t};\n\t} catch (err) {\n\t\t// Check if it was an abort\n\t\tif (options?.signal?.aborted) {\n\t\t\tconst fullOutput = outputChunks.join(\"\");\n\t\t\tconst truncationResult = truncateTail(fullOutput);\n\t\t\tif (truncationResult.truncated) {\n\t\t\t\tensureTempFile();\n\t\t\t}\n\t\t\tawait closeTempFile();\n\t\t\treturn {\n\t\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\t\texitCode: undefined,\n\t\t\t\tcancelled: true,\n\t\t\t\ttruncated: truncationResult.truncated,\n\t\t\t\tfullOutputPath: tempFilePath,\n\t\t\t};\n\t\t}\n\n\t\tawait closeTempFile();\n\n\t\tthrow err;\n\t}\n}\n"]}

package/dist/core/bash-executor.js

@@ -34,6 +34,13 @@ export async function executeBashWithOperations(command, cwd, operations, option
         const id = randomBytes(8).toString("hex");
         tempFilePath = join(tmpdir(), `apex-code-bash-${id}.log`);
         tempFileStream = createWriteStream(tempFilePath);
+        // A stream 'error' event (ENOSPC, EACCES) with no listener crashes the
+        // whole process mid-command; full-output capture is best-effort, so
+        // drop the capture and the reported path together.
+        tempFileStream.on("error", () => {
+            tempFileStream = undefined;
+            tempFilePath = undefined;
+        });
         for (const chunk of outputChunks) {
             tempFileStream.write(chunk);
         }

package/dist/core/bash-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"bash-executor.js","sourceRoot":"","sources":["../../src/core/bash-executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAoB,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA0BtE,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAe,EACf,GAAW,EACX,UAA0B,EAC1B,OAA6B,EACP;IACtB,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,cAAc,GAAG,iBAAiB,GAAG,CAAC,CAAC;IAE7C,IAAI,YAAgC,CAAC;IACrC,IAAI,cAAuC,CAAC;IAC5C,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC;QAC5B,IAAI,YAAY,EAAE,CAAC;YAClB,OAAO;QACR,CAAC;QACD,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC1D,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACjD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC;QAChC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;QAE1B,mEAAmE;QACnE,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAExG,kDAAkD;QAClD,IAAI,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACpC,cAAc,EAAE,CAAC;QAClB,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACpB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,sBAAsB;QACtB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,WAAW,GAAG,cAAc,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAG,CAAC;YACtC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,cAAc;YAAE,OAAO;QAC5B,cAAc,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC;IAAA,CAC/B,CAAC;IAEF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YAClD,MAAM;YACN,MAAM,EAAE,OAAO,EAAE,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAChC,cAAc,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;QAEpD,OAAO;YACN,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YAC1E,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC;YAChE,SAAS;YACT,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,cAAc,EAAE,YAAY;SAC5B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,2BAA2B;QAC3B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;gBAChC,cAAc,EAAE,CAAC;YAClB,CAAC;YACD,MAAM,aAAa,EAAE,CAAC;YACtB,OAAO;gBACN,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;gBAC1E,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,gBAAgB,CAAC,SAAS;gBACrC,cAAc,EAAE,YAAY;aAC5B,CAAC;QACH,CAAC;QAED,MAAM,aAAa,EAAE,CAAC;QAEtB,MAAM,GAAG,CAAC;IACX,CAAC;AAAA,CACD","sourcesContent":["/**\n * Bash command execution with streaming support and cancellation.\n *\n * This module provides a unified bash execution implementation used by:\n * - AgentSession.executeBash() for interactive and RPC modes\n * - Direct calls from modes that need bash execution\n */\n\nimport { randomBytes } from \"node:crypto\";\nimport { createWriteStream, type WriteStream } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { finished } from \"node:stream/promises\";\nimport { stripAnsi } from \"../utils/ansi.ts\";\nimport { sanitizeBinaryOutput } from \"../utils/shell.ts\";\nimport type { BashOperations } from \"./tools/bash.ts\";\nimport { DEFAULT_MAX_BYTES, truncateTail } from \"./tools/truncate.ts\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface BashExecutorOptions {\n\t/** Callback for streaming output chunks (already sanitized) */\n\tonChunk?: (chunk: string) => void;\n\t/** AbortSignal for cancellation */\n\tsignal?: AbortSignal;\n}\n\nexport interface BashResult {\n\t/** Combined stdout + stderr output (sanitized, possibly truncated) */\n\toutput: string;\n\t/** Process exit code (undefined if killed/cancelled) */\n\texitCode: number | undefined;\n\t/** Whether the command was cancelled via signal */\n\tcancelled: boolean;\n\t/** Whether the output was truncated */\n\ttruncated: boolean;\n\t/** Path to temp file containing full output (if output exceeded truncation threshold) */\n\tfullOutputPath?: string;\n}\n\n// ============================================================================\n// Implementation\n// ============================================================================\n\n/**\n * Execute a bash command using custom BashOperations.\n * Used for remote execution (SSH, containers, etc.).\n */\nexport async function executeBashWithOperations(\n\tcommand: string,\n\tcwd: string,\n\toperations: BashOperations,\n\toptions?: BashExecutorOptions,\n): Promise<BashResult> {\n\tconst outputChunks: string[] = [];\n\tlet outputBytes = 0;\n\tconst maxOutputBytes = DEFAULT_MAX_BYTES * 2;\n\n\tlet tempFilePath: string | undefined;\n\tlet tempFileStream: WriteStream | undefined;\n\tlet totalBytes = 0;\n\n\tconst ensureTempFile = () => {\n\t\tif (tempFilePath) {\n\t\t\treturn;\n\t\t}\n\t\tconst id = randomBytes(8).toString(\"hex\");\n\t\ttempFilePath = join(tmpdir(), `apex-code-bash-${id}.log`);\n\t\ttempFileStream = createWriteStream(tempFilePath);\n\t\tfor (const chunk of outputChunks) {\n\t\t\ttempFileStream.write(chunk);\n\t\t}\n\t};\n\n\tconst decoder = new TextDecoder();\n\n\tconst onData = (data: Buffer) => {\n\t\ttotalBytes += data.length;\n\n\t\t// Sanitize: strip ANSI, replace binary garbage, normalize newlines\n\t\tconst text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\\r/g, \"\");\n\n\t\t// Start writing to temp file if exceeds threshold\n\t\tif (totalBytes > DEFAULT_MAX_BYTES) {\n\t\t\tensureTempFile();\n\t\t}\n\n\t\tif (tempFileStream) {\n\t\t\ttempFileStream.write(text);\n\t\t}\n\n\t\t// Keep rolling buffer\n\t\toutputChunks.push(text);\n\t\toutputBytes += text.length;\n\t\twhile (outputBytes > maxOutputBytes && outputChunks.length > 1) {\n\t\t\tconst removed = outputChunks.shift()!;\n\t\t\toutputBytes -= removed.length;\n\t\t}\n\n\t\t// Stream to callback\n\t\tif (options?.onChunk) {\n\t\t\toptions.onChunk(text);\n\t\t}\n\t};\n\n\tconst closeTempFile = async () => {\n\t\tif (!tempFileStream) return;\n\t\ttempFileStream.end();\n\t\tawait finished(tempFileStream);\n\t};\n\n\ttry {\n\t\tconst result = await operations.exec(command, cwd, {\n\t\t\tonData,\n\t\t\tsignal: options?.signal,\n\t\t});\n\n\t\tconst fullOutput = outputChunks.join(\"\");\n\t\tconst truncationResult = truncateTail(fullOutput);\n\t\tif (truncationResult.truncated) {\n\t\t\tensureTempFile();\n\t\t}\n\t\tawait closeTempFile();\n\t\tconst cancelled = options?.signal?.aborted ?? false;\n\n\t\treturn {\n\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\texitCode: cancelled ? undefined : (result.exitCode ?? undefined),\n\t\t\tcancelled,\n\t\t\ttruncated: truncationResult.truncated,\n\t\t\tfullOutputPath: tempFilePath,\n\t\t};\n\t} catch (err) {\n\t\t// Check if it was an abort\n\t\tif (options?.signal?.aborted) {\n\t\t\tconst fullOutput = outputChunks.join(\"\");\n\t\t\tconst truncationResult = truncateTail(fullOutput);\n\t\t\tif (truncationResult.truncated) {\n\t\t\t\tensureTempFile();\n\t\t\t}\n\t\t\tawait closeTempFile();\n\t\t\treturn {\n\t\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\t\texitCode: undefined,\n\t\t\t\tcancelled: true,\n\t\t\t\ttruncated: truncationResult.truncated,\n\t\t\t\tfullOutputPath: tempFilePath,\n\t\t\t};\n\t\t}\n\n\t\tawait closeTempFile();\n\n\t\tthrow err;\n\t}\n}\n"]}
+{"version":3,"file":"bash-executor.js","sourceRoot":"","sources":["../../src/core/bash-executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAoB,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA0BtE,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAe,EACf,GAAW,EACX,UAA0B,EAC1B,OAA6B,EACP;IACtB,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,cAAc,GAAG,iBAAiB,GAAG,CAAC,CAAC;IAE7C,IAAI,YAAgC,CAAC;IACrC,IAAI,cAAuC,CAAC;IAC5C,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC;QAC5B,IAAI,YAAY,EAAE,CAAC;YAClB,OAAO;QACR,CAAC;QACD,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1C,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC1D,cAAc,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACjD,uEAAuE;QACvE,oEAAoE;QACpE,mDAAmD;QACnD,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAChC,cAAc,GAAG,SAAS,CAAC;YAC3B,YAAY,GAAG,SAAS,CAAC;QAAA,CACzB,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC;QAChC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;QAE1B,mEAAmE;QACnE,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAExG,kDAAkD;QAClD,IAAI,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACpC,cAAc,EAAE,CAAC;QAClB,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACpB,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAED,sBAAsB;QACtB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,WAAW,GAAG,cAAc,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAG,CAAC;YACtC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,cAAc;YAAE,OAAO;QAC5B,cAAc,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC;IAAA,CAC/B,CAAC;IAEF,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YAClD,MAAM;YACN,MAAM,EAAE,OAAO,EAAE,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAChC,cAAc,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;QAEpD,OAAO;YACN,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YAC1E,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC;YAChE,SAAS;YACT,SAAS,EAAE,gBAAgB,CAAC,SAAS;YACrC,cAAc,EAAE,YAAY;SAC5B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,2BAA2B;QAC3B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;gBAChC,cAAc,EAAE,CAAC;YAClB,CAAC;YACD,MAAM,aAAa,EAAE,CAAC;YACtB,OAAO;gBACN,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;gBAC1E,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,gBAAgB,CAAC,SAAS;gBACrC,cAAc,EAAE,YAAY;aAC5B,CAAC;QACH,CAAC;QAED,MAAM,aAAa,EAAE,CAAC;QAEtB,MAAM,GAAG,CAAC;IACX,CAAC;AAAA,CACD","sourcesContent":["/**\n * Bash command execution with streaming support and cancellation.\n *\n * This module provides a unified bash execution implementation used by:\n * - AgentSession.executeBash() for interactive and RPC modes\n * - Direct calls from modes that need bash execution\n */\n\nimport { randomBytes } from \"node:crypto\";\nimport { createWriteStream, type WriteStream } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { finished } from \"node:stream/promises\";\nimport { stripAnsi } from \"../utils/ansi.ts\";\nimport { sanitizeBinaryOutput } from \"../utils/shell.ts\";\nimport type { BashOperations } from \"./tools/bash.ts\";\nimport { DEFAULT_MAX_BYTES, truncateTail } from \"./tools/truncate.ts\";\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface BashExecutorOptions {\n\t/** Callback for streaming output chunks (already sanitized) */\n\tonChunk?: (chunk: string) => void;\n\t/** AbortSignal for cancellation */\n\tsignal?: AbortSignal;\n}\n\nexport interface BashResult {\n\t/** Combined stdout + stderr output (sanitized, possibly truncated) */\n\toutput: string;\n\t/** Process exit code (undefined if killed/cancelled) */\n\texitCode: number | undefined;\n\t/** Whether the command was cancelled via signal */\n\tcancelled: boolean;\n\t/** Whether the output was truncated */\n\ttruncated: boolean;\n\t/** Path to temp file containing full output (if output exceeded truncation threshold) */\n\tfullOutputPath?: string;\n}\n\n// ============================================================================\n// Implementation\n// ============================================================================\n\n/**\n * Execute a bash command using custom BashOperations.\n * Used for remote execution (SSH, containers, etc.).\n */\nexport async function executeBashWithOperations(\n\tcommand: string,\n\tcwd: string,\n\toperations: BashOperations,\n\toptions?: BashExecutorOptions,\n): Promise<BashResult> {\n\tconst outputChunks: string[] = [];\n\tlet outputBytes = 0;\n\tconst maxOutputBytes = DEFAULT_MAX_BYTES * 2;\n\n\tlet tempFilePath: string | undefined;\n\tlet tempFileStream: WriteStream | undefined;\n\tlet totalBytes = 0;\n\n\tconst ensureTempFile = () => {\n\t\tif (tempFilePath) {\n\t\t\treturn;\n\t\t}\n\t\tconst id = randomBytes(8).toString(\"hex\");\n\t\ttempFilePath = join(tmpdir(), `apex-code-bash-${id}.log`);\n\t\ttempFileStream = createWriteStream(tempFilePath);\n\t\t// A stream 'error' event (ENOSPC, EACCES) with no listener crashes the\n\t\t// whole process mid-command; full-output capture is best-effort, so\n\t\t// drop the capture and the reported path together.\n\t\ttempFileStream.on(\"error\", () => {\n\t\t\ttempFileStream = undefined;\n\t\t\ttempFilePath = undefined;\n\t\t});\n\t\tfor (const chunk of outputChunks) {\n\t\t\ttempFileStream.write(chunk);\n\t\t}\n\t};\n\n\tconst decoder = new TextDecoder();\n\n\tconst onData = (data: Buffer) => {\n\t\ttotalBytes += data.length;\n\n\t\t// Sanitize: strip ANSI, replace binary garbage, normalize newlines\n\t\tconst text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\\r/g, \"\");\n\n\t\t// Start writing to temp file if exceeds threshold\n\t\tif (totalBytes > DEFAULT_MAX_BYTES) {\n\t\t\tensureTempFile();\n\t\t}\n\n\t\tif (tempFileStream) {\n\t\t\ttempFileStream.write(text);\n\t\t}\n\n\t\t// Keep rolling buffer\n\t\toutputChunks.push(text);\n\t\toutputBytes += text.length;\n\t\twhile (outputBytes > maxOutputBytes && outputChunks.length > 1) {\n\t\t\tconst removed = outputChunks.shift()!;\n\t\t\toutputBytes -= removed.length;\n\t\t}\n\n\t\t// Stream to callback\n\t\tif (options?.onChunk) {\n\t\t\toptions.onChunk(text);\n\t\t}\n\t};\n\n\tconst closeTempFile = async () => {\n\t\tif (!tempFileStream) return;\n\t\ttempFileStream.end();\n\t\tawait finished(tempFileStream);\n\t};\n\n\ttry {\n\t\tconst result = await operations.exec(command, cwd, {\n\t\t\tonData,\n\t\t\tsignal: options?.signal,\n\t\t});\n\n\t\tconst fullOutput = outputChunks.join(\"\");\n\t\tconst truncationResult = truncateTail(fullOutput);\n\t\tif (truncationResult.truncated) {\n\t\t\tensureTempFile();\n\t\t}\n\t\tawait closeTempFile();\n\t\tconst cancelled = options?.signal?.aborted ?? false;\n\n\t\treturn {\n\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\texitCode: cancelled ? undefined : (result.exitCode ?? undefined),\n\t\t\tcancelled,\n\t\t\ttruncated: truncationResult.truncated,\n\t\t\tfullOutputPath: tempFilePath,\n\t\t};\n\t} catch (err) {\n\t\t// Check if it was an abort\n\t\tif (options?.signal?.aborted) {\n\t\t\tconst fullOutput = outputChunks.join(\"\");\n\t\t\tconst truncationResult = truncateTail(fullOutput);\n\t\t\tif (truncationResult.truncated) {\n\t\t\t\tensureTempFile();\n\t\t\t}\n\t\t\tawait closeTempFile();\n\t\t\treturn {\n\t\t\t\toutput: truncationResult.truncated ? truncationResult.content : fullOutput,\n\t\t\t\texitCode: undefined,\n\t\t\t\tcancelled: true,\n\t\t\t\ttruncated: truncationResult.truncated,\n\t\t\t\tfullOutputPath: tempFilePath,\n\t\t\t};\n\t\t}\n\n\t\tawait closeTempFile();\n\n\t\tthrow err;\n\t}\n}\n"]}

package/dist/core/checkpoints/git-checkpoints.d.ts

@@ -0,0 +1,39 @@
+/** One captured worktree state, reachable from a ref so garbage collection cannot reap it. */
+export interface GitCheckpoint {
+    readonly entryId: string;
+    readonly commit: string;
+}
+export interface GitCheckpointsOptions {
+    /** Oldest refs beyond this count are deleted on capture. */
+    readonly maxPerSession?: number;
+    /** A capture that exceeds this is abandoned rather than allowed to stall a turn. */
+    readonly timeoutMilliseconds?: number;
+}
+export interface GitCheckpoints {
+    capture(entryId: string): Promise<GitCheckpoint | undefined>;
+    lookup(entryId: string): Promise<GitCheckpoint | undefined>;
+    list(): Promise<readonly GitCheckpoint[]>;
+    /** Returns a checkpoint of the pre-restore state, which restores back through this same call. */
+    restore(checkpoint: GitCheckpoint): Promise<GitCheckpoint | undefined>;
+    /**
+     * True when the current worktree (tracked and untracked, ignored excluded)
+     * is tree-identical to the checkpoint; false when it moved; undefined when
+     * the comparison could not be performed.
+     */
+    matchesWorktree(checkpoint: GitCheckpoint): Promise<boolean | undefined>;
+    /** Deletes every ref this session owns, leaving other sessions' refs alone. */
+    prune(): Promise<void>;
+}
+export declare function createGitCheckpoints(workspace: string, sessionId: string, options?: GitCheckpointsOptions): Promise<GitCheckpoints | undefined>;
+/**
+ * Opt-in configuration for the engine above.
+ *
+ * Absent by default, and an absent key constructs no engine, so an unconfigured session
+ * runs no `git` subprocess and writes no ref.
+ */
+export interface CheckpointSettings {
+    enabled?: boolean;
+    /** Oldest refs beyond this count are deleted on capture. Defaults to 50. */
+    maxPerSession?: number;
+}
+//# sourceMappingURL=git-checkpoints.d.ts.map

package/dist/core/checkpoints/git-checkpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-checkpoints.d.ts","sourceRoot":"","sources":["../../../src/core/checkpoints/git-checkpoints.ts"],"names":[],"mappings":"AAKA,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACrC,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC7D,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC5D,IAAI,IAAI,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC1C,iGAAiG;IACjG,OAAO,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACvE;;;;OAIG;IACH,eAAe,CAAC,UAAU,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACzE,+EAA+E;IAC/E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAsFD,wBAAsB,oBAAoB,CACzC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAkLrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB","sourcesContent":["import { spawn } from \"node:child_process\";\nimport { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\n/** One captured worktree state, reachable from a ref so garbage collection cannot reap it. */\nexport interface GitCheckpoint {\n\treadonly entryId: string;\n\treadonly commit: string;\n}\n\nexport interface GitCheckpointsOptions {\n\t/** Oldest refs beyond this count are deleted on capture. */\n\treadonly maxPerSession?: number;\n\t/** A capture that exceeds this is abandoned rather than allowed to stall a turn. */\n\treadonly timeoutMilliseconds?: number;\n}\n\nexport interface GitCheckpoints {\n\tcapture(entryId: string): Promise<GitCheckpoint | undefined>;\n\tlookup(entryId: string): Promise<GitCheckpoint | undefined>;\n\tlist(): Promise<readonly GitCheckpoint[]>;\n\t/** Returns a checkpoint of the pre-restore state, which restores back through this same call. */\n\trestore(checkpoint: GitCheckpoint): Promise<GitCheckpoint | undefined>;\n\t/**\n\t * True when the current worktree (tracked and untracked, ignored excluded)\n\t * is tree-identical to the checkpoint; false when it moved; undefined when\n\t * the comparison could not be performed.\n\t */\n\tmatchesWorktree(checkpoint: GitCheckpoint): Promise<boolean | undefined>;\n\t/** Deletes every ref this session owns, leaving other sessions' refs alone. */\n\tprune(): Promise<void>;\n}\n\nconst DEFAULT_MAX_PER_SESSION = 50;\nconst DEFAULT_TIMEOUT_MILLISECONDS = 15_000;\n\n/**\n * A fixed identity, never the user's.\n *\n * A checkpoint is harness bookkeeping rather than authorship, and `commit-tree` fails\n * outright when no identity resolves. Depending on the user's config would break exactly\n * where it matters most: a fresh clone, and a CI checkout, both of which configure none.\n */\nconst CHECKPOINT_IDENTITY = {\n\tGIT_AUTHOR_NAME: \"apex-code\",\n\tGIT_AUTHOR_EMAIL: \"checkpoints@apex-code.local\",\n\tGIT_COMMITTER_NAME: \"apex-code\",\n\tGIT_COMMITTER_EMAIL: \"checkpoints@apex-code.local\",\n} as const;\n\nconst SUBJECT_PREFIX = \"apex-code checkpoint\";\n\n/**\n * Applied to every invocation below, which is why it lives here rather than on the two\n * commands that read and write worktree content.\n *\n * `core.autocrlf` is a property of the machine, not of the repository, and it is `true` by\n * default on Windows. Left alone it decides what a checkpoint restores: capture and restore\n * both run content through git's clean and smudge filters, so a file the agent wrote with\n * LF endings comes back with CRLF and a restore silently rewrites line endings across the\n * worktree. Pinning it off makes the round trip byte-exact.\n *\n * `.gitattributes` is deliberately *not* overridden. That is the repository's own declared\n * policy, git applies it to every ordinary checkout, and a restore that ignored it would\n * disagree with `git checkout` on the same files.\n */\nconst IGNORE_MACHINE_EOL_PREFERENCE = [\"-c\", \"core.autocrlf=false\"];\n\ninterface GitResult {\n\treadonly stdout: string;\n\treadonly ok: boolean;\n}\n\nasync function runGit(\n\tcwd: string,\n\targs: string[],\n\tenvironment?: NodeJS.ProcessEnv,\n\ttimeout?: number,\n): Promise<GitResult> {\n\treturn new Promise((resolve) => {\n\t\tconst child = spawn(\"git\", [...IGNORE_MACHINE_EOL_PREFERENCE, ...args], {\n\t\t\tcwd,\n\t\t\tshell: false,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t\tenv: { ...process.env, ...environment },\n\t\t});\n\t\tlet stdout = \"\";\n\t\tlet settled = false;\n\t\tconst finish = (ok: boolean) => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tclearTimeout(timer);\n\t\t\tresolve({ stdout: stdout.trim(), ok });\n\t\t};\n\t\tconst timer = setTimeout(() => {\n\t\t\tchild.kill(\"SIGKILL\");\n\t\t\tfinish(false);\n\t\t}, timeout ?? DEFAULT_TIMEOUT_MILLISECONDS);\n\n\t\tchild.stdout?.on(\"data\", (chunk) => {\n\t\t\tstdout += chunk;\n\t\t});\n\t\tchild.stderr?.resume();\n\t\tchild.on(\"error\", () => finish(false));\n\t\tchild.on(\"close\", (code) => finish(code === 0));\n\t});\n}\n\n/**\n * An entry id reaches this engine from a session file on disk, so it decides a ref name\n * that must not be able to escape the engine's own namespace. An allowlist is the check\n * that stays correct as git's own ref rules grow; a denylist of `..` and friends does not.\n */\nfunction isSafeRefComponent(value: string): boolean {\n\treturn /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value) && !value.includes(\"..\") && !value.endsWith(\".lock\");\n}\n\nexport async function createGitCheckpoints(\n\tworkspace: string,\n\tsessionId: string,\n\toptions?: GitCheckpointsOptions,\n): Promise<GitCheckpoints | undefined> {\n\tif (!isSafeRefComponent(sessionId)) return undefined;\n\tif (!(await runGit(workspace, [\"rev-parse\", \"--git-dir\"])).ok) return undefined;\n\n\tconst maxPerSession = Math.max(1, options?.maxPerSession ?? DEFAULT_MAX_PER_SESSION);\n\tconst timeout = options?.timeoutMilliseconds ?? DEFAULT_TIMEOUT_MILLISECONDS;\n\tconst checkpointRef = (entryId: string) => `refs/apex-code/checkpoints/${sessionId}/${entryId}`;\n\tconst preRestoreNamespace = `refs/apex-code/pre-restore/${sessionId}`;\n\n\t/**\n\t * Write the worktree to a commit without touching anything the user can see.\n\t *\n\t * A private index is what makes that true: `add -A` against it stages tracked\n\t * modifications and untracked files, honours `.gitignore`, and leaves the real index\n\t * and the worktree byte-identical. `commit-tree` and `update-ref` are plumbing, so no\n\t * hook runs and the stash is never involved.\n\t */\n\tasync function snapshot(subject: string): Promise<string | undefined> {\n\t\tconst indexDirectory = await mkdtemp(join(tmpdir(), \"apex-checkpoint-index-\"));\n\t\tconst indexFile = join(indexDirectory, \"index\");\n\t\tconst environment = { GIT_INDEX_FILE: indexFile };\n\t\ttry {\n\t\t\t// Fails before the first commit, which is a supported state rather than an error.\n\t\t\tawait runGit(workspace, [\"read-tree\", \"HEAD\"], environment, timeout);\n\t\t\tif (!(await runGit(workspace, [\"add\", \"-A\"], environment, timeout)).ok) return undefined;\n\n\t\t\tconst tree = await runGit(workspace, [\"write-tree\"], environment, timeout);\n\t\t\tif (!tree.ok) return undefined;\n\n\t\t\tconst head = await runGit(workspace, [\"rev-parse\", \"HEAD\"]);\n\t\t\tconst parent = head.ok ? [\"-p\", head.stdout] : [];\n\t\t\tconst commit = await runGit(\n\t\t\t\tworkspace,\n\t\t\t\t[\"commit-tree\", tree.stdout, ...parent, \"-m\", subject],\n\t\t\t\t{ ...CHECKPOINT_IDENTITY, ...environment },\n\t\t\t\ttimeout,\n\t\t\t);\n\t\t\treturn commit.ok ? commit.stdout : undefined;\n\t\t} finally {\n\t\t\tawait rm(indexDirectory, { force: true, recursive: true });\n\t\t}\n\t}\n\n\tasync function refsUnder(namespace: string): Promise<Array<{ ref: string; commit: string; ordinal: number }>> {\n\t\tconst listed = await runGit(workspace, [\n\t\t\t\"for-each-ref\",\n\t\t\t\"--format=%(refname) %(objectname) %(contents:subject)\",\n\t\t\tnamespace,\n\t\t]);\n\t\tif (!listed.ok || listed.stdout === \"\") return [];\n\t\treturn listed.stdout\n\t\t\t.split(\"\\n\")\n\t\t\t.map((line) => {\n\t\t\t\tconst [ref, commit, ...subject] = line.split(\" \");\n\t\t\t\treturn { ref: ref ?? \"\", commit: commit ?? \"\", ordinal: Number(subject.at(-1)) };\n\t\t\t})\n\t\t\t.filter((entry) => entry.ref !== \"\" && Number.isFinite(entry.ordinal))\n\t\t\t.sort((left, right) => left.ordinal - right.ordinal);\n\t}\n\n\t/**\n\t * Refs carry no creation order of their own, and `commit-tree` records a committer date\n\t * only to the second, so two captures inside one second would be indistinguishable.\n\t * The ordinal in the subject is the ordering, and it is derived from what is already on\n\t * disk so it survives a restart the same way the refs do.\n\t */\n\tasync function nextOrdinal(): Promise<number> {\n\t\tconst existing = [\n\t\t\t...(await refsUnder(`refs/apex-code/checkpoints/${sessionId}`)),\n\t\t\t...(await refsUnder(preRestoreNamespace)),\n\t\t];\n\t\t// The maximum across both namespaces, not the tail of the pair. `refsUnder` sorts\n\t\t// each list on its own, and two sorted lists concatenated are not sorted, so a\n\t\t// restore followed by further captures would otherwise reuse an ordinal already in\n\t\t// the other namespace and `bound` would prune by a broken order.\n\t\treturn existing.reduce((highest, entry) => Math.max(highest, entry.ordinal), 0) + 1;\n\t}\n\n\tasync function bound(namespace: string): Promise<void> {\n\t\tconst existing = await refsUnder(namespace);\n\t\tfor (const stale of existing.slice(0, Math.max(0, existing.length - maxPerSession))) {\n\t\t\tawait runGit(workspace, [\"update-ref\", \"-d\", stale.ref]);\n\t\t}\n\t}\n\n\tasync function restoreCommit(commit: string): Promise<boolean> {\n\t\tconst indexDirectory = await mkdtemp(join(tmpdir(), \"apex-checkpoint-restore-\"));\n\t\tconst indexFile = join(indexDirectory, \"index\");\n\t\tconst environment = { GIT_INDEX_FILE: indexFile };\n\t\ttry {\n\t\t\t// Seeding the private index from the *current* worktree is what lets\n\t\t\t// `read-tree -u` remove files created after the checkpoint. Seeded from HEAD\n\t\t\t// instead, those files would be untracked and would survive the restore, which\n\t\t\t// is the merge-not-restore defect this replaces.\n\t\t\tawait runGit(workspace, [\"read-tree\", \"HEAD\"], environment, timeout);\n\t\t\tawait runGit(workspace, [\"add\", \"-A\"], environment, timeout);\n\t\t\tif (!(await runGit(workspace, [\"read-tree\", \"-u\", \"--reset\", commit], environment, timeout)).ok) return false;\n\n\t\t\t// The real index goes back to HEAD without touching the worktree, so the\n\t\t\t// checkpoint's changes read as unstaged, which is the shape they had at capture.\n\t\t\tawait runGit(workspace, [\"read-tree\", \"HEAD\"], undefined, timeout);\n\t\t\treturn true;\n\t\t} finally {\n\t\t\tawait rm(indexDirectory, { force: true, recursive: true });\n\t\t}\n\t}\n\n\treturn {\n\t\tasync capture(entryId) {\n\t\t\tif (!isSafeRefComponent(entryId)) return undefined;\n\t\t\tconst ordinal = await nextOrdinal();\n\t\t\tconst commit = await snapshot(`${SUBJECT_PREFIX} ${ordinal}`);\n\t\t\tif (!commit) return undefined;\n\t\t\tif (!(await runGit(workspace, [\"update-ref\", checkpointRef(entryId), commit])).ok) return undefined;\n\t\t\tawait bound(`refs/apex-code/checkpoints/${sessionId}`);\n\t\t\treturn { entryId, commit };\n\t\t},\n\n\t\tasync lookup(entryId) {\n\t\t\tif (!isSafeRefComponent(entryId)) return undefined;\n\t\t\tconst resolved = await runGit(workspace, [\n\t\t\t\t\"rev-parse\",\n\t\t\t\t\"--verify\",\n\t\t\t\t\"--quiet\",\n\t\t\t\t`${checkpointRef(entryId)}^{commit}`,\n\t\t\t]);\n\t\t\treturn resolved.ok && resolved.stdout !== \"\" ? { entryId, commit: resolved.stdout } : undefined;\n\t\t},\n\n\t\tasync list() {\n\t\t\tconst prefix = `refs/apex-code/checkpoints/${sessionId}/`;\n\t\t\treturn (await refsUnder(`refs/apex-code/checkpoints/${sessionId}`)).map((entry) => ({\n\t\t\t\tentryId: entry.ref.slice(prefix.length),\n\t\t\t\tcommit: entry.commit,\n\t\t\t}));\n\t\t},\n\n\t\tasync matchesWorktree(checkpoint) {\n\t\t\tconst indexDirectory = await mkdtemp(join(tmpdir(), \"apex-checkpoint-compare-\"));\n\t\t\tconst indexFile = join(indexDirectory, \"index\");\n\t\t\tconst environment = { GIT_INDEX_FILE: indexFile };\n\t\t\ttry {\n\t\t\t\tconst commitTree = await runGit(workspace, [\"rev-parse\", `${checkpoint.commit}^{tree}`]);\n\t\t\t\tif (!commitTree.ok) return undefined;\n\t\t\t\tif (!(await runGit(workspace, [\"read-tree\", checkpoint.commit], environment, timeout)).ok) return undefined;\n\t\t\t\tif (!(await runGit(workspace, [\"add\", \"-A\"], environment, timeout)).ok) return undefined;\n\t\t\t\tconst worktreeTree = await runGit(workspace, [\"write-tree\"], environment, timeout);\n\t\t\t\tif (!worktreeTree.ok) return undefined;\n\t\t\t\treturn worktreeTree.stdout.trim() === commitTree.stdout.trim();\n\t\t\t} finally {\n\t\t\t\tawait rm(indexDirectory, { recursive: true, force: true }).catch(() => {});\n\t\t\t}\n\t\t},\n\n\t\tasync restore(checkpoint) {\n\t\t\tconst ordinal = await nextOrdinal();\n\t\t\tconst previous = await snapshot(`${SUBJECT_PREFIX} ${ordinal}`);\n\t\t\tif (!previous) return undefined;\n\t\t\t// Pinned before the restore runs, so an interrupted restore still leaves the\n\t\t\t// pre-restore state reachable rather than orphaned. The write is checked because\n\t\t\t// an unpinned snapshot is unreachable and collectable: proceeding past a failure\n\t\t\t// here would overwrite the worktree with no way back to what it held.\n\t\t\tif (!(await runGit(workspace, [\"update-ref\", `${preRestoreNamespace}/${ordinal}`, previous])).ok) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tawait bound(preRestoreNamespace);\n\t\t\tif (!(await restoreCommit(checkpoint.commit))) return undefined;\n\t\t\treturn { entryId: \"pre-restore\", commit: previous };\n\t\t},\n\n\t\tasync prune() {\n\t\t\tfor (const namespace of [`refs/apex-code/checkpoints/${sessionId}`, preRestoreNamespace]) {\n\t\t\t\tfor (const entry of await refsUnder(namespace)) {\n\t\t\t\t\tawait runGit(workspace, [\"update-ref\", \"-d\", entry.ref]);\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t};\n}\n\n/**\n * Opt-in configuration for the engine above.\n *\n * Absent by default, and an absent key constructs no engine, so an unconfigured session\n * runs no `git` subprocess and writes no ref.\n */\nexport interface CheckpointSettings {\n\tenabled?: boolean;\n\t/** Oldest refs beyond this count are deleted on capture. Defaults to 50. */\n\tmaxPerSession?: number;\n}\n"]}