apex-code 0.3.0 → 0.5.0

package/dist/core/project-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-resources.d.ts","sourceRoot":"","sources":["../../src/core/project-resources.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,MAAM,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,kBAAkB,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC7C;AAED,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAC3D,eAAO,MAAM,8BAA8B,2BAA2B,CAAC;AACvE,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAY9C,CAAC;AAEX,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,MAAM,CAElF;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E","sourcesContent":["import { join } from \"node:path\";\nimport { CONFIG_DIR_NAME } from \"../config.ts\";\n\n/**\n * The single list of project-controlled resources a repository can supply, and the only\n * place their paths are built.\n *\n * Both halves of the trust boundary resolve through here: the loaders ask for a path,\n * and `hasTrustRequiringProjectResources` asks the same question of the same entries.\n * Before this existed the two were independent, and four resources were read without\n * ever reaching the classifier (`permissions.json`, `permissions.local.json`, `agents/`,\n * and `.mcp.json`), so a cloned repository supplying one of them was classified trusted\n * and the guard that drops untrusted scopes was satisfied rather than triggered.\n *\n * Relocating the list is not enough on its own. A loader that builds `join(cwd,\n * \".apex-code\", …)` by hand diverges the moment `CONFIG_DIR_NAME` is overridden, which\n * reintroduces the same bypass with no test failing, so the path builders below are the\n * supported way to reach a project resource. See\n * `docs/specs/2026-09-11-trust-classification-and-proof-integrity.md`.\n */\n\n/**\n * Where an entry's `name` is resolved from.\n *\n * `config-dir` resolves under `<cwd>/<CONFIG_DIR_NAME>`. `root` resolves at `<cwd>`,\n * which is what lets `.mcp.json` reach the classifier at all.\n *\n * The ancestor `.agents/skills` walk is deliberately not a scope here. It has no fixed\n * depth and one path under the user's home is exempt, so it lives in the classifier\n * rather than as an entry a caller could resolve to a single path. Adding an `ancestor`\n * member without implementing the walk would let an entry silently resolve at `cwd`\n * only, which is the narrowing this registry exists to prevent.\n */\nexport type ProjectResourceScope = \"config-dir\" | \"root\";\n\n/**\n * How presence maps to authority.\n *\n * `presence` means existing is enough. `permission-scope` means the file is parsed and\n * only grants authority when it carries a rule or a mode, because a `{}` permissions\n * file confers nothing and this repository ships one. A prompt carrying no decision\n * teaches people to dismiss prompts.\n */\nexport type ProjectResourceAuthority = \"presence\" | \"permission-scope\";\n\nexport interface ProjectResource {\n\t/** Path relative to the entry's scope root. A single path segment. */\n\treadonly name: string;\n\treadonly scope: ProjectResourceScope;\n\treadonly authority: ProjectResourceAuthority;\n}\n\nexport const PROJECT_PERMISSIONS_FILE = \"permissions.json\";\nexport const PROJECT_LOCAL_PERMISSIONS_FILE = \"permissions.local.json\";\nexport const PROJECT_AGENTS_DIR = \"agents\";\nexport const PROJECT_MCP_CONFIG_FILE = \".mcp.json\";\n\nexport const PROJECT_RESOURCES: readonly ProjectResource[] = [\n\t{ name: \"settings.json\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"extensions\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"skills\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"prompts\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"themes\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"APPEND_SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_LOCAL_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_AGENTS_DIR, scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_MCP_CONFIG_FILE, scope: \"root\", authority: \"presence\" },\n] as const;\n\n/** The project config directory for `cwd`. Honors a `piConfig.configDir` override. */\nexport function projectConfigDir(cwd: string): string {\n\treturn join(cwd, CONFIG_DIR_NAME);\n}\n\n/**\n * Absolute path of one project resource. Loaders call this instead of composing the\n * config directory themselves, so a loader cannot read a path the classifier does not\n * check.\n */\nexport function projectResourcePath(cwd: string, resource: ProjectResource): string {\n\treturn join(resource.scope === \"config-dir\" ? projectConfigDir(cwd) : cwd, resource.name);\n}\n\nexport function projectResource(name: string): ProjectResource {\n\tconst resource = PROJECT_RESOURCES.find((candidate) => candidate.name === name);\n\tif (!resource) throw new Error(`Unknown project resource: ${name}`);\n\treturn resource;\n}\n\n/** Convenience for the common case: a resource addressed by name. */\nexport function projectResourcePathByName(cwd: string, name: string): string {\n\treturn projectResourcePath(cwd, projectResource(name));\n}\n"]}
+{"version":3,"file":"project-resources.d.ts","sourceRoot":"","sources":["../../src/core/project-resources.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,MAAM,CAAC;AAEzD;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,kBAAkB,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC7C;AAED,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAC3D,eAAO,MAAM,8BAA8B,2BAA2B,CAAC;AACvE,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAC3C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,qFAM5B,CAAC;AAEX,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAe9C,CAAC;AAEX,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,MAAM,CAElF;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E","sourcesContent":["import { join } from \"node:path\";\nimport { CONFIG_DIR_NAME } from \"../config.ts\";\n\n/**\n * The single list of project-controlled resources a repository can supply, and the only\n * place their paths are built.\n *\n * Both halves of the trust boundary resolve through here: the loaders ask for a path,\n * and `hasTrustRequiringProjectResources` asks the same question of the same entries.\n * Before this existed the two were independent, and four resources were read without\n * ever reaching the classifier (`permissions.json`, `permissions.local.json`, `agents/`,\n * and `.mcp.json`), so a cloned repository supplying one of them was classified trusted\n * and the guard that drops untrusted scopes was satisfied rather than triggered.\n *\n * Relocating the list is not enough on its own. A loader that builds `join(cwd,\n * \".apex-code\", …)` by hand diverges the moment `CONFIG_DIR_NAME` is overridden, which\n * reintroduces the same bypass with no test failing, so the path builders below are the\n * supported way to reach a project resource. See\n * `docs/specs/2026-09-11-trust-classification-and-proof-integrity.md`.\n */\n\n/**\n * Where an entry's `name` is resolved from.\n *\n * `config-dir` resolves under `<cwd>/<CONFIG_DIR_NAME>`. `root` resolves at `<cwd>`,\n * which is what lets `.mcp.json` reach the classifier at all.\n *\n * The ancestor `.agents/skills` walk is deliberately not a scope here. It has no fixed\n * depth and one path under the user's home is exempt, so it lives in the classifier\n * rather than as an entry a caller could resolve to a single path. Adding an `ancestor`\n * member without implementing the walk would let an entry silently resolve at `cwd`\n * only, which is the narrowing this registry exists to prevent.\n */\nexport type ProjectResourceScope = \"config-dir\" | \"root\";\n\n/**\n * How presence maps to authority.\n *\n * `presence` means existing is enough. `permission-scope` means the file is parsed and\n * only grants authority when it carries a rule or a mode, because a `{}` permissions\n * file confers nothing and this repository ships one. A prompt carrying no decision\n * teaches people to dismiss prompts.\n */\nexport type ProjectResourceAuthority = \"presence\" | \"permission-scope\";\n\nexport interface ProjectResource {\n\t/** Path relative to the entry's scope root. A single path segment. */\n\treadonly name: string;\n\treadonly scope: ProjectResourceScope;\n\treadonly authority: ProjectResourceAuthority;\n}\n\nexport const PROJECT_PERMISSIONS_FILE = \"permissions.json\";\nexport const PROJECT_LOCAL_PERMISSIONS_FILE = \"permissions.local.json\";\nexport const PROJECT_AGENTS_DIR = \"agents\";\nexport const PROJECT_MCP_CONFIG_FILE = \".mcp.json\";\n\n/**\n * The repository instruction files, in the order the loader prefers them.\n *\n * These are wrapped as `<project_instructions>` and handed to the model as instructions,\n * so a checkout supplying one is steering the agent. That is what the trust prompt asks\n * about, and until this list was registered they reached the system prompt through no gate.\n *\n * The loader reads this array rather than its own copy. A sixth spelling added to one and\n * not the other is the exact divergence this registry exists to prevent, and the earlier\n * form of that bug is why the registry exists at all.\n */\nexport const PROJECT_INSTRUCTION_FILES = [\n\t\"AGENTS.override.md\",\n\t\"AGENTS.md\",\n\t\"AGENTS.MD\",\n\t\"CLAUDE.md\",\n\t\"CLAUDE.MD\",\n] as const;\n\nexport const PROJECT_RESOURCES: readonly ProjectResource[] = [\n\t{ name: \"settings.json\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"extensions\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"skills\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"prompts\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"themes\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"APPEND_SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_LOCAL_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_AGENTS_DIR, scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_MCP_CONFIG_FILE, scope: \"root\", authority: \"presence\" },\n\t...PROJECT_INSTRUCTION_FILES.map(\n\t\t(name) => ({ name, scope: \"root\", authority: \"presence\" }) as const satisfies ProjectResource,\n\t),\n] as const;\n\n/** The project config directory for `cwd`. Honors a `piConfig.configDir` override. */\nexport function projectConfigDir(cwd: string): string {\n\treturn join(cwd, CONFIG_DIR_NAME);\n}\n\n/**\n * Absolute path of one project resource. Loaders call this instead of composing the\n * config directory themselves, so a loader cannot read a path the classifier does not\n * check.\n */\nexport function projectResourcePath(cwd: string, resource: ProjectResource): string {\n\treturn join(resource.scope === \"config-dir\" ? projectConfigDir(cwd) : cwd, resource.name);\n}\n\nexport function projectResource(name: string): ProjectResource {\n\tconst resource = PROJECT_RESOURCES.find((candidate) => candidate.name === name);\n\tif (!resource) throw new Error(`Unknown project resource: ${name}`);\n\treturn resource;\n}\n\n/** Convenience for the common case: a resource addressed by name. */\nexport function projectResourcePathByName(cwd: string, name: string): string {\n\treturn projectResourcePath(cwd, projectResource(name));\n}\n"]}

package/dist/core/project-resources.js

@@ -4,6 +4,24 @@ export const PROJECT_PERMISSIONS_FILE = "permissions.json";
 export const PROJECT_LOCAL_PERMISSIONS_FILE = "permissions.local.json";
 export const PROJECT_AGENTS_DIR = "agents";
 export const PROJECT_MCP_CONFIG_FILE = ".mcp.json";
+/**
+ * The repository instruction files, in the order the loader prefers them.
+ *
+ * These are wrapped as `<project_instructions>` and handed to the model as instructions,
+ * so a checkout supplying one is steering the agent. That is what the trust prompt asks
+ * about, and until this list was registered they reached the system prompt through no gate.
+ *
+ * The loader reads this array rather than its own copy. A sixth spelling added to one and
+ * not the other is the exact divergence this registry exists to prevent, and the earlier
+ * form of that bug is why the registry exists at all.
+ */
+export const PROJECT_INSTRUCTION_FILES = [
+    "AGENTS.override.md",
+    "AGENTS.md",
+    "AGENTS.MD",
+    "CLAUDE.md",
+    "CLAUDE.MD",
+];
 export const PROJECT_RESOURCES = [
     { name: "settings.json", scope: "config-dir", authority: "presence" },
     { name: "extensions", scope: "config-dir", authority: "presence" },
@@ -16,6 +34,7 @@ export const PROJECT_RESOURCES = [
     { name: PROJECT_LOCAL_PERMISSIONS_FILE, scope: "config-dir", authority: "permission-scope" },
     { name: PROJECT_AGENTS_DIR, scope: "config-dir", authority: "presence" },
     { name: PROJECT_MCP_CONFIG_FILE, scope: "root", authority: "presence" },
+    ...PROJECT_INSTRUCTION_FILES.map((name) => ({ name, scope: "root", authority: "presence" })),
 ];
 /** The project config directory for `cwd`. Honors a `piConfig.configDir` override. */
 export function projectConfigDir(cwd) {

package/dist/core/project-resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-resources.js","sourceRoot":"","sources":["../../src/core/project-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAmD/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC5D,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACrE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAClE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAC/D,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAC9D,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACjE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACxE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE;IACtF,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE;IAC5F,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACxE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE;CAC9D,CAAC;AAEX,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAU;IACrD,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AAAA,CAClC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,QAAyB,EAAU;IACnF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AAAA,CAC1F;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAmB;IAC9D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,IAAY,EAAU;IAC5E,OAAO,mBAAmB,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACvD","sourcesContent":["import { join } from \"node:path\";\nimport { CONFIG_DIR_NAME } from \"../config.ts\";\n\n/**\n * The single list of project-controlled resources a repository can supply, and the only\n * place their paths are built.\n *\n * Both halves of the trust boundary resolve through here: the loaders ask for a path,\n * and `hasTrustRequiringProjectResources` asks the same question of the same entries.\n * Before this existed the two were independent, and four resources were read without\n * ever reaching the classifier (`permissions.json`, `permissions.local.json`, `agents/`,\n * and `.mcp.json`), so a cloned repository supplying one of them was classified trusted\n * and the guard that drops untrusted scopes was satisfied rather than triggered.\n *\n * Relocating the list is not enough on its own. A loader that builds `join(cwd,\n * \".apex-code\", …)` by hand diverges the moment `CONFIG_DIR_NAME` is overridden, which\n * reintroduces the same bypass with no test failing, so the path builders below are the\n * supported way to reach a project resource. See\n * `docs/specs/2026-09-11-trust-classification-and-proof-integrity.md`.\n */\n\n/**\n * Where an entry's `name` is resolved from.\n *\n * `config-dir` resolves under `<cwd>/<CONFIG_DIR_NAME>`. `root` resolves at `<cwd>`,\n * which is what lets `.mcp.json` reach the classifier at all.\n *\n * The ancestor `.agents/skills` walk is deliberately not a scope here. It has no fixed\n * depth and one path under the user's home is exempt, so it lives in the classifier\n * rather than as an entry a caller could resolve to a single path. Adding an `ancestor`\n * member without implementing the walk would let an entry silently resolve at `cwd`\n * only, which is the narrowing this registry exists to prevent.\n */\nexport type ProjectResourceScope = \"config-dir\" | \"root\";\n\n/**\n * How presence maps to authority.\n *\n * `presence` means existing is enough. `permission-scope` means the file is parsed and\n * only grants authority when it carries a rule or a mode, because a `{}` permissions\n * file confers nothing and this repository ships one. A prompt carrying no decision\n * teaches people to dismiss prompts.\n */\nexport type ProjectResourceAuthority = \"presence\" | \"permission-scope\";\n\nexport interface ProjectResource {\n\t/** Path relative to the entry's scope root. A single path segment. */\n\treadonly name: string;\n\treadonly scope: ProjectResourceScope;\n\treadonly authority: ProjectResourceAuthority;\n}\n\nexport const PROJECT_PERMISSIONS_FILE = \"permissions.json\";\nexport const PROJECT_LOCAL_PERMISSIONS_FILE = \"permissions.local.json\";\nexport const PROJECT_AGENTS_DIR = \"agents\";\nexport const PROJECT_MCP_CONFIG_FILE = \".mcp.json\";\n\nexport const PROJECT_RESOURCES: readonly ProjectResource[] = [\n\t{ name: \"settings.json\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"extensions\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"skills\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"prompts\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"themes\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"APPEND_SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_LOCAL_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_AGENTS_DIR, scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_MCP_CONFIG_FILE, scope: \"root\", authority: \"presence\" },\n] as const;\n\n/** The project config directory for `cwd`. Honors a `piConfig.configDir` override. */\nexport function projectConfigDir(cwd: string): string {\n\treturn join(cwd, CONFIG_DIR_NAME);\n}\n\n/**\n * Absolute path of one project resource. Loaders call this instead of composing the\n * config directory themselves, so a loader cannot read a path the classifier does not\n * check.\n */\nexport function projectResourcePath(cwd: string, resource: ProjectResource): string {\n\treturn join(resource.scope === \"config-dir\" ? projectConfigDir(cwd) : cwd, resource.name);\n}\n\nexport function projectResource(name: string): ProjectResource {\n\tconst resource = PROJECT_RESOURCES.find((candidate) => candidate.name === name);\n\tif (!resource) throw new Error(`Unknown project resource: ${name}`);\n\treturn resource;\n}\n\n/** Convenience for the common case: a resource addressed by name. */\nexport function projectResourcePathByName(cwd: string, name: string): string {\n\treturn projectResourcePath(cwd, projectResource(name));\n}\n"]}
+{"version":3,"file":"project-resources.js","sourceRoot":"","sources":["../../src/core/project-resources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAmD/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC3D,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,oBAAoB;IACpB,WAAW;IACX,WAAW;IACX,WAAW;IACX,WAAW;CACF,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC5D,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACrE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAClE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAC/D,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IAC9D,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACjE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACxE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE;IACtF,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE;IAC5F,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;IACxE,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE;IACvE,GAAG,yBAAyB,CAAC,GAAG,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAoC,CAC7F;CACQ,CAAC;AAEX,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAU;IACrD,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AAAA,CAClC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,QAAyB,EAAU;IACnF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AAAA,CAC1F;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAmB;IAC9D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,IAAY,EAAU;IAC5E,OAAO,mBAAmB,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACvD","sourcesContent":["import { join } from \"node:path\";\nimport { CONFIG_DIR_NAME } from \"../config.ts\";\n\n/**\n * The single list of project-controlled resources a repository can supply, and the only\n * place their paths are built.\n *\n * Both halves of the trust boundary resolve through here: the loaders ask for a path,\n * and `hasTrustRequiringProjectResources` asks the same question of the same entries.\n * Before this existed the two were independent, and four resources were read without\n * ever reaching the classifier (`permissions.json`, `permissions.local.json`, `agents/`,\n * and `.mcp.json`), so a cloned repository supplying one of them was classified trusted\n * and the guard that drops untrusted scopes was satisfied rather than triggered.\n *\n * Relocating the list is not enough on its own. A loader that builds `join(cwd,\n * \".apex-code\", …)` by hand diverges the moment `CONFIG_DIR_NAME` is overridden, which\n * reintroduces the same bypass with no test failing, so the path builders below are the\n * supported way to reach a project resource. See\n * `docs/specs/2026-09-11-trust-classification-and-proof-integrity.md`.\n */\n\n/**\n * Where an entry's `name` is resolved from.\n *\n * `config-dir` resolves under `<cwd>/<CONFIG_DIR_NAME>`. `root` resolves at `<cwd>`,\n * which is what lets `.mcp.json` reach the classifier at all.\n *\n * The ancestor `.agents/skills` walk is deliberately not a scope here. It has no fixed\n * depth and one path under the user's home is exempt, so it lives in the classifier\n * rather than as an entry a caller could resolve to a single path. Adding an `ancestor`\n * member without implementing the walk would let an entry silently resolve at `cwd`\n * only, which is the narrowing this registry exists to prevent.\n */\nexport type ProjectResourceScope = \"config-dir\" | \"root\";\n\n/**\n * How presence maps to authority.\n *\n * `presence` means existing is enough. `permission-scope` means the file is parsed and\n * only grants authority when it carries a rule or a mode, because a `{}` permissions\n * file confers nothing and this repository ships one. A prompt carrying no decision\n * teaches people to dismiss prompts.\n */\nexport type ProjectResourceAuthority = \"presence\" | \"permission-scope\";\n\nexport interface ProjectResource {\n\t/** Path relative to the entry's scope root. A single path segment. */\n\treadonly name: string;\n\treadonly scope: ProjectResourceScope;\n\treadonly authority: ProjectResourceAuthority;\n}\n\nexport const PROJECT_PERMISSIONS_FILE = \"permissions.json\";\nexport const PROJECT_LOCAL_PERMISSIONS_FILE = \"permissions.local.json\";\nexport const PROJECT_AGENTS_DIR = \"agents\";\nexport const PROJECT_MCP_CONFIG_FILE = \".mcp.json\";\n\n/**\n * The repository instruction files, in the order the loader prefers them.\n *\n * These are wrapped as `<project_instructions>` and handed to the model as instructions,\n * so a checkout supplying one is steering the agent. That is what the trust prompt asks\n * about, and until this list was registered they reached the system prompt through no gate.\n *\n * The loader reads this array rather than its own copy. A sixth spelling added to one and\n * not the other is the exact divergence this registry exists to prevent, and the earlier\n * form of that bug is why the registry exists at all.\n */\nexport const PROJECT_INSTRUCTION_FILES = [\n\t\"AGENTS.override.md\",\n\t\"AGENTS.md\",\n\t\"AGENTS.MD\",\n\t\"CLAUDE.md\",\n\t\"CLAUDE.MD\",\n] as const;\n\nexport const PROJECT_RESOURCES: readonly ProjectResource[] = [\n\t{ name: \"settings.json\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"extensions\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"skills\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"prompts\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"themes\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: \"APPEND_SYSTEM.md\", scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_LOCAL_PERMISSIONS_FILE, scope: \"config-dir\", authority: \"permission-scope\" },\n\t{ name: PROJECT_AGENTS_DIR, scope: \"config-dir\", authority: \"presence\" },\n\t{ name: PROJECT_MCP_CONFIG_FILE, scope: \"root\", authority: \"presence\" },\n\t...PROJECT_INSTRUCTION_FILES.map(\n\t\t(name) => ({ name, scope: \"root\", authority: \"presence\" }) as const satisfies ProjectResource,\n\t),\n] as const;\n\n/** The project config directory for `cwd`. Honors a `piConfig.configDir` override. */\nexport function projectConfigDir(cwd: string): string {\n\treturn join(cwd, CONFIG_DIR_NAME);\n}\n\n/**\n * Absolute path of one project resource. Loaders call this instead of composing the\n * config directory themselves, so a loader cannot read a path the classifier does not\n * check.\n */\nexport function projectResourcePath(cwd: string, resource: ProjectResource): string {\n\treturn join(resource.scope === \"config-dir\" ? projectConfigDir(cwd) : cwd, resource.name);\n}\n\nexport function projectResource(name: string): ProjectResource {\n\tconst resource = PROJECT_RESOURCES.find((candidate) => candidate.name === name);\n\tif (!resource) throw new Error(`Unknown project resource: ${name}`);\n\treturn resource;\n}\n\n/** Convenience for the common case: a resource addressed by name. */\nexport function projectResourcePathByName(cwd: string, name: string): string {\n\treturn projectResourcePath(cwd, projectResource(name));\n}\n"]}

package/dist/core/provider-composer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-composer.d.ts","sourceRoot":"","sources":["../../src/core/provider-composer.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,GAAG,EAER,KAAK,2BAA2B,EAIhC,KAAK,OAAO,EAGZ,KAAK,KAAK,EAGV,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAExB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,WAAW,EAA4C,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnH,OAAO,EACN,qBAAqB,EAMrB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjE,YAAY,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5F,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;IACjD,YAAY,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;CACjF;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,2BAA2B,CAAC;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAClD,KAAK,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;KAC9B,CAAC,CAAC;IACH,aAAa,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;CACnG;AAED,MAAM,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,eAAO,MAAM,gBAAgB,8BAAwB,CAAC;AAwUtD,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,QAAQ,GAAG,SAAS,EAC1B,YAAY,EAAE,kBAAkB,GAAG,SAAS,EAC5C,SAAS,EAAE,mBAAmB,GAC5B,IAAI,CAKN;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,QAAQ,GAAG,SAAS,EAC1B,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,mBAAmB,GAAG,SAAS,GACxC,QAAQ,CAkGV;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,SAAS,EAAE,mBAAmB,GAAG,SAAS,EAC1C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAMpC;AAED,MAAM,WAAW,0BAA0B;IAC1C,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,iCAAiC,CAChD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GACxC,0BAA0B,CAS5B;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GACxC,UAAU,GAAG,SAAS,CAWxB","sourcesContent":["import {\n\ttype Api,\n\ttype ApiKeyAuth,\n\ttype AssistantMessageEventStream,\n\ttype AuthContext,\n\ttype AuthInteraction,\n\ttype AuthResult,\n\ttype Context,\n\ttype Credential,\n\tlazyStream,\n\ttype Model,\n\ttype ModelAuth,\n\ttype OAuthAuth,\n\ttype OAuthCredentials,\n\ttype OAuthLoginCallbacks,\n\ttype Provider,\n\ttype ProviderHeaders,\n\ttype RefreshModelsContext,\n\ttype SimpleStreamOptions,\n\ttype StreamOptions,\n} from \"@earendil-works/pi-ai\";\nimport { getApiProvider } from \"@earendil-works/pi-ai/compat\";\nimport type { ModelConfig, ModelsJsonModel, ModelsJsonModelOverride, ModelsJsonProvider } from \"./model-config.ts\";\nimport {\n\tclearConfigValueCache,\n\tgetConfigValueEnvVarNames,\n\tisCommandConfigValue,\n\tisConfigValueConfigured,\n\tresolveConfigValueOrThrow,\n\tresolveHeadersOrThrow,\n} from \"./resolve-config-value.ts\";\n\nexport interface ExtensionOAuthConfig {\n\tname: string;\n\t/** Whether access through this auth method is backed by a provider subscription. */\n\tisSubscription?: boolean;\n\t/** @deprecated Retained for extension source compatibility; ignored by canonical auth flows. */\n\tusesCallbackServer?: boolean;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n\tmodifyModels?(models: Model<Api>[], credentials: OAuthCredentials): Model<Api>[];\n}\n\n/** Input type for the extension registerProvider API. */\nexport interface ProviderConfigInput {\n\tname?: string;\n\tbaseUrl?: string;\n\tapiKey?: string;\n\tapi?: Api;\n\tstreamSimple?: (model: Model<Api>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;\n\theaders?: Record<string, string>;\n\tauthHeader?: boolean;\n\toauth?: ExtensionOAuthConfig;\n\tmodels?: Array<{\n\t\tid: string;\n\t\tname: string;\n\t\tapi?: Api;\n\t\tbaseUrl?: string;\n\t\treasoning: boolean;\n\t\tthinkingLevelMap?: Model<Api>[\"thinkingLevelMap\"];\n\t\tinput: (\"text\" | \"image\")[];\n\t\tcost: Model<Api>[\"cost\"];\n\t\tcontextWindow: number;\n\t\tmaxTokens: number;\n\t\tsamplingParams?: Record<string, unknown>;\n\t\theaders?: Record<string, string>;\n\t\tcompat?: Model<Api>[\"compat\"];\n\t}>;\n\trefreshModels?(context: RefreshModelsContext): Promise<NonNullable<ProviderConfigInput[\"models\"]>>;\n}\n\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport const clearApiKeyCache = clearConfigValueCache;\n\nfunction mergeCompat(\n\tbase: Model<Api>[\"compat\"],\n\toverride: Model<Api>[\"compat\"] | ModelsJsonModelOverride[\"compat\"],\n): Model<Api>[\"compat\"] {\n\tif (!override) return base;\n\tconst merged = { ...base, ...override } as NonNullable<Model<Api>[\"compat\"]>;\n\tconst baseNested = base as Record<string, unknown> | undefined;\n\tconst overrideNested = override as Record<string, unknown>;\n\tconst mergedNested = merged as Record<string, unknown>;\n\tfor (const key of [\"openRouterRouting\", \"vercelGatewayRouting\", \"chatTemplateKwargs\", \"chatTemplateArgs\"] as const) {\n\t\tconst baseValue = baseNested?.[key];\n\t\tconst overrideValue = overrideNested[key];\n\t\tif (\n\t\t\t(typeof baseValue === \"object\" && baseValue !== null) ||\n\t\t\t(typeof overrideValue === \"object\" && overrideValue !== null)\n\t\t) {\n\t\t\tmergedNested[key] = { ...(baseValue as object | undefined), ...(overrideValue as object | undefined) };\n\t\t}\n\t}\n\treturn merged;\n}\n\nfunction applyModelOverride(model: Model<Api>, override: ModelsJsonModelOverride): Model<Api> {\n\treturn {\n\t\t...model,\n\t\tname: override.name ?? model.name,\n\t\treasoning: override.reasoning ?? model.reasoning,\n\t\tthinkingLevelMap: override.thinkingLevelMap\n\t\t\t? { ...model.thinkingLevelMap, ...override.thinkingLevelMap }\n\t\t\t: model.thinkingLevelMap,\n\t\tinput: (override.input as (\"text\" | \"image\")[] | undefined) ?? model.input,\n\t\tcost: override.cost\n\t\t\t? {\n\t\t\t\t\tinput: override.cost.input ?? model.cost.input,\n\t\t\t\t\toutput: override.cost.output ?? model.cost.output,\n\t\t\t\t\tcacheRead: override.cost.cacheRead ?? model.cost.cacheRead,\n\t\t\t\t\tcacheWrite: override.cost.cacheWrite ?? model.cost.cacheWrite,\n\t\t\t\t\ttiers: override.cost.tiers ?? model.cost.tiers,\n\t\t\t\t}\n\t\t\t: model.cost,\n\t\tcontextWindow: override.contextWindow ?? model.contextWindow,\n\t\tmaxTokens: override.maxTokens ?? model.maxTokens,\n\t\tsamplingParams: override.samplingParams\n\t\t\t? { ...model.samplingParams, ...override.samplingParams }\n\t\t\t: model.samplingParams,\n\t\tcompat: mergeCompat(model.compat, override.compat),\n\t};\n}\n\nfunction modelFromJson(\n\tproviderId: string,\n\tdefinition: ModelsJsonModel,\n\tproviderConfig: ModelsJsonProvider,\n\tdefaults: Model<Api> | undefined,\n): Model<Api> {\n\tconst api = definition.api ?? providerConfig.api ?? defaults?.api;\n\tif (!api) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t);\n\t}\n\tconst baseUrl = definition.baseUrl ?? providerConfig.baseUrl ?? defaults?.baseUrl;\n\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\tif (definition.contextWindow !== undefined && definition.contextWindow <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid contextWindow`);\n\t}\n\tif (definition.maxTokens !== undefined && definition.maxTokens <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid maxTokens`);\n\t}\n\treturn {\n\t\tid: definition.id,\n\t\tname: definition.name ?? definition.id,\n\t\tapi: api as Api,\n\t\tprovider: providerId,\n\t\tbaseUrl,\n\t\treasoning: definition.reasoning ?? false,\n\t\tthinkingLevelMap: definition.thinkingLevelMap,\n\t\tinput: (definition.input ?? [\"text\"]) as (\"text\" | \"image\")[],\n\t\tcost: definition.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\tcontextWindow: definition.contextWindow ?? 128000,\n\t\tmaxTokens: definition.maxTokens ?? 16384,\n\t\tsamplingParams: definition.samplingParams,\n\t\theaders: undefined,\n\t\tcompat: mergeCompat(providerConfig.compat, definition.compat),\n\t};\n}\n\nfunction applyModelsJson(\n\tproviderId: string,\n\tbaseModels: readonly Model<Api>[],\n\tconfig: ModelsJsonProvider | undefined,\n): Model<Api>[] {\n\tif (!config) return [...baseModels];\n\tif (config.oauth && !config.baseUrl) {\n\t\tthrow new Error(`Provider ${providerId}: \"baseUrl\" is required when \"oauth\" is set.`);\n\t}\n\tconst hasOverrides = config.modelOverrides && Object.keys(config.modelOverrides).length > 0;\n\tif (\n\t\t!config.models?.length &&\n\t\t!config.baseUrl &&\n\t\t!config.headers &&\n\t\t!config.compat &&\n\t\t!hasOverrides &&\n\t\t!config.apiKey &&\n\t\t!config.oauth &&\n\t\tconfig.authHeader === undefined\n\t) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}: must specify \"baseUrl\", \"headers\", \"compat\", \"modelOverrides\", or \"models\".`,\n\t\t);\n\t}\n\n\tconst models: Model<Api>[] = baseModels.map((model) => ({\n\t\t...model,\n\t\tbaseUrl: config.oauth === \"radius\" ? model.baseUrl : (config.baseUrl ?? model.baseUrl),\n\t\tcompat: mergeCompat(model.compat, config.compat),\n\t}));\n\tfor (const definition of config.models ?? []) {\n\t\tconst existingIndex = models.findIndex((model) => model.id === definition.id);\n\t\tconst defaults = existingIndex >= 0 ? models[existingIndex] : models[0];\n\t\tconst model = modelFromJson(providerId, definition, config, defaults);\n\t\tif (existingIndex >= 0) models[existingIndex] = model;\n\t\telse models.push(model);\n\t}\n\treturn models;\n}\n\nfunction applyExtension(\n\tproviderId: string,\n\tmodels: readonly Model<Api>[],\n\tconfig: ProviderConfigInput | undefined,\n): Model<Api>[] {\n\tif (!config) return [...models];\n\tif (!config.models) {\n\t\treturn config.baseUrl ? models.map((model) => ({ ...model, baseUrl: config.baseUrl! })) : [...models];\n\t}\n\treturn config.models.map((definition) => {\n\t\tconst defaults = models.find((model) => model.id === definition.id) ?? models[0];\n\t\tconst api = definition.api ?? config.api ?? defaults?.api;\n\t\tif (!api) {\n\t\t\tthrow new Error(\n\t\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t\t);\n\t\t}\n\t\tconst baseUrl = definition.baseUrl ?? config.baseUrl ?? defaults?.baseUrl;\n\t\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\t\treturn {\n\t\t\t...definition,\n\t\t\tapi,\n\t\t\tprovider: providerId,\n\t\t\tbaseUrl,\n\t\t\theaders: undefined,\n\t\t};\n\t});\n}\n\nfunction adaptOAuth(config: ExtensionOAuthConfig): OAuthAuth {\n\treturn {\n\t\tname: config.name,\n\t\tisSubscription: config.isSubscription,\n\t\tlogin: async (callbacks) => {\n\t\t\tconst credential = await config.login({\n\t\t\t\tonAuth: (info) => callbacks.notify({ type: \"auth_url\", ...info }),\n\t\t\t\tonDeviceCode: (info) => callbacks.notify({ type: \"device_code\", ...info }),\n\t\t\t\tonPrompt: (prompt) => callbacks.prompt({ type: \"text\", ...prompt }),\n\t\t\t\tonProgress: (message) => callbacks.notify({ type: \"progress\", message }),\n\t\t\t\tonManualCodeInput: () => callbacks.prompt({ type: \"manual_code\", message: \"Paste the authorization code\" }),\n\t\t\t\tonSelect: (prompt) => callbacks.prompt({ type: \"select\", ...prompt }),\n\t\t\t\tsignal: callbacks.signal,\n\t\t\t});\n\t\t\treturn { ...credential, type: \"oauth\" };\n\t\t},\n\t\trefresh: async (credential, signal) => ({ ...(await config.refreshToken(credential, signal)), type: \"oauth\" }),\n\t\ttoAuth: async (credential) => ({ apiKey: config.getApiKey(credential) }),\n\t};\n}\n\nfunction withConfiguredAuth(\n\tauth: ModelAuth,\n\theaders: Record<string, string> | undefined,\n\tauthHeader: boolean,\n): ModelAuth {\n\tlet mergedHeaders: ProviderHeaders | undefined =\n\t\tauth.headers || headers ? { ...auth.headers, ...headers } : undefined;\n\tif (authHeader) {\n\t\tif (!auth.apiKey) throw new Error(\"authHeader requires a resolved API key\");\n\t\tmergedHeaders = { ...mergedHeaders, Authorization: `Bearer ${auth.apiKey}` };\n\t}\n\treturn { ...auth, headers: mergedHeaders };\n}\n\nfunction configuredApiKey(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): string | undefined {\n\treturn extension?.apiKey ?? config?.apiKey;\n}\n\nfunction configuredHeaders(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tif (!config?.headers && !extension?.headers) return undefined;\n\treturn { ...config?.headers, ...extension?.headers };\n}\n\nasync function configContextEnv(\n\tvalues: readonly string[],\n\tctx: AuthContext,\n\texplicit?: Record<string, string>,\n): Promise<Record<string, string> | undefined> {\n\tconst env = { ...explicit };\n\tfor (const name of new Set(values.flatMap(getConfigValueEnvVarNames))) {\n\t\tif (env[name] !== undefined) continue;\n\t\tconst value = await ctx.env(name);\n\t\tif (value !== undefined) env[name] = value;\n\t}\n\treturn Object.keys(env).length > 0 ? env : undefined;\n}\n\nfunction composeApiKeyAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): ApiKeyAuth | undefined {\n\tconst inherited = base?.auth.apiKey;\n\tconst rawKey = configuredApiKey(config, extension);\n\tconst oauth = extension?.oauth ?? base?.auth.oauth;\n\t// OAuth-only providers get no fabricated API-key login method.\n\tif (!inherited && rawKey === undefined && oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\tname: inherited?.name ?? \"API key\",\n\t\tlogin:\n\t\t\tinherited?.login ??\n\t\t\t(async (interaction: AuthInteraction) => ({\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: await interaction.prompt({ type: \"secret\", message: \"Enter API key\" }),\n\t\t\t})),\n\t\tcheck: async (input) => {\n\t\t\tif (input.credential) {\n\t\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\t\tif (input.credential.key) return { type: \"api_key\", source: \"stored credential\" };\n\t\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t\t}\n\t\t\tif (rawKey !== undefined) {\n\t\t\t\tif (isCommandConfigValue(rawKey)) return { type: \"api_key\", source: \"configured API key\" };\n\t\t\t\tconst envNames = getConfigValueEnvVarNames(rawKey);\n\t\t\t\tfor (const name of envNames) {\n\t\t\t\t\tif ((await input.ctx.env(name)) === undefined) return undefined;\n\t\t\t\t}\n\t\t\t\treturn { type: \"api_key\", source: \"configured API key\" };\n\t\t\t}\n\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t},\n\t\tresolve: async (input) => {\n\t\t\tlet result: AuthResult | undefined;\n\t\t\tif (input.credential) {\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve(input)\n\t\t\t\t\t: input.credential.key\n\t\t\t\t\t\t? { auth: { apiKey: input.credential.key }, env: input.credential.env, source: \"stored credential\" }\n\t\t\t\t\t\t: undefined;\n\t\t\t} else if (rawKey !== undefined) {\n\t\t\t\tconst env = await configContextEnv([rawKey], input.ctx);\n\t\t\t\tconst key = resolveConfigValueOrThrow(rawKey, `API key for provider \"${providerId}\"`, env);\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve({ ...input, credential: { type: \"api_key\", key } })\n\t\t\t\t\t: { auth: { apiKey: key }, source: \"configured API key\" };\n\t\t\t} else {\n\t\t\t\tresult = await inherited?.resolve(input);\n\t\t\t}\n\t\t\tif (!result) return undefined;\n\t\t\tconst explicitEnv = { ...(input.credential?.env ?? {}), ...(result.env ?? {}) };\n\t\t\tconst headerEnv = await configContextEnv(Object.values(rawHeaders ?? {}), input.ctx, explicitEnv);\n\t\t\tconst headers = resolveHeadersOrThrow(rawHeaders, `provider \"${providerId}\"`, headerEnv);\n\t\t\treturn { ...result, auth: withConfiguredAuth(result.auth, headers, authHeader) };\n\t\t},\n\t};\n}\n\nfunction composeOAuthAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): OAuthAuth | undefined {\n\tconst oauth = extension?.oauth ? adaptOAuth(extension.oauth) : base?.auth.oauth;\n\tif (!oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\t...oauth,\n\t\ttoAuth: async (credential) => {\n\t\t\tconst auth = await oauth.toAuth(credential);\n\t\t\tconst env = credential.env;\n\t\t\tconst headers = resolveHeadersOrThrow(\n\t\t\t\trawHeaders,\n\t\t\t\t`provider \"${providerId}\"`,\n\t\t\t\ttypeof env === \"object\" && env !== null ? (env as Record<string, string>) : undefined,\n\t\t\t);\n\t\t\treturn withConfiguredAuth(auth, headers, authHeader);\n\t\t},\n\t};\n}\n\nfunction rawModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tconst definition = config?.models?.find((entry) => entry.id === model.id);\n\tconst extensionModel = extension?.models?.find((entry) => entry.id === model.id);\n\tconst headers = {\n\t\t...config?.modelOverrides?.[model.id]?.headers,\n\t\t...definition?.headers,\n\t\t...extensionModel?.headers,\n\t};\n\treturn Object.keys(headers).length > 0 ? headers : undefined;\n}\n\nexport function validateExtensionProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelsConfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput,\n): void {\n\tif (extension.streamSimple && !extension.api) {\n\t\tthrow new Error(`Provider ${providerId}: \"api\" is required when registering streamSimple.`);\n\t}\n\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], modelsConfig), extension);\n}\n\n/** Compose built-in, models.json, and extension layers without reading credentials. */\nexport function composeModelProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelConfig: ModelConfig,\n\textension: ProviderConfigInput | undefined,\n): Provider {\n\tconst config = modelConfig.getProvider(providerId);\n\tlet extensionOAuthCredential: OAuthCredentials | undefined;\n\tlet refreshedExtensionModels: ProviderConfigInput[\"models\"];\n\tconst currentExtension = (): ProviderConfigInput | undefined =>\n\t\textension && refreshedExtensionModels ? { ...extension, models: refreshedExtensionModels } : extension;\n\t// models.json modelOverrides are the topmost user-config layer: they apply once,\n\t// after custom-model upserts, extension model replacement, and legacy OAuth projection.\n\tconst getModels = () => {\n\t\tlet models = applyExtension(\n\t\t\tproviderId,\n\t\t\tapplyModelsJson(providerId, base?.getModels() ?? [], config),\n\t\t\tcurrentExtension(),\n\t\t);\n\t\tif (extensionOAuthCredential && extension?.oauth?.modifyModels) {\n\t\t\tmodels = extension.oauth.modifyModels(models, extensionOAuthCredential);\n\t\t}\n\t\treturn models.map((model) => {\n\t\t\tconst override = config?.modelOverrides?.[model.id];\n\t\t\treturn override ? applyModelOverride(model, override) : model;\n\t\t});\n\t};\n\t// Validate eagerly so registration/reload reports structural errors immediately.\n\tgetModels();\n\tconst apiKey = composeApiKeyAuth(providerId, base, config, extension);\n\tconst oauth = composeOAuthAuth(providerId, base, config, extension);\n\tif (!apiKey && !oauth) throw new Error(`Provider ${providerId}: no authentication method configured.`);\n\n\tconst supportsBaseApi = (model: Model<Api>) => base?.getModels().some((entry) => entry.api === model.api) ?? false;\n\tconst streamWith = (\n\t\tmodel: Model<Api>,\n\t\tcontext: Context,\n\t\toptions: StreamOptions | undefined,\n\t\tsimple: boolean,\n\t): AssistantMessageEventStream =>\n\t\tlazyStream(model, async () => {\n\t\t\tif (extension?.streamSimple && model.api === extension.api) {\n\t\t\t\treturn extension.streamSimple(model, context, options as SimpleStreamOptions);\n\t\t\t}\n\t\t\tif (base && supportsBaseApi(model)) {\n\t\t\t\treturn simple\n\t\t\t\t\t? base.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t\t: base.stream(model, context, options);\n\t\t\t}\n\t\t\tconst api = getApiProvider(model.api);\n\t\t\tif (!api) throw new Error(`No API provider registered for api: ${model.api}`);\n\t\t\treturn simple\n\t\t\t\t? api.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t: api.stream(model, context, options);\n\t\t});\n\n\tconst provider: Provider = {\n\t\tid: providerId,\n\t\tname: extension?.name ?? config?.name ?? base?.name ?? extension?.oauth?.name ?? providerId,\n\t\tbaseUrl: extension?.baseUrl ?? config?.baseUrl ?? base?.baseUrl,\n\t\theaders: base?.headers,\n\t\tauth: { ...(apiKey ? { apiKey } : {}), ...(oauth ? { oauth } : {}) },\n\t\tgetModels,\n\t\trefreshModels:\n\t\t\tbase?.refreshModels || extension?.refreshModels || extension?.oauth?.modifyModels\n\t\t\t\t? async (context) => {\n\t\t\t\t\t\tawait base?.refreshModels?.(context);\n\t\t\t\t\t\tlet refreshed: NonNullable<ProviderConfigInput[\"models\"]> | undefined;\n\t\t\t\t\t\tif (extension?.refreshModels) refreshed = await extension.refreshModels(context);\n\t\t\t\t\t\tif (context.signal.aborted) return;\n\t\t\t\t\t\tconst oauthCredential = context.credential?.type === \"oauth\" ? context.credential : undefined;\n\t\t\t\t\t\tawait context.publish({\n\t\t\t\t\t\t\tupdate: () => {\n\t\t\t\t\t\t\t\tif (refreshed) {\n\t\t\t\t\t\t\t\t\t// Validate before publishing the new synchronous list.\n\t\t\t\t\t\t\t\t\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], config), {\n\t\t\t\t\t\t\t\t\t\t...extension,\n\t\t\t\t\t\t\t\t\t\tmodels: refreshed,\n\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\trefreshedExtensionModels = refreshed;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\textensionOAuthCredential = oauthCredential;\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\tfilterModels: base?.filterModels\n\t\t\t? (models, credential: Credential | undefined) => base.filterModels!(models, credential)\n\t\t\t: undefined,\n\t\tstream: (model, context, options) => streamWith(model, context, options, false),\n\t\tstreamSimple: (model, context, options) => streamWith(model, context, options, true),\n\t};\n\n\tconst fetchDeferred = base?.fetchDeferred;\n\tif (fetchDeferred) {\n\t\tprovider.fetchDeferred = (model, handle, options) => fetchDeferred(model, handle, options);\n\t}\n\tconst cancelDeferred = base?.cancelDeferred;\n\tif (cancelDeferred) {\n\t\tprovider.cancelDeferred = (model, handle, options) => cancelDeferred(model, handle, options);\n\t}\n\n\treturn provider;\n}\n\nexport function resolveConfiguredModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n\tenv?: Record<string, string>,\n): Record<string, string> | undefined {\n\treturn resolveHeadersOrThrow(\n\t\trawModelHeaders(model, config, extension),\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t\tenv,\n\t);\n}\n\nexport interface CompatibilityRequestConfig {\n\theaders?: ProviderHeaders;\n\tauthHeader: boolean;\n}\n\nexport function resolveCompatibilityRequestConfig(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): CompatibilityRequestConfig {\n\tconst configured = resolveHeadersOrThrow(\n\t\t{ ...configuredHeaders(config, extension), ...rawModelHeaders(model, config, extension) },\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t);\n\treturn {\n\t\theaders: model.headers || configured ? { ...model.headers, ...configured } : undefined,\n\t\tauthHeader: extension?.authHeader ?? config?.authHeader ?? false,\n\t};\n}\n\nexport function configuredRequestAuthStatus(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): AuthStatus | undefined {\n\tconst value = configuredApiKey(config, extension);\n\tif (value === undefined) return undefined;\n\tif (isCommandConfigValue(value)) return { configured: true, source: \"models_json_command\" };\n\tconst names = getConfigValueEnvVarNames(value);\n\tif (names.length > 0) {\n\t\treturn isConfigValueConfigured(value)\n\t\t\t? { configured: true, source: \"environment\", label: names.join(\", \") }\n\t\t\t: { configured: false };\n\t}\n\treturn { configured: true, source: extension?.apiKey !== undefined ? \"fallback\" : \"models_json_key\" };\n}\n"]}
+{"version":3,"file":"provider-composer.d.ts","sourceRoot":"","sources":["../../src/core/provider-composer.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,GAAG,EAER,KAAK,2BAA2B,EAIhC,KAAK,OAAO,EAGZ,KAAK,KAAK,EAGV,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EAExB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAExB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,WAAW,EAA4C,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnH,OAAO,EACN,qBAAqB,EAMrB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjE,YAAY,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5F,SAAS,CAAC,WAAW,EAAE,gBAAgB,GAAG,MAAM,CAAC;IACjD,YAAY,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;CACjF;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,2BAA2B,CAAC;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAClD,KAAK,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;KAC9B,CAAC,CAAC;IACH,aAAa,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;CACnG;AAED,MAAM,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,eAAO,MAAM,gBAAgB,8BAAwB,CAAC;AAiVtD,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,QAAQ,GAAG,SAAS,EAC1B,YAAY,EAAE,kBAAkB,GAAG,SAAS,EAC5C,SAAS,EAAE,mBAAmB,GAC5B,IAAI,CAKN;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,QAAQ,GAAG,SAAS,EAC1B,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,mBAAmB,GAAG,SAAS,GACxC,QAAQ,CAkGV;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,SAAS,EAAE,mBAAmB,GAAG,SAAS,EAC1C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAMpC;AAED,MAAM,WAAW,0BAA0B;IAC1C,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,iCAAiC,CAChD,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GACxC,0BAA0B,CAS5B;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GACxC,UAAU,GAAG,SAAS,CAWxB","sourcesContent":["import {\n\ttype Api,\n\ttype ApiKeyAuth,\n\ttype AssistantMessageEventStream,\n\ttype AuthContext,\n\ttype AuthInteraction,\n\ttype AuthResult,\n\ttype Context,\n\ttype Credential,\n\tlazyStream,\n\ttype Model,\n\ttype ModelAuth,\n\ttype OAuthAuth,\n\ttype OAuthCredentials,\n\ttype OAuthLoginCallbacks,\n\ttype OpenAIResponsesCompat,\n\ttype Provider,\n\ttype ProviderHeaders,\n\ttype RefreshModelsContext,\n\ttype SimpleStreamOptions,\n\ttype StreamOptions,\n} from \"@earendil-works/pi-ai\";\nimport { getApiProvider } from \"@earendil-works/pi-ai/compat\";\nimport type { ModelConfig, ModelsJsonModel, ModelsJsonModelOverride, ModelsJsonProvider } from \"./model-config.ts\";\nimport {\n\tclearConfigValueCache,\n\tgetConfigValueEnvVarNames,\n\tisCommandConfigValue,\n\tisConfigValueConfigured,\n\tresolveConfigValueOrThrow,\n\tresolveHeadersOrThrow,\n} from \"./resolve-config-value.ts\";\n\nexport interface ExtensionOAuthConfig {\n\tname: string;\n\t/** Whether access through this auth method is backed by a provider subscription. */\n\tisSubscription?: boolean;\n\t/** @deprecated Retained for extension source compatibility; ignored by canonical auth flows. */\n\tusesCallbackServer?: boolean;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n\tmodifyModels?(models: Model<Api>[], credentials: OAuthCredentials): Model<Api>[];\n}\n\n/** Input type for the extension registerProvider API. */\nexport interface ProviderConfigInput {\n\tname?: string;\n\tbaseUrl?: string;\n\tapiKey?: string;\n\tapi?: Api;\n\tstreamSimple?: (model: Model<Api>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;\n\theaders?: Record<string, string>;\n\tauthHeader?: boolean;\n\toauth?: ExtensionOAuthConfig;\n\tmodels?: Array<{\n\t\tid: string;\n\t\tname: string;\n\t\tapi?: Api;\n\t\tbaseUrl?: string;\n\t\treasoning: boolean;\n\t\tthinkingLevelMap?: Model<Api>[\"thinkingLevelMap\"];\n\t\tinput: (\"text\" | \"image\")[];\n\t\tcost: Model<Api>[\"cost\"];\n\t\tcontextWindow: number;\n\t\tmaxTokens: number;\n\t\tsamplingParams?: Record<string, unknown>;\n\t\theaders?: Record<string, string>;\n\t\tcompat?: Model<Api>[\"compat\"];\n\t}>;\n\trefreshModels?(context: RefreshModelsContext): Promise<NonNullable<ProviderConfigInput[\"models\"]>>;\n}\n\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport const clearApiKeyCache = clearConfigValueCache;\n\nfunction mergeCompat(\n\tbase: Model<Api>[\"compat\"],\n\toverride: Model<Api>[\"compat\"] | ModelsJsonModelOverride[\"compat\"],\n): Model<Api>[\"compat\"] {\n\tif (!override) return base;\n\tconst merged = { ...base, ...override } as NonNullable<Model<Api>[\"compat\"]>;\n\tconst baseNested = base as Record<string, unknown> | undefined;\n\tconst overrideNested = override as Record<string, unknown>;\n\tconst mergedNested = merged as Record<string, unknown>;\n\tfor (const key of [\"openRouterRouting\", \"vercelGatewayRouting\", \"chatTemplateKwargs\", \"chatTemplateArgs\"] as const) {\n\t\tconst baseValue = baseNested?.[key];\n\t\tconst overrideValue = overrideNested[key];\n\t\tif (\n\t\t\t(typeof baseValue === \"object\" && baseValue !== null) ||\n\t\t\t(typeof overrideValue === \"object\" && overrideValue !== null)\n\t\t) {\n\t\t\tmergedNested[key] = { ...(baseValue as object | undefined), ...(overrideValue as object | undefined) };\n\t\t}\n\t}\n\treturn merged;\n}\n\nfunction applyModelOverride(model: Model<Api>, override: ModelsJsonModelOverride): Model<Api> {\n\treturn {\n\t\t...model,\n\t\tname: override.name ?? model.name,\n\t\treasoning: override.reasoning ?? model.reasoning,\n\t\tthinkingLevelMap: override.thinkingLevelMap\n\t\t\t? { ...model.thinkingLevelMap, ...override.thinkingLevelMap }\n\t\t\t: model.thinkingLevelMap,\n\t\tinput: (override.input as (\"text\" | \"image\")[] | undefined) ?? model.input,\n\t\tcost: override.cost\n\t\t\t? {\n\t\t\t\t\tinput: override.cost.input ?? model.cost.input,\n\t\t\t\t\toutput: override.cost.output ?? model.cost.output,\n\t\t\t\t\tcacheRead: override.cost.cacheRead ?? model.cost.cacheRead,\n\t\t\t\t\tcacheWrite: override.cost.cacheWrite ?? model.cost.cacheWrite,\n\t\t\t\t\ttiers: override.cost.tiers ?? model.cost.tiers,\n\t\t\t\t}\n\t\t\t: model.cost,\n\t\tcontextWindow: override.contextWindow ?? model.contextWindow,\n\t\tmaxTokens: override.maxTokens ?? model.maxTokens,\n\t\tsamplingParams: override.samplingParams\n\t\t\t? { ...model.samplingParams, ...override.samplingParams }\n\t\t\t: model.samplingParams,\n\t\tcompat: mergeCompat(model.compat, override.compat),\n\t};\n}\n\nfunction applyCompatibilityDefaults(model: Model<Api>): Model<Api> {\n\tconst compat = model.api === \"openai-responses\" ? (model.compat as OpenAIResponsesCompat | undefined) : undefined;\n\tif (model.api !== \"openai-responses\" || compat?.supportsStrictMode !== undefined) return model;\n\treturn {\n\t\t...model,\n\t\tcompat: { ...compat, supportsStrictMode: true },\n\t};\n}\n\nfunction modelFromJson(\n\tproviderId: string,\n\tdefinition: ModelsJsonModel,\n\tproviderConfig: ModelsJsonProvider,\n\tdefaults: Model<Api> | undefined,\n): Model<Api> {\n\tconst api = definition.api ?? providerConfig.api ?? defaults?.api;\n\tif (!api) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t);\n\t}\n\tconst baseUrl = definition.baseUrl ?? providerConfig.baseUrl ?? defaults?.baseUrl;\n\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\tif (definition.contextWindow !== undefined && definition.contextWindow <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid contextWindow`);\n\t}\n\tif (definition.maxTokens !== undefined && definition.maxTokens <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid maxTokens`);\n\t}\n\treturn {\n\t\tid: definition.id,\n\t\tname: definition.name ?? definition.id,\n\t\tapi: api as Api,\n\t\tprovider: providerId,\n\t\tbaseUrl,\n\t\treasoning: definition.reasoning ?? false,\n\t\tthinkingLevelMap: definition.thinkingLevelMap,\n\t\tinput: (definition.input ?? [\"text\"]) as (\"text\" | \"image\")[],\n\t\tcost: definition.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\tcontextWindow: definition.contextWindow ?? 128000,\n\t\tmaxTokens: definition.maxTokens ?? 16384,\n\t\tsamplingParams: definition.samplingParams,\n\t\theaders: undefined,\n\t\tcompat: mergeCompat(providerConfig.compat, definition.compat),\n\t};\n}\n\nfunction applyModelsJson(\n\tproviderId: string,\n\tbaseModels: readonly Model<Api>[],\n\tconfig: ModelsJsonProvider | undefined,\n): Model<Api>[] {\n\tif (!config) return [...baseModels];\n\tif (config.oauth && !config.baseUrl) {\n\t\tthrow new Error(`Provider ${providerId}: \"baseUrl\" is required when \"oauth\" is set.`);\n\t}\n\tconst hasOverrides = config.modelOverrides && Object.keys(config.modelOverrides).length > 0;\n\tif (\n\t\t!config.models?.length &&\n\t\t!config.baseUrl &&\n\t\t!config.headers &&\n\t\t!config.compat &&\n\t\t!hasOverrides &&\n\t\t!config.apiKey &&\n\t\t!config.oauth &&\n\t\tconfig.authHeader === undefined\n\t) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}: must specify \"baseUrl\", \"headers\", \"compat\", \"modelOverrides\", or \"models\".`,\n\t\t);\n\t}\n\n\tconst models: Model<Api>[] = baseModels.map((model) => ({\n\t\t...model,\n\t\tbaseUrl: config.oauth === \"radius\" ? model.baseUrl : (config.baseUrl ?? model.baseUrl),\n\t\tcompat: mergeCompat(model.compat, config.compat),\n\t}));\n\tfor (const definition of config.models ?? []) {\n\t\tconst existingIndex = models.findIndex((model) => model.id === definition.id);\n\t\tconst defaults = existingIndex >= 0 ? models[existingIndex] : models[0];\n\t\tconst model = modelFromJson(providerId, definition, config, defaults);\n\t\tif (existingIndex >= 0) models[existingIndex] = model;\n\t\telse models.push(model);\n\t}\n\treturn models;\n}\n\nfunction applyExtension(\n\tproviderId: string,\n\tmodels: readonly Model<Api>[],\n\tconfig: ProviderConfigInput | undefined,\n): Model<Api>[] {\n\tif (!config) return [...models];\n\tif (!config.models) {\n\t\treturn config.baseUrl ? models.map((model) => ({ ...model, baseUrl: config.baseUrl! })) : [...models];\n\t}\n\treturn config.models.map((definition) => {\n\t\tconst defaults = models.find((model) => model.id === definition.id) ?? models[0];\n\t\tconst api = definition.api ?? config.api ?? defaults?.api;\n\t\tif (!api) {\n\t\t\tthrow new Error(\n\t\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t\t);\n\t\t}\n\t\tconst baseUrl = definition.baseUrl ?? config.baseUrl ?? defaults?.baseUrl;\n\t\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\t\treturn {\n\t\t\t...definition,\n\t\t\tapi,\n\t\t\tprovider: providerId,\n\t\t\tbaseUrl,\n\t\t\theaders: undefined,\n\t\t};\n\t});\n}\n\nfunction adaptOAuth(config: ExtensionOAuthConfig): OAuthAuth {\n\treturn {\n\t\tname: config.name,\n\t\tisSubscription: config.isSubscription,\n\t\tlogin: async (callbacks) => {\n\t\t\tconst credential = await config.login({\n\t\t\t\tonAuth: (info) => callbacks.notify({ type: \"auth_url\", ...info }),\n\t\t\t\tonDeviceCode: (info) => callbacks.notify({ type: \"device_code\", ...info }),\n\t\t\t\tonPrompt: (prompt) => callbacks.prompt({ type: \"text\", ...prompt }),\n\t\t\t\tonProgress: (message) => callbacks.notify({ type: \"progress\", message }),\n\t\t\t\tonManualCodeInput: () => callbacks.prompt({ type: \"manual_code\", message: \"Paste the authorization code\" }),\n\t\t\t\tonSelect: (prompt) => callbacks.prompt({ type: \"select\", ...prompt }),\n\t\t\t\tsignal: callbacks.signal,\n\t\t\t});\n\t\t\treturn { ...credential, type: \"oauth\" };\n\t\t},\n\t\trefresh: async (credential, signal) => ({ ...(await config.refreshToken(credential, signal)), type: \"oauth\" }),\n\t\ttoAuth: async (credential) => ({ apiKey: config.getApiKey(credential) }),\n\t};\n}\n\nfunction withConfiguredAuth(\n\tauth: ModelAuth,\n\theaders: Record<string, string> | undefined,\n\tauthHeader: boolean,\n): ModelAuth {\n\tlet mergedHeaders: ProviderHeaders | undefined =\n\t\tauth.headers || headers ? { ...auth.headers, ...headers } : undefined;\n\tif (authHeader) {\n\t\tif (!auth.apiKey) throw new Error(\"authHeader requires a resolved API key\");\n\t\tmergedHeaders = { ...mergedHeaders, Authorization: `Bearer ${auth.apiKey}` };\n\t}\n\treturn { ...auth, headers: mergedHeaders };\n}\n\nfunction configuredApiKey(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): string | undefined {\n\treturn extension?.apiKey ?? config?.apiKey;\n}\n\nfunction configuredHeaders(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tif (!config?.headers && !extension?.headers) return undefined;\n\treturn { ...config?.headers, ...extension?.headers };\n}\n\nasync function configContextEnv(\n\tvalues: readonly string[],\n\tctx: AuthContext,\n\texplicit?: Record<string, string>,\n): Promise<Record<string, string> | undefined> {\n\tconst env = { ...explicit };\n\tfor (const name of new Set(values.flatMap(getConfigValueEnvVarNames))) {\n\t\tif (env[name] !== undefined) continue;\n\t\tconst value = await ctx.env(name);\n\t\tif (value !== undefined) env[name] = value;\n\t}\n\treturn Object.keys(env).length > 0 ? env : undefined;\n}\n\nfunction composeApiKeyAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): ApiKeyAuth | undefined {\n\tconst inherited = base?.auth.apiKey;\n\tconst rawKey = configuredApiKey(config, extension);\n\tconst oauth = extension?.oauth ?? base?.auth.oauth;\n\t// OAuth-only providers get no fabricated API-key login method.\n\tif (!inherited && rawKey === undefined && oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\tname: inherited?.name ?? \"API key\",\n\t\tlogin:\n\t\t\tinherited?.login ??\n\t\t\t(async (interaction: AuthInteraction) => ({\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: await interaction.prompt({ type: \"secret\", message: \"Enter API key\" }),\n\t\t\t})),\n\t\tcheck: async (input) => {\n\t\t\tif (input.credential) {\n\t\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\t\tif (input.credential.key) return { type: \"api_key\", source: \"stored credential\" };\n\t\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t\t}\n\t\t\tif (rawKey !== undefined) {\n\t\t\t\tif (isCommandConfigValue(rawKey)) return { type: \"api_key\", source: \"configured API key\" };\n\t\t\t\tconst envNames = getConfigValueEnvVarNames(rawKey);\n\t\t\t\tfor (const name of envNames) {\n\t\t\t\t\tif ((await input.ctx.env(name)) === undefined) return undefined;\n\t\t\t\t}\n\t\t\t\treturn { type: \"api_key\", source: \"configured API key\" };\n\t\t\t}\n\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t},\n\t\tresolve: async (input) => {\n\t\t\tlet result: AuthResult | undefined;\n\t\t\tif (input.credential) {\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve(input)\n\t\t\t\t\t: input.credential.key\n\t\t\t\t\t\t? { auth: { apiKey: input.credential.key }, env: input.credential.env, source: \"stored credential\" }\n\t\t\t\t\t\t: undefined;\n\t\t\t} else if (rawKey !== undefined) {\n\t\t\t\tconst env = await configContextEnv([rawKey], input.ctx);\n\t\t\t\tconst key = resolveConfigValueOrThrow(rawKey, `API key for provider \"${providerId}\"`, env);\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve({ ...input, credential: { type: \"api_key\", key } })\n\t\t\t\t\t: { auth: { apiKey: key }, source: \"configured API key\" };\n\t\t\t} else {\n\t\t\t\tresult = await inherited?.resolve(input);\n\t\t\t}\n\t\t\tif (!result) return undefined;\n\t\t\tconst explicitEnv = { ...(input.credential?.env ?? {}), ...(result.env ?? {}) };\n\t\t\tconst headerEnv = await configContextEnv(Object.values(rawHeaders ?? {}), input.ctx, explicitEnv);\n\t\t\tconst headers = resolveHeadersOrThrow(rawHeaders, `provider \"${providerId}\"`, headerEnv);\n\t\t\treturn { ...result, auth: withConfiguredAuth(result.auth, headers, authHeader) };\n\t\t},\n\t};\n}\n\nfunction composeOAuthAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): OAuthAuth | undefined {\n\tconst oauth = extension?.oauth ? adaptOAuth(extension.oauth) : base?.auth.oauth;\n\tif (!oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\t...oauth,\n\t\ttoAuth: async (credential) => {\n\t\t\tconst auth = await oauth.toAuth(credential);\n\t\t\tconst env = credential.env;\n\t\t\tconst headers = resolveHeadersOrThrow(\n\t\t\t\trawHeaders,\n\t\t\t\t`provider \"${providerId}\"`,\n\t\t\t\ttypeof env === \"object\" && env !== null ? (env as Record<string, string>) : undefined,\n\t\t\t);\n\t\t\treturn withConfiguredAuth(auth, headers, authHeader);\n\t\t},\n\t};\n}\n\nfunction rawModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tconst definition = config?.models?.find((entry) => entry.id === model.id);\n\tconst extensionModel = extension?.models?.find((entry) => entry.id === model.id);\n\tconst headers = {\n\t\t...config?.modelOverrides?.[model.id]?.headers,\n\t\t...definition?.headers,\n\t\t...extensionModel?.headers,\n\t};\n\treturn Object.keys(headers).length > 0 ? headers : undefined;\n}\n\nexport function validateExtensionProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelsConfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput,\n): void {\n\tif (extension.streamSimple && !extension.api) {\n\t\tthrow new Error(`Provider ${providerId}: \"api\" is required when registering streamSimple.`);\n\t}\n\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], modelsConfig), extension);\n}\n\n/** Compose built-in, models.json, and extension layers without reading credentials. */\nexport function composeModelProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelConfig: ModelConfig,\n\textension: ProviderConfigInput | undefined,\n): Provider {\n\tconst config = modelConfig.getProvider(providerId);\n\tlet extensionOAuthCredential: OAuthCredentials | undefined;\n\tlet refreshedExtensionModels: ProviderConfigInput[\"models\"];\n\tconst currentExtension = (): ProviderConfigInput | undefined =>\n\t\textension && refreshedExtensionModels ? { ...extension, models: refreshedExtensionModels } : extension;\n\t// models.json modelOverrides are the topmost user-config layer: they apply once,\n\t// after custom-model upserts, extension model replacement, and legacy OAuth projection.\n\tconst getModels = () => {\n\t\tlet models = applyExtension(\n\t\t\tproviderId,\n\t\t\tapplyModelsJson(providerId, base?.getModels() ?? [], config),\n\t\t\tcurrentExtension(),\n\t\t);\n\t\tif (extensionOAuthCredential && extension?.oauth?.modifyModels) {\n\t\t\tmodels = extension.oauth.modifyModels(models, extensionOAuthCredential);\n\t\t}\n\t\treturn models.map((model) => {\n\t\t\tconst override = config?.modelOverrides?.[model.id];\n\t\t\treturn applyCompatibilityDefaults(override ? applyModelOverride(model, override) : model);\n\t\t});\n\t};\n\t// Validate eagerly so registration/reload reports structural errors immediately.\n\tgetModels();\n\tconst apiKey = composeApiKeyAuth(providerId, base, config, extension);\n\tconst oauth = composeOAuthAuth(providerId, base, config, extension);\n\tif (!apiKey && !oauth) throw new Error(`Provider ${providerId}: no authentication method configured.`);\n\n\tconst supportsBaseApi = (model: Model<Api>) => base?.getModels().some((entry) => entry.api === model.api) ?? false;\n\tconst streamWith = (\n\t\tmodel: Model<Api>,\n\t\tcontext: Context,\n\t\toptions: StreamOptions | undefined,\n\t\tsimple: boolean,\n\t): AssistantMessageEventStream =>\n\t\tlazyStream(model, async () => {\n\t\t\tif (extension?.streamSimple && model.api === extension.api) {\n\t\t\t\treturn extension.streamSimple(model, context, options as SimpleStreamOptions);\n\t\t\t}\n\t\t\tif (base && supportsBaseApi(model)) {\n\t\t\t\treturn simple\n\t\t\t\t\t? base.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t\t: base.stream(model, context, options);\n\t\t\t}\n\t\t\tconst api = getApiProvider(model.api);\n\t\t\tif (!api) throw new Error(`No API provider registered for api: ${model.api}`);\n\t\t\treturn simple\n\t\t\t\t? api.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t: api.stream(model, context, options);\n\t\t});\n\n\tconst provider: Provider = {\n\t\tid: providerId,\n\t\tname: extension?.name ?? config?.name ?? base?.name ?? extension?.oauth?.name ?? providerId,\n\t\tbaseUrl: extension?.baseUrl ?? config?.baseUrl ?? base?.baseUrl,\n\t\theaders: base?.headers,\n\t\tauth: { ...(apiKey ? { apiKey } : {}), ...(oauth ? { oauth } : {}) },\n\t\tgetModels,\n\t\trefreshModels:\n\t\t\tbase?.refreshModels || extension?.refreshModels || extension?.oauth?.modifyModels\n\t\t\t\t? async (context) => {\n\t\t\t\t\t\tawait base?.refreshModels?.(context);\n\t\t\t\t\t\tlet refreshed: NonNullable<ProviderConfigInput[\"models\"]> | undefined;\n\t\t\t\t\t\tif (extension?.refreshModels) refreshed = await extension.refreshModels(context);\n\t\t\t\t\t\tif (context.signal.aborted) return;\n\t\t\t\t\t\tconst oauthCredential = context.credential?.type === \"oauth\" ? context.credential : undefined;\n\t\t\t\t\t\tawait context.publish({\n\t\t\t\t\t\t\tupdate: () => {\n\t\t\t\t\t\t\t\tif (refreshed) {\n\t\t\t\t\t\t\t\t\t// Validate before publishing the new synchronous list.\n\t\t\t\t\t\t\t\t\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], config), {\n\t\t\t\t\t\t\t\t\t\t...extension,\n\t\t\t\t\t\t\t\t\t\tmodels: refreshed,\n\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\trefreshedExtensionModels = refreshed;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\textensionOAuthCredential = oauthCredential;\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\tfilterModels: base?.filterModels\n\t\t\t? (models, credential: Credential | undefined) => base.filterModels!(models, credential)\n\t\t\t: undefined,\n\t\tstream: (model, context, options) => streamWith(model, context, options, false),\n\t\tstreamSimple: (model, context, options) => streamWith(model, context, options, true),\n\t};\n\n\tconst fetchDeferred = base?.fetchDeferred;\n\tif (fetchDeferred) {\n\t\tprovider.fetchDeferred = (model, handle, options) => fetchDeferred(model, handle, options);\n\t}\n\tconst cancelDeferred = base?.cancelDeferred;\n\tif (cancelDeferred) {\n\t\tprovider.cancelDeferred = (model, handle, options) => cancelDeferred(model, handle, options);\n\t}\n\n\treturn provider;\n}\n\nexport function resolveConfiguredModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n\tenv?: Record<string, string>,\n): Record<string, string> | undefined {\n\treturn resolveHeadersOrThrow(\n\t\trawModelHeaders(model, config, extension),\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t\tenv,\n\t);\n}\n\nexport interface CompatibilityRequestConfig {\n\theaders?: ProviderHeaders;\n\tauthHeader: boolean;\n}\n\nexport function resolveCompatibilityRequestConfig(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): CompatibilityRequestConfig {\n\tconst configured = resolveHeadersOrThrow(\n\t\t{ ...configuredHeaders(config, extension), ...rawModelHeaders(model, config, extension) },\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t);\n\treturn {\n\t\theaders: model.headers || configured ? { ...model.headers, ...configured } : undefined,\n\t\tauthHeader: extension?.authHeader ?? config?.authHeader ?? false,\n\t};\n}\n\nexport function configuredRequestAuthStatus(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): AuthStatus | undefined {\n\tconst value = configuredApiKey(config, extension);\n\tif (value === undefined) return undefined;\n\tif (isCommandConfigValue(value)) return { configured: true, source: \"models_json_command\" };\n\tconst names = getConfigValueEnvVarNames(value);\n\tif (names.length > 0) {\n\t\treturn isConfigValueConfigured(value)\n\t\t\t? { configured: true, source: \"environment\", label: names.join(\", \") }\n\t\t\t: { configured: false };\n\t}\n\treturn { configured: true, source: extension?.apiKey !== undefined ? \"fallback\" : \"models_json_key\" };\n}\n"]}

package/dist/core/provider-composer.js

@@ -45,6 +45,15 @@ function applyModelOverride(model, override) {
         compat: mergeCompat(model.compat, override.compat),
     };
 }
+function applyCompatibilityDefaults(model) {
+    const compat = model.api === "openai-responses" ? model.compat : undefined;
+    if (model.api !== "openai-responses" || compat?.supportsStrictMode !== undefined)
+        return model;
+    return {
+        ...model,
+        compat: { ...compat, supportsStrictMode: true },
+    };
+}
 function modelFromJson(providerId, definition, providerConfig, defaults) {
     const api = definition.api ?? providerConfig.api ?? defaults?.api;
     if (!api) {
@@ -296,7 +305,7 @@ export function composeModelProvider(providerId, base, modelConfig, extension) {
         }
         return models.map((model) => {
             const override = config?.modelOverrides?.[model.id];
-            return override ? applyModelOverride(model, override) : model;
+            return applyCompatibilityDefaults(override ? applyModelOverride(model, override) : model);
         });
     };
     // Validate eagerly so registration/reload reports structural errors immediately.

package/dist/core/provider-composer.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-composer.js","sourceRoot":"","sources":["../../src/core/provider-composer.ts"],"names":[],"mappings":"AAAA,OAAO,EASN,UAAU,GAWV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EACN,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACrB,MAAM,2BAA2B,CAAC;AAgDnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,SAAS,WAAW,CACnB,IAA0B,EAC1B,QAAkE,EAC3C;IACvB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,EAAuC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAA2C,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAmC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAiC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,CAAU,EAAE,CAAC;QACpH,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,IACC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC;YACrD,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,CAAC,EAC5D,CAAC;YACF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,SAAgC,EAAE,GAAI,aAAoC,EAAE,CAAC;QACxG,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAE,QAAiC,EAAc;IAC7F,OAAO;QACN,GAAG,KAAK;QACR,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;QAChD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC1C,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE;YAC7D,CAAC,CAAC,KAAK,CAAC,gBAAgB;QACzB,KAAK,EAAG,QAAQ,CAAC,KAA0C,IAAI,KAAK,CAAC,KAAK;QAC1E,IAAI,EAAE,QAAQ,CAAC,IAAI;YAClB,CAAC,CAAC;gBACA,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK;gBAC9C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;gBACjD,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS;gBAC1D,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU;gBAC7D,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK;aAC9C;YACF,CAAC,CAAC,KAAK,CAAC,IAAI;QACb,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;QAC5D,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;QAChD,cAAc,EAAE,QAAQ,CAAC,cAAc;YACtC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE;YACzD,CAAC,CAAC,KAAK,CAAC,cAAc;QACvB,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;KAClD,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CACrB,UAAkB,EAClB,UAA2B,EAC3B,cAAkC,EAClC,QAAgC,EACnB;IACb,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,cAAc,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACd,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,uDAAuD,CACrG,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;IAClF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,sDAAsD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACtF,CAAC;IACD,OAAO;QACN,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QACtC,GAAG,EAAE,GAAU;QACf,QAAQ,EAAE,UAAU;QACpB,OAAO;QACP,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;QACxC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAyB;QAC7D,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;QAC7E,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,MAAM;QACjD,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;QACxC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;KAC7D,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CACvB,UAAkB,EAClB,UAAiC,EACjC,MAAsC,EACvB;IACf,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,8CAA8C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,IACC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM;QACtB,CAAC,MAAM,CAAC,OAAO;QACf,CAAC,MAAM,CAAC,OAAO;QACf,CAAC,MAAM,CAAC,MAAM;QACd,CAAC,YAAY;QACb,CAAC,MAAM,CAAC,MAAM;QACd,CAAC,MAAM,CAAC,KAAK;QACb,MAAM,CAAC,UAAU,KAAK,SAAS,EAC9B,CAAC;QACF,MAAM,IAAI,KAAK,CACd,YAAY,UAAU,+EAA+E,CACrG,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;QACtF,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,aAAa,IAAI,CAAC;YAAE,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;;YACjD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,cAAc,CACtB,UAAkB,EAClB,MAA6B,EAC7B,MAAuC,EACxB;IACf,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,CAAC;QAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACd,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,uDAAuD,CACrG,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;QAC1E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,sDAAsD,CAAC,CAAC;QAC5G,OAAO;YACN,GAAG,UAAU;YACb,GAAG;YACH,QAAQ,EAAE,UAAU;YACpB,OAAO;YACP,OAAO,EAAE,SAAS;SAClB,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AAED,SAAS,UAAU,CAAC,MAA4B,EAAa;IAC5D,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;gBACrC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;gBACjE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC1E,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;gBACnE,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;gBACxE,iBAAiB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;gBAC3G,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;gBACrE,MAAM,EAAE,SAAS,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAA,CACxC;QACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC9G,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;KACxE,CAAC;AAAA,CACF;AAED,SAAS,kBAAkB,CAC1B,IAAe,EACf,OAA2C,EAC3C,UAAmB,EACP;IACZ,IAAI,aAAa,GAChB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AAAA,CAC3C;AAED,SAAS,gBAAgB,CACxB,MAAsC,EACtC,SAA0C,EACrB;IACrB,OAAO,SAAS,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,CAAC;AAAA,CAC3C;AAED,SAAS,iBAAiB,CACzB,MAAsC,EACtC,SAA0C,EACL;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,SAAS,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC;AAAA,CACrD;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAyB,EACzB,GAAgB,EAChB,QAAiC,EACa;IAC9C,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACrD;AAED,SAAS,iBAAiB,CACzB,UAAkB,EAClB,IAA0B,EAC1B,MAAsC,EACtC,SAA0C,EACjB;IACzB,MAAM,SAAS,GAAG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;IACnD,+DAA+D;IAC/D,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,SAAS,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IACxE,OAAO;QACN,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,SAAS;QAClC,KAAK,EACJ,SAAS,EAAE,KAAK;YAChB,CAAC,KAAK,EAAE,WAA4B,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;aAC3E,CAAC,CAAC;QACJ,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACtB,IAAI,SAAS,EAAE,KAAK;oBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;gBAClF,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,oBAAoB,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBAC3F,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBACnD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC7B,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS;wBAAE,OAAO,SAAS,CAAC;gBACjE,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC1D,CAAC;YACD,IAAI,SAAS,EAAE,KAAK;gBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAAA,CAC3E;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;YACzB,IAAI,MAA8B,CAAC;YACnC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,GAAG,SAAS;oBACjB,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;oBAChC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG;wBACrB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE;wBACpG,CAAC,CAAC,SAAS,CAAC;YACf,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC3F,MAAM,GAAG,SAAS;oBACjB,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;oBAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,MAAM,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAChF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAClG,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,EAAE,aAAa,UAAU,GAAG,EAAE,SAAS,CAAC,CAAC;YACzF,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAAA,CACjF;KACD,CAAC;AAAA,CACF;AAED,SAAS,gBAAgB,CACxB,UAAkB,EAClB,IAA0B,EAC1B,MAAsC,EACtC,SAA0C,EAClB;IACxB,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;IAChF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,SAAS,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IACxE,OAAO;QACN,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;YAC3B,MAAM,OAAO,GAAG,qBAAqB,CACpC,UAAU,EACV,aAAa,UAAU,GAAG,EAC1B,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA8B,CAAC,CAAC,CAAC,SAAS,CACrF,CAAC;YACF,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAAA,CACrD;KACD,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CACvB,KAAiB,EACjB,MAAsC,EACtC,SAA0C,EACL;IACrC,MAAM,UAAU,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG;QACf,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO;QAC9C,GAAG,UAAU,EAAE,OAAO;QACtB,GAAG,cAAc,EAAE,OAAO;KAC1B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC7D;AAED,MAAM,UAAU,yBAAyB,CACxC,UAAkB,EAClB,IAA0B,EAC1B,YAA4C,EAC5C,SAA8B,EACvB;IACP,IAAI,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,oDAAoD,CAAC,CAAC;IAC7F,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;AAAA,CAC1G;AAED,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CACnC,UAAkB,EAClB,IAA0B,EAC1B,WAAwB,EACxB,SAA0C,EAC/B;IACX,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,wBAAsD,CAAC;IAC3D,IAAI,wBAAuD,CAAC;IAC5D,MAAM,gBAAgB,GAAG,GAAoC,EAAE,CAC9D,SAAS,IAAI,wBAAwB,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,iFAAiF;IACjF,wFAAwF;IACxF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,GAAG,cAAc,CAC1B,UAAU,EACV,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,EAC5D,gBAAgB,EAAE,CAClB,CAAC;QACF,IAAI,wBAAwB,IAAI,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;YAChE,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAA,CAC9D,CAAC,CAAC;IAAA,CACH,CAAC;IACF,iFAAiF;IACjF,SAAS,EAAE,CAAC;IACZ,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,wCAAwC,CAAC,CAAC;IAEvG,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IACnH,MAAM,UAAU,GAAG,CAClB,KAAiB,EACjB,OAAgB,EAChB,OAAkC,EAClC,MAAe,EACe,EAAE,CAChC,UAAU,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;QAC7B,IAAI,SAAS,EAAE,YAAY,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAA8B,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM;gBACZ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAA8B,CAAC;gBACnE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,MAAM;YACZ,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAA8B,CAAC;YAClE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CACvC,CAAC,CAAC;IAEJ,MAAM,QAAQ,GAAa;QAC1B,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU;QAC3F,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO;QAC/D,OAAO,EAAE,IAAI,EAAE,OAAO;QACtB,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpE,SAAS;QACT,aAAa,EACZ,IAAI,EAAE,aAAa,IAAI,SAAS,EAAE,aAAa,IAAI,SAAS,EAAE,KAAK,EAAE,YAAY;YAChF,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,SAAiE,CAAC;gBACtE,IAAI,SAAS,EAAE,aAAa;oBAAE,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACjF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;gBACnC,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9F,MAAM,OAAO,CAAC,OAAO,CAAC;oBACrB,MAAM,EAAE,GAAG,EAAE,CAAC;wBACb,IAAI,SAAS,EAAE,CAAC;4BACf,uDAAuD;4BACvD,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE;gCACxF,GAAG,SAAS;gCACZ,MAAM,EAAE,SAAS;6BACjB,CAAC,CAAC;4BACH,wBAAwB,GAAG,SAAS,CAAC;wBACtC,CAAC;wBACD,wBAAwB,GAAG,eAAe,CAAC;oBAAA,CAC3C;iBACD,CAAC,CAAC;YAAA,CACH;YACF,CAAC,CAAC,SAAS;QACb,YAAY,EAAE,IAAI,EAAE,YAAY;YAC/B,CAAC,CAAC,CAAC,MAAM,EAAE,UAAkC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAa,CAAC,MAAM,EAAE,UAAU,CAAC;YACxF,CAAC,CAAC,SAAS;QACZ,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC/E,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;KACpF,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;IAC1C,IAAI,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,IAAI,cAAc,EAAE,CAAC;QACpB,QAAQ,CAAC,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,UAAU,6BAA6B,CAC5C,KAAiB,EACjB,MAAsC,EACtC,SAA0C,EAC1C,GAA4B,EACS;IACrC,OAAO,qBAAqB,CAC3B,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EACzC,UAAU,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,GAAG,EACvC,GAAG,CACH,CAAC;AAAA,CACF;AAOD,MAAM,UAAU,iCAAiC,CAChD,KAAiB,EACjB,MAAsC,EACtC,SAA0C,EACb;IAC7B,MAAM,UAAU,GAAG,qBAAqB,CACvC,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EACzF,UAAU,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,GAAG,CACvC,CAAC;IACF,OAAO;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;QACtF,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,IAAI,KAAK;KAChE,CAAC;AAAA,CACF;AAED,MAAM,UAAU,2BAA2B,CAC1C,MAAsC,EACtC,SAA0C,EACjB;IACzB,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,oBAAoB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,uBAAuB,CAAC,KAAK,CAAC;YACpC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;AAAA,CACtG","sourcesContent":["import {\n\ttype Api,\n\ttype ApiKeyAuth,\n\ttype AssistantMessageEventStream,\n\ttype AuthContext,\n\ttype AuthInteraction,\n\ttype AuthResult,\n\ttype Context,\n\ttype Credential,\n\tlazyStream,\n\ttype Model,\n\ttype ModelAuth,\n\ttype OAuthAuth,\n\ttype OAuthCredentials,\n\ttype OAuthLoginCallbacks,\n\ttype Provider,\n\ttype ProviderHeaders,\n\ttype RefreshModelsContext,\n\ttype SimpleStreamOptions,\n\ttype StreamOptions,\n} from \"@earendil-works/pi-ai\";\nimport { getApiProvider } from \"@earendil-works/pi-ai/compat\";\nimport type { ModelConfig, ModelsJsonModel, ModelsJsonModelOverride, ModelsJsonProvider } from \"./model-config.ts\";\nimport {\n\tclearConfigValueCache,\n\tgetConfigValueEnvVarNames,\n\tisCommandConfigValue,\n\tisConfigValueConfigured,\n\tresolveConfigValueOrThrow,\n\tresolveHeadersOrThrow,\n} from \"./resolve-config-value.ts\";\n\nexport interface ExtensionOAuthConfig {\n\tname: string;\n\t/** Whether access through this auth method is backed by a provider subscription. */\n\tisSubscription?: boolean;\n\t/** @deprecated Retained for extension source compatibility; ignored by canonical auth flows. */\n\tusesCallbackServer?: boolean;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n\tmodifyModels?(models: Model<Api>[], credentials: OAuthCredentials): Model<Api>[];\n}\n\n/** Input type for the extension registerProvider API. */\nexport interface ProviderConfigInput {\n\tname?: string;\n\tbaseUrl?: string;\n\tapiKey?: string;\n\tapi?: Api;\n\tstreamSimple?: (model: Model<Api>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;\n\theaders?: Record<string, string>;\n\tauthHeader?: boolean;\n\toauth?: ExtensionOAuthConfig;\n\tmodels?: Array<{\n\t\tid: string;\n\t\tname: string;\n\t\tapi?: Api;\n\t\tbaseUrl?: string;\n\t\treasoning: boolean;\n\t\tthinkingLevelMap?: Model<Api>[\"thinkingLevelMap\"];\n\t\tinput: (\"text\" | \"image\")[];\n\t\tcost: Model<Api>[\"cost\"];\n\t\tcontextWindow: number;\n\t\tmaxTokens: number;\n\t\tsamplingParams?: Record<string, unknown>;\n\t\theaders?: Record<string, string>;\n\t\tcompat?: Model<Api>[\"compat\"];\n\t}>;\n\trefreshModels?(context: RefreshModelsContext): Promise<NonNullable<ProviderConfigInput[\"models\"]>>;\n}\n\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport const clearApiKeyCache = clearConfigValueCache;\n\nfunction mergeCompat(\n\tbase: Model<Api>[\"compat\"],\n\toverride: Model<Api>[\"compat\"] | ModelsJsonModelOverride[\"compat\"],\n): Model<Api>[\"compat\"] {\n\tif (!override) return base;\n\tconst merged = { ...base, ...override } as NonNullable<Model<Api>[\"compat\"]>;\n\tconst baseNested = base as Record<string, unknown> | undefined;\n\tconst overrideNested = override as Record<string, unknown>;\n\tconst mergedNested = merged as Record<string, unknown>;\n\tfor (const key of [\"openRouterRouting\", \"vercelGatewayRouting\", \"chatTemplateKwargs\", \"chatTemplateArgs\"] as const) {\n\t\tconst baseValue = baseNested?.[key];\n\t\tconst overrideValue = overrideNested[key];\n\t\tif (\n\t\t\t(typeof baseValue === \"object\" && baseValue !== null) ||\n\t\t\t(typeof overrideValue === \"object\" && overrideValue !== null)\n\t\t) {\n\t\t\tmergedNested[key] = { ...(baseValue as object | undefined), ...(overrideValue as object | undefined) };\n\t\t}\n\t}\n\treturn merged;\n}\n\nfunction applyModelOverride(model: Model<Api>, override: ModelsJsonModelOverride): Model<Api> {\n\treturn {\n\t\t...model,\n\t\tname: override.name ?? model.name,\n\t\treasoning: override.reasoning ?? model.reasoning,\n\t\tthinkingLevelMap: override.thinkingLevelMap\n\t\t\t? { ...model.thinkingLevelMap, ...override.thinkingLevelMap }\n\t\t\t: model.thinkingLevelMap,\n\t\tinput: (override.input as (\"text\" | \"image\")[] | undefined) ?? model.input,\n\t\tcost: override.cost\n\t\t\t? {\n\t\t\t\t\tinput: override.cost.input ?? model.cost.input,\n\t\t\t\t\toutput: override.cost.output ?? model.cost.output,\n\t\t\t\t\tcacheRead: override.cost.cacheRead ?? model.cost.cacheRead,\n\t\t\t\t\tcacheWrite: override.cost.cacheWrite ?? model.cost.cacheWrite,\n\t\t\t\t\ttiers: override.cost.tiers ?? model.cost.tiers,\n\t\t\t\t}\n\t\t\t: model.cost,\n\t\tcontextWindow: override.contextWindow ?? model.contextWindow,\n\t\tmaxTokens: override.maxTokens ?? model.maxTokens,\n\t\tsamplingParams: override.samplingParams\n\t\t\t? { ...model.samplingParams, ...override.samplingParams }\n\t\t\t: model.samplingParams,\n\t\tcompat: mergeCompat(model.compat, override.compat),\n\t};\n}\n\nfunction modelFromJson(\n\tproviderId: string,\n\tdefinition: ModelsJsonModel,\n\tproviderConfig: ModelsJsonProvider,\n\tdefaults: Model<Api> | undefined,\n): Model<Api> {\n\tconst api = definition.api ?? providerConfig.api ?? defaults?.api;\n\tif (!api) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t);\n\t}\n\tconst baseUrl = definition.baseUrl ?? providerConfig.baseUrl ?? defaults?.baseUrl;\n\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\tif (definition.contextWindow !== undefined && definition.contextWindow <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid contextWindow`);\n\t}\n\tif (definition.maxTokens !== undefined && definition.maxTokens <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid maxTokens`);\n\t}\n\treturn {\n\t\tid: definition.id,\n\t\tname: definition.name ?? definition.id,\n\t\tapi: api as Api,\n\t\tprovider: providerId,\n\t\tbaseUrl,\n\t\treasoning: definition.reasoning ?? false,\n\t\tthinkingLevelMap: definition.thinkingLevelMap,\n\t\tinput: (definition.input ?? [\"text\"]) as (\"text\" | \"image\")[],\n\t\tcost: definition.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\tcontextWindow: definition.contextWindow ?? 128000,\n\t\tmaxTokens: definition.maxTokens ?? 16384,\n\t\tsamplingParams: definition.samplingParams,\n\t\theaders: undefined,\n\t\tcompat: mergeCompat(providerConfig.compat, definition.compat),\n\t};\n}\n\nfunction applyModelsJson(\n\tproviderId: string,\n\tbaseModels: readonly Model<Api>[],\n\tconfig: ModelsJsonProvider | undefined,\n): Model<Api>[] {\n\tif (!config) return [...baseModels];\n\tif (config.oauth && !config.baseUrl) {\n\t\tthrow new Error(`Provider ${providerId}: \"baseUrl\" is required when \"oauth\" is set.`);\n\t}\n\tconst hasOverrides = config.modelOverrides && Object.keys(config.modelOverrides).length > 0;\n\tif (\n\t\t!config.models?.length &&\n\t\t!config.baseUrl &&\n\t\t!config.headers &&\n\t\t!config.compat &&\n\t\t!hasOverrides &&\n\t\t!config.apiKey &&\n\t\t!config.oauth &&\n\t\tconfig.authHeader === undefined\n\t) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}: must specify \"baseUrl\", \"headers\", \"compat\", \"modelOverrides\", or \"models\".`,\n\t\t);\n\t}\n\n\tconst models: Model<Api>[] = baseModels.map((model) => ({\n\t\t...model,\n\t\tbaseUrl: config.oauth === \"radius\" ? model.baseUrl : (config.baseUrl ?? model.baseUrl),\n\t\tcompat: mergeCompat(model.compat, config.compat),\n\t}));\n\tfor (const definition of config.models ?? []) {\n\t\tconst existingIndex = models.findIndex((model) => model.id === definition.id);\n\t\tconst defaults = existingIndex >= 0 ? models[existingIndex] : models[0];\n\t\tconst model = modelFromJson(providerId, definition, config, defaults);\n\t\tif (existingIndex >= 0) models[existingIndex] = model;\n\t\telse models.push(model);\n\t}\n\treturn models;\n}\n\nfunction applyExtension(\n\tproviderId: string,\n\tmodels: readonly Model<Api>[],\n\tconfig: ProviderConfigInput | undefined,\n): Model<Api>[] {\n\tif (!config) return [...models];\n\tif (!config.models) {\n\t\treturn config.baseUrl ? models.map((model) => ({ ...model, baseUrl: config.baseUrl! })) : [...models];\n\t}\n\treturn config.models.map((definition) => {\n\t\tconst defaults = models.find((model) => model.id === definition.id) ?? models[0];\n\t\tconst api = definition.api ?? config.api ?? defaults?.api;\n\t\tif (!api) {\n\t\t\tthrow new Error(\n\t\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t\t);\n\t\t}\n\t\tconst baseUrl = definition.baseUrl ?? config.baseUrl ?? defaults?.baseUrl;\n\t\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\t\treturn {\n\t\t\t...definition,\n\t\t\tapi,\n\t\t\tprovider: providerId,\n\t\t\tbaseUrl,\n\t\t\theaders: undefined,\n\t\t};\n\t});\n}\n\nfunction adaptOAuth(config: ExtensionOAuthConfig): OAuthAuth {\n\treturn {\n\t\tname: config.name,\n\t\tisSubscription: config.isSubscription,\n\t\tlogin: async (callbacks) => {\n\t\t\tconst credential = await config.login({\n\t\t\t\tonAuth: (info) => callbacks.notify({ type: \"auth_url\", ...info }),\n\t\t\t\tonDeviceCode: (info) => callbacks.notify({ type: \"device_code\", ...info }),\n\t\t\t\tonPrompt: (prompt) => callbacks.prompt({ type: \"text\", ...prompt }),\n\t\t\t\tonProgress: (message) => callbacks.notify({ type: \"progress\", message }),\n\t\t\t\tonManualCodeInput: () => callbacks.prompt({ type: \"manual_code\", message: \"Paste the authorization code\" }),\n\t\t\t\tonSelect: (prompt) => callbacks.prompt({ type: \"select\", ...prompt }),\n\t\t\t\tsignal: callbacks.signal,\n\t\t\t});\n\t\t\treturn { ...credential, type: \"oauth\" };\n\t\t},\n\t\trefresh: async (credential, signal) => ({ ...(await config.refreshToken(credential, signal)), type: \"oauth\" }),\n\t\ttoAuth: async (credential) => ({ apiKey: config.getApiKey(credential) }),\n\t};\n}\n\nfunction withConfiguredAuth(\n\tauth: ModelAuth,\n\theaders: Record<string, string> | undefined,\n\tauthHeader: boolean,\n): ModelAuth {\n\tlet mergedHeaders: ProviderHeaders | undefined =\n\t\tauth.headers || headers ? { ...auth.headers, ...headers } : undefined;\n\tif (authHeader) {\n\t\tif (!auth.apiKey) throw new Error(\"authHeader requires a resolved API key\");\n\t\tmergedHeaders = { ...mergedHeaders, Authorization: `Bearer ${auth.apiKey}` };\n\t}\n\treturn { ...auth, headers: mergedHeaders };\n}\n\nfunction configuredApiKey(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): string | undefined {\n\treturn extension?.apiKey ?? config?.apiKey;\n}\n\nfunction configuredHeaders(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tif (!config?.headers && !extension?.headers) return undefined;\n\treturn { ...config?.headers, ...extension?.headers };\n}\n\nasync function configContextEnv(\n\tvalues: readonly string[],\n\tctx: AuthContext,\n\texplicit?: Record<string, string>,\n): Promise<Record<string, string> | undefined> {\n\tconst env = { ...explicit };\n\tfor (const name of new Set(values.flatMap(getConfigValueEnvVarNames))) {\n\t\tif (env[name] !== undefined) continue;\n\t\tconst value = await ctx.env(name);\n\t\tif (value !== undefined) env[name] = value;\n\t}\n\treturn Object.keys(env).length > 0 ? env : undefined;\n}\n\nfunction composeApiKeyAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): ApiKeyAuth | undefined {\n\tconst inherited = base?.auth.apiKey;\n\tconst rawKey = configuredApiKey(config, extension);\n\tconst oauth = extension?.oauth ?? base?.auth.oauth;\n\t// OAuth-only providers get no fabricated API-key login method.\n\tif (!inherited && rawKey === undefined && oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\tname: inherited?.name ?? \"API key\",\n\t\tlogin:\n\t\t\tinherited?.login ??\n\t\t\t(async (interaction: AuthInteraction) => ({\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: await interaction.prompt({ type: \"secret\", message: \"Enter API key\" }),\n\t\t\t})),\n\t\tcheck: async (input) => {\n\t\t\tif (input.credential) {\n\t\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\t\tif (input.credential.key) return { type: \"api_key\", source: \"stored credential\" };\n\t\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t\t}\n\t\t\tif (rawKey !== undefined) {\n\t\t\t\tif (isCommandConfigValue(rawKey)) return { type: \"api_key\", source: \"configured API key\" };\n\t\t\t\tconst envNames = getConfigValueEnvVarNames(rawKey);\n\t\t\t\tfor (const name of envNames) {\n\t\t\t\t\tif ((await input.ctx.env(name)) === undefined) return undefined;\n\t\t\t\t}\n\t\t\t\treturn { type: \"api_key\", source: \"configured API key\" };\n\t\t\t}\n\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t},\n\t\tresolve: async (input) => {\n\t\t\tlet result: AuthResult | undefined;\n\t\t\tif (input.credential) {\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve(input)\n\t\t\t\t\t: input.credential.key\n\t\t\t\t\t\t? { auth: { apiKey: input.credential.key }, env: input.credential.env, source: \"stored credential\" }\n\t\t\t\t\t\t: undefined;\n\t\t\t} else if (rawKey !== undefined) {\n\t\t\t\tconst env = await configContextEnv([rawKey], input.ctx);\n\t\t\t\tconst key = resolveConfigValueOrThrow(rawKey, `API key for provider \"${providerId}\"`, env);\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve({ ...input, credential: { type: \"api_key\", key } })\n\t\t\t\t\t: { auth: { apiKey: key }, source: \"configured API key\" };\n\t\t\t} else {\n\t\t\t\tresult = await inherited?.resolve(input);\n\t\t\t}\n\t\t\tif (!result) return undefined;\n\t\t\tconst explicitEnv = { ...(input.credential?.env ?? {}), ...(result.env ?? {}) };\n\t\t\tconst headerEnv = await configContextEnv(Object.values(rawHeaders ?? {}), input.ctx, explicitEnv);\n\t\t\tconst headers = resolveHeadersOrThrow(rawHeaders, `provider \"${providerId}\"`, headerEnv);\n\t\t\treturn { ...result, auth: withConfiguredAuth(result.auth, headers, authHeader) };\n\t\t},\n\t};\n}\n\nfunction composeOAuthAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): OAuthAuth | undefined {\n\tconst oauth = extension?.oauth ? adaptOAuth(extension.oauth) : base?.auth.oauth;\n\tif (!oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\t...oauth,\n\t\ttoAuth: async (credential) => {\n\t\t\tconst auth = await oauth.toAuth(credential);\n\t\t\tconst env = credential.env;\n\t\t\tconst headers = resolveHeadersOrThrow(\n\t\t\t\trawHeaders,\n\t\t\t\t`provider \"${providerId}\"`,\n\t\t\t\ttypeof env === \"object\" && env !== null ? (env as Record<string, string>) : undefined,\n\t\t\t);\n\t\t\treturn withConfiguredAuth(auth, headers, authHeader);\n\t\t},\n\t};\n}\n\nfunction rawModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tconst definition = config?.models?.find((entry) => entry.id === model.id);\n\tconst extensionModel = extension?.models?.find((entry) => entry.id === model.id);\n\tconst headers = {\n\t\t...config?.modelOverrides?.[model.id]?.headers,\n\t\t...definition?.headers,\n\t\t...extensionModel?.headers,\n\t};\n\treturn Object.keys(headers).length > 0 ? headers : undefined;\n}\n\nexport function validateExtensionProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelsConfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput,\n): void {\n\tif (extension.streamSimple && !extension.api) {\n\t\tthrow new Error(`Provider ${providerId}: \"api\" is required when registering streamSimple.`);\n\t}\n\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], modelsConfig), extension);\n}\n\n/** Compose built-in, models.json, and extension layers without reading credentials. */\nexport function composeModelProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelConfig: ModelConfig,\n\textension: ProviderConfigInput | undefined,\n): Provider {\n\tconst config = modelConfig.getProvider(providerId);\n\tlet extensionOAuthCredential: OAuthCredentials | undefined;\n\tlet refreshedExtensionModels: ProviderConfigInput[\"models\"];\n\tconst currentExtension = (): ProviderConfigInput | undefined =>\n\t\textension && refreshedExtensionModels ? { ...extension, models: refreshedExtensionModels } : extension;\n\t// models.json modelOverrides are the topmost user-config layer: they apply once,\n\t// after custom-model upserts, extension model replacement, and legacy OAuth projection.\n\tconst getModels = () => {\n\t\tlet models = applyExtension(\n\t\t\tproviderId,\n\t\t\tapplyModelsJson(providerId, base?.getModels() ?? [], config),\n\t\t\tcurrentExtension(),\n\t\t);\n\t\tif (extensionOAuthCredential && extension?.oauth?.modifyModels) {\n\t\t\tmodels = extension.oauth.modifyModels(models, extensionOAuthCredential);\n\t\t}\n\t\treturn models.map((model) => {\n\t\t\tconst override = config?.modelOverrides?.[model.id];\n\t\t\treturn override ? applyModelOverride(model, override) : model;\n\t\t});\n\t};\n\t// Validate eagerly so registration/reload reports structural errors immediately.\n\tgetModels();\n\tconst apiKey = composeApiKeyAuth(providerId, base, config, extension);\n\tconst oauth = composeOAuthAuth(providerId, base, config, extension);\n\tif (!apiKey && !oauth) throw new Error(`Provider ${providerId}: no authentication method configured.`);\n\n\tconst supportsBaseApi = (model: Model<Api>) => base?.getModels().some((entry) => entry.api === model.api) ?? false;\n\tconst streamWith = (\n\t\tmodel: Model<Api>,\n\t\tcontext: Context,\n\t\toptions: StreamOptions | undefined,\n\t\tsimple: boolean,\n\t): AssistantMessageEventStream =>\n\t\tlazyStream(model, async () => {\n\t\t\tif (extension?.streamSimple && model.api === extension.api) {\n\t\t\t\treturn extension.streamSimple(model, context, options as SimpleStreamOptions);\n\t\t\t}\n\t\t\tif (base && supportsBaseApi(model)) {\n\t\t\t\treturn simple\n\t\t\t\t\t? base.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t\t: base.stream(model, context, options);\n\t\t\t}\n\t\t\tconst api = getApiProvider(model.api);\n\t\t\tif (!api) throw new Error(`No API provider registered for api: ${model.api}`);\n\t\t\treturn simple\n\t\t\t\t? api.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t: api.stream(model, context, options);\n\t\t});\n\n\tconst provider: Provider = {\n\t\tid: providerId,\n\t\tname: extension?.name ?? config?.name ?? base?.name ?? extension?.oauth?.name ?? providerId,\n\t\tbaseUrl: extension?.baseUrl ?? config?.baseUrl ?? base?.baseUrl,\n\t\theaders: base?.headers,\n\t\tauth: { ...(apiKey ? { apiKey } : {}), ...(oauth ? { oauth } : {}) },\n\t\tgetModels,\n\t\trefreshModels:\n\t\t\tbase?.refreshModels || extension?.refreshModels || extension?.oauth?.modifyModels\n\t\t\t\t? async (context) => {\n\t\t\t\t\t\tawait base?.refreshModels?.(context);\n\t\t\t\t\t\tlet refreshed: NonNullable<ProviderConfigInput[\"models\"]> | undefined;\n\t\t\t\t\t\tif (extension?.refreshModels) refreshed = await extension.refreshModels(context);\n\t\t\t\t\t\tif (context.signal.aborted) return;\n\t\t\t\t\t\tconst oauthCredential = context.credential?.type === \"oauth\" ? context.credential : undefined;\n\t\t\t\t\t\tawait context.publish({\n\t\t\t\t\t\t\tupdate: () => {\n\t\t\t\t\t\t\t\tif (refreshed) {\n\t\t\t\t\t\t\t\t\t// Validate before publishing the new synchronous list.\n\t\t\t\t\t\t\t\t\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], config), {\n\t\t\t\t\t\t\t\t\t\t...extension,\n\t\t\t\t\t\t\t\t\t\tmodels: refreshed,\n\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\trefreshedExtensionModels = refreshed;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\textensionOAuthCredential = oauthCredential;\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\tfilterModels: base?.filterModels\n\t\t\t? (models, credential: Credential | undefined) => base.filterModels!(models, credential)\n\t\t\t: undefined,\n\t\tstream: (model, context, options) => streamWith(model, context, options, false),\n\t\tstreamSimple: (model, context, options) => streamWith(model, context, options, true),\n\t};\n\n\tconst fetchDeferred = base?.fetchDeferred;\n\tif (fetchDeferred) {\n\t\tprovider.fetchDeferred = (model, handle, options) => fetchDeferred(model, handle, options);\n\t}\n\tconst cancelDeferred = base?.cancelDeferred;\n\tif (cancelDeferred) {\n\t\tprovider.cancelDeferred = (model, handle, options) => cancelDeferred(model, handle, options);\n\t}\n\n\treturn provider;\n}\n\nexport function resolveConfiguredModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n\tenv?: Record<string, string>,\n): Record<string, string> | undefined {\n\treturn resolveHeadersOrThrow(\n\t\trawModelHeaders(model, config, extension),\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t\tenv,\n\t);\n}\n\nexport interface CompatibilityRequestConfig {\n\theaders?: ProviderHeaders;\n\tauthHeader: boolean;\n}\n\nexport function resolveCompatibilityRequestConfig(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): CompatibilityRequestConfig {\n\tconst configured = resolveHeadersOrThrow(\n\t\t{ ...configuredHeaders(config, extension), ...rawModelHeaders(model, config, extension) },\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t);\n\treturn {\n\t\theaders: model.headers || configured ? { ...model.headers, ...configured } : undefined,\n\t\tauthHeader: extension?.authHeader ?? config?.authHeader ?? false,\n\t};\n}\n\nexport function configuredRequestAuthStatus(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): AuthStatus | undefined {\n\tconst value = configuredApiKey(config, extension);\n\tif (value === undefined) return undefined;\n\tif (isCommandConfigValue(value)) return { configured: true, source: \"models_json_command\" };\n\tconst names = getConfigValueEnvVarNames(value);\n\tif (names.length > 0) {\n\t\treturn isConfigValueConfigured(value)\n\t\t\t? { configured: true, source: \"environment\", label: names.join(\", \") }\n\t\t\t: { configured: false };\n\t}\n\treturn { configured: true, source: extension?.apiKey !== undefined ? \"fallback\" : \"models_json_key\" };\n}\n"]}
+{"version":3,"file":"provider-composer.js","sourceRoot":"","sources":["../../src/core/provider-composer.ts"],"names":[],"mappings":"AAAA,OAAO,EASN,UAAU,GAYV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EACN,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,qBAAqB,GACrB,MAAM,2BAA2B,CAAC;AAgDnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,SAAS,WAAW,CACnB,IAA0B,EAC1B,QAAkE,EAC3C;IACvB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,EAAuC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAA2C,CAAC;IAC/D,MAAM,cAAc,GAAG,QAAmC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAiC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,CAAU,EAAE,CAAC;QACpH,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC1C,IACC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,CAAC;YACrD,CAAC,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,CAAC,EAC5D,CAAC;YACF,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAI,SAAgC,EAAE,GAAI,aAAoC,EAAE,CAAC;QACxG,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAE,QAAiC,EAAc;IAC7F,OAAO;QACN,GAAG,KAAK;QACR,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;QAChD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC1C,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,gBAAgB,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE;YAC7D,CAAC,CAAC,KAAK,CAAC,gBAAgB;QACzB,KAAK,EAAG,QAAQ,CAAC,KAA0C,IAAI,KAAK,CAAC,KAAK;QAC1E,IAAI,EAAE,QAAQ,CAAC,IAAI;YAClB,CAAC,CAAC;gBACA,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK;gBAC9C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;gBACjD,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS;gBAC1D,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU;gBAC7D,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK;aAC9C;YACF,CAAC,CAAC,KAAK,CAAC,IAAI;QACb,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;QAC5D,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS;QAChD,cAAc,EAAE,QAAQ,CAAC,cAAc;YACtC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE;YACzD,CAAC,CAAC,KAAK,CAAC,cAAc;QACvB,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;KAClD,CAAC;AAAA,CACF;AAED,SAAS,0BAA0B,CAAC,KAAiB,EAAc;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAE,KAAK,CAAC,MAA4C,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,IAAI,MAAM,EAAE,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/F,OAAO;QACN,GAAG,KAAK;QACR,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE;KAC/C,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CACrB,UAAkB,EAClB,UAA2B,EAC3B,cAAkC,EAClC,QAAgC,EACnB;IACb,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,cAAc,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACd,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,uDAAuD,CACrG,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;IAClF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,sDAAsD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACtF,CAAC;IACD,OAAO;QACN,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,EAAE;QACtC,GAAG,EAAE,GAAU;QACf,QAAQ,EAAE,UAAU;QACpB,OAAO;QACP,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;QACxC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,KAAK,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAyB;QAC7D,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;QAC7E,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,MAAM;QACjD,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,KAAK;QACxC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;KAC7D,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CACvB,UAAkB,EAClB,UAAiC,EACjC,MAAsC,EACvB;IACf,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,8CAA8C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,IACC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM;QACtB,CAAC,MAAM,CAAC,OAAO;QACf,CAAC,MAAM,CAAC,OAAO;QACf,CAAC,MAAM,CAAC,MAAM;QACd,CAAC,YAAY;QACb,CAAC,MAAM,CAAC,MAAM;QACd,CAAC,MAAM,CAAC,KAAK;QACb,MAAM,CAAC,UAAU,KAAK,SAAS,EAC9B,CAAC;QACF,MAAM,IAAI,KAAK,CACd,YAAY,UAAU,+EAA+E,CACrG,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG,KAAK;QACR,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;QACtF,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,aAAa,IAAI,CAAC;YAAE,MAAM,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;;YACjD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,cAAc,CACtB,UAAkB,EAClB,MAA6B,EAC7B,MAAuC,EACxB;IACf,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,CAAC;QAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACd,YAAY,UAAU,WAAW,UAAU,CAAC,EAAE,uDAAuD,CACrG,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;QAC1E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,sDAAsD,CAAC,CAAC;QAC5G,OAAO;YACN,GAAG,UAAU;YACb,GAAG;YACH,QAAQ,EAAE,UAAU;YACpB,OAAO;YACP,OAAO,EAAE,SAAS;SAClB,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AAED,SAAS,UAAU,CAAC,MAA4B,EAAa;IAC5D,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;gBACrC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;gBACjE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC1E,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;gBACnE,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;gBACxE,iBAAiB,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;gBAC3G,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;gBACrE,MAAM,EAAE,SAAS,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAA,CACxC;QACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC9G,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;KACxE,CAAC;AAAA,CACF;AAED,SAAS,kBAAkB,CAC1B,IAAe,EACf,OAA2C,EAC3C,UAAmB,EACP;IACZ,IAAI,aAAa,GAChB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5E,aAAa,GAAG,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AAAA,CAC3C;AAED,SAAS,gBAAgB,CACxB,MAAsC,EACtC,SAA0C,EACrB;IACrB,OAAO,SAAS,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,CAAC;AAAA,CAC3C;AAED,SAAS,iBAAiB,CACzB,MAAsC,EACtC,SAA0C,EACL;IACrC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,SAAS,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC;AAAA,CACrD;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAyB,EACzB,GAAgB,EAChB,QAAiC,EACa;IAC9C,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CACrD;AAED,SAAS,iBAAiB,CACzB,UAAkB,EAClB,IAA0B,EAC1B,MAAsC,EACtC,SAA0C,EACjB;IACzB,MAAM,SAAS,GAAG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IACpC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;IACnD,+DAA+D;IAC/D,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,SAAS,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IACxE,OAAO;QACN,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,SAAS;QAClC,KAAK,EACJ,SAAS,EAAE,KAAK;YAChB,CAAC,KAAK,EAAE,WAA4B,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,EAAE,SAAS;gBACf,GAAG,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;aAC3E,CAAC,CAAC;QACJ,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;YACvB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACtB,IAAI,SAAS,EAAE,KAAK;oBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;gBAClF,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,oBAAoB,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBAC3F,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;gBACnD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC7B,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS;wBAAE,OAAO,SAAS,CAAC;gBACjE,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC1D,CAAC;YACD,IAAI,SAAS,EAAE,KAAK;gBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAAA,CAC3E;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;YACzB,IAAI,MAA8B,CAAC;YACnC,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,GAAG,SAAS;oBACjB,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;oBAChC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG;wBACrB,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE;wBACpG,CAAC,CAAC,SAAS,CAAC;YACf,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxD,MAAM,GAAG,GAAG,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC3F,MAAM,GAAG,SAAS;oBACjB,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;oBAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,MAAM,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAChF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAClG,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,EAAE,aAAa,UAAU,GAAG,EAAE,SAAS,CAAC,CAAC;YACzF,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAAA,CACjF;KACD,CAAC;AAAA,CACF;AAED,SAAS,gBAAgB,CACxB,UAAkB,EAClB,IAA0B,EAC1B,MAAsC,EACtC,SAA0C,EAClB;IACxB,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;IAChF,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,SAAS,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC;IACxE,OAAO;QACN,GAAG,KAAK;QACR,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;YAC3B,MAAM,OAAO,GAAG,qBAAqB,CACpC,UAAU,EACV,aAAa,UAAU,GAAG,EAC1B,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA8B,CAAC,CAAC,CAAC,SAAS,CACrF,CAAC;YACF,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAAA,CACrD;KACD,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CACvB,KAAiB,EACjB,MAAsC,EACtC,SAA0C,EACL;IACrC,MAAM,UAAU,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG;QACf,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO;QAC9C,GAAG,UAAU,EAAE,OAAO;QACtB,GAAG,cAAc,EAAE,OAAO;KAC1B,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC7D;AAED,MAAM,UAAU,yBAAyB,CACxC,UAAkB,EAClB,IAA0B,EAC1B,YAA4C,EAC5C,SAA8B,EACvB;IACP,IAAI,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,oDAAoD,CAAC,CAAC;IAC7F,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,EAAE,SAAS,CAAC,CAAC;AAAA,CAC1G;AAED,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CACnC,UAAkB,EAClB,IAA0B,EAC1B,WAAwB,EACxB,SAA0C,EAC/B;IACX,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,wBAAsD,CAAC;IAC3D,IAAI,wBAAuD,CAAC;IAC5D,MAAM,gBAAgB,GAAG,GAAoC,EAAE,CAC9D,SAAS,IAAI,wBAAwB,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,iFAAiF;IACjF,wFAAwF;IACxF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;QACvB,IAAI,MAAM,GAAG,cAAc,CAC1B,UAAU,EACV,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,EAC5D,gBAAgB,EAAE,CAClB,CAAC;QACF,IAAI,wBAAwB,IAAI,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;YAChE,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpD,OAAO,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAA,CAC1F,CAAC,CAAC;IAAA,CACH,CAAC;IACF,iFAAiF;IACjF,SAAS,EAAE,CAAC;IACZ,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,wCAAwC,CAAC,CAAC;IAEvG,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;IACnH,MAAM,UAAU,GAAG,CAClB,KAAiB,EACjB,OAAgB,EAChB,OAAkC,EAClC,MAAe,EACe,EAAE,CAChC,UAAU,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;QAC7B,IAAI,SAAS,EAAE,YAAY,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAA8B,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM;gBACZ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAA8B,CAAC;gBACnE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,MAAM;YACZ,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAA8B,CAAC;YAClE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAAA,CACvC,CAAC,CAAC;IAEJ,MAAM,QAAQ,GAAa;QAC1B,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,MAAM,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU;QAC3F,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO;QAC/D,OAAO,EAAE,IAAI,EAAE,OAAO;QACtB,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpE,SAAS;QACT,aAAa,EACZ,IAAI,EAAE,aAAa,IAAI,SAAS,EAAE,aAAa,IAAI,SAAS,EAAE,KAAK,EAAE,YAAY;YAChF,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,SAAiE,CAAC;gBACtE,IAAI,SAAS,EAAE,aAAa;oBAAE,SAAS,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACjF,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO;gBACnC,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC9F,MAAM,OAAO,CAAC,OAAO,CAAC;oBACrB,MAAM,EAAE,GAAG,EAAE,CAAC;wBACb,IAAI,SAAS,EAAE,CAAC;4BACf,uDAAuD;4BACvD,cAAc,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE;gCACxF,GAAG,SAAS;gCACZ,MAAM,EAAE,SAAS;6BACjB,CAAC,CAAC;4BACH,wBAAwB,GAAG,SAAS,CAAC;wBACtC,CAAC;wBACD,wBAAwB,GAAG,eAAe,CAAC;oBAAA,CAC3C;iBACD,CAAC,CAAC;YAAA,CACH;YACF,CAAC,CAAC,SAAS;QACb,YAAY,EAAE,IAAI,EAAE,YAAY;YAC/B,CAAC,CAAC,CAAC,MAAM,EAAE,UAAkC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAa,CAAC,MAAM,EAAE,UAAU,CAAC;YACxF,CAAC,CAAC,SAAS;QACZ,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC/E,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;KACpF,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,CAAC;IAC1C,IAAI,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,IAAI,cAAc,EAAE,CAAC;QACpB,QAAQ,CAAC,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,UAAU,6BAA6B,CAC5C,KAAiB,EACjB,MAAsC,EACtC,SAA0C,EAC1C,GAA4B,EACS;IACrC,OAAO,qBAAqB,CAC3B,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EACzC,UAAU,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,GAAG,EACvC,GAAG,CACH,CAAC;AAAA,CACF;AAOD,MAAM,UAAU,iCAAiC,CAChD,KAAiB,EACjB,MAAsC,EACtC,SAA0C,EACb;IAC7B,MAAM,UAAU,GAAG,qBAAqB,CACvC,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EACzF,UAAU,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,GAAG,CACvC,CAAC;IACF,OAAO;QACN,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;QACtF,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,MAAM,EAAE,UAAU,IAAI,KAAK;KAChE,CAAC;AAAA,CACF;AAED,MAAM,UAAU,2BAA2B,CAC1C,MAAsC,EACtC,SAA0C,EACjB;IACzB,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,oBAAoB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC5F,MAAM,KAAK,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,uBAAuB,CAAC,KAAK,CAAC;YACpC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;AAAA,CACtG","sourcesContent":["import {\n\ttype Api,\n\ttype ApiKeyAuth,\n\ttype AssistantMessageEventStream,\n\ttype AuthContext,\n\ttype AuthInteraction,\n\ttype AuthResult,\n\ttype Context,\n\ttype Credential,\n\tlazyStream,\n\ttype Model,\n\ttype ModelAuth,\n\ttype OAuthAuth,\n\ttype OAuthCredentials,\n\ttype OAuthLoginCallbacks,\n\ttype OpenAIResponsesCompat,\n\ttype Provider,\n\ttype ProviderHeaders,\n\ttype RefreshModelsContext,\n\ttype SimpleStreamOptions,\n\ttype StreamOptions,\n} from \"@earendil-works/pi-ai\";\nimport { getApiProvider } from \"@earendil-works/pi-ai/compat\";\nimport type { ModelConfig, ModelsJsonModel, ModelsJsonModelOverride, ModelsJsonProvider } from \"./model-config.ts\";\nimport {\n\tclearConfigValueCache,\n\tgetConfigValueEnvVarNames,\n\tisCommandConfigValue,\n\tisConfigValueConfigured,\n\tresolveConfigValueOrThrow,\n\tresolveHeadersOrThrow,\n} from \"./resolve-config-value.ts\";\n\nexport interface ExtensionOAuthConfig {\n\tname: string;\n\t/** Whether access through this auth method is backed by a provider subscription. */\n\tisSubscription?: boolean;\n\t/** @deprecated Retained for extension source compatibility; ignored by canonical auth flows. */\n\tusesCallbackServer?: boolean;\n\tlogin(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials>;\n\trefreshToken(credentials: OAuthCredentials, signal: AbortSignal): Promise<OAuthCredentials>;\n\tgetApiKey(credentials: OAuthCredentials): string;\n\tmodifyModels?(models: Model<Api>[], credentials: OAuthCredentials): Model<Api>[];\n}\n\n/** Input type for the extension registerProvider API. */\nexport interface ProviderConfigInput {\n\tname?: string;\n\tbaseUrl?: string;\n\tapiKey?: string;\n\tapi?: Api;\n\tstreamSimple?: (model: Model<Api>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;\n\theaders?: Record<string, string>;\n\tauthHeader?: boolean;\n\toauth?: ExtensionOAuthConfig;\n\tmodels?: Array<{\n\t\tid: string;\n\t\tname: string;\n\t\tapi?: Api;\n\t\tbaseUrl?: string;\n\t\treasoning: boolean;\n\t\tthinkingLevelMap?: Model<Api>[\"thinkingLevelMap\"];\n\t\tinput: (\"text\" | \"image\")[];\n\t\tcost: Model<Api>[\"cost\"];\n\t\tcontextWindow: number;\n\t\tmaxTokens: number;\n\t\tsamplingParams?: Record<string, unknown>;\n\t\theaders?: Record<string, string>;\n\t\tcompat?: Model<Api>[\"compat\"];\n\t}>;\n\trefreshModels?(context: RefreshModelsContext): Promise<NonNullable<ProviderConfigInput[\"models\"]>>;\n}\n\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport const clearApiKeyCache = clearConfigValueCache;\n\nfunction mergeCompat(\n\tbase: Model<Api>[\"compat\"],\n\toverride: Model<Api>[\"compat\"] | ModelsJsonModelOverride[\"compat\"],\n): Model<Api>[\"compat\"] {\n\tif (!override) return base;\n\tconst merged = { ...base, ...override } as NonNullable<Model<Api>[\"compat\"]>;\n\tconst baseNested = base as Record<string, unknown> | undefined;\n\tconst overrideNested = override as Record<string, unknown>;\n\tconst mergedNested = merged as Record<string, unknown>;\n\tfor (const key of [\"openRouterRouting\", \"vercelGatewayRouting\", \"chatTemplateKwargs\", \"chatTemplateArgs\"] as const) {\n\t\tconst baseValue = baseNested?.[key];\n\t\tconst overrideValue = overrideNested[key];\n\t\tif (\n\t\t\t(typeof baseValue === \"object\" && baseValue !== null) ||\n\t\t\t(typeof overrideValue === \"object\" && overrideValue !== null)\n\t\t) {\n\t\t\tmergedNested[key] = { ...(baseValue as object | undefined), ...(overrideValue as object | undefined) };\n\t\t}\n\t}\n\treturn merged;\n}\n\nfunction applyModelOverride(model: Model<Api>, override: ModelsJsonModelOverride): Model<Api> {\n\treturn {\n\t\t...model,\n\t\tname: override.name ?? model.name,\n\t\treasoning: override.reasoning ?? model.reasoning,\n\t\tthinkingLevelMap: override.thinkingLevelMap\n\t\t\t? { ...model.thinkingLevelMap, ...override.thinkingLevelMap }\n\t\t\t: model.thinkingLevelMap,\n\t\tinput: (override.input as (\"text\" | \"image\")[] | undefined) ?? model.input,\n\t\tcost: override.cost\n\t\t\t? {\n\t\t\t\t\tinput: override.cost.input ?? model.cost.input,\n\t\t\t\t\toutput: override.cost.output ?? model.cost.output,\n\t\t\t\t\tcacheRead: override.cost.cacheRead ?? model.cost.cacheRead,\n\t\t\t\t\tcacheWrite: override.cost.cacheWrite ?? model.cost.cacheWrite,\n\t\t\t\t\ttiers: override.cost.tiers ?? model.cost.tiers,\n\t\t\t\t}\n\t\t\t: model.cost,\n\t\tcontextWindow: override.contextWindow ?? model.contextWindow,\n\t\tmaxTokens: override.maxTokens ?? model.maxTokens,\n\t\tsamplingParams: override.samplingParams\n\t\t\t? { ...model.samplingParams, ...override.samplingParams }\n\t\t\t: model.samplingParams,\n\t\tcompat: mergeCompat(model.compat, override.compat),\n\t};\n}\n\nfunction applyCompatibilityDefaults(model: Model<Api>): Model<Api> {\n\tconst compat = model.api === \"openai-responses\" ? (model.compat as OpenAIResponsesCompat | undefined) : undefined;\n\tif (model.api !== \"openai-responses\" || compat?.supportsStrictMode !== undefined) return model;\n\treturn {\n\t\t...model,\n\t\tcompat: { ...compat, supportsStrictMode: true },\n\t};\n}\n\nfunction modelFromJson(\n\tproviderId: string,\n\tdefinition: ModelsJsonModel,\n\tproviderConfig: ModelsJsonProvider,\n\tdefaults: Model<Api> | undefined,\n): Model<Api> {\n\tconst api = definition.api ?? providerConfig.api ?? defaults?.api;\n\tif (!api) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t);\n\t}\n\tconst baseUrl = definition.baseUrl ?? providerConfig.baseUrl ?? defaults?.baseUrl;\n\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\tif (definition.contextWindow !== undefined && definition.contextWindow <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid contextWindow`);\n\t}\n\tif (definition.maxTokens !== undefined && definition.maxTokens <= 0) {\n\t\tthrow new Error(`Provider ${providerId}, model ${definition.id}: invalid maxTokens`);\n\t}\n\treturn {\n\t\tid: definition.id,\n\t\tname: definition.name ?? definition.id,\n\t\tapi: api as Api,\n\t\tprovider: providerId,\n\t\tbaseUrl,\n\t\treasoning: definition.reasoning ?? false,\n\t\tthinkingLevelMap: definition.thinkingLevelMap,\n\t\tinput: (definition.input ?? [\"text\"]) as (\"text\" | \"image\")[],\n\t\tcost: definition.cost ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },\n\t\tcontextWindow: definition.contextWindow ?? 128000,\n\t\tmaxTokens: definition.maxTokens ?? 16384,\n\t\tsamplingParams: definition.samplingParams,\n\t\theaders: undefined,\n\t\tcompat: mergeCompat(providerConfig.compat, definition.compat),\n\t};\n}\n\nfunction applyModelsJson(\n\tproviderId: string,\n\tbaseModels: readonly Model<Api>[],\n\tconfig: ModelsJsonProvider | undefined,\n): Model<Api>[] {\n\tif (!config) return [...baseModels];\n\tif (config.oauth && !config.baseUrl) {\n\t\tthrow new Error(`Provider ${providerId}: \"baseUrl\" is required when \"oauth\" is set.`);\n\t}\n\tconst hasOverrides = config.modelOverrides && Object.keys(config.modelOverrides).length > 0;\n\tif (\n\t\t!config.models?.length &&\n\t\t!config.baseUrl &&\n\t\t!config.headers &&\n\t\t!config.compat &&\n\t\t!hasOverrides &&\n\t\t!config.apiKey &&\n\t\t!config.oauth &&\n\t\tconfig.authHeader === undefined\n\t) {\n\t\tthrow new Error(\n\t\t\t`Provider ${providerId}: must specify \"baseUrl\", \"headers\", \"compat\", \"modelOverrides\", or \"models\".`,\n\t\t);\n\t}\n\n\tconst models: Model<Api>[] = baseModels.map((model) => ({\n\t\t...model,\n\t\tbaseUrl: config.oauth === \"radius\" ? model.baseUrl : (config.baseUrl ?? model.baseUrl),\n\t\tcompat: mergeCompat(model.compat, config.compat),\n\t}));\n\tfor (const definition of config.models ?? []) {\n\t\tconst existingIndex = models.findIndex((model) => model.id === definition.id);\n\t\tconst defaults = existingIndex >= 0 ? models[existingIndex] : models[0];\n\t\tconst model = modelFromJson(providerId, definition, config, defaults);\n\t\tif (existingIndex >= 0) models[existingIndex] = model;\n\t\telse models.push(model);\n\t}\n\treturn models;\n}\n\nfunction applyExtension(\n\tproviderId: string,\n\tmodels: readonly Model<Api>[],\n\tconfig: ProviderConfigInput | undefined,\n): Model<Api>[] {\n\tif (!config) return [...models];\n\tif (!config.models) {\n\t\treturn config.baseUrl ? models.map((model) => ({ ...model, baseUrl: config.baseUrl! })) : [...models];\n\t}\n\treturn config.models.map((definition) => {\n\t\tconst defaults = models.find((model) => model.id === definition.id) ?? models[0];\n\t\tconst api = definition.api ?? config.api ?? defaults?.api;\n\t\tif (!api) {\n\t\t\tthrow new Error(\n\t\t\t\t`Provider ${providerId}, model ${definition.id}: no \"api\" specified. Set at provider or model level.`,\n\t\t\t);\n\t\t}\n\t\tconst baseUrl = definition.baseUrl ?? config.baseUrl ?? defaults?.baseUrl;\n\t\tif (!baseUrl) throw new Error(`Provider ${providerId}: \"baseUrl\" is required when defining custom models.`);\n\t\treturn {\n\t\t\t...definition,\n\t\t\tapi,\n\t\t\tprovider: providerId,\n\t\t\tbaseUrl,\n\t\t\theaders: undefined,\n\t\t};\n\t});\n}\n\nfunction adaptOAuth(config: ExtensionOAuthConfig): OAuthAuth {\n\treturn {\n\t\tname: config.name,\n\t\tisSubscription: config.isSubscription,\n\t\tlogin: async (callbacks) => {\n\t\t\tconst credential = await config.login({\n\t\t\t\tonAuth: (info) => callbacks.notify({ type: \"auth_url\", ...info }),\n\t\t\t\tonDeviceCode: (info) => callbacks.notify({ type: \"device_code\", ...info }),\n\t\t\t\tonPrompt: (prompt) => callbacks.prompt({ type: \"text\", ...prompt }),\n\t\t\t\tonProgress: (message) => callbacks.notify({ type: \"progress\", message }),\n\t\t\t\tonManualCodeInput: () => callbacks.prompt({ type: \"manual_code\", message: \"Paste the authorization code\" }),\n\t\t\t\tonSelect: (prompt) => callbacks.prompt({ type: \"select\", ...prompt }),\n\t\t\t\tsignal: callbacks.signal,\n\t\t\t});\n\t\t\treturn { ...credential, type: \"oauth\" };\n\t\t},\n\t\trefresh: async (credential, signal) => ({ ...(await config.refreshToken(credential, signal)), type: \"oauth\" }),\n\t\ttoAuth: async (credential) => ({ apiKey: config.getApiKey(credential) }),\n\t};\n}\n\nfunction withConfiguredAuth(\n\tauth: ModelAuth,\n\theaders: Record<string, string> | undefined,\n\tauthHeader: boolean,\n): ModelAuth {\n\tlet mergedHeaders: ProviderHeaders | undefined =\n\t\tauth.headers || headers ? { ...auth.headers, ...headers } : undefined;\n\tif (authHeader) {\n\t\tif (!auth.apiKey) throw new Error(\"authHeader requires a resolved API key\");\n\t\tmergedHeaders = { ...mergedHeaders, Authorization: `Bearer ${auth.apiKey}` };\n\t}\n\treturn { ...auth, headers: mergedHeaders };\n}\n\nfunction configuredApiKey(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): string | undefined {\n\treturn extension?.apiKey ?? config?.apiKey;\n}\n\nfunction configuredHeaders(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tif (!config?.headers && !extension?.headers) return undefined;\n\treturn { ...config?.headers, ...extension?.headers };\n}\n\nasync function configContextEnv(\n\tvalues: readonly string[],\n\tctx: AuthContext,\n\texplicit?: Record<string, string>,\n): Promise<Record<string, string> | undefined> {\n\tconst env = { ...explicit };\n\tfor (const name of new Set(values.flatMap(getConfigValueEnvVarNames))) {\n\t\tif (env[name] !== undefined) continue;\n\t\tconst value = await ctx.env(name);\n\t\tif (value !== undefined) env[name] = value;\n\t}\n\treturn Object.keys(env).length > 0 ? env : undefined;\n}\n\nfunction composeApiKeyAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): ApiKeyAuth | undefined {\n\tconst inherited = base?.auth.apiKey;\n\tconst rawKey = configuredApiKey(config, extension);\n\tconst oauth = extension?.oauth ?? base?.auth.oauth;\n\t// OAuth-only providers get no fabricated API-key login method.\n\tif (!inherited && rawKey === undefined && oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\tname: inherited?.name ?? \"API key\",\n\t\tlogin:\n\t\t\tinherited?.login ??\n\t\t\t(async (interaction: AuthInteraction) => ({\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey: await interaction.prompt({ type: \"secret\", message: \"Enter API key\" }),\n\t\t\t})),\n\t\tcheck: async (input) => {\n\t\t\tif (input.credential) {\n\t\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\t\tif (input.credential.key) return { type: \"api_key\", source: \"stored credential\" };\n\t\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t\t}\n\t\t\tif (rawKey !== undefined) {\n\t\t\t\tif (isCommandConfigValue(rawKey)) return { type: \"api_key\", source: \"configured API key\" };\n\t\t\t\tconst envNames = getConfigValueEnvVarNames(rawKey);\n\t\t\t\tfor (const name of envNames) {\n\t\t\t\t\tif ((await input.ctx.env(name)) === undefined) return undefined;\n\t\t\t\t}\n\t\t\t\treturn { type: \"api_key\", source: \"configured API key\" };\n\t\t\t}\n\t\t\tif (inherited?.check) return inherited.check(input);\n\t\t\tconst resolved = await inherited?.resolve(input);\n\t\t\treturn resolved ? { type: \"api_key\", source: resolved.source } : undefined;\n\t\t},\n\t\tresolve: async (input) => {\n\t\t\tlet result: AuthResult | undefined;\n\t\t\tif (input.credential) {\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve(input)\n\t\t\t\t\t: input.credential.key\n\t\t\t\t\t\t? { auth: { apiKey: input.credential.key }, env: input.credential.env, source: \"stored credential\" }\n\t\t\t\t\t\t: undefined;\n\t\t\t} else if (rawKey !== undefined) {\n\t\t\t\tconst env = await configContextEnv([rawKey], input.ctx);\n\t\t\t\tconst key = resolveConfigValueOrThrow(rawKey, `API key for provider \"${providerId}\"`, env);\n\t\t\t\tresult = inherited\n\t\t\t\t\t? await inherited.resolve({ ...input, credential: { type: \"api_key\", key } })\n\t\t\t\t\t: { auth: { apiKey: key }, source: \"configured API key\" };\n\t\t\t} else {\n\t\t\t\tresult = await inherited?.resolve(input);\n\t\t\t}\n\t\t\tif (!result) return undefined;\n\t\t\tconst explicitEnv = { ...(input.credential?.env ?? {}), ...(result.env ?? {}) };\n\t\t\tconst headerEnv = await configContextEnv(Object.values(rawHeaders ?? {}), input.ctx, explicitEnv);\n\t\t\tconst headers = resolveHeadersOrThrow(rawHeaders, `provider \"${providerId}\"`, headerEnv);\n\t\t\treturn { ...result, auth: withConfiguredAuth(result.auth, headers, authHeader) };\n\t\t},\n\t};\n}\n\nfunction composeOAuthAuth(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): OAuthAuth | undefined {\n\tconst oauth = extension?.oauth ? adaptOAuth(extension.oauth) : base?.auth.oauth;\n\tif (!oauth) return undefined;\n\tconst rawHeaders = configuredHeaders(config, extension);\n\tconst authHeader = extension?.authHeader ?? config?.authHeader ?? false;\n\treturn {\n\t\t...oauth,\n\t\ttoAuth: async (credential) => {\n\t\t\tconst auth = await oauth.toAuth(credential);\n\t\t\tconst env = credential.env;\n\t\t\tconst headers = resolveHeadersOrThrow(\n\t\t\t\trawHeaders,\n\t\t\t\t`provider \"${providerId}\"`,\n\t\t\t\ttypeof env === \"object\" && env !== null ? (env as Record<string, string>) : undefined,\n\t\t\t);\n\t\t\treturn withConfiguredAuth(auth, headers, authHeader);\n\t\t},\n\t};\n}\n\nfunction rawModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): Record<string, string> | undefined {\n\tconst definition = config?.models?.find((entry) => entry.id === model.id);\n\tconst extensionModel = extension?.models?.find((entry) => entry.id === model.id);\n\tconst headers = {\n\t\t...config?.modelOverrides?.[model.id]?.headers,\n\t\t...definition?.headers,\n\t\t...extensionModel?.headers,\n\t};\n\treturn Object.keys(headers).length > 0 ? headers : undefined;\n}\n\nexport function validateExtensionProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelsConfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput,\n): void {\n\tif (extension.streamSimple && !extension.api) {\n\t\tthrow new Error(`Provider ${providerId}: \"api\" is required when registering streamSimple.`);\n\t}\n\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], modelsConfig), extension);\n}\n\n/** Compose built-in, models.json, and extension layers without reading credentials. */\nexport function composeModelProvider(\n\tproviderId: string,\n\tbase: Provider | undefined,\n\tmodelConfig: ModelConfig,\n\textension: ProviderConfigInput | undefined,\n): Provider {\n\tconst config = modelConfig.getProvider(providerId);\n\tlet extensionOAuthCredential: OAuthCredentials | undefined;\n\tlet refreshedExtensionModels: ProviderConfigInput[\"models\"];\n\tconst currentExtension = (): ProviderConfigInput | undefined =>\n\t\textension && refreshedExtensionModels ? { ...extension, models: refreshedExtensionModels } : extension;\n\t// models.json modelOverrides are the topmost user-config layer: they apply once,\n\t// after custom-model upserts, extension model replacement, and legacy OAuth projection.\n\tconst getModels = () => {\n\t\tlet models = applyExtension(\n\t\t\tproviderId,\n\t\t\tapplyModelsJson(providerId, base?.getModels() ?? [], config),\n\t\t\tcurrentExtension(),\n\t\t);\n\t\tif (extensionOAuthCredential && extension?.oauth?.modifyModels) {\n\t\t\tmodels = extension.oauth.modifyModels(models, extensionOAuthCredential);\n\t\t}\n\t\treturn models.map((model) => {\n\t\t\tconst override = config?.modelOverrides?.[model.id];\n\t\t\treturn applyCompatibilityDefaults(override ? applyModelOverride(model, override) : model);\n\t\t});\n\t};\n\t// Validate eagerly so registration/reload reports structural errors immediately.\n\tgetModels();\n\tconst apiKey = composeApiKeyAuth(providerId, base, config, extension);\n\tconst oauth = composeOAuthAuth(providerId, base, config, extension);\n\tif (!apiKey && !oauth) throw new Error(`Provider ${providerId}: no authentication method configured.`);\n\n\tconst supportsBaseApi = (model: Model<Api>) => base?.getModels().some((entry) => entry.api === model.api) ?? false;\n\tconst streamWith = (\n\t\tmodel: Model<Api>,\n\t\tcontext: Context,\n\t\toptions: StreamOptions | undefined,\n\t\tsimple: boolean,\n\t): AssistantMessageEventStream =>\n\t\tlazyStream(model, async () => {\n\t\t\tif (extension?.streamSimple && model.api === extension.api) {\n\t\t\t\treturn extension.streamSimple(model, context, options as SimpleStreamOptions);\n\t\t\t}\n\t\t\tif (base && supportsBaseApi(model)) {\n\t\t\t\treturn simple\n\t\t\t\t\t? base.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t\t: base.stream(model, context, options);\n\t\t\t}\n\t\t\tconst api = getApiProvider(model.api);\n\t\t\tif (!api) throw new Error(`No API provider registered for api: ${model.api}`);\n\t\t\treturn simple\n\t\t\t\t? api.streamSimple(model, context, options as SimpleStreamOptions)\n\t\t\t\t: api.stream(model, context, options);\n\t\t});\n\n\tconst provider: Provider = {\n\t\tid: providerId,\n\t\tname: extension?.name ?? config?.name ?? base?.name ?? extension?.oauth?.name ?? providerId,\n\t\tbaseUrl: extension?.baseUrl ?? config?.baseUrl ?? base?.baseUrl,\n\t\theaders: base?.headers,\n\t\tauth: { ...(apiKey ? { apiKey } : {}), ...(oauth ? { oauth } : {}) },\n\t\tgetModels,\n\t\trefreshModels:\n\t\t\tbase?.refreshModels || extension?.refreshModels || extension?.oauth?.modifyModels\n\t\t\t\t? async (context) => {\n\t\t\t\t\t\tawait base?.refreshModels?.(context);\n\t\t\t\t\t\tlet refreshed: NonNullable<ProviderConfigInput[\"models\"]> | undefined;\n\t\t\t\t\t\tif (extension?.refreshModels) refreshed = await extension.refreshModels(context);\n\t\t\t\t\t\tif (context.signal.aborted) return;\n\t\t\t\t\t\tconst oauthCredential = context.credential?.type === \"oauth\" ? context.credential : undefined;\n\t\t\t\t\t\tawait context.publish({\n\t\t\t\t\t\t\tupdate: () => {\n\t\t\t\t\t\t\t\tif (refreshed) {\n\t\t\t\t\t\t\t\t\t// Validate before publishing the new synchronous list.\n\t\t\t\t\t\t\t\t\tapplyExtension(providerId, applyModelsJson(providerId, base?.getModels() ?? [], config), {\n\t\t\t\t\t\t\t\t\t\t...extension,\n\t\t\t\t\t\t\t\t\t\tmodels: refreshed,\n\t\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t\t\trefreshedExtensionModels = refreshed;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\textensionOAuthCredential = oauthCredential;\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t: undefined,\n\t\tfilterModels: base?.filterModels\n\t\t\t? (models, credential: Credential | undefined) => base.filterModels!(models, credential)\n\t\t\t: undefined,\n\t\tstream: (model, context, options) => streamWith(model, context, options, false),\n\t\tstreamSimple: (model, context, options) => streamWith(model, context, options, true),\n\t};\n\n\tconst fetchDeferred = base?.fetchDeferred;\n\tif (fetchDeferred) {\n\t\tprovider.fetchDeferred = (model, handle, options) => fetchDeferred(model, handle, options);\n\t}\n\tconst cancelDeferred = base?.cancelDeferred;\n\tif (cancelDeferred) {\n\t\tprovider.cancelDeferred = (model, handle, options) => cancelDeferred(model, handle, options);\n\t}\n\n\treturn provider;\n}\n\nexport function resolveConfiguredModelHeaders(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n\tenv?: Record<string, string>,\n): Record<string, string> | undefined {\n\treturn resolveHeadersOrThrow(\n\t\trawModelHeaders(model, config, extension),\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t\tenv,\n\t);\n}\n\nexport interface CompatibilityRequestConfig {\n\theaders?: ProviderHeaders;\n\tauthHeader: boolean;\n}\n\nexport function resolveCompatibilityRequestConfig(\n\tmodel: Model<Api>,\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): CompatibilityRequestConfig {\n\tconst configured = resolveHeadersOrThrow(\n\t\t{ ...configuredHeaders(config, extension), ...rawModelHeaders(model, config, extension) },\n\t\t`model \"${model.provider}/${model.id}\"`,\n\t);\n\treturn {\n\t\theaders: model.headers || configured ? { ...model.headers, ...configured } : undefined,\n\t\tauthHeader: extension?.authHeader ?? config?.authHeader ?? false,\n\t};\n}\n\nexport function configuredRequestAuthStatus(\n\tconfig: ModelsJsonProvider | undefined,\n\textension: ProviderConfigInput | undefined,\n): AuthStatus | undefined {\n\tconst value = configuredApiKey(config, extension);\n\tif (value === undefined) return undefined;\n\tif (isCommandConfigValue(value)) return { configured: true, source: \"models_json_command\" };\n\tconst names = getConfigValueEnvVarNames(value);\n\tif (names.length > 0) {\n\t\treturn isConfigValueConfigured(value)\n\t\t\t? { configured: true, source: \"environment\", label: names.join(\", \") }\n\t\t\t: { configured: false };\n\t}\n\treturn { configured: true, source: extension?.apiKey !== undefined ? \"fallback\" : \"models_json_key\" };\n}\n"]}

package/dist/core/resource-loader.d.ts

@@ -60,6 +60,12 @@ export interface ResourceLoader {
 export declare function loadProjectContextFiles(options: {
     cwd: string;
     agentDir: string;
+    /**
+     * Required. False keeps the checkout's and its ancestors' instruction files out, and
+     * leaves the agent directory's own, which is the user's and not the project's. The
+     * same exemption the `~/.agents/skills` walk gets, for the same reason.
+     */
+    projectTrusted: boolean;
 }): Array<{
     path: string;
     content: string;